@zhin.js/agent 1.1.23 → 1.1.27

package/lib/plugin-runtime/github-exact-merge-gateway.d.ts

@@ -0,0 +1,62 @@
+import type { WorkroomEffectState, WorkroomEffectGatewayReceipt, WorkroomEffectIntentInput } from '../workroom/effect-ledger.js';
+import type { WorkroomEffectGatewayPort } from './workroom-effect-runtime.js';
+export type GitHubExactMergeTarget = Extract<WorkroomEffectIntentInput['operation'], {
+    kind: 'git_merge_pr';
+}>['parameters'];
+export interface GitHubExactMergeInspection {
+    readonly target: GitHubExactMergeTarget;
+    readonly blockers: readonly string[];
+    readonly observedAt: number;
+}
+export interface GitHubExactMergeInspectorPort {
+    readonly provider: Readonly<{
+        id: string;
+        digest: string;
+    }>;
+    inspect(target: GitHubExactMergeTarget, signal: AbortSignal): Promise<GitHubExactMergeInspection>;
+}
+export declare const workroomExactMergeInspectorToken: import("@zhin.js/plugin-runtime").Token<GitHubExactMergeInspectorPort>;
+/**
+ * GitHub REST merge accepts a head SHA CAS, but no expected base SHA.
+ * https://docs.github.com/en/rest/pulls/pulls#merge-a-pull-request
+ * A read-before-write check cannot implement our exact-base authorization contract.
+ * This adapter intentionally exposes no PUT transport and always returns a blocker.
+ */
+export declare class GitHubExactMergeInspector implements GitHubExactMergeInspectorPort {
+    #private;
+    readonly options: Readonly<{
+        repository: string;
+        repositoryId: number;
+        token: () => Promise<string>;
+        fetch?: typeof fetch;
+        now?: () => number;
+    }>;
+    readonly provider: Readonly<{
+        id: string;
+        digest: string;
+    }>;
+    constructor(options: Readonly<{
+        repository: string;
+        repositoryId: number;
+        token: () => Promise<string>;
+        fetch?: typeof fetch;
+        now?: () => number;
+    }>);
+    inspect(target: GitHubExactMergeTarget, signal: AbortSignal): Promise<GitHubExactMergeInspection>;
+}
+/** Routes through the existing Effect journal/blocker system; never silently weakens an exact-base Gate. */
+export declare class WorkroomExactMergeGateway implements WorkroomEffectGatewayPort {
+    #private;
+    readonly options: Readonly<{
+        resolveInspector: () => GitHubExactMergeInspectorPort | undefined;
+        fallback: WorkroomEffectGatewayPort;
+    }>;
+    constructor(options: Readonly<{
+        resolveInspector: () => GitHubExactMergeInspectorPort | undefined;
+        fallback: WorkroomEffectGatewayPort;
+    }>);
+    prepare(state: WorkroomEffectState, signal: AbortSignal): Promise<void>;
+    execute(state: WorkroomEffectState, signal: AbortSignal): Promise<WorkroomEffectGatewayReceipt>;
+    reconcile(state: WorkroomEffectState, signal: AbortSignal): Promise<WorkroomEffectGatewayReceipt>;
+}
+//# sourceMappingURL=github-exact-merge-gateway.d.ts.map

package/lib/plugin-runtime/github-exact-merge-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-exact-merge-gateway.d.ts","sourceRoot":"","sources":["../../src/plugin-runtime/github-exact-merge-gateway.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACjI,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAE9E,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAAC,yBAAyB,CAAC,WAAW,CAAC,EAAE;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC,CAAC,YAAY,CAAC,CAAC;AAC7H,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AACD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACnG;AACD,eAAO,MAAM,gCAAgC,wEAE5C,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,yBAA0B,YAAW,6BAA6B;;IAEjE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAE,CAAC;IAD5J,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;gBACvC,OAAO,EAAE,QAAQ,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAE,CAAC;IAStJ,OAAO,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,0BAA0B,CAAC;CAcxG;AAED,4GAA4G;AAC5G,qBAAa,yBAA0B,YAAW,yBAAyB;;IAC7D,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;QAAE,gBAAgB,EAAE,MAAM,6BAA6B,GAAG,SAAS,CAAC;QAAC,QAAQ,EAAE,yBAAyB,CAAA;KAAE,CAAC;gBAA7H,OAAO,EAAE,QAAQ,CAAC;QAAE,gBAAgB,EAAE,MAAM,6BAA6B,GAAG,SAAS,CAAC;QAAC,QAAQ,EAAE,yBAAyB,CAAA;KAAE,CAAC;IAW5I,OAAO,CAAC,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7E,OAAO,CAAC,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAG/F,SAAS,CAAC,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,4BAA4B,CAAC;CAIlG"}

package/lib/plugin-runtime/github-exact-merge-gateway.js

@@ -0,0 +1,79 @@
+import { createToken } from '@zhin.js/plugin-runtime';
+import { digestCanonicalWorkroomValue as digest } from '../workroom/canonical-value.js';
+export const workroomExactMergeInspectorToken = createToken('zhin.agent.workroom-exact-merge-inspector', 'Read-only exact PR merge prerequisite inspector; no base CAS available');
+/**
+ * GitHub REST merge accepts a head SHA CAS, but no expected base SHA.
+ * https://docs.github.com/en/rest/pulls/pulls#merge-a-pull-request
+ * A read-before-write check cannot implement our exact-base authorization contract.
+ * This adapter intentionally exposes no PUT transport and always returns a blocker.
+ */
+export class GitHubExactMergeInspector {
+    options;
+    provider;
+    constructor(options) {
+        this.options = options;
+        if (!/^[\w.-]+\/[\w.-]+$/.test(options.repository) || !Number.isSafeInteger(options.repositoryId))
+            throw new Error('Invalid exact merge repository');
+        this.provider = Object.freeze({ id: `github-exact-merge:${options.repositoryId}`, digest: digest({ repository: options.repository, repositoryId: options.repositoryId, strategy: 'head-and-base-cas-required-v1' }) });
+    }
+    async #get(path, signal) {
+        const response = await (this.options.fetch ?? fetch)(`https://api.github.com/repos/${this.options.repository}${path}`, { method: 'GET', redirect: 'error', signal: AbortSignal.any([signal, AbortSignal.timeout(30_000)]), headers: { Accept: 'application/vnd.github+json', Authorization: `Bearer ${await this.options.token()}`, 'X-GitHub-Api-Version': '2022-11-28' } });
+        if (!response.ok)
+            throw new Error(`GitHub exact merge inspection returned ${response.status}`);
+        return await response.json();
+    }
+    async inspect(target, signal) {
+        if (target.repositoryId !== String(this.options.repositoryId) || !Number.isSafeInteger(target.pullNumber) || target.pullNumber < 1)
+            throw new Error('Exact merge repository or PR binding mismatch');
+        const pull = await this.#get(`/pulls/${target.pullNumber}`, signal);
+        const protection = await this.#get(`/branches/${encodeURIComponent(target.baseRef)}/protection`, signal);
+        const checks = await this.#get(`/commits/${target.headSha}/check-runs?per_page=100`, signal);
+        const blockers = ['github_exact_base_cas_unavailable'];
+        if (pull.number !== target.pullNumber || pull.head.repo.id !== this.options.repositoryId || pull.base.repo.id !== this.options.repositoryId)
+            blockers.push('pull_repository_mismatch');
+        if (pull.state !== 'open' || pull.draft || pull.merged)
+            blockers.push('pull_not_mergeable');
+        if (pull.head.sha !== target.headSha || pull.base.ref !== target.baseRef || pull.base.sha !== target.baseSha)
+            blockers.push('pull_head_or_base_changed');
+        if (digest(protection) !== target.protectionDigest)
+            blockers.push('branch_protection_changed');
+        if (checks.total_count > checks.check_runs.length)
+            blockers.push('required_checks_snapshot_incomplete');
+        if (digest(checks) !== target.checksDigest)
+            blockers.push('required_checks_snapshot_changed');
+        return { target, blockers, observedAt: (this.options.now ?? Date.now)() };
+    }
+}
+/** Routes through the existing Effect journal/blocker system; never silently weakens an exact-base Gate. */
+export class WorkroomExactMergeGateway {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async #blocked(state, signal) {
+        signal.throwIfAborted();
+        if (state.intent.operation.kind !== 'git_merge_pr')
+            throw new Error('Expected git_merge_pr');
+        const inspector = this.options.resolveInspector();
+        if (!inspector || inspector.provider.id !== state.intent.capability.ref || inspector.provider.digest !== state.intent.capability.digest)
+            throw new Error('Exact merge capability unavailable or changed');
+        const result = await inspector.inspect(state.intent.operation.parameters, signal);
+        if (digest(result.target) !== digest(state.intent.operation.parameters))
+            throw new Error('Exact merge inspection target drift');
+        // Even a misconfigured inspector cannot turn the known platform limitation into permission to write.
+        throw new Error(`Exact merge blocked: ${[...new Set(['github_exact_base_cas_unavailable', ...result.blockers])].join(', ')}`);
+    }
+    async prepare(state, signal) {
+        if (state.intent.operation.kind === 'git_merge_pr')
+            return this.#blocked(state, signal);
+        await this.options.fallback.prepare?.(state, signal);
+    }
+    execute(state, signal) {
+        return state.intent.operation.kind === 'git_merge_pr' ? this.#blocked(state, signal) : this.options.fallback.execute(state, signal);
+    }
+    reconcile(state, signal) {
+        // An externally merged PR cannot be attributed to an operation this adapter never submitted.
+        return state.intent.operation.kind === 'git_merge_pr' ? this.#blocked(state, signal) : this.options.fallback.reconcile(state, signal);
+    }
+}
+//# sourceMappingURL=github-exact-merge-gateway.js.map

package/lib/plugin-runtime/github-exact-merge-gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-exact-merge-gateway.js","sourceRoot":"","sources":["../../src/plugin-runtime/github-exact-merge-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,4BAA4B,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAcxF,MAAM,CAAC,MAAM,gCAAgC,GAAG,WAAW,CACzD,2CAA2C,EAAE,wEAAwE,CACtH,CAAC;AAEF;;;;;GAKG;AACH,MAAM,OAAO,yBAAyB;IAEf;IADZ,QAAQ,CAA2C;IAC5D,YAAqB,OAAuI;QAAvI,YAAO,GAAP,OAAO,CAAgI;QAC1J,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACrJ,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,sBAAsB,OAAO,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,+BAA+B,EAAE,CAAC,EAAE,CAAC,CAAC;IACzN,CAAC;IACD,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,MAAmB;QAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,gCAAgC,IAAI,CAAC,OAAO,CAAC,UAAU,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,sBAAsB,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAC9W,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/F,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAO,CAAC;IACpC,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,MAA8B,EAAE,MAAmB;QAC/D,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACrM,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAA4K,UAAU,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/O,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAA0B,aAAa,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAClI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAiD,YAAY,MAAM,CAAC,OAAO,0BAA0B,EAAE,MAAM,CAAC,CAAC;QAC7I,MAAM,QAAQ,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACvL,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC5F,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,OAAO;YAAE,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACzJ,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC,gBAAgB;YAAE,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC/F,IAAI,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACxG,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,YAAY;YAAE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAC9F,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5E,CAAC;CACF;AAED,4GAA4G;AAC5G,MAAM,OAAO,yBAAyB;IACf;IAArB,YAAqB,OAA6H;QAA7H,YAAO,GAAP,OAAO,CAAsH;IAAG,CAAC;IACtJ,KAAK,CAAC,QAAQ,CAAC,KAA0B,EAAE,MAAmB;QAC5D,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC7F,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAClD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC1M,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAClF,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAChI,qGAAqG;QACrG,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,mCAAmC,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChI,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,KAA0B,EAAE,MAAmB;QAC3D,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,CAAC,KAA0B,EAAE,MAAmB;QACrD,OAAO,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtI,CAAC;IACD,SAAS,CAAC,KAA0B,EAAE,MAAmB;QACvD,6FAA6F;QAC7F,OAAO,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxI,CAAC;CACF"}

package/lib/plugin-runtime/github-workroom-capability.d.ts

@@ -0,0 +1,15 @@
+import { type GitWorkspaceCredentialPort } from '../workroom/git-workspace-gateway.js';
+import { type GitHubWorkspaceTransportOptions } from '../workroom/github-workspace-transport.js';
+import type { WorkroomGitHubCapabilityPort } from './workroom-effect-production.js';
+export interface GitHubWorkroomCapabilityOptions extends GitHubWorkspaceTransportOptions {
+    readonly credentials: GitWorkspaceCredentialPort;
+    /** Explicit logical identity when it differs from the transport provider identity. */
+    readonly binding?: Readonly<{
+        ref: string;
+        digest: string;
+    }>;
+    readonly now?: () => number;
+}
+/** Register the returned capability as a generation Resource; no process-global credentials/state. */
+export declare function createGitHubWorkroomCapability(options: GitHubWorkroomCapabilityOptions): WorkroomGitHubCapabilityPort;
+//# sourceMappingURL=github-workroom-capability.d.ts.map

package/lib/plugin-runtime/github-workroom-capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-workroom-capability.d.ts","sourceRoot":"","sources":["../../src/plugin-runtime/github-workroom-capability.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,KAAK,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAChH,OAAO,EAA4B,KAAK,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAC3H,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAEpF,MAAM,WAAW,+BAAgC,SAAQ,+BAA+B;IACtF,QAAQ,CAAC,WAAW,EAAE,0BAA0B,CAAC;IACjD,sFAAsF;IACtF,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,sGAAsG;AACtG,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,+BAA+B,GAAG,4BAA4B,CAsErH"}

package/lib/plugin-runtime/github-workroom-capability.js

@@ -0,0 +1,79 @@
+import { canonicalWorkroomJson, digestCanonicalWorkroomValue as digest } from '../workroom/canonical-value.js';
+import { createGitWorkspaceLease } from '../workroom/git-workspace-gateway.js';
+import { GitHubWorkspaceTransport } from '../workroom/github-workspace-transport.js';
+/** Register the returned capability as a generation Resource; no process-global credentials/state. */
+export function createGitHubWorkroomCapability(options) {
+    const transport = new GitHubWorkspaceTransport(options);
+    const now = options.now ?? Date.now;
+    const binding = Object.freeze(options.binding
+        ? { ref: options.binding.ref, digest: options.binding.digest }
+        : { ref: transport.provider.id, digest: transport.provider.digest });
+    if (typeof binding.ref !== 'string' || !binding.ref.trim() || binding.ref !== binding.ref.trim()
+        || !/^sha256:[a-f0-9]{64}$/u.test(binding.digest))
+        throw new Error('GitHub capability binding is invalid');
+    return Object.freeze({
+        binding,
+        provider: transport.provider,
+        credentials: options.credentials,
+        transport,
+        async reconcile({ generation, state, lease }, signal) {
+            signal.throwIfAborted();
+            const canonical = createGitWorkspaceLease(lease);
+            const operation = state.intent.operation;
+            if (canonicalWorkroomJson(state.intent.capability) !== canonicalWorkroomJson(binding)) {
+                throw new Error('GitHub reconciliation capability binding drift');
+            }
+            if (canonicalWorkroomJson(canonical) !== canonicalWorkroomJson(lease)
+                || !state.attempt || !state.authorization || !Number.isSafeInteger(generation) || generation < 1
+                || state.intent.projectId !== lease.projectId || state.intent.runId !== lease.runId
+                || state.intent.taskKey !== lease.taskKey || state.intent.taskRevision !== lease.taskRevision
+                || state.intent.target.ref !== lease.leaseRef || state.intent.target.digest !== lease.digest) {
+                throw new Error('GitHub reconciliation requires the exact authorized workspace lease and attempt');
+            }
+            if (operation.kind !== 'git_push' && operation.kind !== 'git_open_pr' && operation.kind !== 'git_cancel_remote') {
+                throw new Error('GitHub reconciliation operation is unsupported');
+            }
+            if (operation.parameters.repositoryId !== lease.repository.id
+                || (operation.kind === 'git_push' && operation.parameters.ref !== lease.attemptBranch)
+                || (operation.kind === 'git_open_pr' && (operation.parameters.headRef !== lease.attemptBranch
+                    || operation.parameters.baseRef !== lease.targetRef || lease.mode !== 'pull_request'))) {
+                throw new Error('GitHub reconciliation operation is outside the workspace lease');
+            }
+            // Querying after an expired lease is safe and required for recovery. Only fresh credentials are used.
+            const credential = await options.credentials.resolve({ generation, leaseDigest: lease.digest,
+                repositoryId: lease.repository.id, bindingRef: lease.repository.bindingRef,
+                bindingDigest: lease.repository.bindingDigest, operation: operation.kind }, signal);
+            signal.throwIfAborted();
+            if (!credential.credentialId || !credential.secret || !Number.isSafeInteger(credential.expiresAt)
+                || credential.expiresAt <= now())
+                throw new Error('GitHub reconciliation credential is invalid or expired');
+            const operationId = state.attempt.operationId;
+            const shared = { operationId, repositoryId: lease.repository.id };
+            let remoteRef;
+            let remoteDigest;
+            if (operation.kind === 'git_push') {
+                const receipt = await transport.queryPush({ ...shared, ref: lease.attemptBranch,
+                    headSha: operation.parameters.headSha, force: false, baseSha: lease.baseSha, pathScopes: lease.pathScopes,
+                    idempotencyKey: `git-push:${lease.digest}:${operationId}`,
+                }, credential, signal);
+                remoteRef = receipt?.externalReceiptRef;
+                remoteDigest = receipt?.externalReceiptDigest;
+            }
+            else if (operation.kind === 'git_open_pr') {
+                const receipt = await transport.queryPullRequest({ ...shared, headRef: lease.attemptBranch,
+                    baseRef: lease.targetRef, headSha: operation.parameters.headSha, baseSha: lease.baseSha, pathScopes: lease.pathScopes,
+                    idempotencyKey: `git-pr:${lease.digest}:${operationId}`,
+                }, credential, signal);
+                remoteRef = receipt?.prRef;
+                remoteDigest = receipt?.externalReceiptDigest;
+            }
+            const observedAt = now();
+            return Object.freeze({ outcome: remoteRef ? 'committed' : 'outcome_unknown', provider: transport.provider,
+                remoteRef: remoteRef ?? `github-observation:${digest({ operationId, repositoryId: lease.repository.id })}`,
+                remoteDigest: remoteDigest ?? digest({ operationId, observedAt, outcome: 'outcome_unknown' }),
+                observedAt, authenticatedBy: credential.credentialId,
+            });
+        },
+    });
+}
+//# sourceMappingURL=github-workroom-capability.js.map

package/lib/plugin-runtime/github-workroom-capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-workroom-capability.js","sourceRoot":"","sources":["../../src/plugin-runtime/github-workroom-capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAmC,MAAM,sCAAsC,CAAC;AAChH,OAAO,EAAE,wBAAwB,EAAwC,MAAM,2CAA2C,CAAC;AAU3H,sGAAsG;AACtG,MAAM,UAAU,8BAA8B,CAAC,OAAwC;IACrF,MAAM,SAAS,GAAG,IAAI,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;QAC3C,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE;QAC9D,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE;WAC3F,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC7G,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO;QACP,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,SAAS;QACT,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM;YAClD,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;YACzC,IAAI,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtF,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,qBAAqB,CAAC,SAAS,CAAC,KAAK,qBAAqB,CAAC,KAAK,CAAC;mBAChE,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;mBAC7F,KAAK,CAAC,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;mBAChF,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;mBAC1F,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC/F,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;YACrG,CAAC;YACD,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU,IAAI,SAAS,CAAC,IAAI,KAAK,aAAa,IAAI,SAAS,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBAChH,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,SAAS,CAAC,UAAU,CAAC,YAAY,KAAK,KAAK,CAAC,UAAU,CAAC,EAAE;mBACxD,CAAC,SAAS,CAAC,IAAI,KAAK,UAAU,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,KAAK,KAAK,CAAC,aAAa,CAAC;mBACnF,CAAC,SAAS,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,KAAK,KAAK,CAAC,aAAa;uBACxF,SAAS,CAAC,UAAU,CAAC,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,EAAE,CAAC;gBAC3F,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;YACpF,CAAC;YACD,sGAAsG;YACtG,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM;gBAC1F,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,UAAU;gBAC1E,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YACtF,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;mBAC5F,UAAU,CAAC,SAAS,IAAI,GAAG,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;YAC9G,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;YAC9C,MAAM,MAAM,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YAClE,IAAI,SAA6B,CAAC;YAClC,IAAI,YAAgC,CAAC;YACrC,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,aAAa;oBAC7E,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;oBACzG,cAAc,EAAE,YAAY,KAAK,CAAC,MAAM,IAAI,WAAW,EAAE;iBAC1D,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;gBACvB,SAAS,GAAG,OAAO,EAAE,kBAAkB,CAAC;gBACxC,YAAY,GAAG,OAAO,EAAE,qBAAqB,CAAC;YAChD,CAAC;iBAAM,IAAI,SAAS,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC5C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,aAAa;oBACxF,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;oBACrH,cAAc,EAAE,UAAU,KAAK,CAAC,MAAM,IAAI,WAAW,EAAE;iBACxD,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;gBACvB,SAAS,GAAG,OAAO,EAAE,KAAK,CAAC;gBAC3B,YAAY,GAAG,OAAO,EAAE,qBAAqB,CAAC;YAChD,CAAC;YACD,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBACvG,SAAS,EAAE,SAAS,IAAI,sBAAsB,MAAM,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,EAAE;gBAC1G,YAAY,EAAE,YAAY,IAAI,MAAM,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;gBAC7F,UAAU,EAAE,eAAe,EAAE,UAAU,CAAC,YAAY;aACrD,CAAC,CAAC;QACL,CAAC;KACqC,CAAC,CAAC;AAC5C,CAAC"}

package/lib/plugin-runtime/host-tool-projection.d.ts

@@ -4,7 +4,7 @@ export interface HostToolProjectionInput {
     readonly name: string;
     readonly description: string;
     readonly parameters?: unknown;
-    readonly approval?: ToolApproval;
+    readonly requiresApproval?: ToolApproval;
     readonly platforms?: readonly string[];
     readonly scopes?: readonly ToolScope[];
     readonly permissions?: readonly string[];

package/lib/plugin-runtime/host-tool-projection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-tool-projection.d.ts","sourceRoot":"","sources":["../../src/plugin-runtime/host-tool-projection.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,SAAS,EACf,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IACvC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,eAAe,EAAE,oBAAoB,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5H;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,aAAa,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;CACtF;AAED,sFAAsF;AACtF,wBAAgB,eAAe,CAAC,KAAK,EAAE,uBAAuB,GAAG,kBAAkB,CAgBlF"}
+{"version":3,"file":"host-tool-projection.d.ts","sourceRoot":"","sources":["../../src/plugin-runtime/host-tool-projection.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,SAAS,EACf,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,YAAY,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IACvC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,eAAe,EAAE,oBAAoB,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5H;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,aAAa,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;CACtF;AAED,sFAAsF;AACtF,wBAAgB,eAAe,CAAC,KAAK,EAAE,uBAAuB,GAAG,kBAAkB,CAqBlF"}

package/lib/plugin-runtime/host-tool-projection.js

@@ -1,4 +1,4 @@
-import { defineAgentTool, toolFeatureId, } from '@zhin.js/tool';
+import { defineAgentTool, requireToolInputSchema, toolFeatureId, } from '@zhin.js/tool';
 export { toolFeatureId };
 /** Converts a Host-owned tool into the same candidate ToolFeature used by plugins. */
 export function projectHostTool(input) {
@@ -9,8 +9,10 @@ export function projectHostTool(input) {
         name: input.name,
         definition: defineAgentTool({
             description: input.description,
-            inputSchema: input.parameters,
-            approval: input.approval,
+            inputSchema: input.parameters === undefined
+                ? undefined
+                : requireToolInputSchema(input.parameters, `Host Tool ${input.name} parameters`),
+            requiresApproval: input.requiresApproval,
             platforms: input.platforms,
             scopes: input.scopes,
             permissions: input.permissions,

package/lib/plugin-runtime/host-tool-projection.js.map

@@ -1 +1 @@
-{"version":3,"file":"host-tool-projection.js","sourceRoot":"","sources":["../../src/plugin-runtime/host-tool-projection.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,aAAa,GAId,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,aAAa,EAAE,CAAC;AAoBzB,sFAAsF;AACtF,MAAM,UAAU,eAAe,CAAC,KAA8B;IAC5D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;IAC9E,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,eAAe,CAAmC;YAC5D,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,UAAU;YAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;SAC3D,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"host-tool-projection.js","sourceRoot":"","sources":["../../src/plugin-runtime/host-tool-projection.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,aAAa,GAId,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,aAAa,EAAE,CAAC;AAoBzB,sFAAsF;AACtF,MAAM,UAAU,eAAe,CAAC,KAA8B;IAC5D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;IAC9E,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,eAAe,CAAmC;YAC5D,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,UAAU,KAAK,SAAS;gBACzC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,sBAAsB,CACpB,KAAK,CAAC,UAAU,EAChB,aAAa,KAAK,CAAC,IAAI,aAAa,CACrC;YACL,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;SAC3D,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}

package/lib/plugin-runtime/index.d.ts

@@ -1,6 +1,16 @@
 export * from './agent-runtime.js';
 export * from './agent-host-port.js';
+export * from './agent-event-bus.js';
 export * from './agent-trace-runtime.js';
+export * from './native-bash-tool.js';
+export { ZhinAgent } from '../zhin-agent/index.js';
+export type { AgentTurnConfiguration, AgentTurnRequest } from '../zhin-agent/index.js';
+export { composeZhinAgentRuntime } from '../init/compose-zhin-agent-runtime.js';
+export type { ComposedZhinAgentRuntime } from '../init/compose-zhin-agent-runtime.js';
+export { activateAiDatabaseStorage } from '../init/activate-ai-database-storage.js';
+export { defineAiDatabaseModels } from '../init/define-ai-database-models.js';
+export type { AiDatabaseModelDefiner } from '../init/define-ai-database-models.js';
+export { ensureMcpConnections, ensureMcpConnectionsForBinding, getMcpToolsForBinding, } from '../resource-hub/mcp-lifecycle.js';
 export type { AssistantRuntimeHandle } from '../assistant/runtime-contract.js';
 export type { WorkroomRunControlCommand, WorkroomRunControlReceipt, } from '../workroom/workroom-run-control.js';
 export { createCatalogGovernedWorkroomProjectionAuthority, createCatalogGovernedConsoleDisclosureAuthority, createWorkroomRuntime, type WorkroomProjectionReadAuthorityPort, type WorkroomRunDetail, type WorkroomRunHeader, type WorkroomRuntimeHandle, } from '../workroom/runtime.js';
@@ -40,6 +50,7 @@ export * from './workroom-scheduler-portfolio-request-authority.js';
 export * from './workroom-scheduler-portfolio-composition.js';
 export * from './workroom-preemption-runtime.js';
 export * from './workroom-local-assignment-runtime.js';
+export * from './workroom-local-assignment-executor.js';
 export * from './workroom-local-assignment-authority.js';
 export * from './workroom-local-assignment-supply.js';
 export * from './workroom-local-agent-loop.js';
@@ -53,7 +64,9 @@ export * from './workroom-data-governance-root-provider.js';
 export { digestCanonicalWorkroomValue } from '../workroom/canonical-value.js';
 export * from './workroom-data-governance-storage.js';
 export * from './workroom-governed-dispatch-composition.js';
-export * from './workroom-governed-dispatch-reasons.js';
+export * from '../workroom/governed-dispatch-reasons.js';
+export * from '../workroom/remote-executor.js';
+export * from '../data-governance/disclosure-authority.js';
 export * from './workroom-data-lifecycle-composition.js';
 export * from './workroom-data-lifecycle-console.js';
 export * from './workroom-data-lifecycle-human-ingress.js';
@@ -75,9 +88,23 @@ export * from './host-tool-projection.js';
 export * from './host-mcp-projection.js';
 export * from './native-file-tools.js';
 export * from './native-web-tools.js';
+export * from './native-image-tool.js';
+export * from './native-knowledge-tool.js';
+export * from './native-tool-suite.js';
 export * from './native-todo-tools.js';
 export * from './native-interaction-tools.js';
 export * from './native-semantic-memory-tools.js';
 export { FileJournalStore } from '../journal/file-journal-store.js';
 export { capabilityToTool, toolInvocationFromTurn, toolsFromCapabilities, type GenerationStampedTool, } from './capability-tools.js';
+export * from './workroom-delivery-gateway.js';
+export * from './github-workroom-capability.js';
+export * from '../workroom/github-workspace-transport.js';
+export * from '../workroom/software-delivery-plan.js';
+export * from './self-delivery-project.js';
+export * from './self-delivery-project-composition.js';
+export * from './github-actions-delivery-provider.js';
+export * from './github-exact-merge-gateway.js';
+export * from '../workroom/coding-assignment-executor.js';
+export * from '../workroom/coding-git-objects.js';
+export * from '../workroom/file-coding-execution-store.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/plugin-runtime/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/plugin-runtime/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,YAAY,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC/E,YAAY,EACV,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,gDAAgD,EAChD,+CAA+C,EAC/C,qBAAqB,EACrB,KAAK,mCAAmC,EACxC,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,GAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,iCAAiC,EACjC,KAAK,wBAAwB,GAC9B,MAAM,4BAA4B,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC;AACtD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,iDAAiD,CAAC;AAChE,cAAc,yCAAyC,CAAC;AACxD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,0CAA0C,CAAC;AACzD,cAAc,uCAAuC,CAAC;AACtD,cAAc,mCAAmC,CAAC;AAClD,cAAc,kCAAkC,CAAC;AACjD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yCAAyC,CAAC;AACxD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,uCAAuC,CAAC;AACtD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,kDAAkD,CAAC;AACjE,cAAc,kCAAkC,CAAC;AACjD,cAAc,yCAAyC,CAAC;AACxD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AACvD,cAAc,0CAA0C,CAAC;AACzD,cAAc,0CAA0C,CAAC;AACzD,cAAc,iCAAiC,CAAC;AAChD,cAAc,mCAAmC,CAAC;AAClD,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,wCAAwC,CAAC;AACvD,cAAc,0CAA0C,CAAC;AACzD,cAAc,qDAAqD,CAAC;AACpE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,kCAAkC,CAAC;AACjD,cAAc,wCAAwC,CAAC;AACvD,cAAc,0CAA0C,CAAC;AACzD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,wCAAwC,CAAC;AACvD,cAAc,uCAAuC,CAAC;AACtD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,yCAAyC,CAAC;AACxD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6CAA6C,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,cAAc,uCAAuC,CAAC;AACtD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AACzD,cAAc,sCAAsC,CAAC;AACrD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,yCAAyC,CAAC;AACxD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,yCAAyC,CAAC;AACxD,cAAc,sCAAsC,CAAC;AACrD,cAAc,iDAAiD,CAAC;AAChE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,sDAAsD,CAAC;AACrE,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,kCAAkC,CAAC;AACjD,cAAc,wCAAwC,CAAC;AACvD,cAAc,yBAAyB,CAAC;AACxC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,mCAAmC,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/plugin-runtime/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,uBAAuB,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,YAAY,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,YAAY,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,YAAY,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC/E,YAAY,EACV,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,gDAAgD,EAChD,+CAA+C,EAC/C,qBAAqB,EACrB,KAAK,mCAAmC,EACxC,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,GAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,iCAAiC,EACjC,KAAK,wBAAwB,GAC9B,MAAM,4BAA4B,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC;AACtD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,iDAAiD,CAAC;AAChE,cAAc,yCAAyC,CAAC;AACxD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,0CAA0C,CAAC;AACzD,cAAc,uCAAuC,CAAC;AACtD,cAAc,mCAAmC,CAAC;AAClD,cAAc,kCAAkC,CAAC;AACjD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yCAAyC,CAAC;AACxD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,uCAAuC,CAAC;AACtD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,kDAAkD,CAAC;AACjE,cAAc,kCAAkC,CAAC;AACjD,cAAc,yCAAyC,CAAC;AACxD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AACvD,cAAc,0CAA0C,CAAC;AACzD,cAAc,0CAA0C,CAAC;AACzD,cAAc,iCAAiC,CAAC;AAChD,cAAc,mCAAmC,CAAC;AAClD,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,wCAAwC,CAAC;AACvD,cAAc,0CAA0C,CAAC;AACzD,cAAc,qDAAqD,CAAC;AACpE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,kCAAkC,CAAC;AACjD,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AACzD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,wCAAwC,CAAC;AACvD,cAAc,uCAAuC,CAAC;AACtD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,yCAAyC,CAAC;AACxD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6CAA6C,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,cAAc,uCAAuC,CAAC;AACtD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,0CAA0C,CAAC;AACzD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,4CAA4C,CAAC;AAC3D,cAAc,0CAA0C,CAAC;AACzD,cAAc,sCAAsC,CAAC;AACrD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,yCAAyC,CAAC;AACxD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,yCAAyC,CAAC;AACxD,cAAc,sCAAsC,CAAC;AACrD,cAAc,iDAAiD,CAAC;AAChE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,sDAAsD,CAAC;AACrE,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,kCAAkC,CAAC;AACjD,cAAc,wCAAwC,CAAC;AACvD,cAAc,yBAAyB,CAAC;AACxC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,mCAAmC,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iCAAiC,CAAC;AAChD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,uCAAuC,CAAC;AACtD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,uCAAuC,CAAC;AACtD,cAAc,iCAAiC,CAAC;AAChD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,mCAAmC,CAAC;AAClD,cAAc,4CAA4C,CAAC"}

package/lib/plugin-runtime/index.js

@@ -1,6 +1,13 @@
 export * from './agent-runtime.js';
 export * from './agent-host-port.js';
+export * from './agent-event-bus.js';
 export * from './agent-trace-runtime.js';
+export * from './native-bash-tool.js';
+export { ZhinAgent } from '../zhin-agent/index.js';
+export { composeZhinAgentRuntime } from '../init/compose-zhin-agent-runtime.js';
+export { activateAiDatabaseStorage } from '../init/activate-ai-database-storage.js';
+export { defineAiDatabaseModels } from '../init/define-ai-database-models.js';
+export { ensureMcpConnections, ensureMcpConnectionsForBinding, getMcpToolsForBinding, } from '../resource-hub/mcp-lifecycle.js';
 export { createCatalogGovernedWorkroomProjectionAuthority, createCatalogGovernedConsoleDisclosureAuthority, createWorkroomRuntime, } from '../workroom/runtime.js';
 export { createSessionTreeRuntimeFromAgent, } from '../session-tree-runtime.js';
 export * from './turn-intent-resolver.js';
@@ -38,6 +45,7 @@ export * from './workroom-scheduler-portfolio-request-authority.js';
 export * from './workroom-scheduler-portfolio-composition.js';
 export * from './workroom-preemption-runtime.js';
 export * from './workroom-local-assignment-runtime.js';
+export * from './workroom-local-assignment-executor.js';
 export * from './workroom-local-assignment-authority.js';
 export * from './workroom-local-assignment-supply.js';
 export * from './workroom-local-agent-loop.js';
@@ -51,7 +59,9 @@ export * from './workroom-data-governance-root-provider.js';
 export { digestCanonicalWorkroomValue } from '../workroom/canonical-value.js';
 export * from './workroom-data-governance-storage.js';
 export * from './workroom-governed-dispatch-composition.js';
-export * from './workroom-governed-dispatch-reasons.js';
+export * from '../workroom/governed-dispatch-reasons.js';
+export * from '../workroom/remote-executor.js';
+export * from '../data-governance/disclosure-authority.js';
 export * from './workroom-data-lifecycle-composition.js';
 export * from './workroom-data-lifecycle-console.js';
 export * from './workroom-data-lifecycle-human-ingress.js';
@@ -73,9 +83,23 @@ export * from './host-tool-projection.js';
 export * from './host-mcp-projection.js';
 export * from './native-file-tools.js';
 export * from './native-web-tools.js';
+export * from './native-image-tool.js';
+export * from './native-knowledge-tool.js';
+export * from './native-tool-suite.js';
 export * from './native-todo-tools.js';
 export * from './native-interaction-tools.js';
 export * from './native-semantic-memory-tools.js';
 export { FileJournalStore } from '../journal/file-journal-store.js';
 export { capabilityToTool, toolInvocationFromTurn, toolsFromCapabilities, } from './capability-tools.js';
+export * from './workroom-delivery-gateway.js';
+export * from './github-workroom-capability.js';
+export * from '../workroom/github-workspace-transport.js';
+export * from '../workroom/software-delivery-plan.js';
+export * from './self-delivery-project.js';
+export * from './self-delivery-project-composition.js';
+export * from './github-actions-delivery-provider.js';
+export * from './github-exact-merge-gateway.js';
+export * from '../workroom/coding-assignment-executor.js';
+export * from '../workroom/coding-git-objects.js';
+export * from '../workroom/file-coding-execution-store.js';
 //# sourceMappingURL=index.js.map

package/lib/plugin-runtime/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/plugin-runtime/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AAMzC,OAAO,EACL,gDAAgD,EAChD,+CAA+C,EAC/C,qBAAqB,GAKtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,iCAAiC,GAElC,MAAM,4BAA4B,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC;AACtD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,iDAAiD,CAAC;AAChE,cAAc,yCAAyC,CAAC;AACxD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,0CAA0C,CAAC;AACzD,cAAc,uCAAuC,CAAC;AACtD,cAAc,mCAAmC,CAAC;AAClD,cAAc,kCAAkC,CAAC;AACjD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yCAAyC,CAAC;AACxD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,uCAAuC,CAAC;AACtD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,kDAAkD,CAAC;AACjE,cAAc,kCAAkC,CAAC;AACjD,cAAc,yCAAyC,CAAC;AACxD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AACvD,cAAc,0CAA0C,CAAC;AACzD,cAAc,0CAA0C,CAAC;AACzD,cAAc,iCAAiC,CAAC;AAChD,cAAc,mCAAmC,CAAC;AAClD,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,wCAAwC,CAAC;AACvD,cAAc,0CAA0C,CAAC;AACzD,cAAc,qDAAqD,CAAC;AACpE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,kCAAkC,CAAC;AACjD,cAAc,wCAAwC,CAAC;AACvD,cAAc,0CAA0C,CAAC;AACzD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,wCAAwC,CAAC;AACvD,cAAc,uCAAuC,CAAC;AACtD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,yCAAyC,CAAC;AACxD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6CAA6C,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,cAAc,uCAAuC,CAAC;AACtD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AACzD,cAAc,sCAAsC,CAAC;AACrD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,yCAAyC,CAAC;AACxD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,yCAAyC,CAAC;AACxD,cAAc,sCAAsC,CAAC;AACrD,cAAc,iDAAiD,CAAC;AAChE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,sDAAsD,CAAC;AACrE,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,kCAAkC,CAAC;AACjD,cAAc,wCAAwC,CAAC;AACvD,cAAc,yBAAyB,CAAC;AACxC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,mCAAmC,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,GAEtB,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/plugin-runtime/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,uBAAuB,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAEhF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAE9E,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,kCAAkC,CAAC;AAM1C,OAAO,EACL,gDAAgD,EAChD,+CAA+C,EAC/C,qBAAqB,GAKtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,iCAAiC,GAElC,MAAM,4BAA4B,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC;AACtD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,iDAAiD,CAAC;AAChE,cAAc,yCAAyC,CAAC;AACxD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,0CAA0C,CAAC;AACzD,cAAc,uCAAuC,CAAC;AACtD,cAAc,mCAAmC,CAAC;AAClD,cAAc,kCAAkC,CAAC;AACjD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yCAAyC,CAAC;AACxD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,uCAAuC,CAAC;AACtD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,kDAAkD,CAAC;AACjE,cAAc,kCAAkC,CAAC;AACjD,cAAc,yCAAyC,CAAC;AACxD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AACvD,cAAc,0CAA0C,CAAC;AACzD,cAAc,0CAA0C,CAAC;AACzD,cAAc,iCAAiC,CAAC;AAChD,cAAc,mCAAmC,CAAC;AAClD,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,wCAAwC,CAAC;AACvD,cAAc,0CAA0C,CAAC;AACzD,cAAc,qDAAqD,CAAC;AACpE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,kCAAkC,CAAC;AACjD,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AACzD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,wCAAwC,CAAC;AACvD,cAAc,uCAAuC,CAAC;AACtD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,yCAAyC,CAAC;AACxD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6CAA6C,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,cAAc,uCAAuC,CAAC;AACtD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,0CAA0C,CAAC;AACzD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,4CAA4C,CAAC;AAC3D,cAAc,0CAA0C,CAAC;AACzD,cAAc,sCAAsC,CAAC;AACrD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,yCAAyC,CAAC;AACxD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,yCAAyC,CAAC;AACxD,cAAc,sCAAsC,CAAC;AACrD,cAAc,iDAAiD,CAAC;AAChE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,sDAAsD,CAAC;AACrE,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,kCAAkC,CAAC;AACjD,cAAc,wCAAwC,CAAC;AACvD,cAAc,yBAAyB,CAAC;AACxC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,mCAAmC,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,GAEtB,MAAM,uBAAuB,CAAC;AAC/B,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iCAAiC,CAAC;AAChD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,uCAAuC,CAAC;AACtD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,uCAAuC,CAAC;AACtD,cAAc,iCAAiC,CAAC;AAChD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,mCAAmC,CAAC;AAClD,cAAc,4CAA4C,CAAC"}

package/lib/plugin-runtime/native-bash-tool.d.ts

@@ -0,0 +1,35 @@
+import { type AgentToolDefinition, type ToolInvocationPolicy } from '@zhin.js/tool';
+import { type SandboxConfig } from '../security/sandbox.js';
+export interface BashExecutionRequest {
+    readonly command: string;
+    readonly cwd: string;
+    readonly timeoutMs: number;
+    readonly signal: AbortSignal;
+    readonly policy: ToolInvocationPolicy;
+}
+export interface BashExecutionResult {
+    readonly stdout: string;
+    readonly stderr: string;
+    readonly blocked?: boolean;
+    readonly blockReason?: string;
+    readonly timedOut?: boolean;
+}
+export interface BashExecutionPort {
+    execute(request: BashExecutionRequest): Promise<BashExecutionResult>;
+}
+/** Executes one policy-authorized command using the exact Turn isolation boundary. */
+export declare class SandboxBashExecutionPort implements BashExecutionPort {
+    #private;
+    constructor(baseConfig?: Partial<SandboxConfig>);
+    execute(request: BashExecutionRequest): Promise<BashExecutionResult>;
+}
+/** Native generation ToolFeature for shell execution. */
+export declare class NativeBashToolFeature {
+    #private;
+    readonly feature: import("@zhin.js/plugin-runtime").FeatureId;
+    readonly name = "bash";
+    readonly definition: Readonly<AgentToolDefinition<Record<string, unknown>, string>>;
+    constructor(execution?: BashExecutionPort);
+    private execute;
+}
+//# sourceMappingURL=native-bash-tool.d.ts.map

package/lib/plugin-runtime/native-bash-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-bash-tool.d.ts","sourceRoot":"","sources":["../../src/plugin-runtime/native-bash-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EAExB,KAAK,oBAAoB,EAC1B,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAW,KAAK,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAErE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;CACvC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACtE;AAED,sFAAsF;AACtF,qBAAa,wBAAyB,YAAW,iBAAiB;;gBAGpD,UAAU,GAAE,OAAO,CAAC,aAAa,CAAM;IAI7C,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CA6B3E;AAED,yDAAyD;AACzD,qBAAa,qBAAqB;;IAChC,QAAQ,CAAC,OAAO,8CAAiB;IACjC,QAAQ,CAAC,IAAI,UAAU;IACvB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;gBAGxE,SAAS,GAAE,iBAAkD;YAkB3D,OAAO;CAqBtB"}

package/lib/plugin-runtime/native-bash-tool.js

@@ -0,0 +1,110 @@
+import { defineAgentTool, toolFeatureId, } from '@zhin.js/tool';
+import { classifyBashCommand } from '../security/file-policy.js';
+import { Sandbox } from '../security/sandbox.js';
+/** Executes one policy-authorized command using the exact Turn isolation boundary. */
+export class SandboxBashExecutionPort {
+    #baseConfig;
+    constructor(baseConfig = {}) {
+        this.#baseConfig = Object.freeze({ ...baseConfig });
+    }
+    async execute(request) {
+        request.signal.throwIfAborted();
+        const filesystem = request.policy.filesystem;
+        const access = filesystem?.access;
+        const isolation = request.policy.shell?.isolation;
+        const isolated = isolation === 'required'
+            && (access === 'read-only' || access === 'workspace-write');
+        const unrestricted = isolation === 'none' && access === 'danger-full-access';
+        if (!filesystem?.workspaceRoot || (!isolated && !unrestricted)) {
+            throw new Error('Bash execution requires an explicit Turn filesystem and isolation policy');
+        }
+        const sandbox = unrestricted
+            ? new Sandbox({ ...this.#baseConfig, enabled: false })
+            : new Sandbox({
+                ...this.#baseConfig,
+                enabled: true,
+                workingDirectory: filesystem.workingDirectory ?? filesystem.workspaceRoot,
+                enableNetwork: request.policy.network.enabled,
+                filesystemAccess: access === 'read-only' ? 'read-only' : 'workspace-write',
+                useDocker: 'always',
+            });
+        const result = await sandbox.execute(request.command, {
+            cwd: request.cwd,
+            timeout: request.timeoutMs,
+        });
+        request.signal.throwIfAborted();
+        return result;
+    }
+}
+/** Native generation ToolFeature for shell execution. */
+export class NativeBashToolFeature {
+    feature = toolFeatureId;
+    name = 'bash';
+    definition;
+    #execution;
+    constructor(execution = new SandboxBashExecutionPort()) {
+        this.#execution = execution;
+        this.definition = defineAgentTool({
+            description: 'Execute a shell command with Turn-scoped filesystem, network, approval, and isolation policy.',
+            inputSchema: Object.freeze({
+                type: 'object',
+                properties: Object.freeze({
+                    command: Object.freeze({ type: 'string', description: 'Shell command to execute' }),
+                    cwd: Object.freeze({ type: 'string', description: 'Working directory inside the authorized workspace' }),
+                    timeout: Object.freeze({ type: 'number', description: 'Timeout in milliseconds' }),
+                }),
+                required: Object.freeze(['command']),
+            }),
+            requiresApproval: 'on-risk',
+            execute: (input, context) => this.execute(input, context),
+        });
+    }
+    async execute(input, context) {
+        const command = requiredString(input.command, 'command');
+        const filesystem = context.policy.filesystem;
+        const cwd = optionalString(input.cwd)
+            ?? filesystem?.workingDirectory
+            ?? filesystem?.workspaceRoot;
+        if (!cwd)
+            throw new Error('Bash execution requires an authorized working directory');
+        const timeoutMs = positiveInteger(input.timeout, 30_000);
+        const result = await this.#execution.execute({
+            command,
+            cwd,
+            timeoutMs,
+            signal: context.signal,
+            policy: context.policy,
+        });
+        if (result.blocked) {
+            throw new Error(`Command blocked by sandbox: ${result.blockReason ?? 'unknown reason'}`);
+        }
+        if (result.timedOut)
+            throw new Error(`Command timed out after ${timeoutMs}ms`);
+        return formatOutput(command, result);
+    }
+}
+function formatOutput(command, result) {
+    const classification = classifyBashCommand(command);
+    const tag = classification.isReadOnly
+        ? (classification.isSearch ? '[搜索]' : classification.isList ? '[列出]' : '[只读]')
+        : '[执行]';
+    const output = [
+        result.stdout.trim() ? `STDOUT:\n${result.stdout.trim()}` : '',
+        result.stderr.trim() ? `STDERR:\n${result.stderr.trim()}` : '',
+    ].filter(Boolean).join('\n');
+    return `${tag} ${output || '(no output)'}`;
+}
+function requiredString(value, name) {
+    if (typeof value !== 'string' || !value.trim())
+        throw new TypeError(`${name} is required`);
+    return value.trim();
+}
+function optionalString(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+function positiveInteger(value, fallback) {
+    return typeof value === 'number' && Number.isFinite(value) && value > 0
+        ? Math.floor(value)
+        : fallback;
+}
+//# sourceMappingURL=native-bash-tool.js.map