alchemy-effect 0.5.0 → 0.6.2

package/src/Agent/AspectGraph.ts

@@ -0,0 +1,98 @@
+import * as S from "effect/Schema";
+import * as ServiceMap from "effect/ServiceMap";
+import type { Instance } from "..//Util/instance.ts";
+import type { Pointer } from "..//Util/pointer.ts";
+import { isAspect, type Aspect, type AspectLike } from "./Aspect.ts";
+
+export class AspectGraph extends ServiceMap.Service<
+  AspectGraph,
+  {
+    aspects: AspectIndex<AspectLike>;
+    schema: S.Schema<AspectIndex>;
+  }
+>()("AspectGraphService") {}
+
+export type AspectIndex<A extends AspectLike = AspectLike> = {
+  [type in AspectSet<A>["type"]]: {
+    [id in Extract<AspectSet<A>, { type: type }>["id"]]: Extract<
+      Extract<AspectSet<A>, { type: type }>,
+      { id: id }
+    >;
+  };
+};
+
+export type AspectCategory<Aspects extends Aspect> = {
+  [id in keyof Aspects["id"]]: Extract<Aspects, { id: id }>;
+};
+
+export type AspectSet<A extends AspectLike = any> =
+  | A
+  | Visit<A["references"][number], FQN<A>>;
+
+type Visit<Value, Seen extends string = never> =
+  Pointer.Resolve<Value> extends infer A
+    ? A extends {
+        type: string;
+        id: string;
+        references: infer References extends any[];
+      }
+      ? FQN<A> extends Seen
+        ? never
+        : Instance<A> | Visit<References[number], Seen | FQN<A>>
+      : A extends readonly (infer I)[]
+        ? Visit<I, Seen>
+        : A extends Record<string, infer V>
+          ? Visit<V, Seen>
+          : never
+    : never;
+
+type FQN<A extends { type: string; id: string } = any> = A["id"] extends string
+  ? `${A["type"]}:${A["id"]}`
+  : never;
+
+const getFqn = <A extends { type: string; id: string }>(a: A): FQN<A> =>
+  `${a.type}:${a.id}` as FQN<A>;
+
+export type AspectKinds<A extends Aspect> = {
+  [type in keyof AspectIndex<A>]: {
+    // @ts-expect-error
+    [id in keyof AspectIndex<A>[type]]: InstanceType<
+      // @ts-expect-error
+      AspectIndex<A>[type][id]["class"]
+    >;
+    // @ts-expect-error
+  }[keyof AspectIndex<A>[type]];
+}[keyof AspectIndex<A>];
+
+export const deriveGraph = <A extends AspectLike>(agent: A): AspectIndex<A> => {
+  const seen = new Set<FQN>();
+  return [agent, ...agent.references.flatMap((v) => visit(v, seen))].reduce(
+    (acc: AspectIndex<A>, aspect) => ({
+      ...acc,
+      [aspect.type]: {
+        ...acc[aspect.type as keyof AspectIndex<A>],
+        [aspect.id as keyof AspectIndex<A>[keyof AspectIndex<A>]]: aspect,
+      },
+    }),
+    {} as AspectIndex<A>,
+  );
+};
+
+const visit = <A>(a: A, seen: Set<FQN>): Aspect[] => {
+  if (isAspect(a)) {
+    const fqn = getFqn(a);
+    if (!seen.has(fqn)) {
+      seen.add(fqn);
+      return [a, ...a.references.flatMap((v) => visit(v, seen))];
+    }
+  } else if (Array.isArray(a)) {
+    return a.flatMap((v) => visit(v, seen));
+  } else if (a instanceof Set) {
+    return Array.from(a).flatMap((v) => visit(v, seen));
+  } else if (a instanceof Map) {
+    return Array.from(a.values()).flatMap((v) => visit(v, seen));
+  } else if (typeof a === "object" && a !== null) {
+    return Object.values(a).flatMap((v) => visit(v, seen));
+  }
+  return [];
+};

package/src/Agent/ContextPlugin.ts

@@ -0,0 +1,18 @@
+import * as ServiceMap from "effect/ServiceMap";
+import type { Aspect } from "./Aspect.ts";
+
+export type ContextPlugin<A extends Aspect> = ServiceMap.Service<
+  `ContextPlugin<${A["type"]}>`,
+  ContextPluginService<A>
+>;
+
+export interface ContextPluginService<A extends Aspect> {
+  context: (a: A) => string;
+}
+
+export const ContextPlugin = <A extends Aspect>(
+  type: A["type"],
+): ContextPlugin<A> =>
+  ServiceMap.Service<`ContextPlugin<${A["type"]}>`, ContextPluginService<A>>(
+    `ContextPlugin<${type}>`,
+  );

package/src/Agent/Plugin.ts

@@ -0,0 +1,29 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as ServiceMap from "effect/ServiceMap";
+import type { Aspect } from "./Aspect.ts";
+import type { ContextPlugin, ContextPluginService } from "./ContextPlugin.ts";
+
+export type Plugins<A extends Aspect> = {
+  readonly context: Plugin<ContextPlugin<A>, ContextPluginService<A>>;
+};
+
+export type Plugin<Tag, Service> = {
+  effect: <Err, Req>(
+    eff: Effect.Effect<Service, Err, Req>,
+  ) => Layer.Layer<Tag, Err, Req>;
+  succeed: (service: Service) => Layer.Layer<Tag>;
+};
+
+export type ContextPlugins<C> = C extends Aspect ? ContextPlugin<C> : never;
+
+export const createPluginBuilder = <
+  Tag extends ServiceMap.Service<string, Service>,
+  Service,
+>(
+  tag: Tag,
+) => ({
+  effect: <Err, Req>(eff: Effect.Effect<Service, Err, Req>) =>
+    Layer.effect(tag, eff),
+  succeed: (service: Service) => Layer.succeed(tag, service),
+});

package/src/Agent/chat/channel.ts

@@ -0,0 +1,26 @@
+import * as S from "effect/Schema";
+import { defineAspect, type Aspect } from "../Aspect.ts";
+
+export interface Channel<
+  Name extends string = string,
+  References extends any[] = any[],
+> extends Aspect<Channel, "channel", Name, References> {}
+
+export type ChannelId = string;
+export const ChannelId = S.String.annotate({
+  description: "The ID of the channel",
+});
+
+export const Channel =
+  defineAspect<
+    <const Name extends string>(
+      name: Name,
+    ) => <References extends any[]>(
+      template: TemplateStringsArray,
+      ...references: References
+    ) => Channel<Name, References>
+  >("channel");
+
+export const channelContext = Channel.plugin.context.succeed({
+  context: (channel) => `#${channel.id}`,
+});

package/src/Agent/chat/event.ts

@@ -0,0 +1,43 @@
+import * as S from "effect/Schema";
+import { Task } from "../process/task.ts";
+import { Message } from "./message.ts";
+import { Thread } from "./thread.ts";
+
+export class MessageCreatedEvent extends S.Class<MessageCreatedEvent>(
+  "MessageCreatedEvent",
+)({
+  message: Message,
+}) {}
+
+export class ThreadCreatedEvent extends S.Class<ThreadCreatedEvent>(
+  "ThreadCreatedEvent",
+)({
+  thread: Thread,
+}) {}
+
+export class ThreadUpdatedEvent extends S.Class<ThreadUpdatedEvent>(
+  "ThreadUpdatedEvent",
+)({
+  thread: Thread,
+}) {}
+
+export class TaskStartedEvent extends S.Class<TaskStartedEvent>(
+  "TaskStartedEvent",
+)({
+  task: Task,
+}) {}
+
+export class TaskCompletedEvent extends S.Class<TaskCompletedEvent>(
+  "TaskCompletedEvent",
+)({
+  task: Task,
+}) {}
+
+export type ChatEvent = S.Schema.Type<typeof ChatEvent>;
+export const ChatEvent = S.Union([
+  MessageCreatedEvent,
+  ThreadCreatedEvent,
+  ThreadUpdatedEvent,
+  TaskStartedEvent,
+  TaskCompletedEvent,
+]);

package/src/Agent/chat/message.ts

@@ -0,0 +1,35 @@
+import * as S from "effect/Schema";
+import { TaskId } from "../process/task.ts";
+
+export type Message = (typeof Message)["Type"];
+export const Message = S.Union([
+  S.suspend((): S.Schema<TextMessage> => TextMessage),
+  S.suspend((): S.Schema<TaskMessage> => TaskMessage),
+]);
+
+export type MessageId = string;
+
+export const MessageId = S.String.annotate({
+  description: "The ID of the message",
+});
+
+export class TextMessage extends S.Class<TextMessage>("TextMessage")({
+  messageId: MessageId,
+  content: S.String.annotate({
+    description: "The content of the message",
+  }),
+  sender: S.String.annotate({
+    description: "The sender of the message",
+  }),
+  timestamp: S.Number.annotate({
+    description: "The timestamp of the message",
+  }),
+}) {}
+
+export class TaskMessage extends S.Class<TaskMessage>("TaskMessage")({
+  messageId: MessageId,
+  taskId: TaskId,
+  taskDescription: S.String.annotate({
+    description: "The description of the task",
+  }),
+}) {}

package/src/Agent/chat/service.ts

@@ -0,0 +1,133 @@
+import * as Effect from "effect/Effect";
+import * as S from "effect/Schema";
+import * as ServiceMap from "effect/ServiceMap";
+import { AgentId } from "../Agent.ts";
+import { StreamTextPart } from "../llm/stream-text-part.ts";
+import { Task, TaskId } from "../process/task.ts";
+import { ChannelId } from "./channel.ts";
+import { Message, MessageId } from "./message.ts";
+import { Thread, ThreadId } from "./thread.ts";
+
+export type SenderId = string;
+export const SenderId = S.String.annotate({
+  description: "The ID of the Agent or User who sent the message",
+});
+
+export class GetThreadRequest extends S.Class<GetThreadRequest>(
+  "GetThreadRequest",
+)({
+  threadId: ThreadId,
+}) {}
+
+export class GetThreadResponse extends S.Class<GetThreadResponse>(
+  "GetThreadResponse",
+)({
+  thread: S.optional(Thread),
+}) {}
+
+export class CreateThreadRequest extends S.Class<CreateThreadRequest>(
+  "CreateThreadRequest",
+)({
+  channelId: ChannelId,
+  parentThreadId: S.optional(ThreadId),
+}) {}
+
+export class CreateThreadResponse extends S.Class<CreateThreadResponse>(
+  "CreateThreadResponse",
+)({
+  thread: Thread,
+}) {}
+
+export class SendMessageRequest extends S.Class<SendMessageRequest>(
+  "SendMessageRequest",
+)({
+  threadId: ThreadId,
+  sender: SenderId,
+  content: S.String,
+}) {}
+
+export class SendMessageResponse extends S.Class<SendMessageResponse>(
+  "SendMessageResponse",
+)({
+  messageId: MessageId,
+}) {}
+
+export class ListMessagesRequest extends S.Class<ListMessagesRequest>(
+  "ListMessagesRequest",
+)({
+  threadId: ThreadId,
+  nextToken: S.optional(S.String),
+}) {}
+
+export class ListMessagesResponse extends S.Class<ListMessagesResponse>(
+  "ListMessagesResponse",
+)({
+  messages: S.Array(Message),
+  nextToken: S.optional(S.String),
+}) {}
+
+export class ListThreadsRequest extends S.Class<ListThreadsRequest>(
+  "ListThreadsRequest",
+)({
+  channelId: ChannelId,
+  nextToken: S.optional(S.String),
+}) {}
+
+export class ListThreadsResponse extends S.Class<ListThreadsResponse>(
+  "ListThreadsResponse",
+)({
+  threads: S.Array(Thread),
+  nextToken: S.optional(S.String),
+}) {}
+
+export class AppendRequest extends S.Class<AppendRequest>("AppendRequest")({
+  taskId: TaskId,
+  part: StreamTextPart,
+}) {}
+
+export class SubscribeRequest extends S.Class<SubscribeRequest>(
+  "SubscribeRequest",
+)({
+  taskId: TaskId,
+}) {}
+
+export class CreateTaskRequest extends S.Class<CreateTaskRequest>(
+  "CreateTaskRequest",
+)({
+  threadId: ThreadId,
+  agentId: AgentId,
+}) {}
+
+/**
+ * The ChatService is the central service for managing Channels, Threads, and Messages.
+ */
+export class Chat extends ServiceMap.Service<
+  Chat,
+  {
+    getThread: (request: GetThreadRequest) => Effect.Effect<GetThreadResponse>;
+    createThread: (
+      request: CreateThreadRequest,
+    ) => Effect.Effect<CreateThreadResponse>;
+    listThreads: (
+      request: ListThreadsRequest,
+    ) => Effect.Effect<ListThreadsResponse>;
+    sendMessage: (
+      request: SendMessageRequest,
+    ) => Effect.Effect<SendMessageResponse>;
+    listMessages: (
+      request: ListMessagesRequest,
+    ) => Effect.Effect<ListMessagesResponse>;
+    subscribe: (request: SubscribeRequest) => Effect.Effect<StreamTextPart>;
+    createTask: (request: CreateTaskRequest) => Effect.Effect<Task>;
+    appendTask: (request: AppendRequest) => Effect.Effect<void>;
+    subscribeTask: (request: SubscribeRequest) => Effect.Effect<StreamTextPart>;
+    sinkTask: (
+      taskId: TaskId,
+      sink: (part: StreamTextPart) => Effect.Effect<void>,
+    ) => Effect.Effect<void>;
+    sinkThreadDriver: (
+      threadId: ThreadId,
+      sink: (part: StreamTextPart) => Effect.Effect<void>,
+    ) => Effect.Effect<void>;
+  }
+>()("Chat") {}

package/src/Agent/chat/thread.ts

@@ -0,0 +1,17 @@
+import * as S from "effect/Schema";
+
+export type ThreadId = string;
+export const ThreadId = S.String.annotate({
+  description: "The ID of the thread",
+});
+
+export class Thread extends S.Class<Thread>("Thread")({
+  threadId: ThreadId,
+  participants: S.Array(S.String).annotate({
+    description: "The agent participants in the thread",
+  }),
+  messages: S.Array(S.String).annotate({
+    description: "The messages in the thread",
+  }),
+  parent: S.optional(S.suspend((): S.Schema<Thread> => Thread)),
+}) {}

package/src/Agent/coding/bash.ts

@@ -0,0 +1,198 @@
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as S from "effect/Schema";
+import { ChildProcess } from "effect/unstable/process";
+import { cwd } from "../../Config.ts";
+import { AspectConfig } from "../Aspect.ts";
+import { Tool } from "../tool/tool.ts";
+import { CommandValidator } from "../util/command-validator.ts";
+import { exec } from "../util/exec.ts";
+
+export class command extends Tool.input("command")`The command to execute` {}
+
+export class timeout extends Tool.input(
+  "timeout",
+  S.optional(S.Number),
+)`Optional timeout in milliseconds` {}
+
+export class workdir extends Tool.input(
+  "workdir",
+  S.optional(S.String),
+)`The working directory to run the command in. Defaults to ${cwd}. Use this instead of 'cd' commands.` {}
+
+export class description extends Tool.input(
+  "description",
+)`Clear, concise description of what this command does in 5-10 words. Examples:
+Input: ls
+Output: Lists files in current directory
+
+Input: git status
+Output: Shows working tree status
+
+Input: npm install
+Output: Installs package dependencies
+
+Input: mkdir foo
+Output: Creates directory 'foo'` {}
+
+export class exitCode extends Tool.output(
+  "exitCode",
+  S.Number,
+)`The exit code of the command.` {}
+
+export class stdout extends Tool.output(
+  "stdout",
+  S.String,
+)`Containing both stdout and stderr.` {}
+
+export class bash extends Tool("bash", {
+  alias: (model) => (model.includes("anthropic") ? "AnthropicBash" : undefined),
+})`Executes a given bash ${command} in a persistent shell session with optional ${timeout}, ensuring proper handling and security measures.
+Returns the ${exitCode} and ${stdout} containing both stdout and stderr.
+If the command is invalid, an error message will be returned as a ${S.String}.
+
+All commands run in ${cwd} by default. Use the ${workdir} parameter if you need to run a command in a different directory. AVOID using \`cd <directory> && <command>\` patterns - use \`workdir\` instead.
+
+IMPORTANT: This tool is for terminal operations like git, npm, docker, etc. DO NOT use it for file operations (reading, writing, editing, searching, finding files) - use the specialized tools for this instead.
+
+Before executing the command, please follow these steps:
+
+1. Directory Verification:
+   - If the command will create new directories or files, first use \`ls\` to verify the parent directory exists and is the correct location
+   - For example, before running "mkdir foo/bar", first use \`ls foo\` to check that "foo" exists and is the intended parent directory
+
+2. Command Execution:
+   - Always quote file paths that contain spaces with double quotes (e.g., rm "path with spaces/file.txt")
+   - Examples of proper quoting:
+     - mkdir "/Users/name/My Documents" (correct)
+     - mkdir /Users/name/My Documents (incorrect - will fail)
+     - python "/path/with spaces/script.py" (correct)
+     - python /path/with spaces/script.py (incorrect - will fail)
+   - After ensuring proper quoting, execute the command.
+   - Capture the output of the command.
+
+Usage notes:
+  - The command argument is required.
+  - You can specify an optional timeout in milliseconds (up to 600000ms / 10 minutes). If not specified, commands will time out after 120000ms (2 minutes).
+  - It is very helpful if you write a clear, concise ${description} of what this command does in 5-10 words.
+  - If the output exceeds 30000 characters, output will be truncated before being returned to you.
+  - You can use the \`run_in_background\` parameter to run the command in the background, which allows you to continue working while the command runs. You can monitor the output using the Bash tool as it becomes available. You do not need to use '&' at the end of the command when using this parameter.
+
+  - Avoid using Bash with the \`find\`, \`grep\`, \`cat\`, \`head\`, \`tail\`, \`sed\`, \`awk\`, or \`echo\` commands, unless explicitly instructed or when these commands are truly necessary for the task. Instead, always prefer using the dedicated tools for these commands:
+    - File search: Use Glob (NOT find or ls)
+    - Content search: Use Grep (NOT grep or rg)
+    - Read files: Use Read (NOT cat/head/tail)
+    - Edit files: Use Edit (NOT sed/awk)
+    - Write files: Use Write (NOT echo >/cat <<EOF)
+    - Communication: Output text directly (NOT echo/printf)
+  - When issuing multiple commands:
+    - If the commands are independent and can run in parallel, make multiple Bash tool calls in a single message. For example, if you need to run "git status" and "git diff", send a single message with two Bash tool calls in parallel.
+    - If the commands depend on each other and must run sequentially, use a single Bash call with '&&' to chain them together (e.g., \`git add . && git commit -m "message" && git push\`). For instance, if one operation must complete before another starts (like mkdir before cp, Write before Bash for git operations, or git add before git commit), run these operations sequentially instead.
+    - Use ';' only when you need to run commands sequentially but don't care if earlier commands fail
+    - DO NOT use newlines to separate commands (newlines are ok in quoted strings)
+  - AVOID using \`cd <directory> && <command>\`. Use the \`workdir\` parameter to change directories instead.
+    <good-example>
+    Use workdir="/foo/bar" with command: pytest tests
+    </good-example>
+    <bad-example>
+    cd /foo/bar && pytest tests
+    </bad-example>
+
+# Committing changes with git
+
+Only create commits when requested by the user. If unclear, ask first. When the user asks you to create a new git commit, follow these steps carefully:
+
+Git Safety Protocol:
+- NEVER update the git config
+- NEVER run destructive/irreversible git commands (like push --force, hard reset, etc) unless the user explicitly requests them
+- NEVER skip hooks (--no-verify, --no-gpg-sign, etc) unless the user explicitly requests it
+- NEVER run force push to main/master, warn the user if they request it
+- Avoid git commit --amend. ONLY use --amend when ALL conditions are met:
+  (1) User explicitly requested amend, OR commit SUCCEEDED but pre-commit hook auto-modified files that need including
+  (2) HEAD commit was created by you in this conversation (verify: git log -1 --format='%an %ae')
+  (3) Commit has NOT been pushed to remote (verify: git status shows "Your branch is ahead")
+- CRITICAL: If commit FAILED or was REJECTED by hook, NEVER amend - fix the issue and create a NEW commit
+- CRITICAL: If you already pushed to remote, NEVER amend unless user explicitly requests it (requires force push)
+- NEVER commit changes unless the user explicitly asks you to. It is VERY IMPORTANT to only commit when explicitly asked, otherwise the user will feel that you are being too proactive.
+
+1. You can call multiple tools in a single response. When multiple independent pieces of information are requested and all commands are likely to succeed, run multiple tool calls in parallel for optimal performance. run the following bash commands in parallel, each using the Bash tool:
+  - Run a git status command to see all untracked files.
+  - Run a git diff command to see both staged and unstaged changes that will be committed.
+  - Run a git log command to see recent commit messages, so that you can follow this repository's commit message style.
+2. Analyze all staged changes (both previously staged and newly added) and draft a commit message:
+  - Summarize the nature of the changes (eg. new feature, enhancement to an existing feature, bug fix, refactoring, test, docs, etc.). Ensure the message accurately reflects the changes and their purpose (i.e. "add" means a wholly new feature, "update" means an enhancement to an existing feature, "fix" means a bug fix, etc.).
+  - Do not commit files that likely contain secrets (.env, credentials.json, etc.). Warn the user if they specifically request to commit those files
+  - Draft a concise (1-2 sentences) commit message that focuses on the "why" rather than the "what"
+  - Ensure it accurately reflects the changes and their purpose
+3. You can call multiple tools in a single response. When multiple independent pieces of information are requested and all commands are likely to succeed, run multiple tool calls in parallel for optimal performance. run the following commands:
+   - Add relevant untracked files to the staging area.
+   - Create the commit with a message
+   - Run git status after the commit completes to verify success.
+   Note: git status depends on the commit completing, so run it sequentially after the commit.
+4. If the commit fails due to pre-commit hook, fix the issue and create a NEW commit (see amend rules above)
+
+Important notes:
+- NEVER run additional commands to read or explore code, besides git bash commands
+- NEVER use the TodoWrite or Task tools
+- DO NOT push to the remote repository unless the user explicitly asks you to do so
+- IMPORTANT: Never use git commands with the -i flag (like git rebase -i or git add -i) since they require interactive input which is not supported.
+- If there are no changes to commit (i.e., no untracked files and no modifications), do not create an empty commit
+
+# Creating pull requests
+Use the gh command via the Bash tool for ALL GitHub-related tasks including working with issues, pull requests, checks, and releases. If given a Github URL use the gh command to get the information needed.
+
+IMPORTANT: When the user asks you to create a pull request, follow these steps carefully:
+
+1. You can call multiple tools in a single response. When multiple independent pieces of information are requested and all commands are likely to succeed, run multiple tool calls in parallel for optimal performance. run the following bash commands in parallel using the Bash tool, in order to understand the current state of the branch since it diverged from the main branch:
+   - Run a git status command to see all untracked files
+   - Run a git diff command to see both staged and unstaged changes that will be committed
+   - Check if the current branch tracks a remote branch and is up to date with the remote, so you know if you need to push to the remote
+   - Run a git log command and \`git diff [base-branch]...HEAD\` to understand the full commit history for the current branch (from the time it diverged from the base branch)
+2. Analyze all changes that will be included in the pull request, making sure to look at all relevant commits (NOT just the latest commit, but ALL commits that will be included in the pull request!!!), and draft a pull request summary
+3. You can call multiple tools in a single response. When multiple independent pieces of information are requested and all commands are likely to succeed, run multiple tool calls in parallel for optimal performance. run the following commands in parallel:
+   - Create new branch if needed
+   - Push to remote with -u flag if needed
+   - Create PR using gh pr create with the format below. Use a HEREDOC to pass the body to ensure correct formatting.
+<example>
+gh pr create --title "the pr title" --body "$(cat <<'EOF'
+## Summary
+<1-3 bullet points>
+</example>
+
+Important:
+- DO NOT use the TodoWrite or Task tools
+- Return the PR URL when you're done, so the user can see it
+
+# Other common operations
+- View comments on a Github PR: gh api repos/foo/bar/pulls/123/comments
+`(function* ({ command, workdir }) {
+  const config = yield* Effect.serviceOption(AspectConfig).pipe(
+    Effect.map(Option.getOrElse(() => ({ cwd: process.cwd() }))),
+  );
+  const validator = yield* Effect.serviceOption(CommandValidator).pipe(
+    Effect.map(Option.getOrUndefined),
+  );
+  yield* Effect.logDebug(`[bash] command=${command}`);
+
+  if (validator) {
+    const validationError = yield* validator.validate(command).pipe(
+      Effect.map(() => null),
+      Effect.catch((e) => Effect.succeed(`${e}`)),
+    );
+    if (validationError) {
+      return `Security violation: ${validationError}`;
+    }
+  }
+
+  const cmd = ChildProcess.setCwd(
+    ChildProcess.make(command, [], { shell: true }),
+    workdir ?? config.cwd,
+  );
+
+  const result = yield* exec(cmd);
+
+  return {
+    exitCode: result.exitCode,
+    stdout: result.stdout + result.stderr,
+  };
+}) {}