agent-hitch 0.2.6 → 0.2.8

package/dist/src/foundation/contained-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contained-file.js","sourceRoot":"","sources":["../../../src/foundation/contained-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAc,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAmB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,IAAI,MAAM,WAAW,CAAC;AAQ7B,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,QAAgB,EAChB,YAAY,GAAG,MAAM,CAAC,gBAAgB;IAEtC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,aAAa,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IACvG,MAAM,OAAO,GAA0C,EAAE,CAAC;IAC1D,IAAI,SAAS,GAAG,aAAa,CAAC;IAC9B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACzE,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;QACvH,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;IACxI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC9G,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,IAAI,GAAG,YAAY;YAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;QACxF,OAAO;YACL,MAAM;YACN,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,eAAe,EAAE,KAAK,IAAmB,EAAE;gBACzC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;gBACrC,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;gBACtC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;uBACxD,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;uBAClE,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;oBACtD,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACxC,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,SAAiB;IAC5C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACzG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,OAA8C;IAClF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACzE,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;IAC5H,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;IACvI,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAW,EAAE,KAAY;IACzC,OAAO,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC;AAClH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AACrF,CAAC"}

package/dist/src/foundation/credential-redaction.js

@@ -0,0 +1,162 @@
+import { StringDecoder } from "node:string_decoder";
+import { Transform } from "node:stream";
+export const CREDENTIAL_REDACTION_MARKER = "[REDACTED]";
+export const PROVIDER_ENVIRONMENT_NAMES = [
+    "DEEPSEEK_API_KEY", "DEEPSEEK_BASE_URL", "OPENAI_API_KEY", "OPENAI_BASE_URL", "OPENAI_ORG_ID", "OPENAI_ORGANIZATION",
+    "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL", "CLAUDE_CODE_OAUTH_TOKEN", "GOOGLE_API_KEY", "GEMINI_API_KEY",
+    "AZURE_OPENAI_API_KEY", "AZURE_OPENAI_ENDPOINT", "AZURE_OPENAI_API_VERSION", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY",
+    "AWS_SESSION_TOKEN", "AWS_REGION", "AWS_DEFAULT_REGION", "GITHUB_TOKEN", "GH_TOKEN",
+];
+const OVERSIZED_LINE_MARKER = "[REDACTED OVERSIZED LOG LINE]";
+const DEFAULT_MAX_LINE_BYTES = 1024 * 1024;
+const TEXT_RULES = [
+    { id: "authorization-bearer-v1", pattern: /\bBearer\s+[A-Za-z0-9._~+\/-]{8,}/gi, replacement: `Bearer ${CREDENTIAL_REDACTION_MARKER}` },
+    { id: "provider-api-key-v1", pattern: /\b(?:sk|rk|pk)-[A-Za-z0-9_-]{12,}\b/g, replacement: CREDENTIAL_REDACTION_MARKER },
+    { id: "secret-query-v1", pattern: /([?&](?:api[_-]?key|access[_-]?token|refresh[_-]?token|token|secret|password)=)[^&\s]+/gi, replacement: `$1${CREDENTIAL_REDACTION_MARKER}` },
+];
+const SECRET_HEADER = /^(\s*(?:authorization|proxy-authorization|cookie|set-cookie|x-api-key|x-[a-z0-9-]*(?:secret|token|api-key)[a-z0-9-]*)\s*:\s*).+$/gim;
+const NAMED_SECRET = /((?:"|')?(?:authorization|proxy-authorization|cookie|set-cookie|x-api-key|api[-_]?key|access[-_]?token|refresh[-_]?token|client[-_]?secret|secret|password|credential)(?:"|')?\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;}\]]+)/gi;
+/** Match credential-bearing JSON/header field names independently of current environment values. */
+export function isSensitiveFieldName(value) {
+    const normalized = value
+        .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "_");
+    const parts = normalized.split("_").filter(Boolean);
+    return parts.includes("token") || parts.includes("auth")
+        || /authorization|cookie|api_key|client_secret|private_key|password|credential|(?:^|_)secret(?:_|$)/.test(normalized);
+}
+export function safeDiagnosticMessage(value, credentialValues = [], maxCharacters = 4_096) {
+    if (!Number.isSafeInteger(maxCharacters) || maxCharacters < 32)
+        throw new TypeError("diagnostic message limit is invalid");
+    const message = redactCredentialText(value?.message || String(value ?? ""), credentialValues).text;
+    const marker = "…[truncated]";
+    return message.length <= maxCharacters ? message : `${message.slice(0, maxCharacters - marker.length)}${marker}`;
+}
+export function redactCredentialText(value, credentialValues = []) {
+    const redactions = new Map();
+    let text = String(value);
+    const known = [...new Set(credentialValues.filter((entry) => entry.length > 0))]
+        .sort((left, right) => right.length - left.length || left.localeCompare(right));
+    if (known.length > 0) {
+        let count = 0;
+        const pattern = new RegExp(known.map(escapeRegExp).join("|"), "g");
+        text = text.replace(pattern, () => {
+            count += 1;
+            return CREDENTIAL_REDACTION_MARKER;
+        });
+        if (count > 0)
+            increment(redactions, "known-credential-value-v1", count);
+    }
+    // Structured token forms must run before the generic named-field rule. For
+    // example, treating `Authorization: Bearer ...` as a generic field first
+    // would redact only the word `Bearer` and leave the token behind.
+    for (const rule of TEXT_RULES) {
+        const count = text.match(rule.pattern)?.length ?? 0;
+        text = text.replace(rule.pattern, rule.replacement);
+        if (count > 0)
+            increment(redactions, rule.id, count);
+    }
+    text = text.replace(SECRET_HEADER, (_match, prefix) => {
+        increment(redactions, "sensitive-header-v1");
+        return `${prefix}${CREDENTIAL_REDACTION_MARKER}`;
+    });
+    text = text.replace(NAMED_SECRET, (_match, prefix, encoded) => {
+        increment(redactions, "sensitive-field-v1");
+        const quote = encoded.startsWith("\"") ? "\"" : encoded.startsWith("'") ? "'" : "";
+        return `${prefix}${quote}${CREDENTIAL_REDACTION_MARKER}${quote}`;
+    });
+    return { text, redactions };
+}
+export function credentialValuesFromEnv(names, env) {
+    const values = [];
+    for (const name of names) {
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+            throw new TypeError(`invalid credential environment name: ${name}`);
+        const value = env[name];
+        if (value !== undefined && value.length > 0) {
+            values.push(value);
+            // Structured credential files can be handed off as one environment value.
+            // Also redact their opaque strings when a client prints a nested token.
+            if (value.trimStart().startsWith("{")) {
+                try {
+                    const collect = (entry) => {
+                        if (typeof entry === "string" && entry.length >= 16)
+                            values.push(entry);
+                        else if (entry && typeof entry === "object")
+                            Object.values(entry).forEach(collect);
+                    };
+                    collect(JSON.parse(value));
+                }
+                catch { /* Opaque non-JSON credentials retain the exact-value rule. */ }
+            }
+        }
+    }
+    return [...new Set(values)].sort((left, right) => right.length - left.length || left.localeCompare(right));
+}
+export function createCredentialRedactionTransform(credentialValues, maxLineBytes = DEFAULT_MAX_LINE_BYTES) {
+    if (!Number.isSafeInteger(maxLineBytes) || maxLineBytes < 1)
+        throw new TypeError("redaction max line bytes must be positive");
+    const decoder = new StringDecoder("utf8");
+    const streamingValues = [...new Set(credentialValues.flatMap((entry) => [entry, ...entry.split(/\r?\n/)]).filter((entry) => entry.length > 0))];
+    let buffer = "";
+    let discarding = false;
+    return new Transform({
+        transform(chunk, _encoding, callback) {
+            try {
+                buffer += typeof chunk === "string" ? chunk : decoder.write(chunk);
+                buffer = drain(this, buffer, streamingValues, maxLineBytes, () => discarding, (value) => { discarding = value; });
+                callback();
+            }
+            catch (error) {
+                callback(error);
+            }
+        },
+        flush(callback) {
+            try {
+                buffer += decoder.end();
+                if (!discarding && buffer.length > 0)
+                    this.push(redactCredentialText(buffer, streamingValues).text);
+                callback();
+            }
+            catch (error) {
+                callback(error);
+            }
+        },
+    });
+}
+function drain(stream, input, credentialValues, maxLineBytes, isDiscarding, setDiscarding) {
+    let buffer = input;
+    for (;;) {
+        const newline = buffer.indexOf("\n");
+        if (isDiscarding()) {
+            if (newline < 0)
+                return "";
+            buffer = buffer.slice(newline + 1);
+            setDiscarding(false);
+            continue;
+        }
+        if (newline >= 0) {
+            const line = buffer.slice(0, newline + 1);
+            buffer = buffer.slice(newline + 1);
+            if (Buffer.byteLength(line) > maxLineBytes)
+                stream.push(`${OVERSIZED_LINE_MARKER}\n`);
+            else
+                stream.push(redactCredentialText(line, credentialValues).text);
+            continue;
+        }
+        if (Buffer.byteLength(buffer) > maxLineBytes) {
+            stream.push(`${OVERSIZED_LINE_MARKER}\n`);
+            buffer = "";
+            setDiscarding(true);
+        }
+        return buffer;
+    }
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function increment(counts, rule, count = 1) {
+    counts.set(rule, (counts.get(rule) ?? 0) + count);
+}
+//# sourceMappingURL=credential-redaction.js.map

package/dist/src/foundation/credential-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-redaction.js","sourceRoot":"","sources":["../../../src/foundation/credential-redaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC;AACxD,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAE,qBAAqB;IACpH,mBAAmB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,gBAAgB;IAChI,sBAAsB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,uBAAuB;IACzH,mBAAmB,EAAE,YAAY,EAAE,oBAAoB,EAAE,cAAc,EAAE,UAAU;CAC3E,CAAC;AACX,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AAC9D,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C,MAAM,UAAU,GAAgE;IAC9E,EAAE,EAAE,EAAE,yBAAyB,EAAE,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,UAAU,2BAA2B,EAAE,EAAE;IACvI,EAAE,EAAE,EAAE,qBAAqB,EAAE,OAAO,EAAE,sCAAsC,EAAE,WAAW,EAAE,2BAA2B,EAAE;IACxH,EAAE,EAAE,EAAE,iBAAiB,EAAE,OAAO,EAAE,0FAA0F,EAAE,WAAW,EAAE,KAAK,2BAA2B,EAAE,EAAE;CAChL,CAAC;AAEF,MAAM,aAAa,GAAG,qIAAqI,CAAC;AAC5J,MAAM,YAAY,GAAG,0NAA0N,CAAC;AAOhP,oGAAoG;AACpG,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,UAAU,GAAG,KAAK;SACrB,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;WACnD,iGAAiG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAC1H,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,mBAAsC,EAAE,EACxC,aAAa,GAAG,KAAK;IAErB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC3H,MAAM,OAAO,GAAG,oBAAoB,CAAE,KAAe,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC;IAC9G,MAAM,MAAM,GAAG,cAAc,CAAC;IAC9B,OAAO,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;AACnH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,mBAAsC,EAAE;IAC1F,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;SAC7E,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACnE,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE;YAChC,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,2BAA2B,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS,CAAC,UAAU,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC;IACD,2EAA2E;IAC3E,yEAAyE;IACzE,kEAAkE;IAClE,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;QACpD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,MAAc,EAAE,EAAE;QAC5D,SAAS,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAC7C,OAAO,GAAG,MAAM,GAAG,2BAA2B,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;IACH,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAc,EAAE,OAAe,EAAE,EAAE;QAC5E,SAAS,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,2BAA2B,GAAG,KAAK,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAwB,EAAE,GAAsB;IACtF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;QAChH,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,0EAA0E;YAC1E,wEAAwE;YACxE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,CAAC,KAAc,EAAQ,EAAE;wBACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;4BAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;6BACnE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;4BAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;oBACrF,CAAC,CAAC;oBACF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC,CAAC,8DAA8D,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,gBAAmC,EACnC,YAAY,GAAG,sBAAsB;IAErC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;IAC9H,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChJ,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,OAAO,IAAI,SAAS,CAAC;QACnB,SAAS,CAAC,KAAsB,EAAE,SAAS,EAAE,QAAQ;YACnD,IAAI,CAAC;gBACH,MAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACnE,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClH,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,QAAQ,CAAC,KAAc,CAAC,CAAC;YAAC,CAAC;QAC/C,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,IAAI,CAAC;gBACH,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBACxB,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC;gBACpG,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,QAAQ,CAAC,KAAc,CAAC,CAAC;YAAC,CAAC;QAC/C,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CACZ,MAAiB,EACjB,KAAa,EACb,gBAAmC,EACnC,YAAoB,EACpB,YAA2B,EAC3B,aAAuC;IAEvC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,SAAS,CAAC;QACR,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,YAAY,EAAE,EAAE,CAAC;YACnB,IAAI,OAAO,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC3B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YACnC,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;YAC1C,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,YAAY;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAqB,IAAI,CAAC,CAAC;;gBACjF,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAqB,IAAI,CAAC,CAAC;YAC1C,MAAM,GAAG,EAAE,CAAC;YACZ,aAAa,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,SAAS,CAAC,MAA2B,EAAE,IAAY,EAAE,KAAK,GAAG,CAAC;IACrE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;AACpD,CAAC"}

package/dist/src/foundation/environment-image-references.js

@@ -0,0 +1,59 @@
+import path from "node:path";
+import { atomicWriteJSON, readJSON } from "./fs.js";
+import { statePaths } from "./config.js";
+import { withFileLock } from "./locks.js";
+const REFERENCE_FILE = "environment-image-refs.json";
+export function withEnvironmentImageReferenceLock(root, operation) {
+    return withFileLock(statePaths(root).environmentImageReferenceLocks, "global", operation, {
+        timeoutCode: "environment_image_references_locked",
+        timeoutExitCode: 12,
+    });
+}
+export async function beginEvalEnvironmentImagePlanning(evalDirectory, evalId) {
+    return writeReferences(evalDirectory, evalId, "planning", []);
+}
+export async function writeEvalEnvironmentImageReferences(evalDirectory, evalId, images) {
+    if (!/^eval_[a-f0-9]{32}$/.test(evalId))
+        throw new TypeError("environment image reference eval identity is invalid");
+    const imageIds = [...new Set(images.map((image) => image.image_id))].sort(compare);
+    if (imageIds.some((imageId) => !/^sha256:[a-f0-9]{64}$/.test(imageId)))
+        throw new TypeError("environment image references are invalid");
+    return writeReferences(evalDirectory, evalId, "planned", imageIds);
+}
+async function writeReferences(evalDirectory, evalId, state, imageIds) {
+    if (!/^eval_[a-f0-9]{32}$/.test(evalId))
+        throw new TypeError("environment image reference eval identity is invalid");
+    const record = {
+        schema_version: "1",
+        eval_id: evalId,
+        state,
+        image_ids: imageIds,
+        updated_at: new Date().toISOString(),
+    };
+    await atomicWriteJSON(path.join(evalDirectory, REFERENCE_FILE), record);
+    return record;
+}
+export async function readEvalEnvironmentImageReferences(evalDirectory, expectedEvalId) {
+    const value = await readJSON(path.join(evalDirectory, REFERENCE_FILE), null);
+    if (value === null)
+        return null;
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new TypeError("environment image references must be an object");
+    const record = value;
+    const imageIds = record.image_ids;
+    if (Object.keys(record).some((key) => !["schema_version", "eval_id", "state", "image_ids", "updated_at"].includes(key))
+        || record.schema_version !== "1" || record.eval_id !== expectedEvalId
+        || record.state !== "planning" && record.state !== "planned"
+        || !Array.isArray(imageIds) || imageIds.some((entry) => typeof entry !== "string" || !/^sha256:[a-f0-9]{64}$/.test(entry))
+        || new Set(imageIds).size !== imageIds.length
+        || !imageIds.every((entry, index) => index === 0 || compare(imageIds[index - 1], entry) < 0)
+        || typeof record.updated_at !== "string" || !Number.isFinite(Date.parse(record.updated_at))
+        || record.state === "planning" && imageIds.length !== 0) {
+        throw new TypeError("environment image references are invalid");
+    }
+    return record;
+}
+function compare(left, right) {
+    return Buffer.compare(Buffer.from(left), Buffer.from(right));
+}
+//# sourceMappingURL=environment-image-references.js.map

package/dist/src/foundation/environment-image-references.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment-image-references.js","sourceRoot":"","sources":["../../../src/foundation/environment-image-references.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,cAAc,GAAG,6BAA6B,CAAC;AAUrD,MAAM,UAAU,iCAAiC,CAAI,IAAY,EAAE,SAA2B;IAC5F,OAAO,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,8BAA8B,EAAE,QAAQ,EAAE,SAAS,EAAE;QACxF,WAAW,EAAE,qCAAqC;QAClD,eAAe,EAAE,EAAE;KACpB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,aAAqB,EACrB,MAAc;IAEd,OAAO,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,aAAqB,EACrB,MAAc,EACd,MAAwC;IAExC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IACrH,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;IACxI,OAAO,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,aAAqB,EACrB,MAAc,EACd,KAAgD,EAChD,QAAkB;IAElB,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IACrH,MAAM,MAAM,GAAqC;QAC/C,cAAc,EAAE,GAAG;QACnB,OAAO,EAAE,MAAM;QACf,KAAK;QACL,SAAS,EAAE,QAAQ;QACnB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC;IACF,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,aAAqB,EACrB,cAAsB;IAEtB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAiB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7F,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IACvI,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;IAClC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;WAClH,MAAM,CAAC,cAAc,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc;WAClE,MAAM,CAAC,KAAK,KAAK,UAAU,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;WACzD,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;WACvH,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;WAC1C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAW,EAAE,KAAe,CAAC,GAAG,CAAC,CAAC;WAC7G,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;WACxF,MAAM,CAAC,KAAK,KAAK,UAAU,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAqD,CAAC;AAC/D,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa;IAC1C,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/src/foundation/executable.js

@@ -8,12 +8,14 @@ import { terminateProcess } from "./process.js";
 export function runCommand(executable, args, { cwd, env = process.env, failureCode = "internal_error", failureExitCode = 12, timeoutMs = 30 * 60 * 1_000, signal, } = {}) {
     throwIfAborted(signal);
     return new Promise((resolve, reject) => {
-        const child = spawn(executable, args, {
+        const invocation = prepareSpawnCommand(executable, args);
+        const child = spawn(invocation.executable, invocation.args, {
             cwd,
             env,
             stdio: ["ignore", "pipe", "pipe"],
             windowsHide: true,
             detached: process.platform !== "win32",
+            windowsVerbatimArguments: invocation.windowsVerbatimArguments,
         });
         let stdout = "";
         let stderr = "";
@@ -62,7 +64,9 @@ export function commandExecutable(command, env) {
         bun: "HITCH_BUN_PATH",
         pnpm: "HITCH_PNPM_PATH",
     }[command];
-    return override && env[override]?.trim() ? env[override].trim() : command;
+    if (override && env[override]?.trim())
+        return env[override].trim();
+    return process.platform === "win32" && new Set(["npm", "pnpm"]).has(command) ? `${command}.cmd` : command;
 }
 export async function commandVersion(executable, env, signal) {
     try {
@@ -81,10 +85,13 @@ function throwIfAborted(signal) {
 function cancelledError() {
     return new HitchError("harness preparation cancelled", { code: "cancelled", exitCode: 9 });
 }
-export async function resolveExecutable(command, searchPath) {
-    const candidates = isAbsolute(command) || command.includes("/") || command.includes("\\")
+export async function resolveExecutable(command, searchPath, pathExt = process.env.PATHEXT || ".COM;.EXE;.BAT;.CMD") {
+    const bases = isAbsolute(command) || command.includes("/") || command.includes("\\")
         ? [resolve(command)]
         : searchPath.split(delimiter).filter(Boolean).map((directory) => join(directory, command));
+    const extensions = process.platform === "win32" ? pathExt.split(";").map((entry) => entry.trim()).filter(Boolean) : [];
+    const knownExtension = extensions.some((extension) => command.toLowerCase().endsWith(extension.toLowerCase()));
+    const candidates = bases.flatMap((base) => knownExtension ? [base] : [base, ...extensions.map((extension) => `${base}${extension}`)]);
     for (const candidate of candidates) {
         try {
             await access(candidate, constants.X_OK);
@@ -101,7 +108,12 @@ export async function resolveExecutable(command, searchPath) {
 }
 export async function detectVersion(executable, args, timeoutMs = 5_000) {
     return new Promise((resolveVersion) => {
-        const child = spawn(executable, args, { stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+        const invocation = prepareSpawnCommand(executable, args);
+        const child = spawn(invocation.executable, invocation.args, {
+            stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true,
+            windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+        });
         let stdout = "";
         let stderr = "";
         const timer = setTimeout(() => child.kill("SIGKILL"), timeoutMs);
@@ -117,6 +129,34 @@ export async function detectVersion(executable, args, timeoutMs = 5_000) {
         });
     });
 }
+export function prepareSpawnCommand(executable, args, { platform = process.platform, comspec = process.env.ComSpec || process.env.COMSPEC || "cmd.exe" } = {}) {
+    if (platform !== "win32" || !/\.(?:cmd|bat)$/i.test(executable)) {
+        return { executable, args: [...args], windowsVerbatimArguments: false };
+    }
+    if ([executable, ...args].some((value) => value.includes("\0") || /[\r\n]/.test(value))) {
+        throw new HitchError("Windows batch command contains an unsupported control character", { code: "invalid_input", exitCode: 2 });
+    }
+    const doubleEscape = /node_modules[\\/]+\.bin[\\/]+[^\\/]+\.cmd$/i.test(executable);
+    const commandLine = [escapeWindowsCommand(executable), ...args.map((argument) => escapeWindowsArgument(argument, doubleEscape))].join(" ");
+    return {
+        executable: comspec,
+        args: ["/d", "/s", "/c", `"${commandLine}"`],
+        windowsVerbatimArguments: true,
+    };
+}
+const WINDOWS_CMD_META = /([()\][%!^"`<>&|;,*? ])/g;
+function escapeWindowsCommand(value) {
+    return value.replace(WINDOWS_CMD_META, "^$1");
+}
+function escapeWindowsArgument(value, doubleEscapeMetaCharacters) {
+    let escaped = value.replace(/(\\*)"/g, "$1$1\\\"");
+    escaped = escaped.replace(/(\\*)$/, "$1$1");
+    escaped = `"${escaped}"`;
+    escaped = escaped.replace(WINDOWS_CMD_META, "^$1");
+    if (doubleEscapeMetaCharacters)
+        escaped = escaped.replace(WINDOWS_CMD_META, "^$1");
+    return escaped;
+}
 export async function fingerprintExecutable(executable) {
     const hash = createHash("sha256");
     for await (const chunk of createReadStream(executable))

package/dist/src/foundation/executable.js.map

@@ -1 +1 @@
-{"version":3,"file":"executable.js","sourceRoot":"","sources":["../../../src/foundation/executable.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,IAAI,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAgBhD,MAAM,UAAU,UAAU,CAAC,UAAkB,EAAE,IAAc,EAAE,EAC7D,GAAG,EACH,GAAG,GAAG,OAAO,CAAC,GAAG,EACjB,WAAW,GAAG,gBAAgB,EAC9B,eAAe,GAAG,EAAE,EACpB,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,EAC3B,MAAM,MACe,EAAE;IACvB,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;YACpC,GAAG;YACH,GAAG;YACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;SACvC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,KAAsB,EAAE,EAAE,CAAC,GAAG,OAAO,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC;QACnG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACnF,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,CAAC,QAAoB,EAAE,EAAE;YACtC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YACnD,QAAQ,EAAE,CAAC;QACb,CAAC,CAAC;QACF,MAAM,YAAY,GAAG,GAAG,EAAE;YACxB,OAAO,GAAG,IAAI,CAAC;YACf,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1C,CAAC,CAAC;QACF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;YACnC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,mBAAmB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,EAAE;gBACnG,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,eAAe;gBACzB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,aAAoC,EAAE,EAAE;YAChF,IAAI,OAAO;gBAAE,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;YAC3D,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACjE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAChC,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,qBAAqB,IAAI,IAAI,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAC5I,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,CACjD,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,GAAsB;IACvE,MAAM,QAAQ,GAAG;QACf,GAAG,EAAE,gBAAgB;QACrB,GAAG,EAAE,gBAAgB;QACrB,KAAK,EAAE,kBAAkB;QACzB,GAAG,EAAE,gBAAgB;QACrB,IAAI,EAAE,iBAAiB;KACxB,CAAC,OAAO,CAAC,CAAC;IACX,OAAO,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB,EAAE,GAAsB,EAAE,MAA+B;IAC9G,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACrH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAAoB,EAAE,IAAI,KAAK,WAAW;YAAE,MAAM,KAAK,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAA+B;IACrD,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,cAAc,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,IAAI,UAAU,CAAC,+BAA+B,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,UAAkB;IACzE,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACvF,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACpB,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,SAAS;YACjC,OAAO,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkB,EAAE,IAAc,EAAE,SAAS,GAAG,KAAK;IACvF,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAChG,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;QACjE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,cAAc,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,cAAc,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,UAAkB;IAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,gBAAgB,CAAC,UAAU,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,KAAe,CAAC,CAAC;IACrF,OAAO,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IAC9D,MAAM,cAAc,GAAG,wDAAwD,CAAC;IAChF,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACvH,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}
+{"version":3,"file":"executable.js","sourceRoot":"","sources":["../../../src/foundation/executable.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,IAAI,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAsBhD,MAAM,UAAU,UAAU,CAAC,UAAkB,EAAE,IAAc,EAAE,EAC7D,GAAG,EACH,GAAG,GAAG,OAAO,CAAC,GAAG,EACjB,WAAW,GAAG,gBAAgB,EAC9B,eAAe,GAAG,EAAE,EACpB,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,EAC3B,MAAM,MACe,EAAE;IACvB,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE;YAC1D,GAAG;YACH,GAAG;YACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;YACtC,wBAAwB,EAAE,UAAU,CAAC,wBAAwB;SAC9D,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,KAAsB,EAAE,EAAE,CAAC,GAAG,OAAO,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC;QACnG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACnF,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,CAAC,QAAoB,EAAE,EAAE;YACtC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YACnD,QAAQ,EAAE,CAAC;QACb,CAAC,CAAC;QACF,MAAM,YAAY,GAAG,GAAG,EAAE;YACxB,OAAO,GAAG,IAAI,CAAC;YACf,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1C,CAAC,CAAC;QACF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;YACnC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,mBAAmB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,EAAE;gBACnG,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,eAAe;gBACzB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,aAAoC,EAAE,EAAE;YAChF,IAAI,OAAO;gBAAE,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;YAC3D,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACjE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAChC,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,qBAAqB,IAAI,IAAI,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAC5I,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,CACjD,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,GAAsB;IACvE,MAAM,QAAQ,GAAG;QACf,GAAG,EAAE,gBAAgB;QACrB,GAAG,EAAE,gBAAgB;QACrB,KAAK,EAAE,kBAAkB;QACzB,GAAG,EAAE,gBAAgB;QACrB,IAAI,EAAE,iBAAiB;KACxB,CAAC,OAAO,CAAC,CAAC;IACX,IAAI,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAC5G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB,EAAE,GAAsB,EAAE,MAA+B;IAC9G,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACrH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAAoB,EAAE,IAAI,KAAK,WAAW;YAAE,MAAM,KAAK,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAA+B;IACrD,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,cAAc,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,IAAI,UAAU,CAAC,+BAA+B,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,UAAkB,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,qBAAqB;IACjI,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAClF,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACpB,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvH,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC/G,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;IACtI,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,SAAS;YACjC,OAAO,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkB,EAAE,IAAc,EAAE,SAAS,GAAG,KAAK;IACvF,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;QACpC,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE;YAC1D,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,WAAW,EAAE,IAAI;YACjB,wBAAwB,EAAE,UAAU,CAAC,wBAAwB;SAC9D,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;QACjE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,cAAc,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,cAAc,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,UAAkB,EAClB,IAAc,EACd,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,KAAuD,EAAE;IAEzJ,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,UAAU,CAAC,iEAAiE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IAClI,CAAC;IACD,MAAM,YAAY,GAAG,6CAA6C,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpF,MAAM,WAAW,GAAG,CAAC,oBAAoB,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,qBAAqB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3I,OAAO;QACL,UAAU,EAAE,OAAO;QACnB,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,WAAW,GAAG,CAAC;QAC5C,wBAAwB,EAAE,IAAI;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAEpD,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa,EAAE,0BAAmC;IAC/E,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACnD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,OAAO,GAAG,IAAI,OAAO,GAAG,CAAC;IACzB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,0BAA0B;QAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACnF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,UAAkB;IAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,gBAAgB,CAAC,UAAU,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,KAAe,CAAC,CAAC;IACrF,OAAO,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IAC9D,MAAM,cAAc,GAAG,wDAAwD,CAAC;IAChF,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACvH,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/src/foundation/fs.js

@@ -1,4 +1,4 @@
-import { mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { chmod, mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { randomBytes } from "node:crypto";
 import path from "node:path";
 export async function ensureDir(directory) {
@@ -41,5 +41,6 @@ export async function removeIfExists(file) {
 export async function writePrivateFile(file, value) {
     await ensureDir(path.dirname(file));
     await writeFile(file, value, { mode: 0o600 });
+    await chmod(file, 0o600);
 }
 //# sourceMappingURL=fs.js.map

package/dist/src/foundation/fs.js.map

@@ -1 +1 @@
-{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../../src/foundation/fs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,SAAiB;IAC/C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAc,IAAY,EAAE,QAAY;IACpE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QACnG,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,KAAc,EAAE,IAAI,GAAG,KAAK;IAC9E,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC/F,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,KAAa;IAC1D,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IAChE,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../../src/foundation/fs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,SAAiB;IAC/C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAc,IAAY,EAAE,QAAY;IACpE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QACnG,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,KAAc,EAAE,IAAI,GAAG,KAAK;IAC9E,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC/F,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,KAAa;IAC1D,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAA0B;IAC7E,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC"}

package/dist/src/foundation/index.js

@@ -1,11 +1,15 @@
-export { DEFAULT_MAX_CONCURRENT, DEFAULT_PORT, SCHEMA_VERSION, defaultRoot, parseDuration, positiveInteger, statePaths } from "./config.js";
+export { DEFAULT_MAX_CONCURRENT, DEFAULT_PORT, SCHEMA_VERSION, defaultRoot, hitchRootId, parseDuration, positiveInteger, statePaths } from "./config.js";
 export { HitchError, invalidInput } from "./errors.js";
 export { appendLine, atomicWriteJSON, ensureDir, readJSON, removeIfExists, writePrivateFile } from "./fs.js";
+export { openContainedRegularFile } from "./contained-file.js";
 export { reclaimStaleLock } from "./locks.js";
 export { withFileLock } from "./locks.js";
+export { captureProcessIdentity, inspectProcessIdentity, validateProcessIdentity } from "./process-identity.js";
+export { beginEvalEnvironmentImagePlanning, readEvalEnvironmentImageReferences, withEnvironmentImageReferenceLock, writeEvalEnvironmentImageReferences } from "./environment-image-references.js";
 export { consumeLines } from "./line-stream.js";
 export { packageRoot, packageVersion } from "./package-root.js";
 export { delay, terminateProcess } from "./process.js";
-export { commandExecutable, commandVersion, detectVersion, fingerprintExecutable, resolveExecutable, runCommand, selectVersionLine } from "./executable.js";
+export { commandExecutable, commandVersion, detectVersion, fingerprintExecutable, prepareSpawnCommand, resolveExecutable, runCommand, selectVersionLine } from "./executable.js";
 export { canonicalJSON, digest, sha256Bytes, sha256JSON } from "./hash.js";
+export { CREDENTIAL_REDACTION_MARKER, PROVIDER_ENVIRONMENT_NAMES, createCredentialRedactionTransform, credentialValuesFromEnv, isSensitiveFieldName, redactCredentialText, safeDiagnosticMessage } from "./credential-redaction.js";
 //# sourceMappingURL=index.js.map

package/dist/src/foundation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/foundation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE5I,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC7G,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAE5J,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/foundation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzJ,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAA6B,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhH,OAAO,EAAE,iCAAiC,EAAE,kCAAkC,EAAE,iCAAiC,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AAElM,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEjL,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,kCAAkC,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/src/foundation/process-identity.js

@@ -0,0 +1,69 @@
+import { spawn } from "node:child_process";
+import { sha256JSON } from "./hash.js";
+export async function captureProcessIdentity(pid) {
+    const snapshot = await processSnapshot(pid);
+    if (!snapshot || terminalState(snapshot.state))
+        return null;
+    return {
+        pid,
+        start_identity: sha256JSON({ pid, started: snapshot.started, command: snapshot.command }),
+        observed_at: new Date().toISOString(),
+    };
+}
+export async function inspectProcessIdentity(identity) {
+    validateProcessIdentity(identity);
+    const snapshot = await processSnapshot(identity.pid);
+    if (!snapshot)
+        return "terminal";
+    const current = sha256JSON({ pid: identity.pid, started: snapshot.started, command: snapshot.command });
+    if (current !== identity.start_identity)
+        return "identity-mismatch";
+    return terminalState(snapshot.state) ? "terminal" : "running";
+}
+export function validateProcessIdentity(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new TypeError("process identity must be an object");
+    const record = value;
+    if (Object.keys(record).some((key) => !new Set(["pid", "start_identity", "observed_at"]).has(key))
+        || !Number.isSafeInteger(record.pid) || record.pid < 1
+        || typeof record.start_identity !== "string" || !/^sha256:[a-f0-9]{64}$/.test(record.start_identity)
+        || typeof record.observed_at !== "string" || !Number.isFinite(Date.parse(record.observed_at))) {
+        throw new TypeError("process identity is invalid");
+    }
+    return record;
+}
+async function processSnapshot(pid) {
+    if (!Number.isSafeInteger(pid) || pid < 1)
+        throw new TypeError("process pid must be a positive safe integer");
+    if (process.platform === "win32")
+        return null;
+    const output = await runPs(pid);
+    if (output.code === 1 && output.stdout.trim() === "")
+        return null;
+    if (output.code !== 0)
+        return null;
+    const fields = output.stdout.trim().split(/\s+/);
+    if (fields.length < 7)
+        return null;
+    const state = fields.at(-1);
+    const command = fields.at(-2);
+    const started = fields.slice(0, -2).join(" ");
+    return started && command && state ? { started, command, state } : null;
+}
+function runPs(pid) {
+    return new Promise((resolve) => {
+        const child = spawn("/bin/ps", ["-o", "lstart=", "-o", "comm=", "-o", "stat=", "-p", String(pid)], {
+            env: { PATH: "/usr/bin:/bin", LC_ALL: "C" },
+            stdio: ["ignore", "pipe", "ignore"],
+            windowsHide: true,
+        });
+        let stdout = "";
+        child.stdout.on("data", (chunk) => { stdout = `${stdout}${chunk.toString("utf8")}`.slice(-8_192); });
+        child.once("error", () => resolve({ code: null, stdout: "" }));
+        child.once("close", (code) => resolve({ code, stdout }));
+    });
+}
+function terminalState(state) {
+    return state.startsWith("Z") || state.startsWith("X");
+}
+//# sourceMappingURL=process-identity.js.map

package/dist/src/foundation/process-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-identity.js","sourceRoot":"","sources":["../../../src/foundation/process-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAUvC,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAAW;IACtD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO;QACL,GAAG;QACH,cAAc,EAAE,UAAU,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QACzF,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAA2B;IACtE,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC;IACjC,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACxG,IAAI,OAAO,KAAK,QAAQ,CAAC,cAAc;QAAE,OAAO,mBAAmB,CAAC;IACpE,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;IAC3H,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;WAC7F,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAK,MAAM,CAAC,GAAc,GAAG,CAAC;WAC/D,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;WACjG,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,SAAS,CAAC,6BAA6B,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAsC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAW;IACxC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IAC9G,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAClE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAW,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAW,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO,OAAO,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED,SAAS,KAAK,CAAC,GAAW;IACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE;YACjG,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE;YAC3C,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,GAAG,GAAG,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7G,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACxD,CAAC"}

package/dist/src/images/context.js

@@ -0,0 +1,47 @@
+import { lstat, readFile, readdir } from "node:fs/promises";
+import path from "node:path";
+import { sha256Bytes, sha256JSON } from "../foundation/index.js";
+export async function resolveBuildContext(contextDirectory, dockerfile = "Dockerfile") {
+    const root = path.resolve(contextDirectory);
+    const rootStat = await lstat(root);
+    if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
+        throw new TypeError("image build context must be a real directory");
+    if (!dockerfile || path.isAbsolute(dockerfile) || dockerfile.includes("\\"))
+        throw new TypeError("image Dockerfile path is invalid");
+    const dockerfileParts = dockerfile.split("/");
+    if (dockerfileParts.some((part) => !part || part === "." || part === ".."))
+        throw new TypeError("image Dockerfile path is invalid");
+    const files = await contextFiles(root);
+    const dockerfileEntry = files.find((entry) => entry.path === dockerfile);
+    if (!dockerfileEntry)
+        throw new TypeError("image Dockerfile is not a regular context file");
+    return {
+        context_directory: root,
+        dockerfile,
+        context_digest: sha256JSON(files),
+        dockerfile_digest: dockerfileEntry.digest,
+    };
+}
+async function contextFiles(root) {
+    const files = [];
+    const visit = async (directory) => {
+        const entries = (await readdir(directory, { withFileTypes: true })).sort((left, right) => Buffer.compare(Buffer.from(left.name), Buffer.from(right.name)));
+        for (const entry of entries) {
+            const absolute = path.join(directory, entry.name);
+            const stat = await lstat(absolute);
+            if (stat.isSymbolicLink() || (!stat.isDirectory() && !stat.isFile()))
+                throw new TypeError(`image build context contains unsupported file: ${entry.name}`);
+            if (stat.isDirectory())
+                await visit(absolute);
+            else
+                files.push({
+                    path: path.relative(root, absolute).split(path.sep).join("/"),
+                    digest: sha256Bytes(await readFile(absolute)),
+                    executable: (stat.mode & 0o111) !== 0,
+                });
+        }
+    };
+    await visit(root);
+    return files;
+}
+//# sourceMappingURL=context.js.map

package/dist/src/images/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../src/images/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AASjE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,gBAAwB,EAAE,UAAU,GAAG,YAAY;IAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IAC9H,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IACrI,MAAM,eAAe,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IACpI,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,eAAe;QAAE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IAC5F,OAAO;QACL,iBAAiB,EAAE,IAAI;QACvB,UAAU;QACV,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC;QACjC,iBAAiB,EAAE,eAAe,CAAC,MAAM;KAC1C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,MAAM,KAAK,GAAiE,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAG,KAAK,EAAE,SAAiB,EAAiB,EAAE;QACvD,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3J,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,kDAAkD,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1J,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;;gBACzC,KAAK,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;oBAC7D,MAAM,EAAE,WAAW,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBAC7C,UAAU,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACF,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,KAAK,CAAC;AACf,CAAC"}