@vostride/agent-qa-runner-local 0.0.1 → 0.2.1

package/dist/index.cjs

@@ -0,0 +1,1112 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  ARTIFACT_FILE: () => ARTIFACT_FILE,
+  BUILD_ORDINALS_FILE: () => BUILD_ORDINALS_FILE,
+  BUILD_TAGS_FILE: () => BUILD_TAGS_FILE,
+  BuildOrdinalReservationError: () => BuildOrdinalReservationError,
+  CACHE_SCHEMA_VERSION: () => CACHE_SCHEMA_VERSION,
+  DockerHookExecutor: () => DockerHookExecutor,
+  EVENTS_FILE: () => EVENTS_FILE,
+  FsActionCache: () => FsActionCache,
+  FsEventLog: () => FsEventLog,
+  FsEvidenceArtifactStore: () => FsEvidenceArtifactStore,
+  FsHandoffStore: () => FsHandoffStore,
+  FsRunArtifactStore: () => FsRunArtifactStore,
+  FsStorageStateStore: () => FsStorageStateStore,
+  HANDOFF_FILE: () => HANDOFF_FILE,
+  RUNS_SUBDIR: () => RUNS_SUBDIR,
+  RUN_EVIDENCE_BLOBS_SUBDIR: () => RUN_EVIDENCE_BLOBS_SUBDIR,
+  STORAGE_STATES_SUBDIR: () => STORAGE_STATES_SUBDIR,
+  SharpScreenshotCompressor: () => SharpScreenshotCompressor,
+  alignToWindow: () => alignToWindow,
+  checkDockerAvailable: () => checkDockerAvailable,
+  flattenOntoWhite: () => flattenOntoWhite,
+  getImageDimensions: () => getImageDimensions,
+  latestBuildOrdinal: () => latestBuildOrdinal,
+  loadCompletedRunHandoff: () => loadCompletedRunHandoff,
+  nextBuildOrdinal: () => nextBuildOrdinal,
+  readBuildTagMap: () => readBuildTagMap,
+  recordBuildTag: () => recordBuildTag,
+  reserveBuildOrdinalForProducts: () => reserveBuildOrdinalForProducts,
+  resolveBranch: () => resolveBranch,
+  resolveBuildTag: () => resolveBuildTag,
+  shouldWrite: () => shouldWrite,
+  slugBranch: () => import_agent_qa_schema.slugBranch
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/fs-action-cache.ts
+var import_promises = require("fs/promises");
+var import_node_path2 = require("path");
+
+// src/branch-resolver.ts
+var import_node_child_process = require("child_process");
+var import_node_fs = require("fs");
+var import_node_path = require("path");
+var import_agent_qa_schema = require("@vostride/agent-qa-schema");
+var HEAD_REF_RE = /^ref:\s*refs\/heads\/(.+?)\s*$/m;
+var GITDIR_RE = /^gitdir:\s*(.+)$/m;
+function resolveBranch(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const readHead = opts.readHead ?? defaultReadHead;
+  const runSymbolicRef = opts.runSymbolicRef ?? defaultRunSymbolicRef;
+  const defaultBranch = parseSymbolicRef(safe(() => runSymbolicRef(cwd))) ?? opts.configuredDefault ?? "main";
+  const currentBranch = parseHeadBranch(safe(() => readHead(cwd))) ?? defaultBranch;
+  return { currentBranch, defaultBranch };
+}
+function parseHeadBranch(head) {
+  if (head === null) return null;
+  const match = HEAD_REF_RE.exec(head);
+  return match ? match[1] : null;
+}
+function parseSymbolicRef(output) {
+  if (output === null) return null;
+  const trimmed = output.trim();
+  if (trimmed === "") return null;
+  const name = trimmed.slice(trimmed.lastIndexOf("/") + 1);
+  return name.length > 0 ? name : null;
+}
+function defaultReadHead(cwd) {
+  try {
+    const gitPath = (0, import_node_path.join)(cwd, ".git");
+    const stat = (0, import_node_fs.statSync)(gitPath);
+    if (stat.isDirectory()) {
+      return (0, import_node_fs.readFileSync)((0, import_node_path.join)(gitPath, "HEAD"), "utf-8");
+    }
+    const pointer = (0, import_node_fs.readFileSync)(gitPath, "utf-8");
+    const match = GITDIR_RE.exec(pointer);
+    if (match === null) return null;
+    const gitdir = (0, import_node_path.resolve)(cwd, match[1].trim());
+    return (0, import_node_fs.readFileSync)((0, import_node_path.join)(gitdir, "HEAD"), "utf-8");
+  } catch {
+    return null;
+  }
+}
+var DEFAULT_GIT_SYMBOLIC_REF_TIMEOUT_MS = 5e3;
+function runGitSymbolicRef(cwd, options = {}) {
+  const exec = options.exec ?? import_node_child_process.execFileSync;
+  const timeout = options.timeoutMs ?? DEFAULT_GIT_SYMBOLIC_REF_TIMEOUT_MS;
+  try {
+    return exec("git", ["symbolic-ref", "refs/remotes/origin/HEAD"], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout
+    });
+  } catch {
+    return null;
+  }
+}
+function defaultRunSymbolicRef(cwd) {
+  return runGitSymbolicRef(cwd);
+}
+function safe(read) {
+  try {
+    return read();
+  } catch {
+    return null;
+  }
+}
+
+// src/write-policy.ts
+function shouldWrite(policy) {
+  if (policy.disableCache) return false;
+  const protectedNow = policy.protectedBranches.includes(policy.currentBranch);
+  return !protectedNow || policy.saveCache || policy.isCI;
+}
+
+// src/fs-action-cache.ts
+var CACHE_SCHEMA_VERSION = 2;
+var FsActionCache = class {
+  root;
+  policy;
+  constructor(config) {
+    this.root = config.root;
+    this.policy = config.policy;
+  }
+  async get(key) {
+    if (this.policy.disableCache) return null;
+    const onCurrent = await this.readEntry(this.policy.currentBranch, key);
+    if (onCurrent !== null) return onCurrent;
+    if (this.policy.currentBranch !== this.policy.defaultBranch) {
+      return this.readEntry(this.policy.defaultBranch, key);
+    }
+    return null;
+  }
+  async set(key, value) {
+    if (!shouldWrite(this.policy)) return;
+    const dir = this.branchDir(this.policy.currentBranch);
+    await (0, import_promises.mkdir)(dir, { recursive: true });
+    const envelope = { schemaVersion: CACHE_SCHEMA_VERSION, value };
+    await (0, import_promises.writeFile)(this.entryPath(dir, key), `${JSON.stringify(envelope, null, 2)}
+`, "utf-8");
+  }
+  async invalidate(key) {
+    const dir = this.branchDir(this.policy.currentBranch);
+    try {
+      await (0, import_promises.unlink)(this.entryPath(dir, key));
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+    }
+  }
+  branchDir(branch) {
+    return (0, import_node_path2.join)(this.root, (0, import_agent_qa_schema.slugBranch)(branch));
+  }
+  entryPath(dir, key) {
+    return (0, import_node_path2.join)(dir, `${key}.json`);
+  }
+  async readEntry(branch, key) {
+    let raw;
+    try {
+      raw = await (0, import_promises.readFile)(this.entryPath(this.branchDir(branch), key), "utf-8");
+    } catch (err) {
+      if (err.code === "ENOENT") return null;
+      throw err;
+    }
+    let envelope;
+    try {
+      envelope = JSON.parse(raw);
+    } catch {
+      return null;
+    }
+    if (envelope?.schemaVersion !== CACHE_SCHEMA_VERSION) return null;
+    return envelope.value ?? null;
+  }
+};
+
+// src/storage-state-store.ts
+var import_promises2 = require("fs/promises");
+var import_node_path3 = require("path");
+var import_agent_qa_schema2 = require("@vostride/agent-qa-schema");
+var STORAGE_STATES_SUBDIR = "storage-states";
+var FsStorageStateStore = class {
+  root;
+  constructor(config) {
+    this.root = config.root;
+  }
+  async save(name, state) {
+    const dir = this.storageStatesDir();
+    await (0, import_promises2.mkdir)(dir, { recursive: true });
+    const serialized = JSON.stringify(state);
+    await (0, import_promises2.writeFile)(this.entryPath(name), `${serialized}
+`, "utf-8");
+    return { name, fingerprint: (0, import_agent_qa_schema2.sha256hex16)(serialized) };
+  }
+  async load(name) {
+    let raw;
+    try {
+      raw = await (0, import_promises2.readFile)(this.entryPath(name), "utf-8");
+    } catch (err) {
+      if (err.code === "ENOENT") return void 0;
+      throw err;
+    }
+    try {
+      return JSON.parse(raw);
+    } catch {
+      return void 0;
+    }
+  }
+  storageStatesDir() {
+    return (0, import_node_path3.join)(this.root, STORAGE_STATES_SUBDIR);
+  }
+  entryPath(name) {
+    return (0, import_node_path3.join)(this.storageStatesDir(), `${(0, import_agent_qa_schema.slugBranch)(name)}.json`);
+  }
+};
+
+// src/event-log.ts
+var import_node_fs2 = require("fs");
+var import_node_path4 = require("path");
+var RUNS_SUBDIR = "runs";
+var EVENTS_FILE = "events.jsonl";
+var FsEventLog = class {
+  dir;
+  file;
+  constructor(config) {
+    this.dir = (0, import_node_path4.join)(config.root, RUNS_SUBDIR, (0, import_agent_qa_schema.slugBranch)(config.runId));
+    this.file = (0, import_node_path4.join)(this.dir, EVENTS_FILE);
+  }
+  append(envelope) {
+    (0, import_node_fs2.mkdirSync)(this.dir, { recursive: true });
+    (0, import_node_fs2.appendFileSync)(this.file, `${JSON.stringify(envelope)}
+`);
+  }
+  read(fromSeq) {
+    let raw;
+    try {
+      raw = (0, import_node_fs2.readFileSync)(this.file, "utf-8");
+    } catch (err) {
+      if (err.code === "ENOENT") return [];
+      throw err;
+    }
+    const out = [];
+    for (const line of raw.split("\n")) {
+      if (line.length === 0) continue;
+      let parsed;
+      try {
+        parsed = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      if (parsed.seq >= fromSeq) out.push(parsed);
+    }
+    return out;
+  }
+};
+
+// src/handoff-store.ts
+var import_node_fs3 = require("fs");
+var import_node_path5 = require("path");
+var import_agent_qa_schema3 = require("@vostride/agent-qa-schema");
+var HANDOFF_FILE = "handoff.json";
+var FsHandoffStore = class {
+  dir;
+  file;
+  constructor(config) {
+    this.dir = (0, import_node_path5.join)(config.root, RUNS_SUBDIR, (0, import_agent_qa_schema.slugBranch)(config.runId));
+    this.file = (0, import_node_path5.join)(this.dir, HANDOFF_FILE);
+  }
+  save(handoff) {
+    (0, import_node_fs3.mkdirSync)(this.dir, { recursive: true });
+    (0, import_node_fs3.writeFileSync)(this.file, `${JSON.stringify(handoff)}
+`, "utf-8");
+  }
+};
+function loadCompletedRunHandoff(filePath) {
+  const raw = (0, import_node_fs3.readFileSync)(filePath, "utf-8");
+  return (0, import_agent_qa_schema3.guardCompletedRunHandoff)(JSON.parse(raw));
+}
+
+// src/run-artifact-store.ts
+var import_node_fs4 = require("fs");
+var import_node_path6 = require("path");
+var import_agent_qa_schema4 = require("@vostride/agent-qa-schema");
+var ARTIFACT_FILE = "artifact.json";
+var FsRunArtifactStore = class {
+  dir;
+  file;
+  constructor(config) {
+    this.dir = (0, import_node_path6.join)(config.root, RUNS_SUBDIR, (0, import_agent_qa_schema.slugBranch)(config.runId));
+    this.file = (0, import_node_path6.join)(this.dir, ARTIFACT_FILE);
+  }
+  stage(document) {
+    const persisted = this.merge({ schemaVersion: import_agent_qa_schema4.RUN_ARTIFACT_SCHEMA_VERSION }, document);
+    this.write(persisted);
+  }
+  finalize(patch) {
+    const base = this.readExisting() ?? { schemaVersion: import_agent_qa_schema4.RUN_ARTIFACT_SCHEMA_VERSION };
+    const persisted = this.merge(base, patch);
+    this.write(persisted);
+  }
+  /** Shallow-merge a stage/finalize input onto the base, always dropping the top-level runtime. */
+  merge(base, input) {
+    const { runtime: _dropRuntime, ...rest } = input;
+    const merged = {
+      ...base,
+      ...rest,
+      schemaVersion: import_agent_qa_schema4.RUN_ARTIFACT_SCHEMA_VERSION
+    };
+    delete merged.runtime;
+    return merged;
+  }
+  readExisting() {
+    try {
+      return JSON.parse((0, import_node_fs4.readFileSync)(this.file, "utf-8"));
+    } catch (err) {
+      if (err.code === "ENOENT") return void 0;
+      throw err;
+    }
+  }
+  write(document) {
+    (0, import_node_fs4.mkdirSync)(this.dir, { recursive: true });
+    (0, import_node_fs4.writeFileSync)(this.file, `${JSON.stringify(document)}
+`, "utf-8");
+  }
+};
+
+// src/evidence-artifact-store.ts
+var import_node_crypto = require("crypto");
+var import_node_fs5 = require("fs");
+var import_node_path7 = require("path");
+var import_node_fs6 = require("fs");
+var import_node_path8 = require("path");
+var import_agent_qa_schema5 = require("@vostride/agent-qa-schema");
+var import_agent_qa_schema6 = require("@vostride/agent-qa-schema");
+var RUN_EVIDENCE_BLOBS_SUBDIR = "blobs";
+var SHA256_HEX_RE = /^[0-9a-f]{64}$/;
+var DIRECTORY_SYNC_TOLERATED_CODES = ["EINVAL", "EPERM", "ENOTSUP", "EOPNOTSUPP", "EBADF", "EISDIR"];
+var FsEvidenceArtifactStore = class {
+  dir;
+  durabilityRoot;
+  constructor(config) {
+    this.dir = (0, import_node_path7.join)(config.root, RUNS_SUBDIR, (0, import_agent_qa_schema.slugBranch)(config.runId), RUN_EVIDENCE_BLOBS_SUBDIR);
+    this.durabilityRoot = (0, import_node_path7.dirname)((0, import_node_path7.join)(config.root, "."));
+  }
+  persistDecisionScreenshot(bytes) {
+    const sha = (0, import_node_crypto.createHash)("sha256").update(bytes).digest("hex");
+    (0, import_node_fs5.mkdirSync)(this.dir, { recursive: true });
+    (0, import_node_fs5.writeFileSync)((0, import_node_path7.join)(this.dir, sha), bytes);
+    return { id: `decision-screenshot:${sha}`, sha };
+  }
+  persistEvidenceDocument(document) {
+    const bytes = Buffer.from(JSON.stringify(document));
+    const parsed = import_agent_qa_schema6.EvidenceDocumentSchema.parse(JSON.parse(bytes.toString("utf8")));
+    if (parsed.kind === "variables") throw new Error("Variable evidence is stored inline");
+    const sha = (0, import_node_crypto.createHash)("sha256").update(bytes).digest("hex");
+    const prefix = parsed.kind === "aria" ? "aria-state:" : `${parsed.kind}-evidence:`;
+    const ref = import_agent_qa_schema6.EvidenceArtifactRefSchema.parse({ id: `${prefix}${sha}`, sha });
+    (0, import_node_fs5.mkdirSync)(this.dir, { recursive: true });
+    const target = (0, import_node_path7.join)(this.dir, sha);
+    const existing = this.getBlob(sha);
+    if (existing !== void 0 && Buffer.from(existing).equals(bytes)) {
+      this.syncPath(target);
+      this.syncDirectories();
+      return ref;
+    }
+    const temporary = (0, import_node_path7.join)(this.dir, `.${sha}.${(0, import_node_crypto.randomUUID)()}.tmp`);
+    const fd = (0, import_node_fs5.openSync)(temporary, "wx", 384);
+    let opened = true;
+    try {
+      (0, import_node_fs5.writeFileSync)(fd, bytes);
+      (0, import_node_fs5.fsyncSync)(fd);
+      (0, import_node_fs5.closeSync)(fd);
+      opened = false;
+      (0, import_node_fs5.renameSync)(temporary, target);
+      this.syncDirectories();
+      return ref;
+    } finally {
+      if (opened) (0, import_node_fs5.closeSync)(fd);
+      try {
+        (0, import_node_fs5.unlinkSync)(temporary);
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+    }
+  }
+  syncDirectories() {
+    for (let path = this.dir; ; path = (0, import_node_path7.dirname)(path)) {
+      try {
+        this.syncPath(path);
+      } catch (error) {
+        const code = error.code;
+        if (!DIRECTORY_SYNC_TOLERATED_CODES.some((tolerated) => tolerated === code)) throw error;
+      }
+      if (path === this.durabilityRoot || (0, import_node_path7.dirname)(path) === path) return;
+    }
+  }
+  syncPath(path) {
+    const fd = (0, import_node_fs5.openSync)(path, "r");
+    try {
+      (0, import_node_fs5.fsyncSync)(fd);
+    } finally {
+      (0, import_node_fs5.closeSync)(fd);
+    }
+  }
+  hasBlob(sha) {
+    if (!SHA256_HEX_RE.test(sha)) return false;
+    return (0, import_node_fs5.existsSync)((0, import_node_path7.join)(this.dir, sha));
+  }
+  persistRecording(stagingPath) {
+    this.assertRecordingStagingPath(stagingPath);
+    let recordingTemp;
+    try {
+      const byteLength = (0, import_node_fs6.statSync)(stagingPath).size;
+      if (byteLength === 0) throw new Error("Cannot persist an empty recording");
+      const hash = (0, import_node_crypto.createHash)("sha256");
+      const fd = (0, import_node_fs5.openSync)(stagingPath, "r");
+      try {
+        const chunk = Buffer.allocUnsafe(1024 * 1024);
+        let total = 0;
+        for (; ; ) {
+          const count = (0, import_node_fs6.readSync)(fd, chunk, 0, chunk.length, null);
+          if (count === 0) break;
+          total += count;
+          hash.update(chunk.subarray(0, count));
+        }
+        if (total !== byteLength) throw new Error("Recording changed while hashing");
+      } finally {
+        (0, import_node_fs5.closeSync)(fd);
+      }
+      const sha = hash.digest("hex");
+      const result = {
+        ref: { id: `${import_agent_qa_schema5.RECORDING_REF_PREFIX}${sha}`, sha },
+        byteLength
+      };
+      (0, import_node_fs5.mkdirSync)(this.dir, { recursive: true });
+      const target = (0, import_node_path7.join)(this.dir, sha);
+      if (this.blobSize(sha) !== void 0) {
+        this.syncPath(target);
+        this.syncDirectories();
+        return result;
+      }
+      recordingTemp = (0, import_node_path7.join)(this.dir, `.${sha}.${(0, import_node_crypto.randomUUID)()}.tmp`);
+      try {
+        (0, import_node_fs5.renameSync)(stagingPath, recordingTemp);
+      } catch (error) {
+        if (error.code !== "EXDEV") throw error;
+        (0, import_node_fs6.copyFileSync)(stagingPath, recordingTemp);
+      }
+      (0, import_node_fs6.chmodSync)(recordingTemp, 384);
+      this.syncPath(recordingTemp);
+      (0, import_node_fs5.renameSync)(recordingTemp, target);
+      this.syncDirectories();
+      return result;
+    } finally {
+      try {
+        if (recordingTemp !== void 0) this.unlinkRecordingStaging(recordingTemp);
+      } finally {
+        this.unlinkRecordingStaging(stagingPath);
+      }
+    }
+  }
+  blobSize(sha) {
+    if (!SHA256_HEX_RE.test(sha)) return void 0;
+    try {
+      return (0, import_node_fs6.statSync)((0, import_node_path7.join)(this.dir, sha)).size;
+    } catch (error) {
+      if (error.code === "ENOENT") return void 0;
+      throw error;
+    }
+  }
+  readBlobRange(sha, start, end) {
+    if (!SHA256_HEX_RE.test(sha)) return void 0;
+    if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 0 || end < start) return void 0;
+    let fd;
+    try {
+      fd = (0, import_node_fs5.openSync)((0, import_node_path7.join)(this.dir, sha), "r");
+    } catch (error) {
+      if (error.code === "ENOENT") return void 0;
+      throw error;
+    }
+    try {
+      const size = (0, import_node_fs6.fstatSync)(fd).size;
+      if (start >= size) return void 0;
+      const length = Math.min(end, size - 1) - start + 1;
+      const bytes = new Uint8Array(length);
+      let offset = 0;
+      while (offset < length) {
+        const count = (0, import_node_fs6.readSync)(fd, bytes, offset, length - offset, start + offset);
+        if (count === 0) throw new Error("Recording blob ended before the requested range");
+        offset += count;
+      }
+      return bytes;
+    } finally {
+      (0, import_node_fs5.closeSync)(fd);
+    }
+  }
+  discardRecording(stagingPath) {
+    this.assertRecordingStagingPath(stagingPath);
+    this.unlinkRecordingStaging(stagingPath);
+  }
+  assertRecordingStagingPath(stagingPath) {
+    const inside = (dir, path) => {
+      const tail = (0, import_node_path8.relative)(dir, path);
+      return tail === "" || tail !== ".." && !tail.startsWith(`..${import_node_path8.sep}`) && !(0, import_node_path8.isAbsolute)(tail);
+    };
+    if (inside((0, import_node_path8.resolve)(this.dir), (0, import_node_path8.resolve)(stagingPath))) {
+      throw new Error("Recording staging path must be outside the evidence blob directory");
+    }
+    try {
+      if (inside((0, import_node_fs6.realpathSync)(this.dir), (0, import_node_fs6.realpathSync)(stagingPath))) {
+        throw new Error("Recording staging path must be outside the evidence blob directory");
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  unlinkRecordingStaging(path) {
+    try {
+      (0, import_node_fs5.unlinkSync)(path);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  getBlob(sha) {
+    if (!SHA256_HEX_RE.test(sha)) return void 0;
+    try {
+      return new Uint8Array((0, import_node_fs5.readFileSync)((0, import_node_path7.join)(this.dir, sha)));
+    } catch (err) {
+      if (err.code === "ENOENT") return void 0;
+      throw err;
+    }
+  }
+};
+
+// src/screenshot-compressor.ts
+var import_sharp = __toESM(require("sharp"), 1);
+var STARTING_QUALITY = 70;
+var QUALITY_REDUCTION = 0.8;
+var MIN_QUALITY = 10;
+async function compressScreenshot(buffer, opts, logger) {
+  const originalKB = (buffer.length / 1024).toFixed(1);
+  const meta = await (0, import_sharp.default)(buffer).metadata();
+  const srcWidth = meta.width ?? opts.actionSpaceWidth;
+  const srcHeight = meta.height ?? 0;
+  const targetEdge = opts.effectiveResolution;
+  let resizePipeline = (0, import_sharp.default)(buffer);
+  if (srcWidth > targetEdge || srcHeight > targetEdge) {
+    resizePipeline = resizePipeline.resize({
+      width: targetEdge,
+      height: targetEdge,
+      fit: "inside",
+      withoutEnlargement: true,
+      kernel: "lanczos3"
+    });
+  }
+  const afterResize = await resizePipeline.toBuffer({ resolveWithObject: true });
+  const resizedWidth = afterResize.info.width;
+  const resizedHeight = afterResize.info.height;
+  if (!opts.maxBytes) {
+    return { buffer: afterResize.data, imageWidth: resizedWidth, imageHeight: resizedHeight };
+  }
+  const maxBytes = opts.maxBytes;
+  const targetKB = (maxBytes / 1024).toFixed(1);
+  let quality = STARTING_QUALITY;
+  while (quality > MIN_QUALITY) {
+    const { data: data2, info: info2 } = await (0, import_sharp.default)(afterResize.data).jpeg({ quality, mozjpeg: true }).toBuffer({ resolveWithObject: true });
+    if (info2.size <= maxBytes) {
+      logger?.debug("Compressed screenshot", {
+        originalKB: parseFloat(originalKB),
+        compressedKB: parseFloat((info2.size / 1024).toFixed(1)),
+        targetKB: parseFloat(targetKB),
+        quality
+      });
+      return { buffer: data2, imageWidth: resizedWidth, imageHeight: resizedHeight };
+    }
+    quality = Math.max(MIN_QUALITY, Math.round(quality * QUALITY_REDUCTION));
+  }
+  const { data, info } = await (0, import_sharp.default)(afterResize.data).jpeg({ quality: MIN_QUALITY, mozjpeg: true }).toBuffer({ resolveWithObject: true });
+  logger?.debug("Compressed screenshot (exceeded target)", {
+    originalKB: parseFloat(originalKB),
+    compressedKB: parseFloat((info.size / 1024).toFixed(1)),
+    targetKB: parseFloat(targetKB),
+    quality: MIN_QUALITY
+  });
+  return { buffer: data, imageWidth: resizedWidth, imageHeight: resizedHeight };
+}
+var SharpScreenshotCompressor = class {
+  constructor(logger) {
+    this.logger = logger;
+  }
+  async compress(screenshot, options) {
+    return compressScreenshot(screenshot, options, this.logger);
+  }
+  async dimensions(screenshot) {
+    const meta = await (0, import_sharp.default)(screenshot).metadata();
+    return { width: meta.width ?? 0, height: meta.height ?? 0 };
+  }
+};
+async function alignToWindow(buffer, opts) {
+  return (0, import_sharp.default)(buffer).resize({ width: opts.width, height: opts.height, kernel: "lanczos3", fit: "fill" }).png().toBuffer();
+}
+async function getImageDimensions(buffer) {
+  const meta = await (0, import_sharp.default)(buffer).metadata();
+  if (!meta.width || !meta.height) return void 0;
+  return { width: meta.width, height: meta.height };
+}
+async function flattenOntoWhite(buffer) {
+  const meta = await (0, import_sharp.default)(buffer).metadata();
+  if (!meta.hasAlpha) return buffer;
+  return (0, import_sharp.default)(buffer).flatten({ background: "#ffffff" }).png().toBuffer();
+}
+
+// src/build-ordinal.ts
+var import_node_crypto2 = require("crypto");
+var import_node_fs7 = require("fs");
+var import_node_path9 = require("path");
+var BUILD_ORDINALS_FILE = "build-ordinals.json";
+var BuildOrdinalReservationError = class extends Error {
+  name = "BuildOrdinalReservationError";
+  code;
+  product;
+  value;
+  constructor(code, product, value) {
+    const message = code === "invalid-state" ? `${BUILD_ORDINALS_FILE} must contain a JSON object` : code === "missing-counter" ? `Missing build ordinal counter for product ${JSON.stringify(product)}` : code === "invalid-counter" ? `Build ordinal counter for product ${JSON.stringify(product)} must be a non-negative safe integer` : `Build ordinal counter for product ${JSON.stringify(product)} is exhausted`;
+    super(message);
+    this.code = code;
+    this.product = product;
+    this.value = value;
+  }
+};
+var BUILD_ORDINALS_LOCK_FILE = ".build-ordinals.lock";
+var COUNTER_LOCK_POLL_MS = 5;
+var COUNTER_LOCK_WAIT = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+function fsyncDirectory(dir) {
+  let fd;
+  try {
+    fd = (0, import_node_fs7.openSync)(dir, "r");
+    (0, import_node_fs7.fsyncSync)(fd);
+  } catch (error) {
+    const code = error.code;
+    if (code !== "EINVAL" && code !== "EISDIR" && code !== "EPERM" && code !== "ENOTSUP") {
+      throw error;
+    }
+  } finally {
+    if (fd !== void 0) (0, import_node_fs7.closeSync)(fd);
+  }
+}
+function durableExclusiveFile(file, text) {
+  const fd = (0, import_node_fs7.openSync)(file, "wx");
+  try {
+    (0, import_node_fs7.writeFileSync)(fd, text, "utf8");
+    (0, import_node_fs7.fsyncSync)(fd);
+  } finally {
+    (0, import_node_fs7.closeSync)(fd);
+  }
+}
+function parsedLockOwner(file) {
+  try {
+    const value = JSON.parse((0, import_node_fs7.readFileSync)(file, "utf8"));
+    if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+    const owner = value;
+    return typeof owner.pid === "number" && Number.isSafeInteger(owner.pid) && owner.pid > 0 && typeof owner.token === "string" && owner.token !== "" ? { pid: owner.pid, token: owner.token } : void 0;
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+}
+function processIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    const code = error.code;
+    if (code === "ESRCH") return false;
+    if (code === "EPERM") return true;
+    throw error;
+  }
+}
+function withCounterLock(root, operation) {
+  (0, import_node_fs7.mkdirSync)(root, { recursive: true });
+  const lock = (0, import_node_path9.join)(root, BUILD_ORDINALS_LOCK_FILE);
+  const owner = { pid: process.pid, token: (0, import_node_crypto2.randomUUID)() };
+  const ownerFile = `${lock}.owner-${owner.token}`;
+  durableExclusiveFile(ownerFile, `${JSON.stringify(owner)}
+`);
+  let acquired = false;
+  try {
+    while (!acquired) {
+      try {
+        (0, import_node_fs7.linkSync)(ownerFile, lock);
+        fsyncDirectory(root);
+        acquired = true;
+      } catch (error) {
+        if (error.code !== "EEXIST") throw error;
+        const current = parsedLockOwner(lock);
+        if (current !== void 0 && !processIsAlive(current.pid)) {
+          const quarantine = `${lock}.dead-${current.token}-${(0, import_node_crypto2.randomUUID)()}`;
+          try {
+            (0, import_node_fs7.renameSync)(lock, quarantine);
+            fsyncDirectory(root);
+            (0, import_node_fs7.rmSync)(quarantine, { force: true });
+            fsyncDirectory(root);
+            continue;
+          } catch (recoveryError) {
+            if (recoveryError.code === "ENOENT") continue;
+            throw recoveryError;
+          }
+        }
+        Atomics.wait(COUNTER_LOCK_WAIT, 0, 0, COUNTER_LOCK_POLL_MS);
+      }
+    }
+    return operation();
+  } finally {
+    if (acquired && parsedLockOwner(lock)?.token === owner.token) {
+      (0, import_node_fs7.rmSync)(lock, { force: true });
+      fsyncDirectory(root);
+    }
+    (0, import_node_fs7.rmSync)(ownerFile, { force: true });
+  }
+}
+function persistOrdinals(file, map, beforePersist) {
+  const temporary = `${file}.tmp-${(0, import_node_crypto2.randomUUID)()}`;
+  let fd;
+  try {
+    fd = (0, import_node_fs7.openSync)(temporary, "wx");
+    (0, import_node_fs7.writeFileSync)(fd, `${JSON.stringify(map)}
+`, "utf8");
+    (0, import_node_fs7.fsyncSync)(fd);
+    (0, import_node_fs7.closeSync)(fd);
+    fd = void 0;
+    beforePersist?.();
+    (0, import_node_fs7.renameSync)(temporary, file);
+    fsyncDirectory((0, import_node_path9.dirname)(file));
+  } finally {
+    if (fd !== void 0) (0, import_node_fs7.closeSync)(fd);
+    (0, import_node_fs7.rmSync)(temporary, { force: true });
+  }
+}
+async function nextBuildOrdinal(opts) {
+  return withCounterLock(opts.root, () => {
+    const file = (0, import_node_path9.join)(opts.root, BUILD_ORDINALS_FILE);
+    const map = readOrdinals(file, opts.product, true);
+    const current = Object.hasOwn(map, opts.product) ? map[opts.product] : 0;
+    if (current === Number.MAX_SAFE_INTEGER) {
+      throw new BuildOrdinalReservationError("counter-exhausted", opts.product, current);
+    }
+    const next = current + 1;
+    map[opts.product] = next;
+    persistOrdinals(file, map);
+    return next;
+  });
+}
+async function reserveBuildOrdinalForProducts(opts) {
+  const products = Object.freeze([...new Set(opts.products)].sort());
+  if (products.length === 0) return void 0;
+  return withCounterLock(opts.root, () => {
+    const file = (0, import_node_path9.join)(opts.root, BUILD_ORDINALS_FILE);
+    const map = readOrdinals(file, products[0], false);
+    let maximum = 0;
+    for (const product of products) {
+      if (!Object.hasOwn(map, product)) {
+        throw new BuildOrdinalReservationError("missing-counter", product);
+      }
+      const current = map[product];
+      if (current === Number.MAX_SAFE_INTEGER) {
+        throw new BuildOrdinalReservationError("counter-exhausted", product, current);
+      }
+      maximum = Math.max(maximum, current);
+    }
+    const ordinal = maximum + 1;
+    for (const product of products) map[product] = ordinal;
+    const reservation = Object.freeze({ products, ordinal });
+    persistOrdinals(file, map, () => opts.beforePersist?.(reservation));
+    return ordinal;
+  });
+}
+function readOrdinals(file, product, missingIsEmpty) {
+  let raw;
+  try {
+    raw = (0, import_node_fs7.readFileSync)(file, "utf-8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      if (missingIsEmpty) return /* @__PURE__ */ Object.create(null);
+      throw new BuildOrdinalReservationError("missing-counter", product);
+    }
+    throw error;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new BuildOrdinalReservationError("invalid-state", product);
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new BuildOrdinalReservationError("invalid-state", product, parsed);
+  }
+  const map = /* @__PURE__ */ Object.create(null);
+  for (const [key, value] of Object.entries(parsed)) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
+      throw new BuildOrdinalReservationError("invalid-counter", key, value);
+    }
+    map[key] = value;
+  }
+  return map;
+}
+
+// src/build-tag-map.ts
+var import_node_fs8 = require("fs");
+var import_node_path10 = require("path");
+var BUILD_TAGS_FILE = "build-tags.json";
+async function recordBuildTag(opts) {
+  const map = readBuildTagMap({ root: opts.root });
+  const productTags = Object.prototype.hasOwnProperty.call(map, opts.product) ? map[opts.product] : void 0;
+  if (productTags && Object.prototype.hasOwnProperty.call(productTags, opts.tag)) return;
+  const nextMap = {
+    ...map,
+    [opts.product]: {
+      ...productTags,
+      [opts.tag]: opts.ordinal
+    }
+  };
+  const file = (0, import_node_path10.join)(opts.root, BUILD_TAGS_FILE);
+  const tmp = `${file}.tmp`;
+  (0, import_node_fs8.writeFileSync)(tmp, `${JSON.stringify(nextMap)}
+`, "utf-8");
+  (0, import_node_fs8.renameSync)(tmp, file);
+}
+function resolveBuildTag(opts) {
+  return readBuildTagMap({ root: opts.root })[opts.product]?.[opts.tag];
+}
+function latestBuildOrdinal(opts) {
+  const parsed = readJsonRecord((0, import_node_path10.join)(opts.root, BUILD_ORDINALS_FILE));
+  const value = parsed?.[opts.product];
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function readBuildTagMap(opts) {
+  const parsed = readJsonRecord((0, import_node_path10.join)(opts.root, BUILD_TAGS_FILE));
+  if (!parsed) return {};
+  const products = [];
+  for (const [product, tags] of Object.entries(parsed)) {
+    if (!isRecord(tags)) continue;
+    const validTags = Object.fromEntries(
+      Object.entries(tags).filter(
+        (entry) => typeof entry[1] === "number" && Number.isFinite(entry[1])
+      )
+    );
+    products.push([product, validTags]);
+  }
+  return Object.fromEntries(products);
+}
+function readJsonRecord(file) {
+  try {
+    const parsed = JSON.parse((0, import_node_fs8.readFileSync)(file, "utf-8"));
+    return isRecord(parsed) ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/hook-executor.ts
+var import_node_child_process2 = require("child_process");
+var import_promises3 = require("fs/promises");
+var import_node_path11 = require("path");
+var import_node_os = require("os");
+var import_agent_qa_runner = require("@vostride/agent-qa-runner");
+var DEFAULT_DOCKER_BIN = "docker";
+var DockerHookExecutor = class {
+  dockerBin;
+  pullPolicy;
+  constructor(config = {}) {
+    this.dockerBin = config.dockerBin ?? DEFAULT_DOCKER_BIN;
+    this.pullPolicy = config.pullPolicy ?? "if-not-present";
+  }
+  async execute(hook, opts) {
+    const dockerBin = this.dockerBin;
+    const pullPolicy = this.pullPolicy;
+    const start = Date.now();
+    const image = import_agent_qa_runner.RUNTIME_IMAGE_MAP[hook.runtime];
+    if (pullPolicy === "always" || pullPolicy === "if-not-present") {
+      const needsPull = pullPolicy === "always" || !await imageExists(dockerBin, image);
+      if (needsPull) {
+        await pullImage(dockerBin, image);
+      }
+    }
+    let workDir;
+    try {
+      workDir = await (0, import_promises3.mkdtemp)((0, import_node_path11.join)((0, import_node_os.tmpdir)(), "agent-qa-hook-"));
+      await (0, import_promises3.mkdir)((0, import_node_path11.join)(workDir, "tmp"), { recursive: true });
+      await (0, import_promises3.cp)(hook.file, (0, import_node_path11.join)(workDir, (0, import_node_path11.basename)(hook.file)));
+      for (const dep of hook.deps) {
+        await (0, import_promises3.cp)(dep, (0, import_node_path11.join)(workDir, (0, import_node_path11.basename)(dep)));
+      }
+      if (hook.packageFile) {
+        await (0, import_promises3.cp)(hook.packageFile, (0, import_node_path11.join)(workDir, (0, import_node_path11.basename)(hook.packageFile)));
+      }
+      if (opts.authState) {
+        const authStateDir = (0, import_node_path11.join)(workDir, import_agent_qa_runner.AUTH_STATE_HOOK_WORKSPACE_DIR);
+        await (0, import_promises3.mkdir)(authStateDir, { recursive: true });
+        await (0, import_promises3.cp)(opts.authState.storageStatePath, (0, import_node_path11.join)(authStateDir, import_agent_qa_runner.AUTH_STATE_HOOK_STORAGE_STATE_FILENAME));
+      }
+      const args = buildDockerArgs({
+        image,
+        workDir,
+        hook,
+        env: opts.env,
+        secretEnv: opts.secretEnv,
+        authState: opts.authState
+      });
+      const cmd = getHookCommand(hook.runtime, (0, import_node_path11.basename)(hook.file));
+      args.push(...cmd);
+      const { stdout, stderr, exitCode } = await execDocker(dockerBin, args, hook.timeout);
+      let variables = {};
+      try {
+        const envContent = await (0, import_promises3.readFile)((0, import_node_path11.join)(workDir, "tmp", "agent-qa.env"), "utf-8");
+        variables = (0, import_agent_qa_runner.parseEnvFile)(envContent);
+      } catch {
+      }
+      variables = (0, import_agent_qa_runner.stripReservedAuthStateHookEnv)(filterSecretVariables(variables, opts.secretEnv));
+      const redactedStdout = (0, import_agent_qa_runner.redactSecretValue)(stdout, opts.secretRedactor);
+      const redactedStderr = (0, import_agent_qa_runner.redactSecretValue)(stderr, opts.secretRedactor);
+      const output = redactedStdout.trim();
+      return {
+        success: exitCode === 0,
+        variables,
+        output: output || redactedStderr,
+        stdout: redactedStdout,
+        stderr: redactedStderr,
+        duration: Date.now() - start,
+        error: exitCode !== 0 ? (0, import_agent_qa_runner.redactSecretValue)(`Hook exited with code ${exitCode}: ${stderr}`, opts.secretRedactor) : void 0
+      };
+    } catch (err) {
+      return {
+        success: false,
+        variables: {},
+        output: "",
+        stdout: "",
+        stderr: "",
+        duration: Date.now() - start,
+        error: (0, import_agent_qa_runner.redactSecretValue)(err.message, opts.secretRedactor)
+      };
+    } finally {
+      if (workDir) {
+        await (0, import_promises3.rm)(workDir, { recursive: true, force: true }).catch(() => {
+        });
+      }
+    }
+  }
+};
+async function checkDockerAvailable(dockerBin = DEFAULT_DOCKER_BIN) {
+  return new Promise((resolve3) => {
+    (0, import_node_child_process2.execFile)(dockerBin, ["info", "--format", "{{.ID}}"], { timeout: 5e3 }, (err) => {
+      resolve3(!err);
+    });
+  });
+}
+function getHookCommand(runtime, entryFile) {
+  switch (runtime) {
+    case "node":
+      return ["node", entryFile];
+    case "bun":
+      return ["bun", entryFile];
+    case "python":
+      return ["python3", entryFile];
+    case "bash":
+      return ["bash", entryFile];
+  }
+}
+function buildDockerArgs(input) {
+  const args = [
+    "run",
+    "--rm",
+    "--init",
+    "-v",
+    `${input.workDir}:/workspace`,
+    "-w",
+    "/workspace",
+    "--memory",
+    "512m",
+    "--cpus",
+    "1",
+    "--pids-limit",
+    "256",
+    "--read-only",
+    "-v",
+    `${input.workDir}/tmp:/tmp`
+  ];
+  if (!input.hook.network) {
+    args.push("--network", "none");
+  }
+  const envVars = { ...input.env };
+  Object.assign(envVars, input.secretEnv);
+  Object.assign(envVars, (0, import_agent_qa_runner.buildAuthStateHookEnv)(
+    input.authState,
+    import_agent_qa_runner.AUTH_STATE_HOOK_CONTAINER_STORAGE_STATE_PATH
+  ));
+  for (const [k, v] of Object.entries(envVars)) {
+    args.push("-e", `${k}=${v}`);
+  }
+  args.push(input.image);
+  return args;
+}
+function filterSecretVariables(variables, secretEnv) {
+  const secretValues = new Set(Object.values(secretEnv));
+  if (secretValues.size === 0) return variables;
+  return Object.fromEntries(
+    Object.entries(variables).filter(([_key, value]) => !secretValues.has(value))
+  );
+}
+function imageExists(dockerBin, image) {
+  return new Promise((resolve3) => {
+    (0, import_node_child_process2.execFile)(dockerBin, ["image", "inspect", image], { timeout: 1e4 }, (err) => {
+      resolve3(!err);
+    });
+  });
+}
+function pullImage(dockerBin, image) {
+  return new Promise((resolve3, reject) => {
+    (0, import_node_child_process2.execFile)(dockerBin, ["pull", image], { timeout: 12e4 }, (err) => {
+      if (err) reject(new Error(`Failed to pull image ${image}: ${err.message}`));
+      else resolve3();
+    });
+  });
+}
+function execDocker(dockerBin, args, timeout) {
+  return new Promise((resolve3) => {
+    let stdout = "";
+    let stderr = "";
+    let resolved = false;
+    const _proc = (0, import_node_child_process2.execFile)(dockerBin, args, { timeout, maxBuffer: 4 * 1024 * 1024 }, (err, out, errOut) => {
+      if (resolved) return;
+      resolved = true;
+      stdout = out ?? "";
+      stderr = errOut ?? "";
+      if (err && "killed" in err && err.killed) {
+        resolve3({ stdout, stderr: `Hook timed out after ${timeout}ms`, exitCode: 124 });
+        return;
+      }
+      const exitCode = err?.code ?? 0;
+      resolve3({ stdout, stderr, exitCode: typeof exitCode === "number" ? exitCode : 1 });
+    });
+    void _proc;
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ARTIFACT_FILE,
+  BUILD_ORDINALS_FILE,
+  BUILD_TAGS_FILE,
+  BuildOrdinalReservationError,
+  CACHE_SCHEMA_VERSION,
+  DockerHookExecutor,
+  EVENTS_FILE,
+  FsActionCache,
+  FsEventLog,
+  FsEvidenceArtifactStore,
+  FsHandoffStore,
+  FsRunArtifactStore,
+  FsStorageStateStore,
+  HANDOFF_FILE,
+  RUNS_SUBDIR,
+  RUN_EVIDENCE_BLOBS_SUBDIR,
+  STORAGE_STATES_SUBDIR,
+  SharpScreenshotCompressor,
+  alignToWindow,
+  checkDockerAvailable,
+  flattenOntoWhite,
+  getImageDimensions,
+  latestBuildOrdinal,
+  loadCompletedRunHandoff,
+  nextBuildOrdinal,
+  readBuildTagMap,
+  recordBuildTag,
+  reserveBuildOrdinalForProducts,
+  resolveBranch,
+  resolveBuildTag,
+  shouldWrite,
+  slugBranch
+});
+//# sourceMappingURL=index.cjs.map