airlock-bot 0.0.1 → 0.2.1

package/dist/discover/strategies/fig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fig.d.ts","sourceRoot":"","sources":["../../../src/discover/strategies/fig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAkB,MAAM,wBAAwB,CAAC;AAE/E,UAAU,SAAS;IACjB,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;CAC5F;AAED,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,UAAU,OAAO;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC;CAC/B;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAcxE;AAoCD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CA0CjF"}

package/dist/discover/strategies/fig.js

@@ -0,0 +1,82 @@
+export async function fetchFigSpec(tool) {
+    // Validate tool name to prevent path traversal in URL
+    if (!/^[a-zA-Z0-9_-]+$/.test(tool))
+        return null;
+    const url = `https://raw.githubusercontent.com/withfig/autocomplete/master/src/${tool}.ts`;
+    try {
+        const response = await fetch(url);
+        if (!response.ok)
+            return null;
+        const text = await response.text();
+        return parseFigTypeScript(text, tool);
+    }
+    catch {
+        return null;
+    }
+}
+function parseFigTypeScript(source, toolName) {
+    // Best-effort extraction: strip TS syntax and parse the object literal as JSON.
+    // This works for simple specs but will silently return null for specs that use
+    // template literals, function calls, spread operators, or complex TS features.
+    try {
+        // Find the main object after "const completionSpec"
+        const match = source.match(/const\s+completionSpec\s*(?::\s*\w+(?:\.\w+)*)?\s*=\s*(\{[\s\S]*\})\s*;?\s*$/m);
+        if (!match)
+            return null;
+        let objStr = match[1];
+        // Strip TypeScript-specific syntax for eval-safe JSON
+        // Remove trailing commas before } or ]
+        objStr = objStr.replace(/,\s*([}\]])/g, '$1');
+        // Quote unquoted keys
+        objStr = objStr.replace(/(\s)(\w+)\s*:/g, '$1"$2":');
+        // Remove single-line comments
+        objStr = objStr.replace(/\/\/.*$/gm, '');
+        // This is best-effort — many Fig specs won't parse cleanly
+        const parsed = JSON.parse(objStr);
+        return {
+            name: toolName,
+            description: parsed.description,
+            options: parsed.options,
+            subcommands: parsed.subcommands,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function figSpecToCommands(spec) {
+    const commands = {};
+    function processSubcommand(sub, prefix) {
+        const names = Array.isArray(sub.name) ? sub.name : [sub.name];
+        const name = names[0];
+        const fullName = prefix ? `${prefix}_${name}` : name;
+        const params = {};
+        for (const opt of sub.options ?? []) {
+            const optNames = Array.isArray(opt.name) ? opt.name : [opt.name];
+            const longName = optNames.find((n) => n.startsWith('--')) ?? optNames[0];
+            const paramName = longName.replace(/^-+/, '').replace(/-/g, '_');
+            const hasArgs = opt.args && (!Array.isArray(opt.args) || opt.args.length > 0);
+            params[paramName] = {
+                type: hasArgs ? 'string' : 'boolean',
+                flag: longName,
+                positional: false,
+                required: false,
+                description: opt.description,
+            };
+        }
+        commands[fullName] = {
+            exec: `${spec.name} ${prefix ? prefix.replace(/_/g, ' ') + ' ' : ''}${name}`,
+            description: sub.description,
+            params,
+            timeout: 30,
+        };
+        for (const child of sub.subcommands ?? []) {
+            processSubcommand(child, fullName);
+        }
+    }
+    for (const sub of spec.subcommands ?? []) {
+        processSubcommand(sub, '');
+    }
+    return commands;
+}
+//# sourceMappingURL=fig.js.map

package/dist/discover/strategies/fig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fig.js","sourceRoot":"","sources":["../../../src/discover/strategies/fig.ts"],"names":[],"mappings":"AAuBA,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,sDAAsD;IACtD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhD,MAAM,GAAG,GAAG,qEAAqE,IAAI,KAAK,CAAC;IAC3F,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAE9B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc,EAAE,QAAgB;IAC1D,gFAAgF;IAChF,+EAA+E;IAC/E,+EAA+E;IAC/E,IAAI,CAAC;QACH,oDAAoD;QACpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CACxB,+EAA+E,CAChF,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,sDAAsD;QACtD,uCAAuC;QACvC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QAC9C,sBAAsB;QACtB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QACrD,8BAA8B;QAC9B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAEzC,2DAA2D;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAA4B,CAAC;QAC7D,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,MAAM,CAAC,WAAiC;YACrD,OAAO,EAAE,MAAM,CAAC,OAAkC;YAClD,WAAW,EAAE,MAAM,CAAC,WAA0C;SAC/D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC7C,MAAM,QAAQ,GAAqC,EAAE,CAAC;IAEtD,SAAS,iBAAiB,CAAC,GAAkB,EAAE,MAAc;QAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAErD,MAAM,MAAM,GAAmC,EAAE,CAAC;QAElD,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;YACzE,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAEjE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC9E,MAAM,CAAC,SAAS,CAAC,GAAG;gBAClB,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBACpC,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,KAAK;gBACjB,QAAQ,EAAE,KAAK;gBACf,WAAW,EAAE,GAAG,CAAC,WAAW;aAC7B,CAAC;QACJ,CAAC;QAED,QAAQ,CAAC,QAAQ,CAAC,GAAG;YACnB,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE;YAC5E,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,MAAM;YACN,OAAO,EAAE,EAAE;SACZ,CAAC;QAEF,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;YAC1C,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QACzC,iBAAiB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/discover/strategies/help-parser.d.ts

@@ -0,0 +1,21 @@
+import type { CliCommandConfig } from '../../config/schema.js';
+interface DiscoveredCommands {
+    [name: string]: CliCommandConfig;
+}
+export interface ParsedFlag {
+    name: string;
+    flag: string;
+    type: 'string' | 'number' | 'boolean';
+    description?: string;
+    required: boolean;
+}
+export declare function inferType(flag: string, description: string): 'string' | 'number' | 'boolean';
+export declare function parseFlags(helpText: string): ParsedFlag[];
+export declare function parseSubcommands(helpText: string): string[];
+export declare function discoverCli(command: string, options?: {
+    maxDepth?: number;
+    include?: string[];
+    exclude?: string[];
+}): DiscoveredCommands;
+export {};
+//# sourceMappingURL=help-parser.d.ts.map

package/dist/discover/strategies/help-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"help-parser.d.ts","sourceRoot":"","sources":["../../../src/discover/strategies/help-parser.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAkB,MAAM,wBAAwB,CAAC;AAE/E,UAAU,kBAAkB;IAC1B,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAwBD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAS5F;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CA0BzD;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAgB3D;AAED,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GACtE,kBAAkB,CAmDpB"}

package/dist/discover/strategies/help-parser.js

@@ -0,0 +1,121 @@
+import { execFileSync } from 'child_process';
+function runHelp(command) {
+    // Split "docker container ls" into ["docker", "container", "ls", "--help"]
+    // Using execFileSync avoids shell injection — the first element is the binary,
+    // the rest are passed as arguments directly (no shell interpretation).
+    const parts = command.split(/\s+/);
+    const bin = parts[0];
+    const args = [...parts.slice(1), '--help'];
+    try {
+        return execFileSync(bin, args, {
+            timeout: 10000,
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+    }
+    catch (err) {
+        // Many CLIs exit non-zero for --help
+        if (err && typeof err === 'object' && 'stdout' in err) {
+            return err.stdout ?? '';
+        }
+        return '';
+    }
+}
+export function inferType(flag, description) {
+    const lower = description.toLowerCase();
+    // Boolean indicators: no argument expected
+    if (/\b(enable|disable|verbose|quiet|force|dry-run|no-)\b/.test(lower))
+        return 'boolean';
+    if (!description.includes(' ') && /^-\w$/.test(flag))
+        return 'boolean';
+    // Number indicators
+    if (/\b(count|number|num|max|min|limit|timeout|port|size|depth)\b/.test(lower))
+        return 'number';
+    if (/\bN\b/.test(description) && description.length < 50)
+        return 'number';
+    return 'string';
+}
+export function parseFlags(helpText) {
+    const flags = [];
+    const longFlagRegex = /^\s{2,}(?:(-\w),\s*)?(--[\w-]+)(?:[= ]\s*(?:<(\w+)>|\[(\w+)\]|(\w+)))?\s{2,}(.+)/gm;
+    let match;
+    while ((match = longFlagRegex.exec(helpText)) !== null) {
+        const longFlag = match[2];
+        const argName = match[3] ?? match[4] ?? match[5];
+        const description = match[6]?.trim() ?? '';
+        const name = longFlag.replace(/^--/, '').replace(/-/g, '_');
+        const hasArg = !!argName;
+        const type = hasArg ? inferType(longFlag, description) : 'boolean';
+        flags.push({
+            name,
+            flag: longFlag,
+            type,
+            description: description || undefined,
+            required: false,
+        });
+    }
+    return flags;
+}
+export function parseSubcommands(helpText) {
+    const subcommands = [];
+    // Look for lines under "Commands:", "Available Commands:", "COMMANDS:", etc.
+    const sectionRegex = /(?:commands|subcommands|available commands):\s*\n((?:\s{2,}\S.*\n?)*)/gi;
+    let match;
+    while ((match = sectionRegex.exec(helpText)) !== null) {
+        const block = match[1];
+        const cmdRegex = /^\s{2,}(\w[\w-]*)/gm;
+        let cmdMatch;
+        while ((cmdMatch = cmdRegex.exec(block)) !== null) {
+            subcommands.push(cmdMatch[1]);
+        }
+    }
+    return subcommands;
+}
+export function discoverCli(command, options) {
+    const maxDepth = options?.maxDepth ?? 2;
+    const include = options?.include ? new Set(options.include) : undefined;
+    const exclude = options?.exclude ? new Set(options.exclude) : undefined;
+    const commands = {};
+    function discover(cmd, prefix, depth) {
+        const helpText = runHelp(cmd);
+        if (!helpText)
+            return;
+        const flags = parseFlags(helpText);
+        const subcommands = parseSubcommands(helpText);
+        // If this has flags, register as a command
+        if (flags.length > 0 || subcommands.length === 0) {
+            const name = prefix || command;
+            if (exclude?.has(name))
+                return;
+            if (include && !include.has(name))
+                return;
+            const params = {};
+            for (const flag of flags) {
+                params[flag.name] = {
+                    type: flag.type,
+                    flag: flag.flag,
+                    positional: false,
+                    required: flag.required,
+                    description: flag.description,
+                };
+            }
+            commands[name] = {
+                exec: cmd,
+                description: helpText.split('\n')[0]?.trim() || undefined,
+                params,
+                timeout: 30,
+            };
+        }
+        // Recurse into subcommands
+        if (depth < maxDepth) {
+            for (const sub of subcommands) {
+                if (exclude?.has(sub))
+                    continue;
+                discover(`${cmd} ${sub}`, prefix ? `${prefix}_${sub}` : sub, depth + 1);
+            }
+        }
+    }
+    discover(command, '', 0);
+    return commands;
+}
+//# sourceMappingURL=help-parser.js.map

package/dist/discover/strategies/help-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"help-parser.js","sourceRoot":"","sources":["../../../src/discover/strategies/help-parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAe7C,SAAS,OAAO,CAAC,OAAe;IAC9B,2EAA2E;IAC3E,+EAA+E;IAC/E,uEAAuE;IACvE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACrB,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE;YAC7B,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,qCAAqC;QACrC,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAC;YACtD,OAAQ,GAA0B,CAAC,MAAM,IAAI,EAAE,CAAC;QAClD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,WAAmB;IACzD,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IACxC,2CAA2C;IAC3C,IAAI,sDAAsD,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzF,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACvE,oBAAoB;IACpB,IAAI,8DAA8D,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChG,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC1E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,MAAM,KAAK,GAAiB,EAAE,CAAC;IAE/B,MAAM,aAAa,GACjB,oFAAoF,CAAC;IAEvF,IAAI,KAAK,CAAC;IACV,OAAO,CAAC,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAE3C,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEnE,KAAK,CAAC,IAAI,CAAC;YACT,IAAI;YACJ,IAAI,EAAE,QAAQ;YACd,IAAI;YACJ,WAAW,EAAE,WAAW,IAAI,SAAS;YACrC,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,6EAA6E;IAC7E,MAAM,YAAY,GAAG,yEAAyE,CAAC;IAC/F,IAAI,KAAK,CAAC;IAEV,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,QAAQ,GAAG,qBAAqB,CAAC;QACvC,IAAI,QAAQ,CAAC;QACb,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,OAAuE;IAEvE,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAExE,MAAM,QAAQ,GAAuB,EAAE,CAAC;IAExC,SAAS,QAAQ,CAAC,GAAW,EAAE,MAAc,EAAE,KAAa;QAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,WAAW,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAE/C,2CAA2C;QAC3C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAC;YAE/B,IAAI,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC/B,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO;YAE1C,MAAM,MAAM,GAAmC,EAAE,CAAC;YAClD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBAClB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,UAAU,EAAE,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,CAAC;YACJ,CAAC;YAED,QAAQ,CAAC,IAAI,CAAC,GAAG;gBACf,IAAI,EAAE,GAAG;gBACT,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;gBACzD,MAAM;gBACN,OAAO,EAAE,EAAE;aACZ,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;gBAC9B,IAAI,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAChC,QAAQ,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACzB,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/discover/writer.d.ts

@@ -0,0 +1,5 @@
+export declare function serializeDiscovery(data: Record<string, unknown>, meta: {
+    command: string;
+    strategy: string;
+}): string;
+//# sourceMappingURL=writer.d.ts.map

package/dist/discover/writer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"writer.d.ts","sourceRoot":"","sources":["../../src/discover/writer.ts"],"names":[],"mappings":"AAEA,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC1C,MAAM,CAYR"}

package/dist/discover/writer.js

@@ -0,0 +1,14 @@
+import { stringify } from 'yaml';
+export function serializeDiscovery(data, meta) {
+    const header = [
+        '# Auto-discovered by Airlock',
+        `# Command: ${meta.command}`,
+        `# Strategy: ${meta.strategy}`,
+        `# Generated: ${new Date().toISOString()}`,
+        '#',
+        '# Review and customize this file, then reference it in your airlock.yaml config.',
+        '',
+    ].join('\n');
+    return header + stringify(data, { lineWidth: 120 });
+}
+//# sourceMappingURL=writer.js.map

package/dist/discover/writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writer.js","sourceRoot":"","sources":["../../src/discover/writer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,MAAM,UAAU,kBAAkB,CAChC,IAA6B,EAC7B,IAA2C;IAE3C,MAAM,MAAM,GAAG;QACb,8BAA8B;QAC9B,cAAc,IAAI,CAAC,OAAO,EAAE;QAC5B,eAAe,IAAI,CAAC,QAAQ,EAAE;QAC9B,gBAAgB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;QAC1C,GAAG;QACH,kFAAkF;QAClF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;AACtD,CAAC"}

package/dist/gateway.d.ts

@@ -0,0 +1,20 @@
+import type { AgentServerDeps } from './transport/agent-server.js';
+import type { Config } from './config/loader.js';
+export declare class Gateway {
+    private config;
+    private pool;
+    private registry;
+    private allowlist;
+    private hitlEngine;
+    private hitlBatcher;
+    private hitlProvider;
+    private auditLogger;
+    private app;
+    private startTime;
+    constructor(config: Config);
+    start(): Promise<void>;
+    buildAgentDeps(agentId: string): AgentServerDeps | undefined;
+    reload(newConfig: Config): Promise<void>;
+    stop(): Promise<void>;
+}
+//# sourceMappingURL=gateway.d.ts.map

package/dist/gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AASjD,qBAAa,OAAO;IAWN,OAAO,CAAC,MAAM;IAV1B,OAAO,CAAC,IAAI,CAAc;IAC1B,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,SAAS,CAAmB;IACpC,OAAO,CAAC,UAAU,CAAc;IAChC,OAAO,CAAC,WAAW,CAAe;IAClC,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,WAAW,CAAe;IAClC,OAAO,CAAC,GAAG,CAAmB;IAC9B,OAAO,CAAC,SAAS,CAAc;gBAEX,MAAM,EAAE,MAAM;IAE5B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA4E5B,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAkBtD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcxC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAQ5B"}

package/dist/gateway.js

@@ -0,0 +1,125 @@
+import Fastify from 'fastify';
+import { ClientPool } from './pool/pool.js';
+import { ToolRegistry } from './registry/registry.js';
+import { AllowlistEngine } from './allowlist/engine.js';
+import { HitlEngine } from './hitl/engine.js';
+import { HitlBatcher } from './hitl/batcher.js';
+import { AuditLogger } from './audit/logger.js';
+import { hitlApiPlugin } from './hitl/api.js';
+import { auditApiPlugin } from './audit/api.js';
+import { sseServerPlugin } from './transport/sse-server.js';
+import { createHitlProvider } from './hitl/provider-factory.js';
+import { getMcpConfigs } from './config/schema.js';
+import { buildAdapters } from './backend/factory.js';
+import { childLogger } from './util/logger.js';
+const log = childLogger('gateway');
+export class Gateway {
+    config;
+    pool;
+    registry;
+    allowlist;
+    hitlEngine;
+    hitlBatcher;
+    hitlProvider;
+    auditLogger;
+    app;
+    startTime = Date.now();
+    constructor(config) {
+        this.config = config;
+    }
+    async start() {
+        log.info('Starting Airlock gateway');
+        // Audit logger
+        this.auditLogger = new AuditLogger(this.config.audit);
+        this.auditLogger.startDailyCleanup();
+        // Approvals — provider needs approvalApi but engine doesn't exist yet, use forwarder
+        this.hitlBatcher = new HitlBatcher(this.config.approvals.batch_window_ms);
+        const approvalForwarder = {
+            approve: (code) => this.hitlEngine.approve(code),
+            deny: (code, reason) => this.hitlEngine.deny(code, reason),
+        };
+        this.hitlProvider = createHitlProvider(this.config.approvals.provider, approvalForwarder);
+        this.hitlEngine = new HitlEngine(this.auditLogger, this.hitlProvider, this.config.approvals.timeout_ms);
+        // Wire batcher → provider
+        this.hitlBatcher.onBatchReady((_agentId, requests) => {
+            void this.hitlProvider
+                .notify(requests)
+                .catch((err) => log.error({ err }, 'Failed to send approval notifications'));
+        });
+        await this.hitlProvider.init();
+        await this.hitlEngine.recoverPending();
+        // MCP pool — only connect to actual MCP servers, not builtins
+        const mcpConfigs = getMcpConfigs(this.config.providers);
+        this.pool = new ClientPool(mcpConfigs);
+        this.pool.onClientReady((id) => {
+            log.info({ id }, 'MCP became ready, refreshing tool registry');
+            this.registry
+                .refresh()
+                .catch((err) => log.error({ err }, 'Failed to refresh registry after MCP ready'));
+        });
+        await this.pool.initialize();
+        // Build adapters from config (MCP, builtins, CLIs, APIs)
+        const adapters = buildAdapters(this.config, this.pool);
+        // Allowlist + registry
+        this.allowlist = new AllowlistEngine(this.config.agents);
+        this.registry = new ToolRegistry(adapters, this.allowlist, this.config.agents);
+        await this.registry.refresh();
+        // HTTP server
+        this.app = Fastify({ logger: false });
+        const secret = this.config.server.api_secret;
+        await this.app.register(hitlApiPlugin, { engine: this.hitlEngine, secret });
+        await this.app.register(auditApiPlugin, { auditLogger: this.auditLogger, secret });
+        await this.app.register(sseServerPlugin, {
+            getDeps: (agentId) => this.buildAgentDeps(agentId),
+            secret,
+        });
+        this.app.get('/health', () => {
+            const mcpHealth = this.pool.healthCheck();
+            const pendingApprovals = this.hitlEngine.getPending().length;
+            const uptime = Math.floor((Date.now() - this.startTime) / 1000);
+            return { status: 'ok', mcpHealth, pendingApprovals, uptime };
+        });
+        const { port, host } = this.config.server;
+        await this.app.listen({ port, host });
+        log.info({ port, host }, 'Airlock gateway listening');
+    }
+    buildAgentDeps(agentId) {
+        const agentConfig = this.config.agents[agentId];
+        if (!agentConfig)
+            return undefined;
+        return {
+            agentId,
+            agentConfig,
+            getAgentConfig: () => this.config.agents[agentId] ?? agentConfig,
+            registry: this.registry,
+            allowlist: this.allowlist,
+            hitlEngine: this.hitlEngine,
+            hitlBatcher: this.hitlBatcher,
+            hitlProvider: this.hitlProvider,
+            auditLogger: this.auditLogger,
+            securityConfig: this.config.security,
+        };
+    }
+    async reload(newConfig) {
+        log.info('Reloading gateway config');
+        this.config = newConfig;
+        const mcpConfigs = getMcpConfigs(newConfig.providers);
+        await this.pool.reload(mcpConfigs);
+        this.allowlist.reload(newConfig.agents);
+        this.registry.reloadAgents(newConfig.agents);
+        // Rebuild adapters to pick up new CLIs/APIs
+        const adapters = buildAdapters(newConfig, this.pool);
+        this.registry.setAdapters(adapters);
+        await this.registry.refresh();
+        log.info('Config reloaded: providers, allowlist, registry, and agent configs updated');
+    }
+    async stop() {
+        log.info('Stopping Airlock gateway');
+        await this.app?.close();
+        await this.registry?.stopAll();
+        await this.pool?.stop();
+        await this.hitlProvider?.stop();
+        this.auditLogger?.stop();
+    }
+}
+//# sourceMappingURL=gateway.js.map

package/dist/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAI5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;AAEnC,MAAM,OAAO,OAAO;IAWE;IAVZ,IAAI,CAAc;IAClB,QAAQ,CAAgB;IACxB,SAAS,CAAmB;IAC5B,UAAU,CAAc;IACxB,WAAW,CAAe;IAC1B,YAAY,CAAgB;IAC5B,WAAW,CAAe;IAC1B,GAAG,CAAmB;IACtB,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE/B,YAAoB,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAEtC,KAAK,CAAC,KAAK;QACT,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAErC,eAAe;QACf,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAC;QAErC,qFAAqF;QACrF,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAE1E,MAAM,iBAAiB,GAAgB;YACrC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;YAChD,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;SAC3D,CAAC;QAEF,IAAI,CAAC,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAE1F,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAC9B,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CACjC,CAAC;QAEF,0BAA0B;QAC1B,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;YACnD,KAAK,IAAI,CAAC,YAAY;iBACnB,MAAM,CAAC,QAAQ,CAAC;iBAChB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,uCAAuC,CAAC,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;QAEvC,8DAA8D;QAC9D,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE;YAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,4CAA4C,CAAC,CAAC;YAC/D,IAAI,CAAC,QAAQ;iBACV,OAAO,EAAE;iBACT,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,4CAA4C,CAAC,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAE7B,yDAAyD;QACzD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEvD,uBAAuB;QACvB,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/E,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAE9B,cAAc;QACd,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;QAE7C,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACnF,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,EAAE;YACvC,OAAO,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;YAC1D,MAAM;SACP,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE;YAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC;YAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;YAChE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC/D,CAAC,CAAC,CAAC;QAEH,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAC1C,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,2BAA2B,CAAC,CAAC;IACxD,CAAC;IAED,cAAc,CAAC,OAAe;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAEnC,OAAO;YACL,OAAO;YACP,WAAW;YACX,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,WAAW;YAChE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;SACrC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7C,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,IAAI;QACR,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACrC,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF"}

package/dist/hitl/api.d.ts

@@ -0,0 +1,7 @@
+import type { FastifyInstance } from 'fastify';
+import type { HitlEngine } from './engine.js';
+export declare function hitlApiPlugin(app: FastifyInstance, opts: {
+    engine: HitlEngine;
+    secret?: string;
+}): Promise<void>;
+//# sourceMappingURL=api.d.ts.map

package/dist/hitl/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/hitl/api.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAU9C,wBAAsB,aAAa,CACjC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CA2Bf"}

package/dist/hitl/api.js

@@ -0,0 +1,35 @@
+import { timingSafeEqual } from 'crypto';
+function constantTimeEqual(a, b) {
+    const bufA = Buffer.from(a);
+    const bufB = Buffer.from(b);
+    if (bufA.length !== bufB.length)
+        return false;
+    return timingSafeEqual(bufA, bufB);
+}
+// eslint-disable-next-line @typescript-eslint/require-await
+export async function hitlApiPlugin(app, opts) {
+    const { engine, secret } = opts;
+    app.addHook('preHandler', async (request, reply) => {
+        if (!secret)
+            return;
+        const auth = request.headers.authorization ?? '';
+        if (!constantTimeEqual(auth, `Bearer ${secret}`)) {
+            return reply.status(401).send({ error: 'Unauthorized' });
+        }
+    });
+    app.post('/hitl/approve/:id', async (request, reply) => {
+        const { id } = request.params;
+        engine.approve(id);
+        return reply.send({ ok: true });
+    });
+    app.post('/hitl/deny/:id', async (request, reply) => {
+        const { id } = request.params;
+        const body = request.body;
+        engine.deny(id, body?.reason);
+        return reply.send({ ok: true });
+    });
+    app.get('/hitl/pending', async (_request, reply) => {
+        return reply.send(engine.getPending());
+    });
+}
+//# sourceMappingURL=api.js.map

package/dist/hitl/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/hitl/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAIzC,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAoB,EACpB,IAA6C;IAE7C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEhC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjD,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,UAAU,MAAM,EAAE,CAAC,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrD,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnB,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAClD,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAuC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QACjD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/hitl/batcher.d.ts

@@ -0,0 +1,11 @@
+import type { HitlNotification } from './providers/types.js';
+export declare class HitlBatcher {
+    private windowMs;
+    private batches;
+    private onBatchReadyCallback?;
+    constructor(windowMs: number);
+    onBatchReady(cb: (agentId: string, requests: HitlNotification[]) => void): void;
+    add(request: HitlNotification): void;
+    private flush;
+}
+//# sourceMappingURL=batcher.d.ts.map

package/dist/hitl/batcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"batcher.d.ts","sourceRoot":"","sources":["../../src/hitl/batcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAU7D,qBAAa,WAAW;IAIV,OAAO,CAAC,QAAQ;IAH5B,OAAO,CAAC,OAAO,CAA4B;IAC3C,OAAO,CAAC,oBAAoB,CAAC,CAA0D;gBAEnE,QAAQ,EAAE,MAAM;IAEpC,YAAY,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,IAAI,GAAG,IAAI;IAI/E,GAAG,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI;IAepC,OAAO,CAAC,KAAK;CAQd"}

package/dist/hitl/batcher.js

@@ -0,0 +1,37 @@
+import { childLogger } from '../util/logger.js';
+const log = childLogger('hitl-batcher');
+export class HitlBatcher {
+    windowMs;
+    batches = new Map(); // agentId → batch
+    onBatchReadyCallback;
+    constructor(windowMs) {
+        this.windowMs = windowMs;
+    }
+    onBatchReady(cb) {
+        this.onBatchReadyCallback = cb;
+    }
+    add(request) {
+        const { agentId } = request;
+        const existing = this.batches.get(agentId);
+        if (existing) {
+            existing.requests.push(request);
+            log.debug({ agentId, batchSize: existing.requests.length }, 'Added to existing batch');
+        }
+        else {
+            const timer = setTimeout(() => this.flush(agentId), this.windowMs);
+            timer.unref();
+            this.batches.set(agentId, { requests: [request], timer });
+            log.debug({ agentId }, 'Started new batch window');
+        }
+    }
+    flush(agentId) {
+        const batch = this.batches.get(agentId);
+        if (!batch)
+            return;
+        this.batches.delete(agentId);
+        clearTimeout(batch.timer);
+        log.info({ agentId, count: batch.requests.length }, 'Batch window closed, firing');
+        this.onBatchReadyCallback?.(agentId, batch.requests);
+    }
+}
+//# sourceMappingURL=batcher.js.map

package/dist/hitl/batcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"batcher.js","sourceRoot":"","sources":["../../src/hitl/batcher.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,GAAG,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;AAOxC,MAAM,OAAO,WAAW;IAIF;IAHZ,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC,CAAC,kBAAkB;IACtD,oBAAoB,CAA2D;IAEvF,YAAoB,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAExC,YAAY,CAAC,EAA2D;QACtE,IAAI,CAAC,oBAAoB,GAAG,EAAE,CAAC;IACjC,CAAC;IAED,GAAG,CAAC,OAAyB;QAC3B,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE3C,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnE,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,0BAA0B,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAe;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7B,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,6BAA6B,CAAC,CAAC;QACnF,IAAI,CAAC,oBAAoB,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvD,CAAC;CACF"}

package/dist/hitl/engine.d.ts

@@ -0,0 +1,36 @@
+import type { AuditLogger } from '../audit/logger.js';
+import type { HitlProvider, ApprovalApi } from './providers/types.js';
+export type HitlResult = 'approved' | 'denied' | 'timeout';
+export interface HitlTicket {
+    id: string;
+    code: string;
+    result: Promise<HitlResult>;
+}
+export declare class HitlEngine implements ApprovalApi {
+    private auditLogger;
+    private provider;
+    readonly timeoutMs: number;
+    private pending;
+    private byCode;
+    constructor(auditLogger: AuditLogger, provider: HitlProvider, timeoutMs: number);
+    create(params: {
+        agentId: string;
+        tool: string;
+        args: Record<string, unknown>;
+    }): HitlTicket;
+    /** Approve by code (used by providers) or by id (used by API) */
+    approve(codeOrId: string): void;
+    /** Deny by code or id */
+    deny(codeOrId: string, reason?: string): void;
+    getPending(): Array<{
+        id: string;
+        code: string;
+        agentId: string;
+        tool: string;
+        args: Record<string, unknown>;
+    }>;
+    private resolveRequest;
+    /** Recover pending requests from DB on startup */
+    recoverPending(): Promise<void>;
+}
+//# sourceMappingURL=engine.d.ts.map

package/dist/hitl/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/hitl/engine.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAKtE,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE3D,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;CAC7B;AAYD,qBAAa,UAAW,YAAW,WAAW;IAK1C,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,QAAQ;IAChB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAN5B,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,MAAM,CAA6B;gBAGjC,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,YAAY,EACrB,SAAS,EAAE,MAAM;IAG5B,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,UAAU;IAkC5F,iEAAiE;IACjE,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAc/B,yBAAyB;IACzB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAc7C,UAAU,IAAI,KAAK,CAAC;QAClB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC/B,CAAC;IAUF,OAAO,CAAC,cAAc;IAStB,kDAAkD;IAE5C,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;CA8DtC"}