charness 3.6.1 → 3.8.0

package/dist/remoteRun/runnersCatalog.js

@@ -0,0 +1,68 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadRunnersCatalog = loadRunnersCatalog;
+const os = __importStar(require("os"));
+const pairedRunners_1 = require("./pairedRunners");
+const runnersConfig_1 = require("./runnersConfig");
+/**
+ * @description Every runner `remote-run` may use: the hand-made ones of `runners.json` (plain ssh, phase 1) and the paired ones of the
+ * hub's registry (`pairedRunners.ts`), as one list with the hand-made first — the order `pickRunner` walks. A name in both is an error
+ * that names it (a runner is addressed by name, in job ids too); pairing itself avoids the clash by renaming a newcomer (`-2`), so it can
+ * only come from a hand edit made afterwards. This is the only place that knows both sources; it is kept apart from `runnersConfig.ts`
+ * because the hub registry's schemas import that file.
+ *
+ * Both loads are stamp-cached, so the bot MCP can read the runners (`runnerSummary.ts`) on every connect for the cost of two `stat` calls.
+ */
+/** @description The runners of the user whose home is `homeDir`. `missing` = neither a `runners.json` nor a paired runner; `invalid` carries every problem and, when there is one, the last good (or best-effort) list. */
+function loadRunnersCatalog(homeDir = os.homedir()) {
+    const handMade = (0, runnersConfig_1.loadRunnersConfig)(homeDir);
+    const paired = (0, pairedRunners_1.loadPairedRunners)(homeDir);
+    const handMadeRunners = handMade.config?.runners ?? [];
+    const pairedRunners = paired.config?.runners ?? [];
+    const handMadeNames = new Set(handMadeRunners.map((runner) => runner.name));
+    const clashes = pairedRunners.filter((runner) => handMadeNames.has(runner.name));
+    const errors = [
+        ...(handMade.status === 'invalid' ? handMade.errors : []),
+        ...(paired.status === 'invalid' ? paired.errors : []),
+        ...clashes.map((runner) => `runner "${runner.name}" is in runners.json and also paired — rename the runners.json entry (or remove the pairing)`),
+    ];
+    const clashingNames = new Set(clashes.map((runner) => runner.name));
+    const config = { runners: [...handMadeRunners, ...pairedRunners.filter((runner) => !clashingNames.has(runner.name))] };
+    if (errors.length > 0)
+        return { status: 'invalid', config: config.runners.length > 0 ? config : null, errors };
+    return { status: handMade.status === 'missing' && paired.status === 'missing' ? 'missing' : 'ok', config };
+}
+//# sourceMappingURL=runnersCatalog.js.map

package/dist/remoteRun/runnersCatalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runnersCatalog.js","sourceRoot":"","sources":["../../src/remoteRun/runnersCatalog.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBA,gDAgBC;AAhCD,uCAAyB;AAEzB,mDAAoD;AACpD,mDAA2F;AAE3F;;;;;;;;GAQG;AAEH,2NAA2N;AAC3N,SAAgB,kBAAkB,CAAC,UAAkB,EAAE,CAAC,OAAO,EAAE;IAC/D,MAAM,QAAQ,GAAG,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,eAAe,GAAmB,QAAQ,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;IACvE,MAAM,aAAa,GAAmB,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;IACnE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACjF,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,MAAM,CAAC,IAAI,8FAA8F,CAAC;KACjJ,CAAC;IACF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,MAAM,GAAkB,EAAE,OAAO,EAAE,CAAC,GAAG,eAAe,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACtI,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAC/G,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;AAC7G,CAAC"}

package/dist/remoteRun/runnersConfig.d.ts

@@ -0,0 +1,53 @@
+import { z } from 'zod';
+import { type ConfigFileLoad } from '../configDirFile';
+/** @description What a runner's name may be: lowercase letters and digits, single dashes between. */
+export declare const runnerNamePattern: RegExp;
+/** The group every runner has; its parallel limit may be set, it never needs `group add`. */
+export declare const defaultPueueGroup = "default";
+/** @description A runner's work folder: an absolute path on the runner, or one the runner's shell expands from `~`. */
+export declare const runnerWorkDirSchema: z.ZodString;
+declare const runnerSchema: z.ZodObject<{
+    name: z.ZodString;
+    ssh: z.ZodString;
+    sshOptions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    workDir: z.ZodString;
+    pueue: z.ZodOptional<z.ZodObject<{
+        bin: z.ZodOptional<z.ZodString>;
+        config: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    groups: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+}, z.core.$strict>;
+/**
+ * @name PairedRunnerLink
+ * @description What only a PAIRED runner has (`pairedRunners.ts` fills it; the file never can): where the hub keeps its link on this
+ * machine and whether the hub paused it. A runner without it is a hand-made one, reached by plain ssh.
+ */
+export interface PairedRunnerLink {
+    runnerId: string;
+    /** The registry folder (`~/.config/charness/runners`): `link/<id>.sock` / `link/<id>.json` say whether the runner is connected. */
+    hubDir: string;
+    /** Paused from the hub (`charness runners pause`, `/runners`): the runner stays attached but is never picked for a job. */
+    isPausedByHub: boolean;
+    /** The OS the runner reported at pairing (`macOS 15.1`) — text from the runner machine, to be cleaned before it is shown to an agent. */
+    os: string;
+}
+/** @name RunnerConfig @description One runner: an entry of the file, or a paired runner built from the hub's registry. */
+export type RunnerConfig = z.infer<typeof runnerSchema> & {
+    paired?: PairedRunnerLink;
+};
+/** @name RunnersConfig @description Every runner `remote-run` may use (see `runnersCatalog.ts`); the file alone holds only the hand-made ones. */
+export interface RunnersConfig {
+    runners: RunnerConfig[];
+}
+/** @description Where the file lives: beside the user's global charness env file, whatever `ENV_FILE` says (it is per OS user, not per instance). */
+export declare function getRunnersConfigPath(homeDir?: string): string;
+/** @description The content of the runners file at `filePath` (stamp-cached): missing = no runners, invalid = its errors and the last good config of this process, if any. */
+export declare function loadRunnersConfigAt(filePath: string): ConfigFileLoad<RunnersConfig>;
+/** @description The user's `runners.json` right now. */
+export declare function loadRunnersConfig(homeDir?: string): ConfigFileLoad<RunnersConfig>;
+/** @description Forget the cached loads (tests that swap files under one path). */
+export declare function resetRunnersConfigCache(): void;
+/** @description The parallel limits of a runner's groups as the `name=n,name=n` string the runner script applies, in the order of the file (the runner applies each pair on its own, so the order carries no meaning). */
+export declare function formatGroupLimits(groups: RunnerConfig['groups']): string;
+export {};
+//# sourceMappingURL=runnersConfig.d.ts.map

package/dist/remoteRun/runnersConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runnersConfig.d.ts","sourceRoot":"","sources":["../../src/remoteRun/runnersConfig.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAkB/E,qGAAqG;AACrG,eAAO,MAAM,iBAAiB,QAA+B,CAAC;AAE9D,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAE3C,uHAAuH;AACvH,eAAO,MAAM,mBAAmB,aAA2K,CAAC;AAE5M,QAAA,MAAM,YAAY;;;;;;;;;;kBAOhB,CAAC;AAMH;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,mIAAmI;IACnI,MAAM,EAAE,MAAM,CAAC;IACf,2HAA2H;IAC3H,aAAa,EAAE,OAAO,CAAC;IACvB,yIAAyI;IACzI,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,0HAA0H;AAC1H,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAAC;AACxF,kJAAkJ;AAClJ,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB;AAED,qJAAqJ;AACrJ,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,MAAqB,GAAG,MAAM,CAE3E;AAYD,8KAA8K;AAC9K,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,CAAC,aAAa,CAAC,CAEnF;AAED,wDAAwD;AACxD,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,MAAqB,GAAG,cAAc,CAAC,aAAa,CAAC,CAE/F;AAED,mFAAmF;AACnF,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C;AAED,0NAA0N;AAC1N,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,GAAG,MAAM,CAExE"}

package/dist/remoteRun/runnersConfig.js

@@ -0,0 +1,109 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runnerWorkDirSchema = exports.defaultPueueGroup = exports.runnerNamePattern = void 0;
+exports.getRunnersConfigPath = getRunnersConfigPath;
+exports.loadRunnersConfigAt = loadRunnersConfigAt;
+exports.loadRunnersConfig = loadRunnersConfig;
+exports.resetRunnersConfigCache = resetRunnersConfigCache;
+exports.formatGroupLimits = formatGroupLimits;
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const zod_1 = require("zod");
+const configDirFile_1 = require("../configDirFile");
+const legacyNames_1 = require("../legacyNames");
+/**
+ * @description `~/.config/charness/runners.json` — the machines `charness remote-run` may use, written by hand (phase 1). ONE file per
+ * OS user, deliberately NOT in an instance's `DATA_DIR`: an agent's environment does not say which instance it belongs to (a Jira agent
+ * has neither `ENV_FILE` nor `DATA_DIR`), so every charness instance of the user shares it.
+ *
+ *   { "runners": [{ "name": "box1", "ssh": "runner@box1.example", "workDir": "/home/runner/charness-runner",
+ *                   "sshOptions": ["-i", "/home/user/.ssh/runner_key"],
+ *                   "pueue": { "bin": "/home/runner/.local/bin/pueue", "config": "/home/runner/.config/pueue/pueue.yml" },
+ *                   "groups": { "default": 2, "emulator": 1 } }] }
+ *
+ * Validation is strict (an unknown key, a bad name, a duplicate is an error that names the field and echoes no value). The loader is
+ * the shared stamp-cached one, so the bot's MCP can ask "is any runner listed?" on every connect for the cost of one `stat`.
+ */
+const configFileName = 'runners.json';
+/** @description What a runner's name may be: lowercase letters and digits, single dashes between. */
+exports.runnerNamePattern = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const groupNamePattern = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+/** The group every runner has; its parallel limit may be set, it never needs `group add`. */
+exports.defaultPueueGroup = 'default';
+/** @description A runner's work folder: an absolute path on the runner, or one the runner's shell expands from `~`. */
+exports.runnerWorkDirSchema = zod_1.z.string().min(1).refine((workDir) => workDir.startsWith('/') || workDir === '~' || workDir.startsWith('~/'), 'must be an absolute path on the runner or start with ~/');
+const runnerSchema = zod_1.z.strictObject({
+    name: zod_1.z.string().regex(exports.runnerNamePattern, 'must be lowercase letters, digits and single dashes'),
+    ssh: zod_1.z.string().min(1).refine((destination) => !destination.startsWith('-') && !/\s/.test(destination), 'must be an ssh destination (user@host or a host alias): no spaces, not an option'),
+    sshOptions: zod_1.z.array(zod_1.z.string()).optional(),
+    workDir: exports.runnerWorkDirSchema,
+    pueue: zod_1.z.strictObject({ bin: zod_1.z.string().min(1).optional(), config: zod_1.z.string().min(1).optional() }).optional(),
+    groups: zod_1.z.record(zod_1.z.string().regex(groupNamePattern, 'is not a valid group name'), zod_1.z.number().int().positive()).optional(),
+});
+const runnersConfigSchema = zod_1.z.strictObject({
+    runners: zod_1.z.array(runnerSchema),
+}).refine((config) => new Set(config.runners.map((runner) => runner.name)).size === config.runners.length, { path: ['runners'], message: 'runner names must be unique' });
+/** @description Where the file lives: beside the user's global charness env file, whatever `ENV_FILE` says (it is per OS user, not per instance). */
+function getRunnersConfigPath(homeDir = os.homedir()) {
+    return path.join(path.dirname((0, legacyNames_1.resolveGlobalConfigEnvPath)(homeDir)), configFileName);
+}
+const loader = (0, configDirFile_1.createConfigFileLoader)({
+    fileName: configFileName,
+    createEmpty: () => ({ runners: [] }),
+    validate: (parsedJson) => {
+        const parsed = runnersConfigSchema.safeParse(parsedJson);
+        if (parsed.success)
+            return { ok: true, config: parsed.data };
+        return { ok: false, errors: parsed.error.issues.map((issue) => `${configFileName} ${issue.path.join('.') || '(root)'}: ${issue.message}`) };
+    },
+});
+/** @description The content of the runners file at `filePath` (stamp-cached): missing = no runners, invalid = its errors and the last good config of this process, if any. */
+function loadRunnersConfigAt(filePath) {
+    return loader.load(filePath);
+}
+/** @description The user's `runners.json` right now. */
+function loadRunnersConfig(homeDir = os.homedir()) {
+    return loadRunnersConfigAt(getRunnersConfigPath(homeDir));
+}
+/** @description Forget the cached loads (tests that swap files under one path). */
+function resetRunnersConfigCache() {
+    loader.resetCache();
+}
+/** @description The parallel limits of a runner's groups as the `name=n,name=n` string the runner script applies, in the order of the file (the runner applies each pair on its own, so the order carries no meaning). */
+function formatGroupLimits(groups) {
+    return Object.entries(groups ?? {}).map(([groupName, parallel]) => `${groupName}=${parallel}`).join(',');
+}
+//# sourceMappingURL=runnersConfig.js.map

package/dist/remoteRun/runnersConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runnersConfig.js","sourceRoot":"","sources":["../../src/remoteRun/runnersConfig.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkEA,oDAEC;AAaD,kDAEC;AAGD,8CAEC;AAGD,0DAEC;AAGD,8CAEC;AAlGD,uCAAyB;AACzB,2CAA6B;AAC7B,6BAAwB;AACxB,oDAA+E;AAC/E,gDAA4D;AAE5D;;;;;;;;;;;;GAYG;AAEH,MAAM,cAAc,GAAG,cAAc,CAAC;AACtC,qGAAqG;AACxF,QAAA,iBAAiB,GAAG,4BAA4B,CAAC;AAC9D,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AACvD,6FAA6F;AAChF,QAAA,iBAAiB,GAAG,SAAS,CAAC;AAE3C,uHAAuH;AAC1G,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,yDAAyD,CAAC,CAAC;AAE5M,MAAM,YAAY,GAAG,OAAC,CAAC,YAAY,CAAC;IAClC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAiB,EAAE,qDAAqD,CAAC;IAChG,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,kFAAkF,CAAC;IAC3L,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,2BAAmB;IAC5B,KAAK,EAAE,OAAC,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7G,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1H,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,OAAC,CAAC,YAAY,CAAC;IACzC,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,YAAY,CAAC;CAC/B,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;AAwB1K,qJAAqJ;AACrJ,SAAgB,oBAAoB,CAAC,UAAkB,EAAE,CAAC,OAAO,EAAE;IACjE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAA,wCAA0B,EAAC,OAAO,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,MAAM,GAAG,IAAA,sCAAsB,EAAgB;IACnD,QAAQ,EAAE,cAAc;IACxB,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACpC,QAAQ,EAAE,CAAC,UAAU,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,cAAc,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IAC9I,CAAC;CACF,CAAC,CAAC;AAEH,8KAA8K;AAC9K,SAAgB,mBAAmB,CAAC,QAAgB;IAClD,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,wDAAwD;AACxD,SAAgB,iBAAiB,CAAC,UAAkB,EAAE,CAAC,OAAO,EAAE;IAC9D,OAAO,mBAAmB,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,mFAAmF;AACnF,SAAgB,uBAAuB;IACrC,MAAM,CAAC,UAAU,EAAE,CAAC;AACtB,CAAC;AAED,0NAA0N;AAC1N,SAAgB,iBAAiB,CAAC,MAA8B;IAC9D,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3G,CAAC"}

package/dist/remoteRun/safeCopy.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @description Bring a job's result files into the project, from a temp folder the runner's files were rsynced into. The runner is not
+ * trusted to write into the main box: only REGULAR files whose project-relative path a `pull:` pattern names are copied — never one that
+ * {@link getProtectedPathReason} protects; a symlink,
+ * a special file, a path no pattern names, or a destination that would pass through a symlink or over a directory of the project is
+ * refused and only counted. Nothing outside the project root can be reached: paths come from walking the temp folder, and every
+ * destination directory is checked component by component.
+ */
+export interface SafeCopyResult {
+    copied: string[];
+    /** Files seen in the fetched folder that were not copied (symlinks, special files, paths no pattern names, unsafe destinations). */
+    refusedCount: number;
+}
+/**
+ * @description Why a path may never be copied in, whatever a `pull:` pattern says — or `null`. A broad pattern (`**`) is a trust in the
+ * runner for what it names, but some files turn that into code running on the MAIN box: anything under a `.git` (a hook, or
+ * `core.hooksPath` / `fsmonitor` in its `config`, run at the next git command), the project's own `.remote-run` (it decides what is sent,
+ * installed and pulled next time), and anything in a folder git takes hooks from (`hookDirectories`: `getHookDirectories` in `project.ts` —
+ * husky's `.husky`, a `core.hooksPath` inside the project). Compared case-insensitively: on a case-insensitive disk `.Git/hooks` IS
+ * `.git/hooks`. Other tools that run commands at commit (lint-staged and lefthook configs, `package.json` scripts) are not recognised:
+ * that is what keeping `pull:` narrow is for.
+ */
+export declare function getProtectedPathReason(relativePath: string, hookDirectories?: readonly string[]): string | null;
+/** @description Copy the files of `fetchedRoot` that `patterns` name into `projectRoot`, as the module comment says. */
+export declare function copyFetchedFiles(params: {
+    fetchedRoot: string;
+    projectRoot: string;
+    patterns: readonly string[];
+    hookDirectories?: readonly string[];
+}): SafeCopyResult;
+//# sourceMappingURL=safeCopy.d.ts.map

package/dist/remoteRun/safeCopy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safeCopy.d.ts","sourceRoot":"","sources":["../../src/remoteRun/safeCopy.ts"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AAEH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,oIAAoI;IACpI,YAAY,EAAE,MAAM,CAAC;CACtB;AAuCD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,eAAe,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,GAAG,IAAI,CAMnH;AAED,wHAAwH;AACxH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,cAAc,CAmCvK"}

package/dist/remoteRun/safeCopy.js

@@ -0,0 +1,137 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getProtectedPathReason = getProtectedPathReason;
+exports.copyFetchedFiles = copyFetchedFiles;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const pathPatterns_1 = require("./pathPatterns");
+const projectConfig_1 = require("./projectConfig");
+const copiedFileModeMask = 0o777;
+function listFetchedEntries(directory, relativeDirectory, found) {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+        const relativePath = relativeDirectory === '' ? entry.name : path.posix.join(relativeDirectory, entry.name);
+        if (entry.isDirectory())
+            listFetchedEntries(path.join(directory, entry.name), relativePath, found);
+        else
+            found.push({ relativePath, kind: entry.isFile() ? 'file' : 'other' });
+    }
+}
+/** Create the directories of `relativeDirectory` under `rootReal`, refusing a symlink or a non-directory on the way. `false` = unsafe. */
+function ensureSafeDirectory(rootReal, relativeDirectory) {
+    let current = rootReal;
+    for (const part of relativeDirectory.split('/').filter((segment) => segment !== '')) {
+        current = path.join(current, part);
+        let stat;
+        try {
+            stat = fs.lstatSync(current);
+        }
+        catch {
+            stat = null;
+        }
+        if (stat === null)
+            fs.mkdirSync(current);
+        else if (!stat.isDirectory())
+            return false;
+    }
+    return true;
+}
+const gitDirectoryName = '.git';
+/** Is `relativePath` the folder `directory` or inside it? `''` is the project root: everything. Case-insensitive, like the disks that make `.Git` the same as `.git`. */
+function checkIsInsideDirectory(relativePath, directory) {
+    if (directory === '')
+        return true;
+    const lowerPath = relativePath.toLowerCase();
+    const lowerDirectory = directory.toLowerCase();
+    return lowerPath === lowerDirectory || lowerPath.startsWith(`${lowerDirectory}/`);
+}
+/**
+ * @description Why a path may never be copied in, whatever a `pull:` pattern says — or `null`. A broad pattern (`**`) is a trust in the
+ * runner for what it names, but some files turn that into code running on the MAIN box: anything under a `.git` (a hook, or
+ * `core.hooksPath` / `fsmonitor` in its `config`, run at the next git command), the project's own `.remote-run` (it decides what is sent,
+ * installed and pulled next time), and anything in a folder git takes hooks from (`hookDirectories`: `getHookDirectories` in `project.ts` —
+ * husky's `.husky`, a `core.hooksPath` inside the project). Compared case-insensitively: on a case-insensitive disk `.Git/hooks` IS
+ * `.git/hooks`. Other tools that run commands at commit (lint-staged and lefthook configs, `package.json` scripts) are not recognised:
+ * that is what keeping `pull:` narrow is for.
+ */
+function getProtectedPathReason(relativePath, hookDirectories = []) {
+    if (relativePath.split('/').some((part) => part.toLowerCase() === gitDirectoryName))
+        return 'inside a .git';
+    if (relativePath.toLowerCase() === projectConfig_1.projectConfigName)
+        return "the project's .remote-run";
+    const hookDirectory = hookDirectories.find((directory) => checkIsInsideDirectory(relativePath, directory));
+    if (hookDirectory !== undefined)
+        return hookDirectory === '' ? 'in a project whose git hooks folder is the project root' : `inside the git hooks folder ${hookDirectory}`;
+    return null;
+}
+/** @description Copy the files of `fetchedRoot` that `patterns` name into `projectRoot`, as the module comment says. */
+function copyFetchedFiles(params) {
+    const isNamed = (0, pathPatterns_1.createPathMatcher)(params.patterns);
+    const rootReal = fs.realpathSync(params.projectRoot);
+    const entries = [];
+    listFetchedEntries(params.fetchedRoot, '', entries);
+    const result = { copied: [], refusedCount: 0 };
+    for (const entry of entries) {
+        const isInside = !entry.relativePath.split('/').includes('..') && !path.isAbsolute(entry.relativePath);
+        if (entry.kind !== 'file' || !isInside || !isNamed(entry.relativePath) || getProtectedPathReason(entry.relativePath, params.hookDirectories) !== null) {
+            result.refusedCount += 1;
+            continue;
+        }
+        const destination = path.join(rootReal, entry.relativePath);
+        if (!ensureSafeDirectory(rootReal, path.posix.dirname(entry.relativePath) === '.' ? '' : path.posix.dirname(entry.relativePath))) {
+            result.refusedCount += 1;
+            continue;
+        }
+        let existing;
+        try {
+            existing = fs.lstatSync(destination);
+        }
+        catch {
+            existing = null;
+        }
+        if (existing !== null && !existing.isFile()) {
+            result.refusedCount += 1;
+            continue;
+        }
+        const source = path.join(params.fetchedRoot, entry.relativePath);
+        const temporary = `${destination}.remote-run-${process.pid}.tmp`;
+        fs.copyFileSync(source, temporary);
+        fs.chmodSync(temporary, fs.statSync(source).mode & copiedFileModeMask);
+        fs.renameSync(temporary, destination);
+        result.copied.push(entry.relativePath);
+    }
+    return result;
+}
+//# sourceMappingURL=safeCopy.js.map

package/dist/remoteRun/safeCopy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safeCopy.js","sourceRoot":"","sources":["../../src/remoteRun/safeCopy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkEA,wDAMC;AAGD,4CAmCC;AA9GD,uCAAyB;AACzB,2CAA6B;AAC7B,iDAAmD;AACnD,mDAAoD;AAiBpD,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,SAAS,kBAAkB,CAAC,SAAiB,EAAE,iBAAyB,EAAE,KAA8D;IACtI,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACvE,MAAM,YAAY,GAAG,iBAAiB,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5G,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;;YAC9F,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,0IAA0I;AAC1I,SAAS,mBAAmB,CAAC,QAAgB,EAAE,iBAAyB;IACtE,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC;QACpF,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,IAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,KAAK,IAAI;YAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;aACpC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,KAAK,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,yKAAyK;AACzK,SAAS,sBAAsB,CAAC,YAAoB,EAAE,SAAiB;IACrE,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,cAAc,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IAC/C,OAAO,SAAS,KAAK,cAAc,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,sBAAsB,CAAC,YAAoB,EAAE,kBAAqC,EAAE;IAClG,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC;QAAE,OAAO,eAAe,CAAC;IAC5G,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,iCAAiB;QAAE,OAAO,2BAA2B,CAAC;IACzF,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,sBAAsB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;IAC3G,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,yDAAyD,CAAC,CAAC,CAAC,+BAA+B,aAAa,EAAE,CAAC;IAC1K,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wHAAwH;AACxH,SAAgB,gBAAgB,CAAC,MAAsH;IACrJ,MAAM,OAAO,GAAG,IAAA,gCAAiB,EAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,OAAO,GAA4D,EAAE,CAAC;IAC5E,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,MAAM,GAAmB,EAAE,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAC/D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvG,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,sBAAsB,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE,CAAC;YACtJ,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5D,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YACjI,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,IAAI,QAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5C,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,GAAG,WAAW,eAAe,OAAO,CAAC,GAAG,MAAM,CAAC;QACjE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACnC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,kBAAkB,CAAC,CAAC;QACvE,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/remoteRun/sendPlan.d.ts

@@ -0,0 +1,67 @@
+/**
+ * @description What goes to the runner and how: the file list (git decides, `.remote-run` trims and opts in), the files held back
+ * because they look like secrets, and the rsync argument lists. Pure — the git calls and the process spawns are elsewhere.
+ *
+ * Sent: tracked and untracked-not-ignored files, submodules included. Never sent: what `.gitignore` names (the runner keeps its own
+ * `node_modules`, `build`, caches), `.git` unless `--with-git`, `exclude:` paths, and secret-looking files unless `send:` names them.
+ */
+/**
+ * rsync decides a file is unchanged when its size and mtime match, and by default the mtime is compared in WHOLE SECONDS: an edit of the
+ * same length within the second of the previous version would be skipped, and the runner would keep the old file. A negative modify
+ * window compares the nanoseconds too (rsync 3.1.3 or newer on both ends; older ones fall back to seconds).
+ */
+export declare const rsyncNanosecondWindowArg = "--modify-window=-1";
+/** @description Does the NAME of `relativePath` look like a secret (`.env`, `.env.*` but not its templates, `*.pem`, `*.p12`, `*.key`, `.npmrc`)? */
+export declare function checkIsSecretLookingFile(relativePath: string): boolean;
+export interface SendListInput {
+    /** What git lists as sendable: tracked + untracked-not-ignored, submodule files included, relative to the project root, all of them present on disk. */
+    files: readonly string[];
+    /** Ignored files that exist (git's `-o -i`), consulted ONLY for what `send:` names. */
+    ignoredFiles: readonly string[];
+    exclude: readonly string[];
+    send: readonly string[];
+}
+export interface SendPlan {
+    /** What is sent, sorted. */
+    files: string[];
+    /** Secret-looking files NOT sent (the caller says which and how to opt in). */
+    heldBack: string[];
+    /** Names with a newline that `exclude:` does not drop: the whole run is refused (the runner reads its lists one name per line). */
+    refused: string[];
+}
+/** @description Turn git's lists into the send plan. `exclude:` beats `send:`; a name with a newline that is not excluded is refused. */
+export declare function planSendList(input: SendListInput): SendPlan;
+/** @description The NUL-separated list `rsync --files-from=- --from0` reads. */
+export declare function formatNulSeparatedList(files: readonly string[]): string;
+/** @description The list the runner diffs between two submits to find deletions: one path per line. */
+export declare function formatManifest(files: readonly string[]): string;
+export interface RsyncSendParams {
+    /** The ssh command rsync runs (`-e`), already joined. */
+    sshCommand: string;
+    /** The project root on this machine. */
+    sourceRoot: string;
+    /** `host:/path/stage/<job>/` */
+    destination: string;
+    /** The runner's current copy, so unchanged files are copied locally instead of sent again; `null` on a first send. */
+    copyDestination: string | null;
+}
+/**
+ * @description `rsync` of the listed files into the job's stage dir. `--copy-dest` (not `--link-dest`): a staged file is a real copy,
+ * so a job that rewrites a file in place (`jest -u`) can never change what a queued job of the same project is going to apply.
+ */
+export declare function buildRsyncSendArgs(params: RsyncSendParams): string[];
+/** @description `rsync` of the project's `.git` directory into the stage dir (`--with-git`). */
+export declare function buildRsyncGitArgs(params: RsyncSendParams): string[];
+/** @description `rsync` of a small local folder (the job's meta files) to `destination`. */
+export declare function buildRsyncMetaArgs(params: {
+    sshCommand: string;
+    sourceDirectory: string;
+    destination: string;
+}): string[];
+/** @description `rsync` of a job's result files into a local temp folder: no symlinks at all, the runner is not trusted to write into the main box. */
+export declare function buildRsyncFetchArgs(params: {
+    sshCommand: string;
+    source: string;
+    destinationDirectory: string;
+}): string[];
+//# sourceMappingURL=sendPlan.d.ts.map

package/dist/remoteRun/sendPlan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sendPlan.d.ts","sourceRoot":"","sources":["../../src/remoteRun/sendPlan.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AAEH;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAM7D,qJAAqJ;AACrJ,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAKtE;AAED,MAAM,WAAW,aAAa;IAC5B,wJAAwJ;IACxJ,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,uFAAuF;IACvF,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,QAAQ;IACvB,4BAA4B;IAC5B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,mIAAmI;IACnI,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,yIAAyI;AACzI,wBAAgB,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,QAAQ,CAe3D;AAED,gFAAgF;AAChF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAEvE;AAED,uGAAuG;AACvG,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAE/D;AAED,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,sHAAsH;IACtH,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,EAAE,CAYpE;AAED,gGAAgG;AAChG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,EAAE,CAUnE;AAED,4FAA4F;AAC5F,wBAAgB,kBAAkB,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAEzH;AAED,uJAAuJ;AACvJ,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAE1H"}