@vostride/agent-qa-runner-local 0.0.1 → 0.2.2

package/dist/index.js

@@ -0,0 +1,1073 @@
+// src/fs-action-cache.ts
+import { mkdir, readFile, unlink, writeFile } from "fs/promises";
+import { join as join2 } from "path";
+
+// src/branch-resolver.ts
+import { execFileSync } from "child_process";
+import { readFileSync, statSync } from "fs";
+import { join, resolve } from "path";
+import { slugBranch } from "@vostride/agent-qa-schema";
+var HEAD_REF_RE = /^ref:\s*refs\/heads\/(.+?)\s*$/m;
+var GITDIR_RE = /^gitdir:\s*(.+)$/m;
+function resolveBranch(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const readHead = opts.readHead ?? defaultReadHead;
+  const runSymbolicRef = opts.runSymbolicRef ?? defaultRunSymbolicRef;
+  const defaultBranch = parseSymbolicRef(safe(() => runSymbolicRef(cwd))) ?? opts.configuredDefault ?? "main";
+  const currentBranch = parseHeadBranch(safe(() => readHead(cwd))) ?? defaultBranch;
+  return { currentBranch, defaultBranch };
+}
+function parseHeadBranch(head) {
+  if (head === null) return null;
+  const match = HEAD_REF_RE.exec(head);
+  return match ? match[1] : null;
+}
+function parseSymbolicRef(output) {
+  if (output === null) return null;
+  const trimmed = output.trim();
+  if (trimmed === "") return null;
+  const name = trimmed.slice(trimmed.lastIndexOf("/") + 1);
+  return name.length > 0 ? name : null;
+}
+function defaultReadHead(cwd) {
+  try {
+    const gitPath = join(cwd, ".git");
+    const stat = statSync(gitPath);
+    if (stat.isDirectory()) {
+      return readFileSync(join(gitPath, "HEAD"), "utf-8");
+    }
+    const pointer = readFileSync(gitPath, "utf-8");
+    const match = GITDIR_RE.exec(pointer);
+    if (match === null) return null;
+    const gitdir = resolve(cwd, match[1].trim());
+    return readFileSync(join(gitdir, "HEAD"), "utf-8");
+  } catch {
+    return null;
+  }
+}
+var DEFAULT_GIT_SYMBOLIC_REF_TIMEOUT_MS = 5e3;
+function runGitSymbolicRef(cwd, options = {}) {
+  const exec = options.exec ?? execFileSync;
+  const timeout = options.timeoutMs ?? DEFAULT_GIT_SYMBOLIC_REF_TIMEOUT_MS;
+  try {
+    return exec("git", ["symbolic-ref", "refs/remotes/origin/HEAD"], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout
+    });
+  } catch {
+    return null;
+  }
+}
+function defaultRunSymbolicRef(cwd) {
+  return runGitSymbolicRef(cwd);
+}
+function safe(read) {
+  try {
+    return read();
+  } catch {
+    return null;
+  }
+}
+
+// src/write-policy.ts
+function shouldWrite(policy) {
+  if (policy.disableCache) return false;
+  const protectedNow = policy.protectedBranches.includes(policy.currentBranch);
+  return !protectedNow || policy.saveCache || policy.isCI;
+}
+
+// src/fs-action-cache.ts
+var CACHE_SCHEMA_VERSION = 2;
+var FsActionCache = class {
+  root;
+  policy;
+  constructor(config) {
+    this.root = config.root;
+    this.policy = config.policy;
+  }
+  async get(key) {
+    if (this.policy.disableCache) return null;
+    const onCurrent = await this.readEntry(this.policy.currentBranch, key);
+    if (onCurrent !== null) return onCurrent;
+    if (this.policy.currentBranch !== this.policy.defaultBranch) {
+      return this.readEntry(this.policy.defaultBranch, key);
+    }
+    return null;
+  }
+  async set(key, value) {
+    if (!shouldWrite(this.policy)) return;
+    const dir = this.branchDir(this.policy.currentBranch);
+    await mkdir(dir, { recursive: true });
+    const envelope = { schemaVersion: CACHE_SCHEMA_VERSION, value };
+    await writeFile(this.entryPath(dir, key), `${JSON.stringify(envelope, null, 2)}
+`, "utf-8");
+  }
+  async invalidate(key) {
+    const dir = this.branchDir(this.policy.currentBranch);
+    try {
+      await unlink(this.entryPath(dir, key));
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+    }
+  }
+  branchDir(branch) {
+    return join2(this.root, slugBranch(branch));
+  }
+  entryPath(dir, key) {
+    return join2(dir, `${key}.json`);
+  }
+  async readEntry(branch, key) {
+    let raw;
+    try {
+      raw = await readFile(this.entryPath(this.branchDir(branch), key), "utf-8");
+    } catch (err) {
+      if (err.code === "ENOENT") return null;
+      throw err;
+    }
+    let envelope;
+    try {
+      envelope = JSON.parse(raw);
+    } catch {
+      return null;
+    }
+    if (envelope?.schemaVersion !== CACHE_SCHEMA_VERSION) return null;
+    return envelope.value ?? null;
+  }
+};
+
+// src/storage-state-store.ts
+import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { join as join3 } from "path";
+import { sha256hex16 } from "@vostride/agent-qa-schema";
+var STORAGE_STATES_SUBDIR = "storage-states";
+var FsStorageStateStore = class {
+  root;
+  constructor(config) {
+    this.root = config.root;
+  }
+  async save(name, state) {
+    const dir = this.storageStatesDir();
+    await mkdir2(dir, { recursive: true });
+    const serialized = JSON.stringify(state);
+    await writeFile2(this.entryPath(name), `${serialized}
+`, "utf-8");
+    return { name, fingerprint: sha256hex16(serialized) };
+  }
+  async load(name) {
+    let raw;
+    try {
+      raw = await readFile2(this.entryPath(name), "utf-8");
+    } catch (err) {
+      if (err.code === "ENOENT") return void 0;
+      throw err;
+    }
+    try {
+      return JSON.parse(raw);
+    } catch {
+      return void 0;
+    }
+  }
+  storageStatesDir() {
+    return join3(this.root, STORAGE_STATES_SUBDIR);
+  }
+  entryPath(name) {
+    return join3(this.storageStatesDir(), `${slugBranch(name)}.json`);
+  }
+};
+
+// src/event-log.ts
+import { appendFileSync, mkdirSync, readFileSync as readFileSync2 } from "fs";
+import { join as join4 } from "path";
+var RUNS_SUBDIR = "runs";
+var EVENTS_FILE = "events.jsonl";
+var FsEventLog = class {
+  dir;
+  file;
+  constructor(config) {
+    this.dir = join4(config.root, RUNS_SUBDIR, slugBranch(config.runId));
+    this.file = join4(this.dir, EVENTS_FILE);
+  }
+  append(envelope) {
+    mkdirSync(this.dir, { recursive: true });
+    appendFileSync(this.file, `${JSON.stringify(envelope)}
+`);
+  }
+  read(fromSeq) {
+    let raw;
+    try {
+      raw = readFileSync2(this.file, "utf-8");
+    } catch (err) {
+      if (err.code === "ENOENT") return [];
+      throw err;
+    }
+    const out = [];
+    for (const line of raw.split("\n")) {
+      if (line.length === 0) continue;
+      let parsed;
+      try {
+        parsed = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      if (parsed.seq >= fromSeq) out.push(parsed);
+    }
+    return out;
+  }
+};
+
+// src/handoff-store.ts
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync } from "fs";
+import { join as join5 } from "path";
+import { guardCompletedRunHandoff } from "@vostride/agent-qa-schema";
+var HANDOFF_FILE = "handoff.json";
+var FsHandoffStore = class {
+  dir;
+  file;
+  constructor(config) {
+    this.dir = join5(config.root, RUNS_SUBDIR, slugBranch(config.runId));
+    this.file = join5(this.dir, HANDOFF_FILE);
+  }
+  save(handoff) {
+    mkdirSync2(this.dir, { recursive: true });
+    writeFileSync(this.file, `${JSON.stringify(handoff)}
+`, "utf-8");
+  }
+};
+function loadCompletedRunHandoff(filePath) {
+  const raw = readFileSync3(filePath, "utf-8");
+  return guardCompletedRunHandoff(JSON.parse(raw));
+}
+
+// src/run-artifact-store.ts
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
+import { join as join6 } from "path";
+import { RUN_ARTIFACT_SCHEMA_VERSION } from "@vostride/agent-qa-schema";
+var ARTIFACT_FILE = "artifact.json";
+var FsRunArtifactStore = class {
+  dir;
+  file;
+  constructor(config) {
+    this.dir = join6(config.root, RUNS_SUBDIR, slugBranch(config.runId));
+    this.file = join6(this.dir, ARTIFACT_FILE);
+  }
+  stage(document) {
+    const persisted = this.merge({ schemaVersion: RUN_ARTIFACT_SCHEMA_VERSION }, document);
+    this.write(persisted);
+  }
+  finalize(patch) {
+    const base = this.readExisting() ?? { schemaVersion: RUN_ARTIFACT_SCHEMA_VERSION };
+    const persisted = this.merge(base, patch);
+    this.write(persisted);
+  }
+  /** Shallow-merge a stage/finalize input onto the base, always dropping the top-level runtime. */
+  merge(base, input) {
+    const { runtime: _dropRuntime, ...rest } = input;
+    const merged = {
+      ...base,
+      ...rest,
+      schemaVersion: RUN_ARTIFACT_SCHEMA_VERSION
+    };
+    delete merged.runtime;
+    return merged;
+  }
+  readExisting() {
+    try {
+      return JSON.parse(readFileSync4(this.file, "utf-8"));
+    } catch (err) {
+      if (err.code === "ENOENT") return void 0;
+      throw err;
+    }
+  }
+  write(document) {
+    mkdirSync3(this.dir, { recursive: true });
+    writeFileSync2(this.file, `${JSON.stringify(document)}
+`, "utf-8");
+  }
+};
+
+// src/evidence-artifact-store.ts
+import { createHash, randomUUID } from "crypto";
+import {
+  closeSync,
+  existsSync,
+  fsyncSync,
+  mkdirSync as mkdirSync4,
+  openSync,
+  readFileSync as readFileSync5,
+  renameSync,
+  unlinkSync,
+  writeFileSync as writeFileSync3
+} from "fs";
+import { dirname, join as join7 } from "path";
+import { chmodSync, copyFileSync, fstatSync, readSync, realpathSync, statSync as statSync2 } from "fs";
+import { isAbsolute, relative, resolve as resolve2, sep } from "path";
+import { RECORDING_REF_PREFIX } from "@vostride/agent-qa-schema";
+import { EvidenceArtifactRefSchema, EvidenceDocumentSchema } from "@vostride/agent-qa-schema";
+var RUN_EVIDENCE_BLOBS_SUBDIR = "blobs";
+var SHA256_HEX_RE = /^[0-9a-f]{64}$/;
+var DIRECTORY_SYNC_TOLERATED_CODES = ["EINVAL", "EPERM", "ENOTSUP", "EOPNOTSUPP", "EBADF", "EISDIR"];
+var FsEvidenceArtifactStore = class {
+  dir;
+  durabilityRoot;
+  constructor(config) {
+    this.dir = join7(config.root, RUNS_SUBDIR, slugBranch(config.runId), RUN_EVIDENCE_BLOBS_SUBDIR);
+    this.durabilityRoot = dirname(join7(config.root, "."));
+  }
+  persistDecisionScreenshot(bytes) {
+    const sha = createHash("sha256").update(bytes).digest("hex");
+    mkdirSync4(this.dir, { recursive: true });
+    writeFileSync3(join7(this.dir, sha), bytes);
+    return { id: `decision-screenshot:${sha}`, sha };
+  }
+  persistEvidenceDocument(document) {
+    const bytes = Buffer.from(JSON.stringify(document));
+    const parsed = EvidenceDocumentSchema.parse(JSON.parse(bytes.toString("utf8")));
+    if (parsed.kind === "variables") throw new Error("Variable evidence is stored inline");
+    const sha = createHash("sha256").update(bytes).digest("hex");
+    const prefix = parsed.kind === "aria" ? "aria-state:" : `${parsed.kind}-evidence:`;
+    const ref = EvidenceArtifactRefSchema.parse({ id: `${prefix}${sha}`, sha });
+    mkdirSync4(this.dir, { recursive: true });
+    const target = join7(this.dir, sha);
+    const existing = this.getBlob(sha);
+    if (existing !== void 0 && Buffer.from(existing).equals(bytes)) {
+      this.syncPath(target);
+      this.syncDirectories();
+      return ref;
+    }
+    const temporary = join7(this.dir, `.${sha}.${randomUUID()}.tmp`);
+    const fd = openSync(temporary, "wx", 384);
+    let opened = true;
+    try {
+      writeFileSync3(fd, bytes);
+      fsyncSync(fd);
+      closeSync(fd);
+      opened = false;
+      renameSync(temporary, target);
+      this.syncDirectories();
+      return ref;
+    } finally {
+      if (opened) closeSync(fd);
+      try {
+        unlinkSync(temporary);
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+    }
+  }
+  syncDirectories() {
+    for (let path = this.dir; ; path = dirname(path)) {
+      try {
+        this.syncPath(path);
+      } catch (error) {
+        const code = error.code;
+        if (!DIRECTORY_SYNC_TOLERATED_CODES.some((tolerated) => tolerated === code)) throw error;
+      }
+      if (path === this.durabilityRoot || dirname(path) === path) return;
+    }
+  }
+  syncPath(path) {
+    const fd = openSync(path, "r");
+    try {
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+  }
+  hasBlob(sha) {
+    if (!SHA256_HEX_RE.test(sha)) return false;
+    return existsSync(join7(this.dir, sha));
+  }
+  persistRecording(stagingPath) {
+    this.assertRecordingStagingPath(stagingPath);
+    let recordingTemp;
+    try {
+      const byteLength = statSync2(stagingPath).size;
+      if (byteLength === 0) throw new Error("Cannot persist an empty recording");
+      const hash = createHash("sha256");
+      const fd = openSync(stagingPath, "r");
+      try {
+        const chunk = Buffer.allocUnsafe(1024 * 1024);
+        let total = 0;
+        for (; ; ) {
+          const count = readSync(fd, chunk, 0, chunk.length, null);
+          if (count === 0) break;
+          total += count;
+          hash.update(chunk.subarray(0, count));
+        }
+        if (total !== byteLength) throw new Error("Recording changed while hashing");
+      } finally {
+        closeSync(fd);
+      }
+      const sha = hash.digest("hex");
+      const result = {
+        ref: { id: `${RECORDING_REF_PREFIX}${sha}`, sha },
+        byteLength
+      };
+      mkdirSync4(this.dir, { recursive: true });
+      const target = join7(this.dir, sha);
+      if (this.blobSize(sha) !== void 0) {
+        this.syncPath(target);
+        this.syncDirectories();
+        return result;
+      }
+      recordingTemp = join7(this.dir, `.${sha}.${randomUUID()}.tmp`);
+      try {
+        renameSync(stagingPath, recordingTemp);
+      } catch (error) {
+        if (error.code !== "EXDEV") throw error;
+        copyFileSync(stagingPath, recordingTemp);
+      }
+      chmodSync(recordingTemp, 384);
+      this.syncPath(recordingTemp);
+      renameSync(recordingTemp, target);
+      this.syncDirectories();
+      return result;
+    } finally {
+      try {
+        if (recordingTemp !== void 0) this.unlinkRecordingStaging(recordingTemp);
+      } finally {
+        this.unlinkRecordingStaging(stagingPath);
+      }
+    }
+  }
+  blobSize(sha) {
+    if (!SHA256_HEX_RE.test(sha)) return void 0;
+    try {
+      return statSync2(join7(this.dir, sha)).size;
+    } catch (error) {
+      if (error.code === "ENOENT") return void 0;
+      throw error;
+    }
+  }
+  readBlobRange(sha, start, end) {
+    if (!SHA256_HEX_RE.test(sha)) return void 0;
+    if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 0 || end < start) return void 0;
+    let fd;
+    try {
+      fd = openSync(join7(this.dir, sha), "r");
+    } catch (error) {
+      if (error.code === "ENOENT") return void 0;
+      throw error;
+    }
+    try {
+      const size = fstatSync(fd).size;
+      if (start >= size) return void 0;
+      const length = Math.min(end, size - 1) - start + 1;
+      const bytes = new Uint8Array(length);
+      let offset = 0;
+      while (offset < length) {
+        const count = readSync(fd, bytes, offset, length - offset, start + offset);
+        if (count === 0) throw new Error("Recording blob ended before the requested range");
+        offset += count;
+      }
+      return bytes;
+    } finally {
+      closeSync(fd);
+    }
+  }
+  discardRecording(stagingPath) {
+    this.assertRecordingStagingPath(stagingPath);
+    this.unlinkRecordingStaging(stagingPath);
+  }
+  assertRecordingStagingPath(stagingPath) {
+    const inside = (dir, path) => {
+      const tail = relative(dir, path);
+      return tail === "" || tail !== ".." && !tail.startsWith(`..${sep}`) && !isAbsolute(tail);
+    };
+    if (inside(resolve2(this.dir), resolve2(stagingPath))) {
+      throw new Error("Recording staging path must be outside the evidence blob directory");
+    }
+    try {
+      if (inside(realpathSync(this.dir), realpathSync(stagingPath))) {
+        throw new Error("Recording staging path must be outside the evidence blob directory");
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  unlinkRecordingStaging(path) {
+    try {
+      unlinkSync(path);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  getBlob(sha) {
+    if (!SHA256_HEX_RE.test(sha)) return void 0;
+    try {
+      return new Uint8Array(readFileSync5(join7(this.dir, sha)));
+    } catch (err) {
+      if (err.code === "ENOENT") return void 0;
+      throw err;
+    }
+  }
+};
+
+// src/screenshot-compressor.ts
+import sharp from "sharp";
+var STARTING_QUALITY = 70;
+var QUALITY_REDUCTION = 0.8;
+var MIN_QUALITY = 10;
+async function compressScreenshot(buffer, opts, logger) {
+  const originalKB = (buffer.length / 1024).toFixed(1);
+  const meta = await sharp(buffer).metadata();
+  const srcWidth = meta.width ?? opts.actionSpaceWidth;
+  const srcHeight = meta.height ?? 0;
+  const targetEdge = opts.effectiveResolution;
+  let resizePipeline = sharp(buffer);
+  if (srcWidth > targetEdge || srcHeight > targetEdge) {
+    resizePipeline = resizePipeline.resize({
+      width: targetEdge,
+      height: targetEdge,
+      fit: "inside",
+      withoutEnlargement: true,
+      kernel: "lanczos3"
+    });
+  }
+  const afterResize = await resizePipeline.toBuffer({ resolveWithObject: true });
+  const resizedWidth = afterResize.info.width;
+  const resizedHeight = afterResize.info.height;
+  if (!opts.maxBytes) {
+    return { buffer: afterResize.data, imageWidth: resizedWidth, imageHeight: resizedHeight };
+  }
+  const maxBytes = opts.maxBytes;
+  const targetKB = (maxBytes / 1024).toFixed(1);
+  let quality = STARTING_QUALITY;
+  while (quality > MIN_QUALITY) {
+    const { data: data2, info: info2 } = await sharp(afterResize.data).jpeg({ quality, mozjpeg: true }).toBuffer({ resolveWithObject: true });
+    if (info2.size <= maxBytes) {
+      logger?.debug("Compressed screenshot", {
+        originalKB: parseFloat(originalKB),
+        compressedKB: parseFloat((info2.size / 1024).toFixed(1)),
+        targetKB: parseFloat(targetKB),
+        quality
+      });
+      return { buffer: data2, imageWidth: resizedWidth, imageHeight: resizedHeight };
+    }
+    quality = Math.max(MIN_QUALITY, Math.round(quality * QUALITY_REDUCTION));
+  }
+  const { data, info } = await sharp(afterResize.data).jpeg({ quality: MIN_QUALITY, mozjpeg: true }).toBuffer({ resolveWithObject: true });
+  logger?.debug("Compressed screenshot (exceeded target)", {
+    originalKB: parseFloat(originalKB),
+    compressedKB: parseFloat((info.size / 1024).toFixed(1)),
+    targetKB: parseFloat(targetKB),
+    quality: MIN_QUALITY
+  });
+  return { buffer: data, imageWidth: resizedWidth, imageHeight: resizedHeight };
+}
+var SharpScreenshotCompressor = class {
+  constructor(logger) {
+    this.logger = logger;
+  }
+  async compress(screenshot, options) {
+    return compressScreenshot(screenshot, options, this.logger);
+  }
+  async dimensions(screenshot) {
+    const meta = await sharp(screenshot).metadata();
+    return { width: meta.width ?? 0, height: meta.height ?? 0 };
+  }
+};
+async function alignToWindow(buffer, opts) {
+  return sharp(buffer).resize({ width: opts.width, height: opts.height, kernel: "lanczos3", fit: "fill" }).png().toBuffer();
+}
+async function getImageDimensions(buffer) {
+  const meta = await sharp(buffer).metadata();
+  if (!meta.width || !meta.height) return void 0;
+  return { width: meta.width, height: meta.height };
+}
+async function flattenOntoWhite(buffer) {
+  const meta = await sharp(buffer).metadata();
+  if (!meta.hasAlpha) return buffer;
+  return sharp(buffer).flatten({ background: "#ffffff" }).png().toBuffer();
+}
+
+// src/build-ordinal.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import {
+  closeSync as closeSync2,
+  fsyncSync as fsyncSync2,
+  linkSync,
+  mkdirSync as mkdirSync5,
+  openSync as openSync2,
+  readFileSync as readFileSync6,
+  renameSync as renameSync2,
+  rmSync,
+  writeFileSync as writeFileSync4
+} from "fs";
+import { dirname as dirname2, join as join8 } from "path";
+var BUILD_ORDINALS_FILE = "build-ordinals.json";
+var BuildOrdinalReservationError = class extends Error {
+  name = "BuildOrdinalReservationError";
+  code;
+  product;
+  value;
+  constructor(code, product, value) {
+    const message = code === "invalid-state" ? `${BUILD_ORDINALS_FILE} must contain a JSON object` : code === "missing-counter" ? `Missing build ordinal counter for product ${JSON.stringify(product)}` : code === "invalid-counter" ? `Build ordinal counter for product ${JSON.stringify(product)} must be a non-negative safe integer` : `Build ordinal counter for product ${JSON.stringify(product)} is exhausted`;
+    super(message);
+    this.code = code;
+    this.product = product;
+    this.value = value;
+  }
+};
+var BUILD_ORDINALS_LOCK_FILE = ".build-ordinals.lock";
+var COUNTER_LOCK_POLL_MS = 5;
+var COUNTER_LOCK_WAIT = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+function fsyncDirectory(dir) {
+  let fd;
+  try {
+    fd = openSync2(dir, "r");
+    fsyncSync2(fd);
+  } catch (error) {
+    const code = error.code;
+    if (code !== "EINVAL" && code !== "EISDIR" && code !== "EPERM" && code !== "ENOTSUP") {
+      throw error;
+    }
+  } finally {
+    if (fd !== void 0) closeSync2(fd);
+  }
+}
+function durableExclusiveFile(file, text) {
+  const fd = openSync2(file, "wx");
+  try {
+    writeFileSync4(fd, text, "utf8");
+    fsyncSync2(fd);
+  } finally {
+    closeSync2(fd);
+  }
+}
+function parsedLockOwner(file) {
+  try {
+    const value = JSON.parse(readFileSync6(file, "utf8"));
+    if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+    const owner = value;
+    return typeof owner.pid === "number" && Number.isSafeInteger(owner.pid) && owner.pid > 0 && typeof owner.token === "string" && owner.token !== "" ? { pid: owner.pid, token: owner.token } : void 0;
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+}
+function processIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    const code = error.code;
+    if (code === "ESRCH") return false;
+    if (code === "EPERM") return true;
+    throw error;
+  }
+}
+function withCounterLock(root, operation) {
+  mkdirSync5(root, { recursive: true });
+  const lock = join8(root, BUILD_ORDINALS_LOCK_FILE);
+  const owner = { pid: process.pid, token: randomUUID2() };
+  const ownerFile = `${lock}.owner-${owner.token}`;
+  durableExclusiveFile(ownerFile, `${JSON.stringify(owner)}
+`);
+  let acquired = false;
+  try {
+    while (!acquired) {
+      try {
+        linkSync(ownerFile, lock);
+        fsyncDirectory(root);
+        acquired = true;
+      } catch (error) {
+        if (error.code !== "EEXIST") throw error;
+        const current = parsedLockOwner(lock);
+        if (current !== void 0 && !processIsAlive(current.pid)) {
+          const quarantine = `${lock}.dead-${current.token}-${randomUUID2()}`;
+          try {
+            renameSync2(lock, quarantine);
+            fsyncDirectory(root);
+            rmSync(quarantine, { force: true });
+            fsyncDirectory(root);
+            continue;
+          } catch (recoveryError) {
+            if (recoveryError.code === "ENOENT") continue;
+            throw recoveryError;
+          }
+        }
+        Atomics.wait(COUNTER_LOCK_WAIT, 0, 0, COUNTER_LOCK_POLL_MS);
+      }
+    }
+    return operation();
+  } finally {
+    if (acquired && parsedLockOwner(lock)?.token === owner.token) {
+      rmSync(lock, { force: true });
+      fsyncDirectory(root);
+    }
+    rmSync(ownerFile, { force: true });
+  }
+}
+function persistOrdinals(file, map, beforePersist) {
+  const temporary = `${file}.tmp-${randomUUID2()}`;
+  let fd;
+  try {
+    fd = openSync2(temporary, "wx");
+    writeFileSync4(fd, `${JSON.stringify(map)}
+`, "utf8");
+    fsyncSync2(fd);
+    closeSync2(fd);
+    fd = void 0;
+    beforePersist?.();
+    renameSync2(temporary, file);
+    fsyncDirectory(dirname2(file));
+  } finally {
+    if (fd !== void 0) closeSync2(fd);
+    rmSync(temporary, { force: true });
+  }
+}
+async function nextBuildOrdinal(opts) {
+  return withCounterLock(opts.root, () => {
+    const file = join8(opts.root, BUILD_ORDINALS_FILE);
+    const map = readOrdinals(file, opts.product, true);
+    const current = Object.hasOwn(map, opts.product) ? map[opts.product] : 0;
+    if (current === Number.MAX_SAFE_INTEGER) {
+      throw new BuildOrdinalReservationError("counter-exhausted", opts.product, current);
+    }
+    const next = current + 1;
+    map[opts.product] = next;
+    persistOrdinals(file, map);
+    return next;
+  });
+}
+async function reserveBuildOrdinalForProducts(opts) {
+  const products = Object.freeze([...new Set(opts.products)].sort());
+  if (products.length === 0) return void 0;
+  return withCounterLock(opts.root, () => {
+    const file = join8(opts.root, BUILD_ORDINALS_FILE);
+    const map = readOrdinals(file, products[0], false);
+    let maximum = 0;
+    for (const product of products) {
+      if (!Object.hasOwn(map, product)) {
+        throw new BuildOrdinalReservationError("missing-counter", product);
+      }
+      const current = map[product];
+      if (current === Number.MAX_SAFE_INTEGER) {
+        throw new BuildOrdinalReservationError("counter-exhausted", product, current);
+      }
+      maximum = Math.max(maximum, current);
+    }
+    const ordinal = maximum + 1;
+    for (const product of products) map[product] = ordinal;
+    const reservation = Object.freeze({ products, ordinal });
+    persistOrdinals(file, map, () => opts.beforePersist?.(reservation));
+    return ordinal;
+  });
+}
+function readOrdinals(file, product, missingIsEmpty) {
+  let raw;
+  try {
+    raw = readFileSync6(file, "utf-8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      if (missingIsEmpty) return /* @__PURE__ */ Object.create(null);
+      throw new BuildOrdinalReservationError("missing-counter", product);
+    }
+    throw error;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new BuildOrdinalReservationError("invalid-state", product);
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new BuildOrdinalReservationError("invalid-state", product, parsed);
+  }
+  const map = /* @__PURE__ */ Object.create(null);
+  for (const [key, value] of Object.entries(parsed)) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
+      throw new BuildOrdinalReservationError("invalid-counter", key, value);
+    }
+    map[key] = value;
+  }
+  return map;
+}
+
+// src/build-tag-map.ts
+import { readFileSync as readFileSync7, renameSync as renameSync3, writeFileSync as writeFileSync5 } from "fs";
+import { join as join9 } from "path";
+var BUILD_TAGS_FILE = "build-tags.json";
+async function recordBuildTag(opts) {
+  const map = readBuildTagMap({ root: opts.root });
+  const productTags = Object.prototype.hasOwnProperty.call(map, opts.product) ? map[opts.product] : void 0;
+  if (productTags && Object.prototype.hasOwnProperty.call(productTags, opts.tag)) return;
+  const nextMap = {
+    ...map,
+    [opts.product]: {
+      ...productTags,
+      [opts.tag]: opts.ordinal
+    }
+  };
+  const file = join9(opts.root, BUILD_TAGS_FILE);
+  const tmp = `${file}.tmp`;
+  writeFileSync5(tmp, `${JSON.stringify(nextMap)}
+`, "utf-8");
+  renameSync3(tmp, file);
+}
+function resolveBuildTag(opts) {
+  return readBuildTagMap({ root: opts.root })[opts.product]?.[opts.tag];
+}
+function latestBuildOrdinal(opts) {
+  const parsed = readJsonRecord(join9(opts.root, BUILD_ORDINALS_FILE));
+  const value = parsed?.[opts.product];
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function readBuildTagMap(opts) {
+  const parsed = readJsonRecord(join9(opts.root, BUILD_TAGS_FILE));
+  if (!parsed) return {};
+  const products = [];
+  for (const [product, tags] of Object.entries(parsed)) {
+    if (!isRecord(tags)) continue;
+    const validTags = Object.fromEntries(
+      Object.entries(tags).filter(
+        (entry) => typeof entry[1] === "number" && Number.isFinite(entry[1])
+      )
+    );
+    products.push([product, validTags]);
+  }
+  return Object.fromEntries(products);
+}
+function readJsonRecord(file) {
+  try {
+    const parsed = JSON.parse(readFileSync7(file, "utf-8"));
+    return isRecord(parsed) ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/hook-executor.ts
+import { execFile } from "child_process";
+import { readFile as readFile3, mkdtemp, mkdir as mkdir3, rm, cp } from "fs/promises";
+import { join as join10, basename } from "path";
+import { tmpdir } from "os";
+import {
+  RUNTIME_IMAGE_MAP,
+  parseEnvFile,
+  AUTH_STATE_HOOK_CONTAINER_STORAGE_STATE_PATH,
+  AUTH_STATE_HOOK_STORAGE_STATE_FILENAME,
+  AUTH_STATE_HOOK_WORKSPACE_DIR,
+  buildAuthStateHookEnv,
+  stripReservedAuthStateHookEnv,
+  redactSecretValue
+} from "@vostride/agent-qa-runner";
+var DEFAULT_DOCKER_BIN = "docker";
+var DockerHookExecutor = class {
+  dockerBin;
+  pullPolicy;
+  constructor(config = {}) {
+    this.dockerBin = config.dockerBin ?? DEFAULT_DOCKER_BIN;
+    this.pullPolicy = config.pullPolicy ?? "if-not-present";
+  }
+  async execute(hook, opts) {
+    const dockerBin = this.dockerBin;
+    const pullPolicy = this.pullPolicy;
+    const start = Date.now();
+    const image = RUNTIME_IMAGE_MAP[hook.runtime];
+    if (pullPolicy === "always" || pullPolicy === "if-not-present") {
+      const needsPull = pullPolicy === "always" || !await imageExists(dockerBin, image);
+      if (needsPull) {
+        await pullImage(dockerBin, image);
+      }
+    }
+    let workDir;
+    try {
+      workDir = await mkdtemp(join10(tmpdir(), "agent-qa-hook-"));
+      await mkdir3(join10(workDir, "tmp"), { recursive: true });
+      await cp(hook.file, join10(workDir, basename(hook.file)));
+      for (const dep of hook.deps) {
+        await cp(dep, join10(workDir, basename(dep)));
+      }
+      if (hook.packageFile) {
+        await cp(hook.packageFile, join10(workDir, basename(hook.packageFile)));
+      }
+      if (opts.authState) {
+        const authStateDir = join10(workDir, AUTH_STATE_HOOK_WORKSPACE_DIR);
+        await mkdir3(authStateDir, { recursive: true });
+        await cp(opts.authState.storageStatePath, join10(authStateDir, AUTH_STATE_HOOK_STORAGE_STATE_FILENAME));
+      }
+      const args = buildDockerArgs({
+        image,
+        workDir,
+        hook,
+        env: opts.env,
+        secretEnv: opts.secretEnv,
+        authState: opts.authState
+      });
+      const cmd = getHookCommand(hook.runtime, basename(hook.file));
+      args.push(...cmd);
+      const { stdout, stderr, exitCode } = await execDocker(dockerBin, args, hook.timeout);
+      let variables = {};
+      try {
+        const envContent = await readFile3(join10(workDir, "tmp", "agent-qa.env"), "utf-8");
+        variables = parseEnvFile(envContent);
+      } catch {
+      }
+      variables = stripReservedAuthStateHookEnv(filterSecretVariables(variables, opts.secretEnv));
+      const redactedStdout = redactSecretValue(stdout, opts.secretRedactor);
+      const redactedStderr = redactSecretValue(stderr, opts.secretRedactor);
+      const output = redactedStdout.trim();
+      return {
+        success: exitCode === 0,
+        variables,
+        output: output || redactedStderr,
+        stdout: redactedStdout,
+        stderr: redactedStderr,
+        duration: Date.now() - start,
+        error: exitCode !== 0 ? redactSecretValue(`Hook exited with code ${exitCode}: ${stderr}`, opts.secretRedactor) : void 0
+      };
+    } catch (err) {
+      return {
+        success: false,
+        variables: {},
+        output: "",
+        stdout: "",
+        stderr: "",
+        duration: Date.now() - start,
+        error: redactSecretValue(err.message, opts.secretRedactor)
+      };
+    } finally {
+      if (workDir) {
+        await rm(workDir, { recursive: true, force: true }).catch(() => {
+        });
+      }
+    }
+  }
+};
+async function checkDockerAvailable(dockerBin = DEFAULT_DOCKER_BIN) {
+  return new Promise((resolve3) => {
+    execFile(dockerBin, ["info", "--format", "{{.ID}}"], { timeout: 5e3 }, (err) => {
+      resolve3(!err);
+    });
+  });
+}
+function getHookCommand(runtime, entryFile) {
+  switch (runtime) {
+    case "node":
+      return ["node", entryFile];
+    case "bun":
+      return ["bun", entryFile];
+    case "python":
+      return ["python3", entryFile];
+    case "bash":
+      return ["bash", entryFile];
+  }
+}
+function buildDockerArgs(input) {
+  const args = [
+    "run",
+    "--rm",
+    "--init",
+    "-v",
+    `${input.workDir}:/workspace`,
+    "-w",
+    "/workspace",
+    "--memory",
+    "512m",
+    "--cpus",
+    "1",
+    "--pids-limit",
+    "256",
+    "--read-only",
+    "-v",
+    `${input.workDir}/tmp:/tmp`
+  ];
+  if (!input.hook.network) {
+    args.push("--network", "none");
+  }
+  const envVars = { ...input.env };
+  Object.assign(envVars, input.secretEnv);
+  Object.assign(envVars, buildAuthStateHookEnv(
+    input.authState,
+    AUTH_STATE_HOOK_CONTAINER_STORAGE_STATE_PATH
+  ));
+  for (const [k, v] of Object.entries(envVars)) {
+    args.push("-e", `${k}=${v}`);
+  }
+  args.push(input.image);
+  return args;
+}
+function filterSecretVariables(variables, secretEnv) {
+  const secretValues = new Set(Object.values(secretEnv));
+  if (secretValues.size === 0) return variables;
+  return Object.fromEntries(
+    Object.entries(variables).filter(([_key, value]) => !secretValues.has(value))
+  );
+}
+function imageExists(dockerBin, image) {
+  return new Promise((resolve3) => {
+    execFile(dockerBin, ["image", "inspect", image], { timeout: 1e4 }, (err) => {
+      resolve3(!err);
+    });
+  });
+}
+function pullImage(dockerBin, image) {
+  return new Promise((resolve3, reject) => {
+    execFile(dockerBin, ["pull", image], { timeout: 12e4 }, (err) => {
+      if (err) reject(new Error(`Failed to pull image ${image}: ${err.message}`));
+      else resolve3();
+    });
+  });
+}
+function execDocker(dockerBin, args, timeout) {
+  return new Promise((resolve3) => {
+    let stdout = "";
+    let stderr = "";
+    let resolved = false;
+    const _proc = execFile(dockerBin, args, { timeout, maxBuffer: 4 * 1024 * 1024 }, (err, out, errOut) => {
+      if (resolved) return;
+      resolved = true;
+      stdout = out ?? "";
+      stderr = errOut ?? "";
+      if (err && "killed" in err && err.killed) {
+        resolve3({ stdout, stderr: `Hook timed out after ${timeout}ms`, exitCode: 124 });
+        return;
+      }
+      const exitCode = err?.code ?? 0;
+      resolve3({ stdout, stderr, exitCode: typeof exitCode === "number" ? exitCode : 1 });
+    });
+    void _proc;
+  });
+}
+export {
+  ARTIFACT_FILE,
+  BUILD_ORDINALS_FILE,
+  BUILD_TAGS_FILE,
+  BuildOrdinalReservationError,
+  CACHE_SCHEMA_VERSION,
+  DockerHookExecutor,
+  EVENTS_FILE,
+  FsActionCache,
+  FsEventLog,
+  FsEvidenceArtifactStore,
+  FsHandoffStore,
+  FsRunArtifactStore,
+  FsStorageStateStore,
+  HANDOFF_FILE,
+  RUNS_SUBDIR,
+  RUN_EVIDENCE_BLOBS_SUBDIR,
+  STORAGE_STATES_SUBDIR,
+  SharpScreenshotCompressor,
+  alignToWindow,
+  checkDockerAvailable,
+  flattenOntoWhite,
+  getImageDimensions,
+  latestBuildOrdinal,
+  loadCompletedRunHandoff,
+  nextBuildOrdinal,
+  readBuildTagMap,
+  recordBuildTag,
+  reserveBuildOrdinalForProducts,
+  resolveBranch,
+  resolveBuildTag,
+  shouldWrite,
+  slugBranch
+};
+//# sourceMappingURL=index.js.map