@vigil-guard/vge-cc-guard 0.9.0-beta.1

package/dist/daemon/conversation-decision-prompt.js

@@ -0,0 +1,250 @@
+import { parseBlockingDecisionReply, } from '../shared/blocking-decision-reply.js';
+import { decisionOwnerFromDecision, decisionOwnerLabel } from './decision-owner.js';
+export function blockUserPromptWithReason(reason) {
+    return {
+        decision: 'block',
+        reason,
+        continue: false,
+        stopReason: reason,
+    };
+}
+function oneLine(value, maxLength = 220) {
+    const normalized = value
+        .replace(/\x1B\[[0-?]*[ -/]*[@-~]/g, '')
+        .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F-\x9F]/g, '')
+        .replace(/\s+/g, ' ')
+        .trim();
+    if (normalized.length <= maxLength)
+        return normalized;
+    return `${normalized.slice(0, maxLength - 3)}...`;
+}
+function branchScore(value) {
+    return value?.score ?? 0;
+}
+export function branchScores(vgeResult) {
+    return {
+        heuristics: branchScore(vgeResult.branches?.heuristics),
+        semantic: branchScore(vgeResult.branches?.semantic),
+        llmGuard: branchScore(vgeResult.branches?.llmGuard),
+    };
+}
+export function sanitizeUrlLabel(url) {
+    try {
+        const parsed = new URL(url);
+        return `${parsed.origin}${parsed.pathname}${parsed.search ? '?[redacted]' : ''}`;
+    }
+    catch {
+        return url.split('#')[0]?.split('?')[0]?.trim() ?? url;
+    }
+}
+export function sanitizeDecisionResourceLabel(label) {
+    const urlMatch = label.match(/https?:\/\/[^\s)>\]}]+/i);
+    if (!urlMatch)
+        return oneLine(label);
+    const sanitizedUrl = sanitizeUrlLabel(urlMatch[0]);
+    return oneLine(label.replace(urlMatch[0], sanitizedUrl));
+}
+export function parseConversationDecisionReply(prompt) {
+    return parseBlockingDecisionReply(prompt);
+}
+function stageLabel(kind) {
+    if (kind === 'pretool_url')
+        return 'PreTool URL';
+    if (kind === 'posttool_output')
+        return 'PostTool output';
+    if (kind === 'prompt_input')
+        return 'Prompt input';
+    return 'Attachment input';
+}
+function safetyLine(kind) {
+    if (kind === 'pretool_url') {
+        return 'Claude has not fetched this URL yet. Allow prepares an exact-resource retry; block keeps it denied.';
+    }
+    if (kind === 'posttool_output') {
+        return 'Raw tool output is quarantined. Claude sees only the safe placeholder until you allow it.';
+    }
+    if (kind === 'prompt_input') {
+        return 'Claude has not used this prompt yet. Allow prepares an exact-prompt retry; block keeps it out of model context.';
+    }
+    return 'Claude has not used this file attachment yet. Allow prepares an exact-attachment retry; block keeps it out of model context.';
+}
+function blockChoiceLine(kind) {
+    if (kind === 'pretool_url') {
+        return '1 = block. Keep this resource blocked. This is the default and safest choice.';
+    }
+    if (kind === 'posttool_output') {
+        return '1 = block. Keep this output out of model context. This is the default and safest choice.';
+    }
+    if (kind === 'prompt_input') {
+        return '1 = block. Keep this exact prompt out of model context. This is the default and safest choice.';
+    }
+    return '1 = block. Keep this file attachment out of model context. This is the default and safest choice.';
+}
+function allowOnceChoiceLine(kind) {
+    if (kind === 'prompt_input') {
+        return '2 = allow once. Allow only this exact prompt once, then continue from the original blocked prompt unless you add a replacement instruction.';
+    }
+    if (kind === 'attachment_input') {
+        return '2 = allow once. Allow only this exact resource once, then continue from the original blocked prompt unless you add a replacement instruction.';
+    }
+    return '2 = allow once. Allow only this exact resource once, then ask again next time.';
+}
+function allowSessionChoiceLine(kind) {
+    if (kind === 'prompt_input') {
+        return '3 = allow for session. Allow this exact prompt until SessionEnd, then continue from the original blocked prompt unless you add a replacement instruction.';
+    }
+    if (kind === 'attachment_input') {
+        return '3 = allow for session. Allow this exact resource until SessionEnd, then continue from the original blocked prompt unless you add a replacement instruction.';
+    }
+    return '3 = allow for session. Allow this exact resource until SessionEnd.';
+}
+function shortcutLine(kind) {
+    if (kind === 'attachment_input' || kind === 'prompt_input') {
+        return 'For the single active decision in this session, you can type: 1, 2, 2 <replacement instruction>, 3, or 3 <replacement instruction>.';
+    }
+    if (kind === 'posttool_output') {
+        return 'For the single active decision in this session, you can type: 1, 2, or 3.';
+    }
+    return 'For the single active decision in this session, you can type: 1, 2 <continue instruction>, or 3 <continue instruction>.';
+}
+function textAliasesLine(kind) {
+    if (kind === 'posttool_output') {
+        return 'Text aliases also work: block, allow once, allow for session.';
+    }
+    if (kind === 'prompt_input') {
+        return 'Text aliases also work: block, allow once <replacement instruction>, allow for session <replacement instruction>.';
+    }
+    return 'Text aliases also work: block, allow once <continue instruction>, allow for session <continue instruction>.';
+}
+function allowCommandLine(decision) {
+    if (decision.kind === 'posttool_output')
+        return `vge allow ${decision.decisionId}`;
+    if (decision.kind === 'prompt_input')
+        return `vge allow ${decision.decisionId} <replacement instruction>`;
+    return `vge allow ${decision.decisionId} <continue instruction>`;
+}
+function allowSessionCommandLine(decision) {
+    if (decision.kind === 'posttool_output')
+        return `vge allow-session ${decision.decisionId}`;
+    if (decision.kind === 'prompt_input')
+        return `vge allow-session ${decision.decisionId} <replacement instruction>`;
+    return `vge allow-session ${decision.decisionId} <continue instruction>`;
+}
+function localFallbackLine(decision) {
+    if (decision.vge.origin === 'local_fallback') {
+        return `Local sidecar fallback: ${decision.reason}. VGE did not return a block decision for this input.`;
+    }
+    return null;
+}
+function vgeDecisionLine(decision) {
+    const fallback = localFallbackLine(decision);
+    if (fallback)
+        return fallback;
+    return `VGE: score=${decision.vge.score}`
+        + (decision.vge.ruleAction ? ` | ruleAction=${decision.vge.ruleAction}` : '')
+        + (decision.vge.decision ? ` | decision=${decision.vge.decision}` : '')
+        + (decision.vge.arbiterSignal ? ` | arbiterSignal=${decision.vge.arbiterSignal}` : '');
+}
+export function renderConversationDecisionPrompt(decision) {
+    const resourceLabel = sanitizeDecisionResourceLabel(decision.resourceLabel);
+    const lines = [
+        'VGE Agent Guard requires your decision.',
+        `Stage: ${stageLabel(decision.kind)}`,
+        `Decision ID: ${decision.decisionId}`,
+        `Owner: ${decisionOwnerLabel(decisionOwnerFromDecision(decision))}`,
+        `Tool: ${decision.toolName}`,
+        `Resource: ${resourceLabel}`,
+        `Reason: ${decision.reason}`,
+        vgeDecisionLine(decision),
+        '',
+        safetyLine(decision.kind),
+        '',
+        'Reply in this same Claude Code session with one of these choices:',
+        blockChoiceLine(decision.kind),
+        allowOnceChoiceLine(decision.kind),
+        allowSessionChoiceLine(decision.kind),
+        '',
+        shortcutLine(decision.kind),
+        textAliasesLine(decision.kind),
+        'Any other reply while this decision is active re-shows this prompt and is not sent to Claude.',
+        'No final block is recorded until you choose block explicitly.',
+        '',
+        'Exact commands, if you prefer copy/paste:',
+        allowCommandLine(decision),
+        allowSessionCommandLine(decision),
+        `vge block ${decision.decisionId}`,
+    ];
+    return lines.join('\n');
+}
+export function renderConversationDecisionReask(decision) {
+    return [
+        'VGE Agent Guard requires a valid VGE decision before continuing.',
+        'Your last reply did not choose allow or block, so it was not sent to Claude and no final block was recorded.',
+        '',
+        renderConversationDecisionPrompt(decision),
+    ].join('\n');
+}
+export function renderConversationApprovalContext(params) {
+    const { decision } = params;
+    const resourceLabel = sanitizeDecisionResourceLabel(decision.resourceLabel);
+    const stage = stageLabel(decision.kind);
+    const tag = decision.kind === 'pretool_url'
+        ? 'PRETOOL DECISION'
+        : decision.kind === 'posttool_output'
+            ? 'POSTTOOL DECISION'
+            : decision.kind === 'prompt_input'
+                ? 'PROMPT INPUT DECISION'
+                : 'ATTACHMENT INPUT DECISION';
+    const stageSpecific = (() => {
+        if (decision.kind === 'pretool_url') {
+            return [
+                'The original PreTool call was stopped before execution.',
+                'The exact resource is now approved. Retry the same tool call now if it is still needed.',
+            ];
+        }
+        if (decision.kind === 'posttool_output') {
+            return [
+                'The user approved a quarantined PostToolUse result in this same session.',
+                'Retry the original tool call now if it is still needed.',
+                'Do not use Bash/sed/python/edit workarounds.',
+            ];
+        }
+        if (decision.kind === 'prompt_input') {
+            return [
+                'The original prompt text was stopped before Claude used it.',
+                'The exact prompt is now approved.',
+                'Continue from the follow-up instruction below when one is present.',
+            ];
+        }
+        return [
+            'The original prompt attachment was stopped before Claude used it.',
+            'The exact attachment is now approved.',
+            'Continue from the follow-up instruction below when one is present.',
+        ];
+    })();
+    const followUpInstruction = params.residual ||
+        ((decision.kind === 'attachment_input' || decision.kind === 'prompt_input') && params.originalPrompt
+            ? oneLine(params.originalPrompt, 1000)
+            : '');
+    return [
+        `[VGE APPROVED ${tag}]`,
+        ...stageSpecific,
+        'The user\'s latest prompt is a VGE local decision token, not task content.',
+        `Treat it as: ${params.choice === 'allow_once' ? 'allow once' : 'allow for session'}.`,
+        'Do not answer about the token itself.',
+        followUpInstruction ? `User follow-up instruction: ${followUpInstruction}` : null,
+        '',
+        `Decision ID: ${decision.decisionId}`,
+        `Choice: ${params.choice}`,
+        `Stage: ${stage}`,
+        `Owner: ${decisionOwnerLabel(decisionOwnerFromDecision(decision))}`,
+        `Tool: ${decision.toolName}`,
+        `Resource: ${resourceLabel}`,
+        params.routerOutcome ? `Router outcome: ${params.routerOutcome}` : null,
+        params.contentSizeBytes !== undefined ? `Original size bytes: ${params.contentSizeBytes}` : null,
+        params.contentHash ? `Original sha256: ${params.contentHash}` : null,
+        `VGE reason: ${decision.reason}`,
+        `[/VGE APPROVED ${tag}]`,
+    ].filter((line) => line !== null).join('\n');
+}
+//# sourceMappingURL=conversation-decision-prompt.js.map

package/dist/daemon/conversation-decision-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conversation-decision-prompt.js","sourceRoot":"","sources":["../../src/daemon/conversation-decision-prompt.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0BAA0B,GAE3B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAWpF,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACtD,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,MAAM;QACN,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,MAAM;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,SAAS,GAAG,GAAG;IAC7C,MAAM,UAAU,GAAG,KAAK;SACrB,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC;SACvC,OAAO,CAAC,wCAAwC,EAAE,EAAE,CAAC;SACrD,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;IACV,IAAI,UAAU,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,UAAU,CAAC;IACtD,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAED,SAAS,WAAW,CAAC,KAA2C;IAC9D,OAAO,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAA8B;IACzD,OAAO;QACL,UAAU,EAAE,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC;QACvD,QAAQ,EAAE,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC;QACnD,QAAQ,EAAE,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC;IACzD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAa;IACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACxD,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,MAAc;IAC3D,OAAO,0BAA0B,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,UAAU,CAAC,IAA0B;IAC5C,IAAI,IAAI,KAAK,aAAa;QAAE,OAAO,aAAa,CAAC;IACjD,IAAI,IAAI,KAAK,iBAAiB;QAAE,OAAO,iBAAiB,CAAC;IACzD,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,cAAc,CAAC;IACnD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,SAAS,UAAU,CAAC,IAA0B;IAC5C,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,OAAO,qGAAqG,CAAC;IAC/G,CAAC;IACD,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO,2FAA2F,CAAC;IACrG,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,OAAO,iHAAiH,CAAC;IAC3H,CAAC;IACD,OAAO,8HAA8H,CAAC;AACxI,CAAC;AAED,SAAS,eAAe,CAAC,IAA0B;IACjD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,OAAO,+EAA+E,CAAC;IACzF,CAAC;IACD,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO,0FAA0F,CAAC;IACpG,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,OAAO,gGAAgG,CAAC;IAC1G,CAAC;IACD,OAAO,mGAAmG,CAAC;AAC7G,CAAC;AAED,SAAS,mBAAmB,CAAC,IAA0B;IACrD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,OAAO,6IAA6I,CAAC;IACvJ,CAAC;IACD,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChC,OAAO,+IAA+I,CAAC;IACzJ,CAAC;IACD,OAAO,gFAAgF,CAAC;AAC1F,CAAC;AAED,SAAS,sBAAsB,CAAC,IAA0B;IACxD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,OAAO,2JAA2J,CAAC;IACrK,CAAC;IACD,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChC,OAAO,6JAA6J,CAAC;IACvK,CAAC;IACD,OAAO,oEAAoE,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,IAA0B;IAC9C,IAAI,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC3D,OAAO,qIAAqI,CAAC;IAC/I,CAAC;IACD,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO,2EAA2E,CAAC;IACrF,CAAC;IACD,OAAO,yHAAyH,CAAC;AACnI,CAAC;AAED,SAAS,eAAe,CAAC,IAA0B;IACjD,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO,+DAA+D,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,OAAO,mHAAmH,CAAC;IAC7H,CAAC;IACD,OAAO,6GAA6G,CAAC;AACvH,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA0B;IAClD,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,aAAa,QAAQ,CAAC,UAAU,EAAE,CAAC;IACnF,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,aAAa,QAAQ,CAAC,UAAU,4BAA4B,CAAC;IAC1G,OAAO,aAAa,QAAQ,CAAC,UAAU,yBAAyB,CAAC;AACnE,CAAC;AAED,SAAS,uBAAuB,CAAC,QAA0B;IACzD,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,qBAAqB,QAAQ,CAAC,UAAU,EAAE,CAAC;IAC3F,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,qBAAqB,QAAQ,CAAC,UAAU,4BAA4B,CAAC;IAClH,OAAO,qBAAqB,QAAQ,CAAC,UAAU,yBAAyB,CAAC;AAC3E,CAAC;AAED,SAAS,iBAAiB,CAAC,QAA0B;IACnD,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAC7C,OAAO,2BAA2B,QAAQ,CAAC,MAAM,uDAAuD,CAAC;IAC3G,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,QAA0B;IACjD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,cAAc,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE;UACrC,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;UAC3E,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;UACrE,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,oBAAoB,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,QAA0B;IACzE,MAAM,aAAa,GAAG,6BAA6B,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG;QACZ,yCAAyC;QACzC,UAAU,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACrC,gBAAgB,QAAQ,CAAC,UAAU,EAAE;QACrC,UAAU,kBAAkB,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC,EAAE;QACnE,SAAS,QAAQ,CAAC,QAAQ,EAAE;QAC5B,aAAa,aAAa,EAAE;QAC5B,WAAW,QAAQ,CAAC,MAAM,EAAE;QAC5B,eAAe,CAAC,QAAQ,CAAC;QACzB,EAAE;QACF,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,EAAE;QACF,mEAAmE;QACnE,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC9B,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC;QAClC,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrC,EAAE;QACF,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC3B,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC9B,+FAA+F;QAC/F,+DAA+D;QAC/D,EAAE;QACF,2CAA2C;QAC3C,gBAAgB,CAAC,QAAQ,CAAC;QAC1B,uBAAuB,CAAC,QAAQ,CAAC;QACjC,aAAa,QAAQ,CAAC,UAAU,EAAE;KACnC,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,QAA0B;IACxE,OAAO;QACL,kEAAkE;QAClE,8GAA8G;QAC9G,EAAE;QACF,gCAAgC,CAAC,QAAQ,CAAC;KAC3C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,MAQjD;IACC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC5B,MAAM,aAAa,GAAG,6BAA6B,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,GAAG,GACP,QAAQ,CAAC,IAAI,KAAK,aAAa;QAC7B,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,iBAAiB;YACnC,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,cAAc;gBAChC,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,2BAA2B,CAAC;IACtC,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE;QAC1B,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACpC,OAAO;gBACL,yDAAyD;gBACzD,yFAAyF;aAC1F,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACxC,OAAO;gBACL,0EAA0E;gBAC1E,yDAAyD;gBACzD,8CAA8C;aAC/C,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACrC,OAAO;gBACL,6DAA6D;gBAC7D,mCAAmC;gBACnC,oEAAoE;aACrE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,mEAAmE;YACnE,uCAAuC;YACvC,oEAAoE;SACrE,CAAC;IACJ,CAAC,CAAC,EAAE,CAAC;IACL,MAAM,mBAAmB,GACvB,MAAM,CAAC,QAAQ;QACf,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,kBAAkB,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,CAAC,IAAI,MAAM,CAAC,cAAc;YAClG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC;YACtC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEV,OAAO;QACL,iBAAiB,GAAG,GAAG;QACvB,GAAG,aAAa;QAChB,4EAA4E;QAC5E,gBAAgB,MAAM,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,mBAAmB,GAAG;QACtF,uCAAuC;QACvC,mBAAmB,CAAC,CAAC,CAAC,+BAA+B,mBAAmB,EAAE,CAAC,CAAC,CAAC,IAAI;QACjF,EAAE;QACF,gBAAgB,QAAQ,CAAC,UAAU,EAAE;QACrC,WAAW,MAAM,CAAC,MAAM,EAAE;QAC1B,UAAU,KAAK,EAAE;QACjB,UAAU,kBAAkB,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC,EAAE;QACnE,SAAS,QAAQ,CAAC,QAAQ,EAAE;QAC5B,aAAa,aAAa,EAAE;QAC5B,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,mBAAmB,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI;QACvE,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,wBAAwB,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI;QAChG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;QACpE,eAAe,QAAQ,CAAC,MAAM,EAAE;QAChC,kBAAkB,GAAG,GAAG;KACzB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC"}

package/dist/daemon/daemon-instance.d.ts

@@ -0,0 +1,27 @@
+import { type RuntimeLockAcquireResult, type RuntimeLockOwner } from '../shared/runtime-lock.js';
+export interface DaemonOwner extends RuntimeLockOwner {
+    purpose: 'daemon-instance';
+    startedAt: string;
+    configDir: string;
+    socketPath: string;
+    tokenPath: string;
+    execPath: string;
+    argv: string[];
+    binaryPath: string;
+    binarySha256: string;
+    packageVersion: string;
+}
+export declare function resolveDaemonLockDir(configDir?: string): string;
+export declare function buildDaemonOwner(args: {
+    configDir: string;
+    socketPath: string;
+    tokenPath: string;
+}): DaemonOwner;
+export declare function readDaemonOwner(configDir?: string): DaemonOwner | null;
+export declare function acquireDaemonInstanceLock(args: {
+    configDir: string;
+    socketPath: string;
+    tokenPath: string;
+}): RuntimeLockAcquireResult<DaemonOwner>;
+export declare function isDaemonBuildStale(owner: DaemonOwner, current?: import("../shared/build-stamp.js").BuildStamp): boolean;
+//# sourceMappingURL=daemon-instance.d.ts.map

package/dist/daemon/daemon-instance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-instance.d.ts","sourceRoot":"","sources":["../../src/daemon/daemon-instance.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACtB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,WAAY,SAAQ,gBAAgB;IACnD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,oBAAoB,CAAC,SAAS,SAAqB,GAAG,MAAM,CAE3E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,WAAW,CAkBd;AAED,wBAAgB,eAAe,CAAC,SAAS,SAAqB,GAAG,WAAW,GAAG,IAAI,CAElF;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAGxC;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,gDAAsB,GAAG,OAAO,CAE7F"}

package/dist/daemon/daemon-instance.js

@@ -0,0 +1,41 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { currentBuildStamp } from '../shared/build-stamp.js';
+import { acquireRuntimeLock, readRuntimeLockOwner, } from '../shared/runtime-lock.js';
+export function resolveDaemonLockDir(configDir = resolveConfigDir()) {
+    return path.join(configDir, 'daemon-instance.lock');
+}
+export function buildDaemonOwner(args) {
+    const now = new Date().toISOString();
+    const stamp = currentBuildStamp();
+    return {
+        schemaVersion: 1,
+        pid: process.pid,
+        createdAt: now,
+        purpose: 'daemon-instance',
+        startedAt: now,
+        configDir: args.configDir,
+        socketPath: args.socketPath,
+        tokenPath: args.tokenPath,
+        execPath: process.execPath,
+        argv: [...process.argv],
+        binaryPath: stamp.binaryPath,
+        binarySha256: stamp.binarySha256,
+        packageVersion: stamp.packageVersion,
+    };
+}
+export function readDaemonOwner(configDir = resolveConfigDir()) {
+    return readRuntimeLockOwner(resolveDaemonLockDir(configDir));
+}
+export function acquireDaemonInstanceLock(args) {
+    fs.mkdirSync(args.configDir, { recursive: true });
+    return acquireRuntimeLock(resolveDaemonLockDir(args.configDir), buildDaemonOwner(args));
+}
+export function isDaemonBuildStale(owner, current = currentBuildStamp()) {
+    return owner.binarySha256 !== current.binarySha256;
+}
+function resolveConfigDir() {
+    return process.env['VGE_CC_GUARD_CONFIG_DIR'] ?? path.join(os.homedir(), '.vge-cc-guard');
+}
+//# sourceMappingURL=daemon-instance.js.map

package/dist/daemon/daemon-instance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-instance.js","sourceRoot":"","sources":["../../src/daemon/daemon-instance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EACL,kBAAkB,EAClB,oBAAoB,GAGrB,MAAM,2BAA2B,CAAC;AAenC,MAAM,UAAU,oBAAoB,CAAC,SAAS,GAAG,gBAAgB,EAAE;IACjE,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAIhC;IACC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,SAAS,EAAE,GAAG;QACd,OAAO,EAAE,iBAAiB;QAC1B,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;QACvB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAS,GAAG,gBAAgB,EAAE;IAC5D,OAAO,oBAAoB,CAAc,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAIzC;IACC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,OAAO,kBAAkB,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAkB,EAAE,OAAO,GAAG,iBAAiB,EAAE;IAClF,OAAO,KAAK,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY,CAAC;AACrD,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,eAAe,CAAC,CAAC;AAC5F,CAAC"}

package/dist/daemon/daemon-ipc.d.ts

@@ -0,0 +1,29 @@
+import * as http from 'http';
+import * as net from 'net';
+type IpcSocket = Pick<net.Socket, 'destroy' | 'once' | 'setTimeout'>;
+export type IpcConnector = (ipcAddress: string) => IpcSocket;
+export type SocketProbeState = {
+    state: 'missing';
+} | {
+    state: 'live';
+} | {
+    state: 'refused';
+    code: 'ECONNREFUSED';
+} | {
+    state: 'timeout';
+} | {
+    state: 'error';
+    code?: string;
+    message: string;
+};
+export declare function isWindowsNamedPipeAddress(ipcAddress: string): boolean;
+export declare function prepareDaemonIpcAddress(ipcAddress: string): void;
+export declare function probeSocketState(ipcAddress: string, opts?: {
+    timeoutMs?: number;
+    createConnection?: IpcConnector;
+}): Promise<SocketProbeState>;
+export declare function removeStaleDaemonIpcAddress(ipcAddress: string, probe: SocketProbeState): boolean;
+export declare function cleanupDaemonIpcAddress(ipcAddress: string): void;
+export declare function hardenDaemonIpcAddress(ipcAddress: string, server: Pick<http.Server, 'close'>): Promise<void>;
+export {};
+//# sourceMappingURL=daemon-ipc.d.ts.map

package/dist/daemon/daemon-ipc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-ipc.d.ts","sourceRoot":"","sources":["../../src/daemon/daemon-ipc.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAK3B,KAAK,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,YAAY,CAAC,CAAC;AAErE,MAAM,MAAM,YAAY,GAAG,CAAC,UAAU,EAAE,MAAM,KAAK,SAAS,CAAC;AAE7D,MAAM,MAAM,gBAAgB,GACxB;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GACpB;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GACjB;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GAC1C;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GACpB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAErE;AAED,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAKhE;AAED,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,YAAY,CAAA;CAAO,GACjE,OAAO,CAAC,gBAAgB,CAAC,CAkB3B;AAED,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAShG;AAED,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAGhE;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,OAAO,CAAC,IAAI,CAAC,CAaf"}

package/dist/daemon/daemon-ipc.js

@@ -0,0 +1,82 @@
+import fs from 'fs';
+import * as net from 'net';
+import * as path from 'path';
+import { chmodPrivateDirectorySync, chmodPrivateSync } from '../shared/private-file.js';
+import { debugLogger } from './debug-logger.js';
+export function isWindowsNamedPipeAddress(ipcAddress) {
+    return ipcAddress.toLowerCase().startsWith('\\\\.\\pipe\\');
+}
+export function prepareDaemonIpcAddress(ipcAddress) {
+    if (isWindowsNamedPipeAddress(ipcAddress))
+        return;
+    const socketDirectory = path.dirname(ipcAddress);
+    fs.mkdirSync(socketDirectory, { recursive: true, mode: 0o700 });
+    chmodPrivateDirectorySync(socketDirectory);
+}
+export function probeSocketState(ipcAddress, opts = {}) {
+    if (!isWindowsNamedPipeAddress(ipcAddress) && !fs.existsSync(ipcAddress)) {
+        return Promise.resolve({ state: 'missing' });
+    }
+    return new Promise((resolve) => {
+        let settled = false;
+        let socket;
+        const done = (probe) => {
+            if (settled)
+                return;
+            settled = true;
+            socket.destroy();
+            resolve(probe);
+        };
+        socket = (opts.createConnection ?? net.createConnection)(ipcAddress);
+        socket.once('connect', () => done({ state: 'live' }));
+        socket.once('error', (err) => done(probeFromSocketError(err)));
+        socket.setTimeout(opts.timeoutMs ?? 250, () => done({ state: 'timeout' }));
+    });
+}
+export function removeStaleDaemonIpcAddress(ipcAddress, probe) {
+    if (isWindowsNamedPipeAddress(ipcAddress))
+        return false;
+    if (probe.state !== 'refused')
+        return false;
+    try {
+        fs.unlinkSync(ipcAddress);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function cleanupDaemonIpcAddress(ipcAddress) {
+    if (isWindowsNamedPipeAddress(ipcAddress))
+        return;
+    try {
+        fs.unlinkSync(ipcAddress);
+    }
+    catch { /* already gone */ }
+}
+export async function hardenDaemonIpcAddress(ipcAddress, server) {
+    if (isWindowsNamedPipeAddress(ipcAddress))
+        return;
+    try {
+        chmodPrivateSync(ipcAddress);
+    }
+    catch (err) {
+        debugLogger().error({ err: String(err), ipcKind: 'filesystem-socket', ipcAddress }, 'daemon socket chmod failed');
+        await closeServer(server);
+        cleanupDaemonIpcAddress(ipcAddress);
+        throw err;
+    }
+}
+function probeFromSocketError(err) {
+    if (err.code === 'ECONNREFUSED')
+        return { state: 'refused', code: 'ECONNREFUSED' };
+    if (err.code === 'EAGAIN' || err.code === 'EWOULDBLOCK')
+        return { state: 'timeout' };
+    if (err.code === 'ENOENT')
+        return { state: 'missing' };
+    return { state: 'error', code: err.code, message: err.message };
+}
+function closeServer(server) {
+    return new Promise((resolve) => server.close(() => resolve()));
+}
+//# sourceMappingURL=daemon-ipc.js.map

package/dist/daemon/daemon-ipc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-ipc.js","sourceRoot":"","sources":["../../src/daemon/daemon-ipc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAC3B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AACxF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAahD,MAAM,UAAU,yBAAyB,CAAC,UAAkB;IAC1D,OAAO,UAAU,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,IAAI,yBAAyB,CAAC,UAAU,CAAC;QAAE,OAAO;IAClD,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,yBAAyB,CAAC,eAAe,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,UAAkB,EAClB,OAAgE,EAAE;IAElE,IAAI,CAAC,yBAAyB,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACzE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,MAAiB,CAAC;QACtB,MAAM,IAAI,GAAG,CAAC,KAAuB,EAAQ,EAAE;YAC7C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,UAAU,CAAC,CAAC;QACrE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAA8B,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1F,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,UAAkB,EAAE,KAAuB;IACrF,IAAI,yBAAyB,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,IAAI,yBAAyB,CAAC,UAAU,CAAC;QAAE,OAAO;IAClD,IAAI,CAAC;QAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkB,EAClB,MAAkC;IAElC,IAAI,yBAAyB,CAAC,UAAU,CAAC;QAAE,OAAO;IAClD,IAAI,CAAC;QACH,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,EAAE,CAAC,KAAK,CACjB,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,EAC9D,4BAA4B,CAC7B,CAAC;QACF,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1B,uBAAuB,CAAC,UAAU,CAAC,CAAC;QACpC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,GAA8B;IAC1D,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IACnF,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACrF,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACvD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,WAAW,CAAC,MAAkC;IACrD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC"}

package/dist/daemon/daemon-supersede.d.ts

@@ -0,0 +1,3 @@
+export declare function resolveLiveDaemonBeforeStart(socketPath: string, configDir: string): Promise<'reuse' | 'stopped'>;
+export declare function canReuseCurrentLockOwner(configDir: string): boolean;
+//# sourceMappingURL=daemon-supersede.d.ts.map

package/dist/daemon/daemon-supersede.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-supersede.d.ts","sourceRoot":"","sources":["../../src/daemon/daemon-supersede.ts"],"names":[],"mappings":"AAiBA,wBAAsB,4BAA4B,CAChD,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAqB9B;AAED,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAGnE"}

package/dist/daemon/daemon-supersede.js

@@ -0,0 +1,126 @@
+import * as http from 'http';
+import { currentBuildStamp } from '../shared/build-stamp.js';
+import { readDaemonToken, tokenHeader } from '../shared/daemon-token.js';
+import { isDaemonBuildStale, readDaemonOwner } from './daemon-instance.js';
+import { probeSocketState } from './daemon-ipc.js';
+export async function resolveLiveDaemonBeforeStart(socketPath, configDir) {
+    const status = await readLiveDaemonStatus(socketPath);
+    const owner = readDaemonOwner(configDir);
+    if (owner && status.pid !== owner.pid) {
+        throw new Error(`daemon status pid ${status.pid} does not match lock owner pid ${owner.pid}`);
+    }
+    if (!status.staleBuild)
+        return 'reuse';
+    if (status.pendingDecisionCount > 0) {
+        throw new Error(`stale daemon has ${status.pendingDecisionCount} pending decision(s)`);
+    }
+    try {
+        const stop = await postDaemonControl(socketPath, '/v1/control/stop', {});
+        if (stop.status < 200 || stop.status >= 300) {
+            throw new Error(`stale daemon stop failed with HTTP ${stop.status}`);
+        }
+    }
+    catch (err) {
+        if (!isControlStopTransportClose(err))
+            throw err;
+    }
+    await waitForStoppedDaemon(socketPath, configDir);
+    return 'stopped';
+}
+export function canReuseCurrentLockOwner(configDir) {
+    const owner = readDaemonOwner(configDir);
+    return owner !== null && !isDaemonBuildStale(owner, currentBuildStamp(owner.binaryPath));
+}
+async function readLiveDaemonStatus(socketPath) {
+    const response = await postDaemonControl(socketPath, '/v1/control/status', {});
+    if (response.status === 401) {
+        throw new Error('daemon control status could not be authenticated');
+    }
+    if (response.status < 200 || response.status >= 300) {
+        throw new Error(`daemon control status failed with HTTP ${response.status}`);
+    }
+    if (typeof response.json !== 'object' || response.json === null) {
+        throw new Error('daemon control status response was not JSON');
+    }
+    const body = response.json;
+    if (typeof body['pid'] !== 'number' || !Number.isInteger(body['pid'])) {
+        throw new Error('daemon control status did not include pid');
+    }
+    if (typeof body['staleBuild'] !== 'boolean') {
+        throw new Error('daemon control status did not include stale build state');
+    }
+    const pendingDecisionCount = body['pendingDecisionCount'];
+    return {
+        pid: body['pid'],
+        staleBuild: body['staleBuild'],
+        pendingDecisionCount: typeof pendingDecisionCount === 'number' ? pendingDecisionCount : 0,
+    };
+}
+function postDaemonControl(socketPath, route, body) {
+    return new Promise((resolve, reject) => {
+        const token = readDaemonToken();
+        if (!token) {
+            reject(new Error('daemon token is missing; cannot authenticate control request'));
+            return;
+        }
+        const payload = JSON.stringify(body);
+        let settled = false;
+        const finish = (outcome) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(outcome);
+        };
+        const fail = (err) => {
+            if (settled)
+                return;
+            settled = true;
+            reject(err);
+        };
+        const req = http.request({
+            socketPath,
+            path: route,
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Content-Length': Buffer.byteLength(payload),
+                ...tokenHeader(token),
+            },
+        }, (res) => {
+            let raw = '';
+            res.on('data', (chunk) => { raw += chunk.toString(); });
+            res.on('end', () => {
+                try {
+                    finish({ status: res.statusCode ?? 0, json: JSON.parse(raw) });
+                }
+                catch {
+                    finish({ status: res.statusCode ?? 0, json: raw });
+                }
+            });
+        });
+        req.on('error', fail);
+        req.write(payload);
+        req.end();
+    });
+}
+async function waitForStoppedDaemon(socketPath, configDir) {
+    const deadline = Date.now() + 3_000;
+    let delayMs = 100;
+    let lastSocketState = 'unknown';
+    while (Date.now() < deadline) {
+        lastSocketState = (await probeSocketState(socketPath)).state;
+        const lockOwner = readDaemonOwner(configDir);
+        if (lastSocketState !== 'live' && lockOwner === null)
+            return;
+        await new Promise((resolve) => setTimeout(resolve, delayMs));
+        delayMs = Math.min(250, delayMs + 50);
+    }
+    throw new Error(`stale daemon did not release socket and instance lock; last socket state: ${lastSocketState}`);
+}
+function isControlStopTransportClose(err) {
+    if (!(err instanceof Error) || !('code' in err))
+        return false;
+    const code = err.code;
+    return code === 'EPIPE' || code === 'ECONNRESET';
+}
+//# sourceMappingURL=daemon-supersede.js.map

package/dist/daemon/daemon-supersede.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-supersede.js","sourceRoot":"","sources":["../../src/daemon/daemon-supersede.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAanD,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,UAAkB,EAClB,SAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,KAAK,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,GAAG,kCAAkC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC;IACvC,IAAI,MAAM,CAAC,oBAAoB,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,CAAC,oBAAoB,sBAAsB,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IACnD,CAAC;IACD,MAAM,oBAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAClD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACzC,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,UAAkB;IACpD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;IAC/E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAA+B,CAAC;IACtD,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,oBAAoB,GAAG,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC1D,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC;QAChB,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC;QAC9B,oBAAoB,EAAE,OAAO,oBAAoB,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;KAC1F,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkB,EAAE,KAAa,EAAE,IAAa;IACzE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,OAAwB,EAAQ,EAAE;YAChD,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,GAAU,EAAQ,EAAE;YAChC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CACtB;YACE,UAAU;YACV,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;gBAC5C,GAAG,WAAW,CAAC,KAAK,CAAC;aACtB;SACF,EACD,CAAC,GAAG,EAAE,EAAE;YACN,IAAI,GAAG,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;gBACvE,MAAM,CAAC;oBAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBAAC,CAAC;YAC/D,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACtB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,UAAkB,EAAE,SAAiB;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;IACpC,IAAI,OAAO,GAAG,GAAG,CAAC;IAClB,IAAI,eAAe,GAAG,SAAS,CAAC;IAChC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,eAAe,GAAG,CAAC,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;QAC7D,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,eAAe,KAAK,MAAM,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO;QAC7D,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7D,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,6EAA6E,eAAe,EAAE,CAAC,CAAC;AAClH,CAAC;AAED,SAAS,2BAA2B,CAAC,GAAY;IAC/C,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;IACjD,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,YAAY,CAAC;AACnD,CAAC"}

package/dist/daemon/debug-logger.d.ts

@@ -0,0 +1,5 @@
+import type { Logger } from 'pino';
+export declare function debugLogger(): Logger;
+export declare function _resetForTests(configDirScope?: string): void;
+export declare function _rotateDebugLogIfNeededForTests(): void;
+//# sourceMappingURL=debug-logger.d.ts.map

package/dist/daemon/debug-logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug-logger.d.ts","sourceRoot":"","sources":["../../src/daemon/debug-logger.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAqLnC,wBAAgB,WAAW,IAAI,MAAM,CAGpC;AAGD,wBAAgB,cAAc,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CA6B5D;AA4BD,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD"}