@wjarka/cezarion 0.14.5 → 0.14.6-pr476.729

package/README.md

@@ -463,6 +463,38 @@ segment.
 
 ---
 
+## Waiting for PR checks
+
+An agent can call `cezar_wait_for_ci` with a GitHub PR URL to ask Cezar to watch CI
+outside the model. The optional `timeout_seconds` defaults to 1,800 and accepts
+1–7,200. No authored configuration or worker delegation permission is needed.
+Registration requires `gh`, access to the repository, and a supported GitHub host;
+GitHub Enterprise hosts must already be recognized by the forge/auth configuration.
+Tool startup itself makes no GitHub request.
+
+A successful registration returns a durable receipt and an absolute deadline. The
+agent ends its turn to wait, with no marker required. The header keeps the active
+run status during registration, then shows Monitoring with **Waiting for CI —
+owner/repo#N**, a PR link and the deadline. **CI result ready — waiting for capacity**
+means the observation is queued for the agent to resume. Ordinary monitoring keeps
+its existing automatic-check schedule when no CI wait is registered.
+
+Cezar reports passed, failed, cancelled or skipped checks, no checks, changed head,
+timeout or an operational error. It watches the registered commit: a new PR head
+is reported separately, and the agent decides whether to wait again. Four watchers
+run concurrently; queued waits retain their original deadline. Results are bounded
+observations, not merge approval or evidence that every expected workflow appeared.
+The agent still decides its next action; CI success never completes the task or
+accepts review. A human message cancels the current wait, and CI never answers a
+pending human question. Controller recovery can replay an observation after an
+ambiguous delivery checkpoint, identified by its stable lifecycle input ID.
+
+The adapters are bundled for Claude (including `claude-cli`), Codex, OpenCode,
+Cursor and Pi. Internal socket/capability environment values are runtime wiring,
+not settings to create or share. If the tool is unavailable or denied, its error
+is surfaced while ordinary tasks continue. See [the CI-wait protocol](AGENT_PROTOCOL.md#ci-wait-tool-contract-474)
+for limits and the executable harness verification required before release.
+
 ## Owned workers (opt-in)
 
 Start the cockpit or a headless task with `CEZ_DELEGATION=1`. Each eligible parent session receives the absolute bundled Node/CLI invocation and its own environment credentials; no `cez` installation on the agent's PATH, config file, separate daemon, or remembered port is needed. If the private listener cannot start, ordinary tasks keep working without delegation tools. `.env` is never loaded automatically.
@@ -472,6 +504,7 @@ The provisioned command has these forms (the session instructions supply the abs
 ```sh
 cez worker spawn --baseline parent-head --request-id <UUID> 'Implement the assigned change'
 cez worker spawn --baseline parent-head --request-id <UUID> --backend codex --effort high --context-file ./selected-context.txt 'Review the parser'
+cez worker spawn --baseline parent-head --request-id <UUID> --workflow review 'Review the parser change'
 cez worker inspect <worker-id>
 cez worker steer <worker-id> 'Consider this additional constraint'
 cez worker diff <worker-id>
@@ -492,7 +525,9 @@ cez worker stop <worker-id>
 cez worker destroy <worker-id>
 ```
 
-Use `cez worker --help` to list operations and flags, or `cez worker <operation> --help` for one operation. Explicit help prints human-readable text and exits successfully without an active delegation session. Commands otherwise return bounded JSON and a nonzero exit on failure or incomplete cleanup. Spawn requires a committed baseline (`parent-head` or an explicit ref) and pins its SHA at acceptance; dirty parent edits are excluded. Optional `--context '<text>'` or `--context-file <UTF-8-file>` supplies selected context, not the parent's conversation. The two flags are mutually exclusive, and combined task/context text is limited to 100,000 characters. The API also accepts up to 32 pinned-baseline file or parent-attachment references, with at most 8 MiB of copied attachments. Inspect reports worker-local input locations. Reuse a request ID only with the same task, baseline, context, backend, model and effort when retrying a lost response. There are at most 32 accepted creations per parent, counting destroyed workers, and 32 undelivered steering messages per worker.
+Use `cez worker --help` to list operations and flags, or `cez worker <operation> --help` for one operation. Explicit help prints human-readable text and exits successfully without an active delegation session. Commands otherwise return bounded JSON and a nonzero exit on failure or incomplete cleanup. Spawn requires a committed baseline (`parent-head` or an explicit ref) and pins its SHA at acceptance; dirty parent edits are excluded. Optional `--context '<text>'` or `--context-file <UTF-8-file>` supplies selected context, not the parent's conversation. The two flags are mutually exclusive, and combined task/context text is limited to 100,000 characters. The API also accepts up to 32 pinned-baseline file or parent-attachment references, with at most 8 MiB of copied attachments. Inspect reports worker-local input locations. Reuse a request ID only with the same task, baseline, context, backend, model, effort and workflow when retrying a lost response. There are at most 32 accepted creations per parent, counting destroyed workers, and 32 undelivered steering messages per worker.
+
+`--workflow <name>` runs a catalog workflow inside the worker: the built-in `quick-task` or any `.ai/cezar/workflows/*.yaml` by name, with its agent and check steps, `skill:` bodies and `onFail` loops, so a repo's `review.yaml` becomes a dedicated reviewer. Omitted `--workflow` runs `quick-task` exactly as before. `--backend`, `--model` and `--effort` fill only the steps that leave those fields unset; a step's own `allowedTools`/`bashAllowlist` narrow the parent's grants and never widen them. An unknown name is refused. Agent steps may mix runners: at spawn every agent step is resolved and pinned separately, so an implement-with-codex, review-with-claude chain runs each step under its own runner, account, model, effort and grants. A step's optional `agentProfile` names the account it runs under (an id the registry does not know is refused); same-backend steps otherwise inherit the parent's account and other runners resolve their project/default one. Run-level columns show the first agent step.
 
 Omitted `--backend` inherits the parent's active backend. Same-backend workers inherit omitted model/account/effort; `--backend <claude|codex|opencode|pi|cursor>` selecting another backend resolves that backend's project/default account and model without forwarding another provider's settings. `--model <model>` selects a supported model, subject to existing locks. `--effort <low|medium|high|xhigh|max>` pins reasoning effort on same-backend and mixed-backend spawn; omitted `--effort` still inherits the parent pin on same-backend spawn and drops it on mixed-backend spawn. Accepted identity and grants remain fixed across queuing, restart and Continue, including explicit empty grants. Changing or deleting an account registry entry does not rebind a worker. Missing accepted identity evidence or account homes, incompatible Claude state-file layouts, and conflicting later model locks refuse execution explicitly. Credentials and vendor configuration are never copied; each worker receives its own delegation credential, and unspecified native models stay unspecified.
 
@@ -573,7 +608,7 @@ Useful environment variables:
 |---|---|
 | `CEZ_DELEGATION=1` | Enable owned workers and the private loopback listener for this controller. Off by default; works with the cockpit and headless `cez run`. Session instructions and credentials are automatic. |
 | `CEZ_DELEGATION_URL`, `CEZ_DELEGATION_TOKEN` | Internal generated session values; do not configure or copy them. Tokens rotate on Continue/restart and are revoked when the session/controller closes. |
-| `CEZ_DRY_RUN=1` | Use the bundled mock instead of the real `claude` CLI — the entire cockpit works offline, for demos and development. |
+| `CEZ_DRY_RUN=1` | Use bundled mocks for all five agent backends — the cockpit works offline for demos and development. Explicit backend binary overrides still win. |
 | `CEZ_AGENT_MODELS_LOCKED=1` | Globally lock each runner to the model configured in its native Claude/Codex/OpenCode settings while keeping runner selection available. Exact `1` also delegates authentication and provider enablement to those native agents, so Cezar skips its credential probes and provider-disable preferences. Existing Cezar presets are preserved but ignored, and an environment change requires a restart. The config-file equivalent is `"modelsLocked": true` in global `~/.cezar/config.json` or one repository's `.ai/cezar/config.json`; config-file locks do not disable provider checks. |
 | `CEZ_APPROVAL_GATE=1` | Opt into Claude's interactive approval UI; by default, unapproved tools are denied without interrupting the run. Ignored when `CEZ_CLAUDE_PERMISSION_MODE` is a recognized value (`dontAsk`, `acceptEdits`, or `bypass`). |
 | `CEZ_CLAUDE_PERMISSION_MODE` | Claude agent-run permission flag: `dontAsk` (default), `acceptEdits`, or `bypass`. `bypass` passes `--dangerously-skip-permissions` and omits `--permission-mode`. Unset or unknown keeps today's `dontAsk` / `CEZ_APPROVAL_GATE` path. Provider verification commands are never given this flag. |

package/dist/agent-config/model-settings/shared.d.ts

@@ -1,9 +1,10 @@
 import type { RunnerId } from '../../core/agent-runner.ts';
-import { type ConfigFileDef } from '../catalog.ts';
+import { type ConfigFileDef, type ConfigFormat } from '../catalog.ts';
 export interface NativeSettingsFile {
     def: ConfigFileDef;
     content: string;
 }
+export declare function parseConfigContent(content: string, format: ConfigFormat): unknown;
 export declare function readNativeSettingsFiles(runner: RunnerId, repoRoot: string, env: NodeJS.ProcessEnv): Promise<NativeSettingsFile[]>;
 /** One string-valued key out of a native settings file, or undefined when absent, blank, or unparsable. */
 export declare function configuredString(file: NativeSettingsFile, path: string): string | undefined;

package/dist/agent-config/model-settings/shared.js

@@ -42,7 +42,7 @@ function valueAtPath(value, path) {
         return current[segment];
     }, value);
 }
-function parseConfigContent(content, format) {
+export function parseConfigContent(content, format) {
     return format === 'toml'
         ? parseToml(content)
         : JSON.parse(format === 'jsonc' ? stripJsonTrailingCommas(stripJsonComments(content)) : content);

package/dist/agent-config/model-settings/shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../../src/agent-config/model-settings/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAyC,MAAM,eAAe,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAOnD,iFAAiF;AACjF,SAAS,uBAAuB,CAAC,KAAa;IAC5C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,GAAG,IAAI,SAAS,CAAC;YACjB,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,CAAC;iBACxB,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;iBACvC,IAAI,SAAS,KAAK,GAAG;gBAAE,QAAQ,GAAG,KAAK,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,QAAQ,GAAG,IAAI,CAAC;YAChB,GAAG,IAAI,SAAS,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,IAAI,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC;YACrB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAAE,IAAI,EAAE,CAAC;YAC5C,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG;gBAAE,SAAS;QAC3D,CAAC;QACD,GAAG,IAAI,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,IAAY;IAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAU,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;QAC1D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QACxF,OAAQ,OAAmC,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC,EAAE,KAAK,CAAC,CAAC;AACZ,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAE,MAAoB;IAC/D,OAAO,MAAM,KAAK,MAAM;QACtB,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC;QACpB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,MAAoB,EAAE,IAAY;IACvE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,WAAW,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QACrE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAgB,EAChB,QAAgB,EAChB,GAAsB;IAEtB,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CACrC,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,IAAI,KAAK,UAAU;QAC9B,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnC,UAAU,CAAC,QAAQ,KAAK,SAAS;QACjC,UAAU,CAAC,aAAa,KAAK,SAAS,CACzC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,SAAS;QACvD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,gBAAgB,CAAC,IAAwB,EAAE,IAAY;IACrE,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAoC;IACvE,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,KAAK,EAAE,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,QAAS,CAAC,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACrD,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAoC;IAC1E,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,KAAK,EAAE,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,gBAAgB;YAAE,SAAS;QACpC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACzE,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../../src/agent-config/model-settings/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAyC,MAAM,eAAe,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAOnD,iFAAiF;AACjF,SAAS,uBAAuB,CAAC,KAAa;IAC5C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,GAAG,IAAI,SAAS,CAAC;YACjB,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,CAAC;iBACxB,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;iBACvC,IAAI,SAAS,KAAK,GAAG;gBAAE,QAAQ,GAAG,KAAK,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,QAAQ,GAAG,IAAI,CAAC;YAChB,GAAG,IAAI,SAAS,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,IAAI,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC;YACrB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAAE,IAAI,EAAE,CAAC;YAC5C,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG;gBAAE,SAAS;QAC3D,CAAC;QACD,GAAG,IAAI,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,IAAY;IAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAU,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;QAC1D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QACxF,OAAQ,OAAmC,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC,EAAE,KAAK,CAAC,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,MAAoB;IACtE,OAAO,MAAM,KAAK,MAAM;QACtB,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC;QACpB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,MAAoB,EAAE,IAAY;IACvE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,WAAW,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QACrE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAgB,EAChB,QAAgB,EAChB,GAAsB;IAEtB,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CACrC,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,IAAI,KAAK,UAAU;QAC9B,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnC,UAAU,CAAC,QAAQ,KAAK,SAAS;QACjC,UAAU,CAAC,aAAa,KAAK,SAAS,CACzC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,SAAS;QACvD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,gBAAgB,CAAC,IAAwB,EAAE,IAAY;IACrE,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAoC;IACvE,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,KAAK,EAAE,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,QAAS,CAAC,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACrD,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAoC;IAC1E,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,KAAK,EAAE,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,gBAAgB;YAAE,SAAS;QACpC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACzE,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/automations/types.d.ts

@@ -32,6 +32,7 @@ export declare const automationTaskSchema: z.ZodObject<{
             opencode: "opencode";
             pi: "pi";
         }>>;
+        agentProfile: z.ZodOptional<z.ZodString>;
         allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
         bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
         command: z.ZodOptional<z.ZodString>;
@@ -95,6 +96,7 @@ export declare const automationDefinitionSchema: z.ZodObject<{
                 opencode: "opencode";
                 pi: "pi";
             }>>;
+            agentProfile: z.ZodOptional<z.ZodString>;
             allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
             bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
             command: z.ZodOptional<z.ZodString>;

package/dist/ci-wait/client.d.ts

@@ -0,0 +1,4 @@
+import { type CiWaitReceipt } from '../contract/index.js';
+export declare function callCiWait(input: unknown, env?: NodeJS.ProcessEnv): Promise<CiWaitReceipt>;
+/** Controller pipe death (including SIGKILL) bounds the adapter's lifetime. */
+export declare function monitorCiOwner(onClose: () => void, env?: NodeJS.ProcessEnv): () => void;

package/dist/ci-wait/client.js

@@ -0,0 +1,67 @@
+import { request } from 'node:http';
+import { ciWaitRequestSchema, ciWaitReceiptSchema, ciWaitErrorSchema } from '../contract/index.js';
+const UNAVAILABLE = 'CI tool unavailable: the owning session is closed or the private IPC connection failed.';
+export async function callCiWait(input, env = process.env) {
+    const parsed = ciWaitRequestSchema.safeParse(input);
+    if (!parsed.success)
+        throw new Error('Invalid CI wait arguments: provide a GitHub PR URL and optional timeout_seconds (1–7200).');
+    const socketPath = env.CEZ_TOOL_SOCKET;
+    const token = env.CEZ_TOOL_TOKEN;
+    if (!socketPath || !token)
+        throw new Error(UNAVAILABLE);
+    return new Promise((resolve, reject) => {
+        const req = request({ socketPath, path: '/api/v1/tools/ci-wait', method: 'POST', headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' } }, response => {
+            const chunks = [];
+            let bytes = 0;
+            response.on('data', (chunk) => { bytes += chunk.length; if (bytes > 32768)
+                req.destroy(new Error(UNAVAILABLE));
+            else
+                chunks.push(chunk); });
+            response.on('error', () => reject(new Error(UNAVAILABLE)));
+            response.on('end', () => {
+                try {
+                    const body = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+                    if (response.statusCode !== 200) {
+                        const error = ciWaitErrorSchema.safeParse(body);
+                        reject(new Error(error.success ? `${error.data.code}: ${error.data.message}` : UNAVAILABLE));
+                        return;
+                    }
+                    resolve(ciWaitReceiptSchema.parse(body));
+                }
+                catch {
+                    reject(new Error(UNAVAILABLE));
+                }
+            });
+        });
+        req.setTimeout(15000, () => req.destroy(new Error(UNAVAILABLE)));
+        req.on('error', () => reject(new Error(UNAVAILABLE)));
+        req.end(JSON.stringify(parsed.data));
+    });
+}
+/** Controller pipe death (including SIGKILL) bounds the adapter's lifetime. */
+export function monitorCiOwner(onClose, env = process.env) {
+    let stopped = false;
+    const close = () => { if (!stopped) {
+        stopped = true;
+        onClose();
+    } };
+    if (!env.CEZ_TOOL_SOCKET || !env.CEZ_TOOL_TOKEN) {
+        queueMicrotask(close);
+        return () => { stopped = true; };
+    }
+    const req = request({ socketPath: env.CEZ_TOOL_SOCKET, path: '/api/v1/tools/ci-wait', headers: { authorization: `Bearer ${env.CEZ_TOOL_TOKEN}` } }, response => {
+        if (response.statusCode !== 200) {
+            response.resume();
+            close();
+            return;
+        }
+        response.resume();
+        response.on('end', close);
+        response.on('error', close);
+        response.on('close', close);
+    });
+    req.on('error', close);
+    req.end();
+    return () => { stopped = true; req.destroy(); };
+}
+//# sourceMappingURL=client.js.map

package/dist/ci-wait/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/ci-wait/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,iBAAiB,EAAsB,MAAM,8BAA8B,CAAC;AAE/H,MAAM,WAAW,GAAG,yFAAyF,CAAC;AAC9G,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAc,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IACnF,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;IAClI,MAAM,UAAU,GAAG,GAAG,CAAC,eAAe,CAAC;IAAC,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,CAAC;IACzE,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE;YAC/K,MAAM,MAAM,GAAa,EAAE,CAAC;YAAC,IAAI,KAAK,GAAG,CAAC,CAAC;YAC3C,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,GAAG,KAAK;gBAAE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;;gBAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpJ,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YAC3D,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACtB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;oBACzE,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;wBAChC,MAAM,KAAK,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;wBAChD,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;wBAC7F,OAAO;oBACT,CAAC;oBACD,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC3C,CAAC;gBAAC,MAAM,CAAC;oBAAC,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;gBAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACjE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,OAAmB,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IACtF,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;QAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAC7G,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,cAAc,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE;QAC7J,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAAC,KAAK,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QACxE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzG,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IAClC,OAAO,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC"}

package/dist/ci-wait/controller.d.ts

@@ -0,0 +1,78 @@
+import { type CiWait, type CiWaitRequest } from '../contract/index.js';
+import type { AgentRunSpec } from '../core/agent-runner.ts';
+type Registration = (request: CiWaitRequest, signal: AbortSignal) => Promise<CiWait>;
+type Capability = {
+    register: Registration;
+    lifetime: AbortController;
+};
+export type CiToolSession = {
+    descriptor: NonNullable<AgentRunSpec['cezarTools']>;
+    env: Record<string, string>;
+    revoke(): void;
+};
+/** Separate from the cockpit and delegation APIs. No TCP listener or durable credentials. */
+export declare class CiToolController {
+    private readonly server;
+    private readonly address;
+    private readonly directory?;
+    private readonly capabilities;
+    private readonly sockets;
+    private closed;
+    private constructor();
+    static start(): Promise<CiToolController>;
+    provision(register: Registration): CiToolSession;
+    close(): Promise<void>;
+}
+/** Typed private route inventory: GET holds adapter lifetime; POST registers CI only. */
+export declare function ciToolRoutes(capabilities: Map<string, Capability>): import("hono/hono-base").HonoBase<{
+    Variables: {
+        capability: Capability;
+    };
+}, {
+    "/api/v1/tools/ci-wait": {
+        $get: {
+            output: {};
+            outputFormat: string;
+            status: import("hono/utils/http-status").StatusCode;
+            input: {};
+        };
+    };
+} & {
+    "/api/v1/tools/ci-wait": {
+        $post: {
+            output: {
+                prUrl: string;
+                repository: string;
+                prNumber: number;
+                headSha: string;
+                waitId: string;
+                registeredAt: string;
+                deadline: string;
+                phase: "delivered" | "parked" | "registered" | "wake-pending" | "withdrawn";
+            };
+            outputFormat: "json";
+            status: import("hono/utils/http-status").ContentfulStatusCode;
+            input: {
+                json: {
+                    pr: string;
+                    timeout_seconds?: number | undefined;
+                };
+            };
+        } | {
+            output: {
+                code: "authentication" | "capacity" | "command_failed" | "gh_missing" | "inaccessible_pr" | "invalid_request" | "malformed_data" | "output_limit" | "persistence" | "query_timeout" | "unauthorized" | "unavailable" | "unsupported_host" | "wait_conflict";
+                message: string;
+            };
+            outputFormat: "json";
+            status: 503;
+            input: {
+                json: {
+                    pr: string;
+                    timeout_seconds?: number | undefined;
+                };
+            };
+        };
+    };
+}, "/", "/api/v1/tools/ci-wait">;
+export type CiToolApp = ReturnType<typeof ciToolRoutes>;
+export {};

package/dist/ci-wait/controller.js

@@ -0,0 +1,148 @@
+import { randomBytes, randomUUID } from 'node:crypto';
+import { chmod, mkdtemp, rm } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { getRequestListener } from '@hono/node-server';
+import { Hono } from 'hono';
+import { bodyLimit } from 'hono/body-limit';
+import { ciWaitRequestSchema, ciWaitReceiptSchema, ciWaitErrorCodeSchema } from '../contract/index.js';
+import { jsonZodValidator } from '../server/validators.js';
+const unavailable = { code: 'unavailable', message: 'CI tool unavailable: session authority expired or registration failed.' };
+/** Separate from the cockpit and delegation APIs. No TCP listener or durable credentials. */
+export class CiToolController {
+    server;
+    address;
+    directory;
+    capabilities = new Map();
+    sockets = new Set();
+    closed = false;
+    constructor(server, address, directory) {
+        this.server = server;
+        this.address = address;
+        this.directory = directory;
+    }
+    static async start() {
+        let directory;
+        let server;
+        try {
+            // sockaddr_un is only 104–108 bytes on supported Unix platforms. Agent
+            // worktree TMPDIRs can be much longer; the endpoint must not inherit that.
+            const temporaryRoot = Buffer.byteLength(tmpdir()) > 64 ? '/tmp' : tmpdir();
+            directory = process.platform === 'win32' ? undefined : await mkdtemp(join(temporaryRoot, 'cez-ci-'));
+            if (directory)
+                await chmod(directory, 0o700);
+            const address = directory ? join(directory, 'ipc') : `\\\\.\\pipe\\cezar-ci-${randomUUID()}`;
+            server = createServer();
+            const controller = new CiToolController(server, address, directory);
+            const app = ciToolRoutes(controller.capabilities);
+            server.on('request', getRequestListener(app.fetch));
+            server.on('connection', socket => { controller.sockets.add(socket); socket.on('close', () => controller.sockets.delete(socket)); });
+            server.maxConnections = 64;
+            server.headersTimeout = 5000;
+            server.requestTimeout = 15000;
+            await new Promise((resolve, reject) => { server.once('error', reject); server.listen(address, () => { server.off('error', reject); resolve(); }); });
+            if (directory)
+                await chmod(address, 0o600);
+            server.unref();
+            return controller;
+        }
+        catch {
+            server?.close();
+            server?.closeAllConnections();
+            if (directory)
+                await rm(directory, { recursive: true, force: true }).catch(() => { });
+            throw new Error('CI tool unavailable: private IPC could not start');
+        }
+    }
+    provision(register) {
+        if (this.closed)
+            throw new Error(unavailable.message);
+        const token = randomBytes(32).toString('hex');
+        const capability = { register, lifetime: new AbortController() };
+        this.capabilities.set(token, capability);
+        const entry = fileURLToPath(new URL('./mcp.js', import.meta.url));
+        // Source execution uses tsx already installed by the developer; installed artifacts use plain Node.
+        const source = import.meta.url.endsWith('.ts');
+        return {
+            descriptor: { name: `cezar_ci_${randomUUID().replaceAll('-', '')}`, command: process.execPath, args: source ? ['--import', fileURLToPath(import.meta.resolve('tsx')), entry.replace(/\.js$/, '.ts')] : [entry] },
+            env: { CEZ_TOOL_TOKEN: token, CEZ_TOOL_SOCKET: this.address },
+            revoke: () => { this.capabilities.delete(token); capability.lifetime.abort(); },
+        };
+    }
+    async close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        for (const capability of this.capabilities.values())
+            capability.lifetime.abort();
+        this.capabilities.clear();
+        const closed = new Promise(resolve => this.server.close(() => resolve()));
+        for (const socket of this.sockets)
+            socket.destroy();
+        await closed;
+        if (this.directory)
+            await rm(this.directory, { recursive: true, force: true });
+    }
+}
+/** Typed private route inventory: GET holds adapter lifetime; POST registers CI only. */
+export function ciToolRoutes(capabilities) {
+    return new Hono()
+        .use('/api/v1/tools/ci-wait', async (c, next) => {
+        const authorization = c.req.header('authorization');
+        const token = authorization?.startsWith('Bearer ') ? authorization.slice(7) : undefined;
+        const capability = token ? capabilities.get(token) : undefined;
+        if (!capability || capability.lifetime.signal.aborted)
+            return c.json({ ...unavailable, code: 'unauthorized' }, 401);
+        c.set('capability', capability);
+        await next();
+        // The shared middleware uses the public API error envelope. Normalize this
+        // private family to the CI contract without forwarding request contents.
+        if (c.res.status === 400)
+            c.res = c.json({ code: 'invalid_request', message: 'Invalid CI wait arguments' }, 400);
+    })
+        .get('/api/v1/tools/ci-wait', c => {
+        const signal = c.get('capability').lifetime.signal;
+        let release = () => { };
+        return new Response(new ReadableStream({ start(stream) {
+                stream.enqueue(new TextEncoder().encode('connected\n'));
+                const close = () => { try {
+                    stream.close();
+                }
+                catch { } };
+                signal.addEventListener('abort', close, { once: true });
+                release = () => signal.removeEventListener('abort', close);
+            }, cancel() { release(); } }), { headers: { 'content-type': 'text/plain', 'cache-control': 'no-store' } });
+    })
+        .post('/api/v1/tools/ci-wait', bodyLimit({ maxSize: 16_384, onError: c => c.json({ code: 'invalid_request', message: 'CI request exceeds 16 KiB' }, 413) }), jsonZodValidator(ciWaitRequestSchema, { code: 'invalid_input', message: 'Invalid CI wait arguments' }), async (c) => {
+        const capability = c.get('capability');
+        try {
+            const wait = await capability.register(c.req.valid('json'), capability.lifetime.signal);
+            capability.lifetime.signal.throwIfAborted();
+            const receipt = ciWaitReceiptSchema.parse({ waitId: wait.id, prUrl: wait.prUrl, repository: wait.repository, prNumber: wait.prNumber, headSha: wait.headSha, registeredAt: wait.registeredAt, deadline: wait.deadline, phase: wait.phase });
+            return c.json(receipt);
+        }
+        catch (error) {
+            const code = ciWaitErrorCodeSchema.safeParse(error && typeof error === 'object' && 'code' in error ? error.code : undefined);
+            if (code.success)
+                return c.json({ code: code.data, message: ciErrorMessage(code.data) }, 503);
+            return c.json(unavailable, 503);
+        }
+    });
+}
+function ciErrorMessage(code) {
+    const messages = {
+        wait_conflict: 'A different CI wait is already active for this run.',
+        unsupported_host: 'GitHub Enterprise host is not recognized; use a host configured with the existing GitHub authentication.',
+        gh_missing: 'Install GitHub CLI (gh) to wait for CI.',
+        authentication: 'Authenticate GitHub CLI with gh auth login and retry.',
+        inaccessible_pr: 'The pull request is inaccessible; check its URL and GitHub permissions.',
+        capacity: 'CI wait registration capacity is exhausted; retry later.',
+        persistence: 'CI wait could not be saved; check local storage and retry.',
+        query_timeout: 'GitHub metadata lookup timed out; check connectivity and retry.',
+        invalid_request: 'Invalid CI wait arguments.',
+    };
+    return messages[code] ?? unavailable.message;
+}
+//# sourceMappingURL=controller.js.map

package/dist/ci-wait/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../src/ci-wait/controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,qBAAqB,EAAmC,MAAM,8BAA8B,CAAC;AAChJ,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAM3D,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,aAAsB,EAAE,OAAO,EAAE,wEAAwE,EAAE,CAAC;AAExI,6FAA6F;AAC7F,MAAM,OAAO,gBAAgB;IAIU,MAAM;IAA2B,OAAO;IAA2B,SAAS;IAHhG,YAAY,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,GAAG,KAAK,CAAC;IACvB,YAAqC,MAAc,EAAmB,OAAe,EAAmB,SAAkB;sBAArF,MAAM;uBAA2B,OAAO;yBAA2B,SAAS;IAAY,CAAC;IAE9H,MAAM,CAAC,KAAK,CAAC,KAAK;QAChB,IAAI,SAA6B,CAAC;QAClC,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,uEAAuE;YACvE,2EAA2E;YAC3E,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAC3E,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;YACrG,IAAI,SAAS;gBAAE,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,yBAAyB,UAAU,EAAE,EAAE,CAAC;YAC7F,MAAM,GAAG,YAAY,EAAE,CAAC;YACxB,MAAM,UAAU,GAAG,IAAI,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YACpE,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YACpD,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpI,MAAM,CAAC,cAAc,GAAG,EAAE,CAAC;YAC3B,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;YAC9B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,MAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,MAAO,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,MAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9J,IAAI,SAAS;gBAAE,MAAM,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC3C,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,KAAK,EAAE,CAAC;YAChB,MAAM,EAAE,mBAAmB,EAAE,CAAC;YAC9B,IAAI,SAAS;gBAAE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrF,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,SAAS,CAAC,QAAsB;QAC9B,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,eAAe,EAAE,EAAE,CAAC;QACjE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,oGAAoG;QACpG,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/C,OAAO;YACL,UAAU,EAAE,EAAE,IAAI,EAAE,YAAY,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,aAAa,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE;YAChN,GAAG,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,CAAC,OAAO,EAAE;YAC7D,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;SAChF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;YAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjF,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAChF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACpD,MAAM,MAAM,CAAC;QACb,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;CACF;AAED,yFAAyF;AACzF,MAAM,UAAU,YAAY,CAAC,YAAqC;IAChE,OAAO,IAAI,IAAI,EAA6C;SACzD,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC9C,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,cAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7H,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAChC,MAAM,IAAI,EAAE,CAAC;QACb,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAA0B,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5H,CAAC,CAAC;SACD,GAAG,CAAC,uBAAuB,EAAE,CAAC,CAAC,EAAE;QAChC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnD,IAAI,OAAO,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;QACvB,OAAO,IAAI,QAAQ,CAAC,IAAI,cAAc,CAAa,EAAE,KAAK,CAAC,MAAM;gBAC/D,MAAM,CAAC,OAAO,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;gBACxD,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;oBAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC,CAAC,CAAC,CAAC;gBACzD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxD,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC7D,CAAC,EAAE,MAAM,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC7G,CAAC,CAAC;SACD,IAAI,CAAC,uBAAuB,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAA0B,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;QACtR,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxF,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5O,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,qBAAqB,CAAC,SAAS,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC7H,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAC9F,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAGD,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,QAAQ,GAA2B;QACvC,aAAa,EAAE,qDAAqD;QACpE,gBAAgB,EAAE,0GAA0G;QAC5H,UAAU,EAAE,yCAAyC;QACrD,cAAc,EAAE,uDAAuD;QACvE,eAAe,EAAE,yEAAyE;QAC1F,QAAQ,EAAE,0DAA0D;QACpE,WAAW,EAAE,4DAA4D;QACzE,aAAa,EAAE,iEAAiE;QAChF,eAAe,EAAE,4BAA4B;KAC9C,CAAC;IACF,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC;AAC/C,CAAC"}

package/dist/ci-wait/github.d.ts

@@ -0,0 +1,61 @@
+import { z } from 'zod';
+import { type CiPrIdentity, type CiWaitErrorCode } from '../contract/index.js';
+export declare const CI_QUERY_TIMEOUT_MS = 10000;
+export declare const CI_QUERY_LIMIT = 4;
+export declare const CI_OUTPUT_LIMIT: number;
+export declare const CI_TERMINATE_MS = 2000;
+export declare class CiGithubError extends Error {
+    readonly code: CiWaitErrorCode;
+    readonly transient: boolean;
+    constructor(code: CiWaitErrorCode, message: string, transient?: boolean);
+}
+/** FIFO permits; aborted queued requests never consume a slot. */
+export declare class CiSemaphore {
+    private readonly limit;
+    private active;
+    private readonly queue;
+    constructor(limit: number);
+    acquire(signal: AbortSignal): Promise<() => void>;
+    private release;
+}
+export declare const CI_PROCESS_WRAPPER: string;
+export type CiCommandResult = {
+    code: number;
+    stdout: string;
+    stderr: string;
+};
+export type CiCommandOptions = {
+    file: string;
+    args: string[];
+};
+/** Environment stays inherited, matching the existing forge gh resolver (including GH_TOKEN/GITHUB_TOKEN). */
+export declare function runCiCommand(command: CiCommandOptions, signal: AbortSignal, discardOutput?: boolean, env?: NodeJS.ProcessEnv, cwd?: string): Promise<CiCommandResult>;
+export declare const githubChecksSchema: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    state: z.ZodString;
+    link: z.ZodString;
+    bucket: z.ZodEnum<{
+        cancel: "cancel";
+        fail: "fail";
+        pass: "pass";
+        pending: "pending";
+        skipping: "skipping";
+    }>;
+}, z.core.$strip>>;
+export type GithubCheck = z.infer<typeof githubChecksSchema>[number];
+export declare class GithubCiClient {
+    private readonly queries;
+    private readonly command;
+    private readonly env;
+    private readonly cwd?;
+    constructor(options?: {
+        command?: CiCommandOptions;
+        env?: NodeJS.ProcessEnv;
+        cwd?: string;
+    });
+    private query;
+    resolve(pr: string, signal: AbortSignal): Promise<CiPrIdentity>;
+    head(pr: CiPrIdentity, signal: AbortSignal): Promise<string>;
+    checks(pr: CiPrIdentity, signal: AbortSignal): Promise<GithubCheck[]>;
+    watch(pr: CiPrIdentity, signal: AbortSignal): Promise<void>;
+}