agentic-engineering-harness 0.4.16 → 0.5.1

package/dist/paseo/start.js

@@ -0,0 +1,155 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { loadResolvedAgentTopology } from "../agents/config.js";
+import { executionSelectionForAgent } from "../agents/routing.js";
+import { setupToolchain } from "../toolchain/setup.js";
+import { clearToolchainEnvCache, commandExists, runProcess } from "../utils/process.js";
+export const PASEO_BOOTSTRAP_VERSION = 1;
+const DEFAULT_DEPS = {
+    run: runProcess,
+    commandExists,
+    setupToolchain,
+    loadTopology: loadResolvedAgentTopology
+};
+export async function startPaseoHarness(root, config, options = {}, deps = DEFAULT_DEPS) {
+    const projectRoot = path.resolve(root);
+    const settings = config.orchestration?.interactive;
+    const autoSetup = options.autoSetup ?? settings?.autoSetup ?? true;
+    const webUi = options.webUi ?? settings?.webUi ?? true;
+    const forceNew = options.forceNew ?? false;
+    const reuseSession = settings?.reuseSession ?? true;
+    const stateDir = path.resolve(projectRoot, settings?.stateDir ?? ".harness/paseo");
+    const stateFile = path.join(stateDir, "lead-session.json");
+    const bootstrapFile = path.join(stateDir, "lead-bootstrap.md");
+    const topology = await deps.loadTopology(projectRoot, config, config.agents?.activeProfile);
+    const leadName = resolveLeadAgent(topology, options.leadAgent ?? settings?.leadAgent);
+    const lead = topology.agents[leadName];
+    const selection = executionSelectionForAgent(topology, leadName);
+    const runtimeCommand = runtimeExecutable(topology, leadName);
+    const missingBefore = await missingCommands(projectRoot, ["paseo", runtimeCommand], deps);
+    if (missingBefore.length && autoSetup) {
+        await deps.setupToolchain(projectRoot, config, { skipProjectDependencies: true });
+        clearToolchainEnvCache();
+    }
+    const missingAfter = await missingCommands(projectRoot, ["paseo", runtimeCommand], deps);
+    if (missingAfter.length)
+        throw new Error(`aeh start cannot launch Paseo because these managed commands are unavailable: ${missingAfter.join(", ")}. Run aeh setup or provide the required host prerequisite/credential.`);
+    let daemonStarted = false;
+    const daemonStatus = await deps.run("paseo daemon status --json", { cwd: projectRoot, timeoutMs: 30_000 });
+    if (daemonStatus.exitCode !== 0) {
+        const startCommand = webUi ? "paseo daemon start --web-ui" : "paseo daemon start";
+        const daemonStart = await deps.run(startCommand, { cwd: projectRoot, timeoutMs: 60_000 });
+        if (daemonStart.exitCode !== 0)
+            throw new Error(`Failed to start Paseo daemon: ${diagnostic(daemonStart)}`);
+        daemonStarted = true;
+        const verify = await deps.run("paseo daemon status --json", { cwd: projectRoot, timeoutMs: 30_000 });
+        if (verify.exitCode !== 0)
+            throw new Error(`Paseo daemon did not become ready after startup: ${diagnostic(verify)}`);
+    }
+    const provider = selection.paseoProvider;
+    const model = paseoModel(selection);
+    const title = options.title ?? settings?.title ?? `AEH Lead · ${config.project.name}`;
+    const aehCommand = options.aehCommand ?? "aeh";
+    const bootstrap = buildPaseoLeadBootstrap(config.project.name, projectRoot, aehCommand);
+    await fs.mkdir(stateDir, { recursive: true });
+    await fs.writeFile(bootstrapFile, `${bootstrap}\n`);
+    if (!forceNew && reuseSession) {
+        const existing = await loadState(stateFile);
+        if (existing && compatibleState(existing, { projectRoot, leadName, provider, model, title })) {
+            const probe = await deps.run(`paseo logs ${quote(existing.agentId)} --tail 1`, { cwd: projectRoot, timeoutMs: 30_000 });
+            if (probe.exitCode === 0)
+                return { daemonStarted, session: "reused", agentId: existing.agentId, title: existing.title, leadAgent: existing.leadAgent, provider: existing.provider, model: existing.model, stateFile, bootstrapFile };
+        }
+    }
+    const launch = await deps.run([
+        "paseo run --background --quiet",
+        `--title ${quote(title)}`,
+        `--provider ${quote(provider)}`,
+        `--model ${quote(model)}`,
+        quote(bootstrap)
+    ].join(" "), { cwd: projectRoot, timeoutMs: 60_000 });
+    if (launch.exitCode !== 0)
+        throw new Error(`Failed to create persistent AEH lead in Paseo: ${diagnostic(launch)}`);
+    const agentId = extractAgentId(launch.stdout);
+    if (!agentId)
+        throw new Error(`Paseo created no parseable agent id. Output: ${launch.stdout.trim() || "<empty>"}`);
+    const wait = await deps.run(`paseo wait ${quote(agentId)} --timeout 300`, { cwd: projectRoot, timeoutMs: 330_000 });
+    if (wait.exitCode !== 0)
+        throw new Error(`AEH lead bootstrap did not complete successfully: ${diagnostic(wait)}`);
+    const state = {
+        version: 1,
+        bootstrapVersion: PASEO_BOOTSTRAP_VERSION,
+        projectRoot,
+        projectName: config.project.name,
+        agentId,
+        title,
+        leadAgent: leadName,
+        provider,
+        model,
+        createdAt: new Date().toISOString()
+    };
+    await fs.writeFile(stateFile, `${JSON.stringify(state, null, 2)}\n`);
+    return { daemonStarted, session: "created", agentId, title, leadAgent: leadName, provider, model, stateFile, bootstrapFile };
+}
+export function buildPaseoLeadBootstrap(projectName, projectRoot, aehCommand) {
+    return `AEH persistent Paseo lead bootstrap v${PASEO_BOOTSTRAP_VERSION}.
+
+You are the persistent top-level engineering lead for project ${JSON.stringify(projectName)} at ${JSON.stringify(projectRoot)}. This instruction governs every later user message in this Paseo conversation.
+
+Before handling repository-changing work, read AGENTS.md and .harness/skills/engineering-workflow/SKILL.md when present. Treat every natural-language request that could modify the repository as input to the Agentic Engineering Harness workflow. The user must not have to mention AEH, QUICK, SPEC, SDD, TaskContract, validators, reviewers, Graphify, workers, or any Harness command.
+
+Whenever the workflow skill says \`aeh\`, invoke the Harness through this command on this machine: \`${aehCommand}\`.
+
+Required behavior for mutating engineering requests:
+1. inspect repository context and automatically build triage evidence;
+2. run deterministic QUICK/SPEC triage and obey the result without manual downgrade;
+3. create/validate the QuickContract or complete SDD/TaskContract as required;
+4. seal normative inputs before implementation;
+5. invoke the Harness run so routed workers, planner waves, deterministic validators, evidence graph, review convergence, remediation/escalation and lead acceptance execute under the frozen control plane;
+6. never implement directly as a shortcut around Harness execution;
+7. keep implementation/tool/review failures autonomous unless the Harness reaches a true human-on-exception state;
+8. surface concise progress and final acceptance/delivery state to the user.
+
+Read-only questions may be answered directly, but must not mutate repository state. Existing GitHub issue requests must use the issue-driven Harness path. If a QUICK request discovers architecture/security/schema/public-API/cross-module or otherwise unsafe scope, escalate it to SPEC rather than broadening QUICK.
+
+You remain the parent Paseo session. Harness-spawned agents are workers/subagents, not replacements for this lead. Do not ask the user to choose the internal workflow.
+
+Initialize this role now by reading the project entry instructions. Do not start an engineering change until the user supplies one. When initialization is complete, respond with exactly: AEH READY`;
+}
+export function resolveLeadAgent(topology, configured) {
+    if (configured) {
+        const selected = topology.agents[configured];
+        if (!selected || selected.disabled)
+            throw new Error(`Configured interactive lead agent '${configured}' is unavailable.`);
+        return configured;
+    }
+    if (topology.agents.lead && !topology.agents.lead.disabled)
+        return "lead";
+    const orchestrator = Object.values(topology.agents).find((agent) => agent.role === "orchestrator" && !agent.disabled);
+    if (!orchestrator)
+        throw new Error("aeh start requires an enabled orchestrator/lead agent in the resolved topology.");
+    return orchestrator.name;
+}
+function runtimeExecutable(topology, leadName) {
+    const runtime = topology.agents[leadName].runtime;
+    return runtime.command?.trim().split(/\s+/, 1)[0] || runtime.adapter;
+}
+async function missingCommands(root, commands, deps) {
+    const result = [];
+    for (const command of [...new Set(commands.filter(Boolean))])
+        if (!(await deps.commandExists(command, root)))
+            result.push(command);
+    return result;
+}
+function paseoModel(selection) { return selection.runtimeAdapter === "codex" ? selection.modelName : selection.modelId; }
+function extractAgentId(stdout) { return stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).at(-1); }
+async function loadState(file) { try {
+    return JSON.parse(await fs.readFile(file, "utf8"));
+}
+catch {
+    return undefined;
+} }
+function compatibleState(state, expected) { return state.version === 1 && state.bootstrapVersion === PASEO_BOOTSTRAP_VERSION && state.projectRoot === expected.projectRoot && state.leadAgent === expected.leadName && state.provider === expected.provider && state.model === expected.model && state.title === expected.title; }
+function diagnostic(result) { return [result.stderr.trim(), result.stdout.trim()].filter(Boolean).join("\n") || `exit code ${result.exitCode}`; }
+function quote(value) { return `'${value.replaceAll("'", "'\\''")}'`; }
+//# sourceMappingURL=start.js.map

package/dist/paseo/start.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start.js","sourceRoot":"","sources":["../../src/paseo/start.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,UAAU,EAAsB,MAAM,qBAAqB,CAAC;AAE5G,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AA2CzC,MAAM,YAAY,GAAmB;IACnC,GAAG,EAAE,UAAU;IACf,aAAa;IACb,cAAc;IACd,YAAY,EAAE,yBAAyB;CACxC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,MAA4B,EAC5B,UAA6B,EAAE,EAC/B,OAAuB,YAAY;IAEnC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,EAAE,SAAS,IAAI,IAAI,CAAC;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;IACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC3C,MAAM,YAAY,GAAG,QAAQ,EAAE,YAAY,IAAI,IAAI,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,IAAI,gBAAgB,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAE/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,QAAQ,EAAE,SAAS,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,cAAc,GAAG,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE7D,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1F,IAAI,aAAa,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,sBAAsB,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;IACzF,IAAI,YAAY,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IAE1N,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3G,IAAI,YAAY,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAClF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1F,IAAI,WAAW,CAAC,QAAQ,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5G,aAAa,GAAG,IAAI,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACrG,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvH,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,aAAa,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,QAAQ,EAAE,KAAK,IAAI,cAAc,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACtF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC;IAC/C,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IACxF,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,GAAG,SAAS,IAAI,CAAC,CAAC;IAEpD,IAAI,CAAC,QAAQ,IAAI,YAAY,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,QAAQ,IAAI,eAAe,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAC7F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YACxH,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC;gBAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QACvO,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;QAC5B,gCAAgC;QAChC,WAAW,KAAK,CAAC,KAAK,CAAC,EAAE;QACzB,cAAc,KAAK,CAAC,QAAQ,CAAC,EAAE;QAC/B,WAAW,KAAK,CAAC,KAAK,CAAC,EAAE;QACzB,KAAK,CAAC,SAAS,CAAC;KACjB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnH,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,SAAS,EAAE,CAAC,CAAC;IAEnH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IACpH,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAElH,MAAM,KAAK,GAAmB;QAC5B,OAAO,EAAE,CAAC;QACV,gBAAgB,EAAE,uBAAuB;QACzC,WAAW;QACX,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QAChC,OAAO;QACP,KAAK;QACL,SAAS,EAAE,QAAQ;QACnB,QAAQ;QACR,KAAK;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACrE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;AAC/H,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,WAAmB,EAAE,WAAmB,EAAE,UAAkB;IAClG,OAAO,wCAAwC,uBAAuB;;gEAER,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;uGAItB,UAAU;;;;;;;;;;;;;;;;qMAgBoF,CAAC;AACtM,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAA+B,EAAE,UAAmB;IACnF,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,UAAU,mBAAmB,CAAC,CAAC;QACzH,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC1E,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtH,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACtH,OAAO,YAAY,CAAC,IAAI,CAAC;AAC3B,CAAC;AAED,SAAS,iBAAiB,CAAC,QAA+B,EAAE,QAAgB;IAC1E,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;IAClD,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,QAAkB,EAAE,IAAoB;IACnF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnI,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,SAAkC,IAAY,OAAO,SAAS,CAAC,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;AAC1J,SAAS,cAAc,CAAC,MAAc,IAAwB,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/I,KAAK,UAAU,SAAS,CAAC,IAAY,IAAyC,IAAI,CAAC;IAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAmB,CAAC;AAAC,CAAC;AAAC,MAAM,CAAC;IAAC,OAAO,SAAS,CAAC;AAAC,CAAC,CAAC,CAAC;AACzL,SAAS,eAAe,CAAC,KAAqB,EAAE,QAAmG,IAAa,OAAO,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,gBAAgB,KAAK,uBAAuB,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACtb,SAAS,UAAU,CAAC,MAAqB,IAAY,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AACxK,SAAS,KAAK,CAAC,KAAa,IAAY,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC"}

package/dist/policy/bundles.d.ts

@@ -0,0 +1,27 @@
+import type { HarnessProjectConfig } from "../core/types.js";
+export interface PolicyBundleFile {
+    path: string;
+    sha256: string;
+}
+export interface OrganizationPolicyBundleManifest {
+    version: 1;
+    name: string;
+    extends?: string[];
+    policyDirs?: string[];
+    files: PolicyBundleFile[];
+}
+export interface ResolvedPolicyBundle {
+    name: string;
+    root: string;
+    manifestSha256: string;
+    verifiedSignature: boolean;
+    policyDirs: string[];
+    extends: string[];
+}
+export interface PolicyBundleResolution {
+    bundles: ResolvedPolicyBundle[];
+    policyDirs: string[];
+    issues: string[];
+}
+export declare function resolveOrganizationPolicyBundles(root: string, config: HarnessProjectConfig): Promise<PolicyBundleResolution>;
+export declare function withOrganizationPolicies(config: HarnessProjectConfig, resolution: PolicyBundleResolution): HarnessProjectConfig;

package/dist/policy/bundles.js

@@ -0,0 +1,129 @@
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { commandExists, runProcess } from "../utils/process.js";
+export async function resolveOrganizationPolicyBundles(root, config) {
+    const settings = config.organization?.policyBundles;
+    const sources = settings?.sources ?? [];
+    if (!sources.length)
+        return { bundles: [], policyDirs: [], issues: [] };
+    const cacheRoot = path.resolve(root, settings?.cacheDir ?? ".harness/policy-bundles");
+    await fs.mkdir(cacheRoot, { recursive: true });
+    const byName = new Map(sources.map((source) => [source.name, source]));
+    const resolved = new Map();
+    const issues = [];
+    const visiting = new Set();
+    const visit = async (name) => {
+        if (resolved.has(name))
+            return;
+        if (visiting.has(name))
+            throw new Error(`Organization policy bundle inheritance cycle at ${name}.`);
+        const source = byName.get(name);
+        if (!source)
+            throw new Error(`Organization policy bundle '${name}' is referenced but not configured.`);
+        visiting.add(name);
+        try {
+            const bundle = await materializeBundle(root, cacheRoot, source);
+            for (const parent of bundle.extends)
+                await visit(parent);
+            resolved.set(name, bundle);
+        }
+        catch (error) {
+            const message = `${name}: ${String(error)}`;
+            issues.push(message);
+            if (source.required !== false || settings?.required === true)
+                throw new Error(`Required organization policy bundle failed: ${message}`);
+        }
+        finally {
+            visiting.delete(name);
+        }
+    };
+    for (const source of sources)
+        await visit(source.name);
+    const bundles = [...resolved.values()];
+    return { bundles, policyDirs: [...new Set(bundles.flatMap((bundle) => bundle.policyDirs))], issues };
+}
+export function withOrganizationPolicies(config, resolution) {
+    if (!resolution.policyDirs.length)
+        return config;
+    const existing = config.validation?.opa?.policyDirs ?? [];
+    return {
+        ...config,
+        validation: {
+            ...config.validation,
+            opa: { ...config.validation?.opa, enabled: config.validation?.opa?.enabled ?? true, policyDirs: [...new Set([...existing, ...resolution.policyDirs])] }
+        }
+    };
+}
+async function materializeBundle(projectRoot, cacheRoot, source) {
+    const target = path.join(cacheRoot, safe(source.name));
+    await fs.rm(target, { recursive: true, force: true });
+    await fs.mkdir(target, { recursive: true });
+    const loaded = source.path ? await loadLocalManifest(projectRoot, source.path) : await loadRemoteManifest(source.url);
+    if (loaded.manifest.name !== source.name)
+        throw new Error(`manifest name '${loaded.manifest.name}' does not match configured source '${source.name}'.`);
+    const manifestHash = sha256(loaded.raw);
+    if (source.sha256 && source.sha256 !== manifestHash)
+        throw new Error(`manifest SHA-256 mismatch: expected ${source.sha256}, got ${manifestHash}.`);
+    const manifestFile = path.join(target, "bundle.json");
+    await fs.writeFile(manifestFile, loaded.raw);
+    let verifiedSignature = false;
+    if (source.signature || source.publicKey) {
+        if (!source.signature || !source.publicKey)
+            throw new Error("signed bundle requires both signature and publicKey.");
+        verifiedSignature = await verifySignature(projectRoot, manifestFile, source.signature, source.publicKey);
+        if (!verifiedSignature)
+            throw new Error("cosign signature verification failed.");
+    }
+    for (const file of loaded.manifest.files) {
+        if (file.path.includes("..") || path.isAbsolute(file.path))
+            throw new Error(`unsafe bundle file path ${file.path}.`);
+        const content = source.path ? await readLocalBundleFile(projectRoot, source.path, file.path) : await readRemoteBundleFile(source.url, file.path);
+        const actual = sha256(content);
+        if (actual !== file.sha256)
+            throw new Error(`${file.path} SHA-256 mismatch: expected ${file.sha256}, got ${actual}.`);
+        const destination = path.join(target, file.path);
+        await fs.mkdir(path.dirname(destination), { recursive: true });
+        await fs.writeFile(destination, content);
+    }
+    const policyDirs = (loaded.manifest.policyDirs?.length ? loaded.manifest.policyDirs : ["policies"]).map((relative) => path.relative(projectRoot, path.resolve(target, relative)).replaceAll("\\", "/"));
+    return { name: source.name, root: target, manifestSha256: manifestHash, verifiedSignature, policyDirs, extends: loaded.manifest.extends ?? [] };
+}
+async function loadLocalManifest(projectRoot, configuredPath) {
+    const source = path.resolve(projectRoot, configuredPath);
+    const stat = await fs.stat(source);
+    const manifestFile = stat.isDirectory() ? path.join(source, "bundle.json") : source;
+    const raw = await fs.readFile(manifestFile);
+    return { manifest: parseManifest(raw), raw };
+}
+async function loadRemoteManifest(url) {
+    const response = await fetch(url);
+    if (!response.ok)
+        throw new Error(`unable to fetch manifest ${url}: HTTP ${response.status}`);
+    const raw = Buffer.from(await response.arrayBuffer());
+    return { manifest: parseManifest(raw), raw };
+}
+function parseManifest(raw) {
+    const value = JSON.parse(raw.toString("utf8"));
+    if (value.version !== 1 || !value.name || !Array.isArray(value.files))
+        throw new Error("invalid organization policy bundle manifest.");
+    for (const file of value.files)
+        if (!file.path || !/^[a-f0-9]{64}$/.test(file.sha256))
+            throw new Error(`invalid bundle file declaration ${file.path ?? "<missing>"}.`);
+    return value;
+}
+async function readLocalBundleFile(projectRoot, configuredPath, relative) { const source = path.resolve(projectRoot, configuredPath); const stat = await fs.stat(source); const base = stat.isDirectory() ? source : path.dirname(source); return fs.readFile(path.resolve(base, relative)); }
+async function readRemoteBundleFile(manifestUrl, relative) { const url = new URL(relative, manifestUrl).toString(); const response = await fetch(url); if (!response.ok)
+    throw new Error(`unable to fetch bundle file ${url}: HTTP ${response.status}`); return Buffer.from(await response.arrayBuffer()); }
+async function verifySignature(root, manifestFile, signature, publicKey) {
+    if (!(await commandExists("cosign", root)))
+        throw new Error("cosign is required to verify the configured organization policy bundle signature.");
+    const signaturePath = path.resolve(root, signature);
+    const keyPath = path.resolve(root, publicKey);
+    const result = await runProcess(`cosign verify-blob --key ${quote(keyPath)} --signature ${quote(signaturePath)} ${quote(manifestFile)}`, { cwd: root, timeoutMs: 60_000 });
+    return result.exitCode === 0;
+}
+function sha256(value) { return crypto.createHash("sha256").update(value).digest("hex"); }
+function safe(value) { return value.replace(/[^A-Za-z0-9._-]/g, "-"); }
+function quote(value) { return `'${value.replaceAll("'", "'\\''")}'`; }
+//# sourceMappingURL=bundles.js.map

package/dist/policy/bundles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundles.js","sourceRoot":"","sources":["../../src/policy/bundles.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAahE,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,IAAY,EAAE,MAA4B;IAC/F,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC;IACpD,MAAM,OAAO,GAAG,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,IAAI,yBAAyB,CAAC,CAAC;IACtF,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IACzD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnC,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QAClD,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC/B,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,IAAI,GAAG,CAAC,CAAC;QACpG,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,qCAAqC,CAAC,CAAC;QACxI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAChE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;YACzD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,GAAG,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,IAAI,QAAQ,EAAE,QAAQ,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,OAAO,EAAE,CAAC,CAAC;QAC1I,CAAC;gBAAS,CAAC;YAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IACtC,CAAC,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;AACvG,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAA4B,EAAE,UAAkC;IACvG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC;IAC1D,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE;YACV,GAAG,MAAM,CAAC,UAAU;YACpB,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,OAAO,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;SACxJ;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,WAAmB,EAAE,SAAiB,EAAE,MAAgC;IACvG,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnG,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,MAAM,CAAC,GAAI,CAAC,CAAC;IACvH,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,QAAQ,CAAC,IAAI,uCAAuC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;IACxJ,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,MAAM,SAAS,YAAY,GAAG,CAAC,CAAC;IACnJ,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAAC,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACpG,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACpH,iBAAiB,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACzG,IAAI,CAAC,iBAAiB;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QACrH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,GAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAClJ,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,+BAA+B,IAAI,CAAC,MAAM,SAAS,MAAM,GAAG,CAAC,CAAC;QACtJ,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC7J,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACxM,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;AAClJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,WAAmB,EAAE,cAAsB;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAAC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAClL,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;AAC5F,CAAC;AACD,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAC3C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,UAAU,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAAC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;AACxO,CAAC;AACD,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAqC,CAAC;IACnF,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACvI,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,CAAC,IAAI,IAAI,WAAW,GAAG,CAAC,CAAC;IACvK,OAAO,KAAK,CAAC;AACf,CAAC;AACD,KAAK,UAAU,mBAAmB,CAAC,WAAmB,EAAE,cAAsB,EAAE,QAAgB,IAAqB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACvU,KAAK,UAAU,oBAAoB,CAAC,WAAmB,EAAE,QAAgB,IAAqB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;IAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,UAAU,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7U,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,YAAoB,EAAE,SAAiB,EAAE,SAAiB;IACrG,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACjJ,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAAC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACnG,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,4BAA4B,KAAK,CAAC,OAAO,CAAC,gBAAgB,KAAK,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3K,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;AAC/B,CAAC;AACD,SAAS,MAAM,CAAC,KAAsB,IAAY,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnH,SAAS,IAAI,CAAC,KAAa,IAAY,OAAO,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AACvF,SAAS,KAAK,CAAC,KAAa,IAAY,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC"}

package/dist/security/sandbox.d.ts

@@ -0,0 +1,12 @@
+import type { AgentExecutionSelection } from "../agents/types.js";
+import type { HarnessProjectConfig, TaskRisk } from "../core/types.js";
+export interface SandboxDecision {
+    required: boolean;
+    provider: string;
+    reasons: string[];
+    selection: AgentExecutionSelection;
+}
+export declare function enforceSandboxPolicy(selection: AgentExecutionSelection, config: HarnessProjectConfig, risk?: TaskRisk): SandboxDecision;
+export declare function hardenedPodmanArgs(config: HarnessProjectConfig, selection: AgentExecutionSelection, writable: boolean): string[];
+export declare function sandboxImage(config: HarnessProjectConfig): string;
+export declare function allowedSandboxEnvironment(config: HarnessProjectConfig, source?: NodeJS.ProcessEnv): Record<string, string>;

package/dist/security/sandbox.js

@@ -0,0 +1,64 @@
+export function enforceSandboxPolicy(selection, config, risk = "low") {
+    const sandbox = config.security?.sandbox;
+    const force = (sandbox?.forceForRisks ?? []).includes(risk);
+    const required = sandbox?.required === true || force;
+    const provider = sandbox?.provider ?? "podman";
+    if (!required)
+        return { required: false, provider, reasons: [], selection };
+    if (provider === "none")
+        throw new Error(`Sandbox is required for ${risk}-risk work but security.sandbox.provider is none.`);
+    if (selection.runtimeAdapter !== "opencode")
+        throw new Error(`Sandbox policy requires ${provider}, but runtime ${selection.runtimeAdapter} is not supported by the hardened worker sandbox.`);
+    if (!sandbox?.image)
+        throw new Error("Sandbox policy requires security.sandbox.image.");
+    return { required: true, provider, reasons: force ? [`risk:${risk}`] : ["security.sandbox.required"], selection: { ...selection, transport: provider === "podman" ? "podman" : selection.transport } };
+}
+export function hardenedPodmanArgs(config, selection, writable) {
+    const sandbox = config.security?.sandbox;
+    const args = ["--rm", "-i", "--userns=keep-id"];
+    if (sandbox?.readOnlyRoot !== false)
+        args.push("--read-only");
+    if (sandbox?.capDropAll !== false)
+        args.push("--cap-drop=ALL");
+    if (sandbox?.noNewPrivileges !== false)
+        args.push("--security-opt=no-new-privileges");
+    args.push(`--pids-limit=${sandbox?.pidsLimit ?? 512}`);
+    if (sandbox?.memory)
+        args.push(`--memory=${sandbox.memory}`);
+    if (sandbox?.cpus)
+        args.push(`--cpus=${sandbox.cpus}`);
+    if (sandbox?.network === false || selection.permissions.network === "deny")
+        args.push("--network=none");
+    const tmpfs = sandbox?.tmpfs ?? ["/tmp:rw,nosuid,nodev,noexec,size=1g"];
+    for (const mount of tmpfs)
+        args.push(`--tmpfs=${mount}`);
+    if (sandbox?.ephemeralHome !== false) {
+        args.push("--tmpfs=/home/aeh:rw,nosuid,nodev,size=256m");
+        args.push("--env=HOME=/home/aeh");
+    }
+    if (!writable)
+        args.push("--env=AEH_WORKSPACE_READ_ONLY=1");
+    for (const extra of sandbox?.extraArgs ?? [])
+        args.push(extra);
+    return args;
+}
+export function sandboxImage(config) {
+    const sandbox = config.security?.sandbox;
+    if (!sandbox?.image)
+        throw new Error("security.sandbox.image is required for Podman execution.");
+    if (!sandbox.imageDigest || sandbox.image.includes("@sha256:"))
+        return sandbox.image;
+    const digest = sandbox.imageDigest.startsWith("sha256:") ? sandbox.imageDigest : `sha256:${sandbox.imageDigest}`;
+    return `${sandbox.image.replace(/:[^/@]+$/, "")}@${digest}`;
+}
+export function allowedSandboxEnvironment(config, source = process.env) {
+    const sandbox = config.security?.sandbox;
+    const allowed = new Set(sandbox?.environmentAllowlist ?? []);
+    const credentials = new Set(sandbox?.credentialEnvAllowlist ?? []);
+    const result = {};
+    for (const name of [...allowed, ...credentials])
+        if (source[name] !== undefined)
+            result[name] = source[name];
+    return result;
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/security/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/security/sandbox.ts"],"names":[],"mappings":"AAUA,MAAM,UAAU,oBAAoB,CAAC,SAAkC,EAAE,MAA4B,EAAE,OAAiB,KAAK;IAC3H,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC;IACrD,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,QAAQ,CAAC;IAC/C,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IAC5E,IAAI,QAAQ,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,mDAAmD,CAAC,CAAC;IAC7H,IAAI,SAAS,CAAC,cAAc,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,iBAAiB,SAAS,CAAC,cAAc,mDAAmD,CAAC,CAAC;IAC9L,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACxF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,SAAS,EAAE,SAAS,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;AACzM,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAA4B,EAAE,SAAkC,EAAE,QAAiB;IACpH,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;IACzC,MAAM,IAAI,GAAa,CAAC,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAC1D,IAAI,OAAO,EAAE,YAAY,KAAK,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9D,IAAI,OAAO,EAAE,UAAU,KAAK,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/D,IAAI,OAAO,EAAE,eAAe,KAAK,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACtF,IAAI,CAAC,IAAI,CAAC,gBAAgB,OAAO,EAAE,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC;IACvD,IAAI,OAAO,EAAE,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7D,IAAI,OAAO,EAAE,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,OAAO,EAAE,OAAO,KAAK,KAAK,IAAI,SAAS,CAAC,WAAW,CAAC,OAAO,KAAK,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACxG,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACxE,KAAK,MAAM,KAAK,IAAI,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;IACzD,IAAI,OAAO,EAAE,aAAa,KAAK,KAAK,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,SAAS,IAAI,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAA4B;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;IACzC,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACjG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACrF,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,OAAO,CAAC,WAAW,EAAE,CAAC;IACjH,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAA4B,EAAE,SAA4B,OAAO,CAAC,GAAG;IAC7G,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,sBAAsB,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,EAAE,GAAG,WAAW,CAAC;QAAE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAE,CAAC;IAC9G,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/toolchain/resolve.js

@@ -4,10 +4,9 @@ import { loadResolvedAgentTopology } from "../agents/config.js";
 export async function resolveToolchain(root, project, toolchain, options = {}) {
     const profile = options.profile ?? "auto";
     const selected = new Map();
-    if (profile !== "auto") {
+    if (profile !== "auto")
         for (const name of profileTools(toolchain, profile))
             select(selected, name, `profile:${profile}`);
-    }
     else {
         const capabilities = await activeCapabilities(root, project);
         for (const [name, definition] of Object.entries(toolchain.tools)) {
@@ -22,35 +21,15 @@ export async function resolveToolchain(root, project, toolchain, options = {}) {
     expandDependencies(toolchain, selected);
     const versionOverrides = await projectVersionOverrides(root);
     const preferContainers = options.preferContainers ?? toolchain.strategy?.validators === "prefer-container";
-    const tools = [...selected.entries()].map(([name, selectedBy]) => {
-        const definition = requireTool(toolchain, name);
-        const provisioning = definition.kind === "system" ? "system"
-            : preferContainers && options.containerAvailable && definition.container ? "container"
-                : "mise";
-        return { name, ...definition, version: versionOverrides[name] ?? definition.version, selectedBy, provisioning };
-    });
+    const tools = [...selected.entries()].map(([name, selectedBy]) => { const definition = requireTool(toolchain, name); const provisioning = definition.kind === "system" ? "system" : preferContainers && options.containerAvailable && definition.container ? "container" : "mise"; return { name, ...definition, version: versionOverrides[name] ?? definition.version, selectedBy, provisioning }; });
     tools.sort((a, b) => a.name.localeCompare(b.name));
     return { profile, tools };
 }
-export function profileTools(toolchain, profile) {
-    const visiting = new Set();
-    const result = new Set();
-    const visit = (name) => {
-        if (visiting.has(name))
-            throw new Error(`Toolchain profile cycle detected at '${name}'.`);
-        const value = toolchain.profiles?.[name];
-        if (!value)
-            throw new Error(`Unknown toolchain profile '${name}'.`);
-        visiting.add(name);
-        for (const parent of value.extends ?? [])
-            visit(parent);
-        for (const tool of value.tools ?? [])
-            result.add(tool);
-        visiting.delete(name);
-    };
-    visit(profile);
-    return [...result];
-}
+export function profileTools(toolchain, profile) { const visiting = new Set(); const result = new Set(); const visit = (name) => { if (visiting.has(name))
+    throw new Error(`Toolchain profile cycle detected at '${name}'.`); const value = toolchain.profiles?.[name]; if (!value)
+    throw new Error(`Unknown toolchain profile '${name}'.`); visiting.add(name); for (const parent of value.extends ?? [])
+    visit(parent); for (const tool of value.tools ?? [])
+    result.add(tool); visiting.delete(name); }; visit(profile); return [...result]; }
 async function activeCapabilities(root, project) {
     const result = new Set();
     if (project.agents) {
@@ -60,7 +39,7 @@ async function activeCapabilities(root, project) {
                 if (!agent.disabled)
                     result.add(`runtime:${agent.runtime.name}`);
         }
-        catch { /* doctor/setup will surface topology problems independently */ }
+        catch { /* doctor/setup surfaces topology independently */ }
     }
     if (project.orchestration?.provider)
         result.add(`orchestration:${project.orchestration.provider}`);
@@ -76,6 +55,8 @@ async function activeCapabilities(root, project) {
         result.add("validation:opa");
     if (project.security?.sandbox?.provider)
         result.add(`sandbox:${project.security.sandbox.provider}`);
+    if ((project.organization?.policyBundles?.sources ?? []).some((source) => Boolean(source.signature || source.publicKey)))
+        result.add("organization:signed-policy");
     for (const name of project.security?.tools ?? [])
         result.add(`security-tool:${name}`);
     for (const validator of project.validation?.validators ?? [])
@@ -83,75 +64,55 @@ async function activeCapabilities(root, project) {
     await addProjectCapabilities(root, result);
     return result;
 }
-async function addProjectCapabilities(root, result) {
-    const files = new Set(await fs.readdir(root).catch(() => []));
-    if (files.has("package.json"))
-        result.add("project:node");
-    if (files.has("bun.lock") || files.has("bun.lockb"))
-        result.add("project:bun");
-    if (files.has("pnpm-lock.yaml"))
-        result.add("project:pnpm");
-    if (files.has("yarn.lock"))
-        result.add("project:yarn");
-    if (files.has("uv.lock") || files.has("pyproject.toml"))
-        result.add("project:python");
-    if ([...files].some((name) => name.endsWith(".sln") || name.endsWith(".slnx") || name.endsWith(".csproj")) || files.has("global.json"))
-        result.add("project:dotnet");
-    if (files.has("go.mod"))
-        result.add("project:go");
-    if (files.has("Cargo.toml"))
-        result.add("project:rust");
-    try {
-        const pkg = JSON.parse(await fs.readFile(path.join(root, "package.json"), "utf8"));
-        const manager = typeof pkg.packageManager === "string" ? pkg.packageManager.split("@")[0] : undefined;
-        if (manager)
-            result.add(`project:${manager}`);
-    }
-    catch { /* package.json is optional */ }
+async function addProjectCapabilities(root, result) { const files = new Set(await fs.readdir(root).catch(() => [])); if (files.has("package.json"))
+    result.add("project:node"); if (files.has("bun.lock") || files.has("bun.lockb"))
+    result.add("project:bun"); if (files.has("pnpm-lock.yaml"))
+    result.add("project:pnpm"); if (files.has("yarn.lock"))
+    result.add("project:yarn"); if (files.has("uv.lock") || files.has("pyproject.toml"))
+    result.add("project:python"); if ([...files].some((name) => name.endsWith(".sln") || name.endsWith(".slnx") || name.endsWith(".csproj")) || files.has("global.json"))
+    result.add("project:dotnet"); if (files.has("go.mod"))
+    result.add("project:go"); if (files.has("Cargo.toml"))
+    result.add("project:rust"); try {
+    const pkg = JSON.parse(await fs.readFile(path.join(root, "package.json"), "utf8"));
+    const manager = typeof pkg.packageManager === "string" ? pkg.packageManager.split("@")[0] : undefined;
+    if (manager)
+        result.add(`project:${manager}`);
 }
-async function projectVersionOverrides(root) {
-    const result = {};
-    for (const name of [".node-version", ".nvmrc"]) {
-        try {
-            const value = (await fs.readFile(path.join(root, name), "utf8")).trim().replace(/^v/, "");
-            if (value) {
-                result.node = value;
-                break;
-            }
-        }
-        catch { /* optional */ }
-    }
-    try {
-        const global = JSON.parse(await fs.readFile(path.join(root, "global.json"), "utf8"));
-        if (typeof global.sdk?.version === "string" && global.sdk.version.trim())
-            result.dotnet = global.sdk.version.trim();
-    }
-    catch { /* optional */ }
+catch { /* optional */ } }
+async function projectVersionOverrides(root) { const result = {}; for (const name of [".node-version", ".nvmrc"]) {
     try {
-        const pkg = JSON.parse(await fs.readFile(path.join(root, "package.json"), "utf8"));
-        if (typeof pkg.packageManager === "string") {
-            const match = pkg.packageManager.match(/^bun@(.+)$/);
-            if (match)
-                result.bun = match[1];
+        const value = (await fs.readFile(path.join(root, name), "utf8")).trim().replace(/^v/, "");
+        if (value) {
+            result.node = value;
+            break;
         }
     }
     catch { /* optional */ }
-    return result;
+} try {
+    const global = JSON.parse(await fs.readFile(path.join(root, "global.json"), "utf8"));
+    if (typeof global.sdk?.version === "string" && global.sdk.version.trim())
+        result.dotnet = global.sdk.version.trim();
 }
-function expandDependencies(toolchain, selected) {
-    let changed = true;
-    while (changed) {
-        changed = false;
-        for (const name of [...selected.keys()]) {
-            const tool = requireTool(toolchain, name);
-            for (const dependency of tool.dependsOn ?? [])
-                if (!selected.has(dependency)) {
-                    select(selected, dependency, `dependency:${name}`);
-                    changed = true;
-                }
-        }
+catch { /* optional */ } try {
+    const pkg = JSON.parse(await fs.readFile(path.join(root, "package.json"), "utf8"));
+    if (typeof pkg.packageManager === "string") {
+        const match = pkg.packageManager.match(/^bun@(.+)$/);
+        if (match)
+            result.bun = match[1];
     }
 }
+catch { /* optional */ } return result; }
+function expandDependencies(toolchain, selected) { let changed = true; while (changed) {
+    changed = false;
+    for (const name of [...selected.keys()]) {
+        const tool = requireTool(toolchain, name);
+        for (const dependency of tool.dependsOn ?? [])
+            if (!selected.has(dependency)) {
+                select(selected, dependency, `dependency:${name}`);
+                changed = true;
+            }
+    }
+} }
 function select(selected, name, reason) { const reasons = selected.get(name) ?? []; if (!reasons.includes(reason))
     reasons.push(reason); selected.set(name, reasons); }
 function requireTool(toolchain, name) { const tool = toolchain.tools[name]; if (!tool)