codex-orchestrator 0.1.46 → 0.1.48

package/dist/src/runner/mission-capability-kernel.d.ts

@@ -0,0 +1,34 @@
+export type MissionSandboxBackend = 'macos-sandbox' | 'linux-bwrap';
+export type MissionCapability = 'git-status' | 'read-file' | 'validate-patch';
+export declare const missionGitStatusArgv: readonly ["/usr/bin/git", "-c", "core.fsmonitor=false", "-c", "core.untrackedCache=false", "-c", "core.hooksPath=/dev/null", "status", "--porcelain=v1", "--untracked-files=all"];
+export interface MissionCapabilityProbeInput {
+    platform: NodeJS.Platform;
+    commands: ReadonlySet<string>;
+}
+export interface MissionCapabilityProbeResult {
+    prerequisitesAvailable: boolean;
+    backend?: MissionSandboxBackend;
+    missing: string[];
+}
+export interface MissionCapabilityRequest {
+    missionId: string;
+    actionKey: string;
+    capability: MissionCapability;
+    argv: string[];
+    requestedPaths: string[];
+    grantedPaths: string[];
+    inputSnapshot: string;
+    fencingEpoch: number;
+    expiresAt: string;
+    readPath?: string;
+    maxReadBytes?: number;
+}
+export interface MissionCapabilityPermit extends MissionCapabilityRequest {
+    network: 'deny';
+    workspace: 'read-only';
+}
+export declare function missionCapabilityPermitFingerprint(permit: MissionCapabilityPermit): string;
+export declare function discoverMissionExecutorPrerequisites(input: MissionCapabilityProbeInput): MissionCapabilityProbeResult;
+export declare function authorizeMissionCapability(request: MissionCapabilityRequest): MissionCapabilityPermit;
+export declare function scrubMissionExecutorEnv(source: NodeJS.ProcessEnv, allowedKeys: string[]): Record<string, string>;
+//# sourceMappingURL=mission-capability-kernel.d.ts.map

package/dist/src/runner/mission-capability-kernel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission-capability-kernel.d.ts","sourceRoot":"","sources":["../../../src/runner/mission-capability-kernel.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,qBAAqB,GAAG,eAAe,GAAG,aAAa,CAAC;AACpE,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,WAAW,GAAG,gBAAgB,CAAC;AAE9E,eAAO,MAAM,oBAAoB,mLAMvB,CAAC;AAEX,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,4BAA4B;IAC3C,sBAAsB,EAAE,OAAO,CAAC;IAChC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAChC,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAwB,SAAQ,wBAAwB;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,WAAW,CAAC;CACxB;AAED,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,uBAAuB,GAAG,MAAM,CAkB1F;AAOD,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,2BAA2B,GACjC,4BAA4B,CA4B9B;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,wBAAwB,GAChC,uBAAuB,CAoDzB;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,CAAC,UAAU,EACzB,WAAW,EAAE,MAAM,EAAE,GACpB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYxB"}

package/dist/src/runner/mission-capability-kernel.js

@@ -0,0 +1,158 @@
+import { basename } from 'node:path';
+import { createHash } from 'node:crypto';
+import { uniqueSortedPaths } from '../path-policy.js';
+import { assertMissionPathPattern, scopePatternContainedBy } from './mission-path-language.js';
+export const missionGitStatusArgv = [
+    '/usr/bin/git',
+    '-c', 'core.fsmonitor=false',
+    '-c', 'core.untrackedCache=false',
+    '-c', 'core.hooksPath=/dev/null',
+    'status', '--porcelain=v1', '--untracked-files=all',
+];
+export function missionCapabilityPermitFingerprint(permit) {
+    const canonical = JSON.stringify([
+        'mission-capability-permit-v1',
+        permit.missionId,
+        permit.actionKey,
+        permit.capability,
+        permit.argv,
+        permit.requestedPaths,
+        permit.grantedPaths,
+        permit.inputSnapshot,
+        permit.fencingEpoch,
+        permit.expiresAt,
+        permit.readPath ?? null,
+        permit.maxReadBytes ?? null,
+        permit.network,
+        permit.workspace,
+    ]);
+    return `sha256:${createHash('sha256').update(canonical).digest('hex')}`;
+}
+const secretPath = /(^|\/)(?:\.env(?:\..*)?|\.git(?:\/|$)|id_(?:rsa|ed25519)(?:\.pub)?$)/iu;
+const safeEnvironmentKeys = new Set([
+    'CI', 'LANG', 'LC_ALL', 'LC_CTYPE', 'NO_COLOR', 'PATH', 'TERM', 'TZ',
+]);
+export function discoverMissionExecutorPrerequisites(input) {
+    if (input.platform === 'darwin') {
+        const missing = [
+            input.commands.has('/usr/bin/sandbox-exec') ? undefined : 'sandbox-exec',
+            input.commands.has('/usr/bin/git') ? undefined : 'git',
+        ].filter((value) => value !== undefined);
+        return {
+            prerequisitesAvailable: missing.length === 0,
+            backend: missing.length === 0 ? 'macos-sandbox' : undefined,
+            missing,
+        };
+    }
+    if (input.platform === 'linux') {
+        const hasBwrap = [...input.commands].some((command) => basename(command) === 'bwrap');
+        const hasGit = [...input.commands].some((command) => basename(command) === 'git');
+        const missing = [hasBwrap ? undefined : 'bwrap', hasGit ? undefined : 'git']
+            .filter((value) => value !== undefined);
+        return {
+            prerequisitesAvailable: missing.length === 0,
+            backend: missing.length === 0 ? 'linux-bwrap' : undefined,
+            missing,
+        };
+    }
+    return {
+        prerequisitesAvailable: false,
+        backend: undefined,
+        missing: [`unsupported-platform:${input.platform}`],
+    };
+}
+export function authorizeMissionCapability(request) {
+    requireText(request.missionId, 'missionId');
+    requireText(request.actionKey, 'actionKey');
+    requireText(request.inputSnapshot, 'inputSnapshot');
+    if (!Number.isSafeInteger(request.fencingEpoch) || request.fencingEpoch <= 0) {
+        throw new Error('Mission capability fencingEpoch must be a positive integer.');
+    }
+    if (!Number.isFinite(Date.parse(request.expiresAt))) {
+        throw new Error('Mission capability expiresAt must be an ISO timestamp.');
+    }
+    assertAllowedArgv(request.capability, request.argv);
+    const grantedPaths = normalizeScope(request.grantedPaths, 'granted');
+    const requestedPaths = normalizeScope(request.requestedPaths, 'requested');
+    if (request.capability === 'read-file') {
+        if (typeof request.readPath !== 'string' || request.readPath.includes('*')
+            || requestedPaths.length !== 1 || requestedPaths[0] !== request.readPath
+            || !Number.isSafeInteger(request.maxReadBytes) || request.maxReadBytes <= 0
+            || request.maxReadBytes > 1024 * 1024) {
+            throw new Error('Mission read-file requires one concrete readPath and maxReadBytes up to 1048576.');
+        }
+    }
+    else if (request.readPath !== undefined || request.maxReadBytes !== undefined) {
+        throw new Error(`Mission capability ${request.capability} forbids read-file inputs.`);
+    }
+    if (request.capability === 'git-status'
+        && (requestedPaths.length !== 1 || requestedPaths[0] !== '**')) {
+        throw new Error('Mission capability git-status requires explicit whole-repository scope.');
+    }
+    for (const path of requestedPaths) {
+        if (secretPath.test(path)) {
+            throw new Error(`Mission capability requested secret path: ${path}.`);
+        }
+        if (!grantedPaths.some((grant) => scopePatternContainedBy(path, grant))) {
+            throw new Error(`Mission capability path is outside granted scope: ${path}.`);
+        }
+    }
+    return {
+        missionId: request.missionId,
+        actionKey: request.actionKey,
+        capability: request.capability,
+        argv: [...request.argv],
+        requestedPaths,
+        grantedPaths,
+        inputSnapshot: request.inputSnapshot,
+        fencingEpoch: request.fencingEpoch,
+        expiresAt: request.expiresAt,
+        ...(request.capability === 'read-file' ? {
+            readPath: request.readPath,
+            maxReadBytes: request.maxReadBytes,
+        } : {}),
+        network: 'deny',
+        workspace: 'read-only',
+    };
+}
+export function scrubMissionExecutorEnv(source, allowedKeys) {
+    const result = {};
+    for (const key of [...new Set(allowedKeys)].sort()) {
+        if (!safeEnvironmentKeys.has(key)) {
+            continue;
+        }
+        const value = source[key];
+        if (value !== undefined) {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+function assertAllowedArgv(capability, argv) {
+    const expected = {
+        'git-status': [[]],
+        'read-file': [[]],
+        'validate-patch': [[]],
+    };
+    const normalized = argv.map((value, index) => index === 0 ? basename(value) : value);
+    if (!expected[capability].some((candidate) => arraysEqual(candidate, normalized))) {
+        throw new Error(`Mission capability ${capability} requires allowlisted argv.`);
+    }
+}
+function normalizeScope(paths, kind) {
+    const normalized = uniqueSortedPaths(paths);
+    if (normalized.length === 0) {
+        throw new Error(`Mission capability ${kind} scope must contain repository-relative globs.`);
+    }
+    normalized.forEach((path) => assertMissionPathPattern(path, `Mission capability ${kind} scope`));
+    return normalized;
+}
+function arraysEqual(left, right) {
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function requireText(value, field) {
+    if (value.trim().length === 0) {
+        throw new Error(`Mission capability ${field} must be non-empty.`);
+    }
+}
+//# sourceMappingURL=mission-capability-kernel.js.map

package/dist/src/runner/mission-capability-kernel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission-capability-kernel.js","sourceRoot":"","sources":["../../../src/runner/mission-capability-kernel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAK/F,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,cAAc;IACd,IAAI,EAAE,sBAAsB;IAC5B,IAAI,EAAE,2BAA2B;IACjC,IAAI,EAAE,0BAA0B;IAChC,QAAQ,EAAE,gBAAgB,EAAE,uBAAuB;CAC3C,CAAC;AAgCX,MAAM,UAAU,kCAAkC,CAAC,MAA+B;IAChF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,8BAA8B;QAC9B,MAAM,CAAC,SAAS;QAChB,MAAM,CAAC,SAAS;QAChB,MAAM,CAAC,UAAU;QACjB,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,cAAc;QACrB,MAAM,CAAC,YAAY;QACnB,MAAM,CAAC,aAAa;QACpB,MAAM,CAAC,YAAY;QACnB,MAAM,CAAC,SAAS;QAChB,MAAM,CAAC,QAAQ,IAAI,IAAI;QACvB,MAAM,CAAC,YAAY,IAAI,IAAI;QAC3B,MAAM,CAAC,OAAO;QACd,MAAM,CAAC,SAAS;KACjB,CAAC,CAAC;IACH,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,GAAG,wEAAwE,CAAC;AAC5F,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI;CACrE,CAAC,CAAC;AAEH,MAAM,UAAU,oCAAoC,CAClD,KAAkC;IAElC,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG;YACd,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc;YACxE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK;SACvD,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;QAC1D,OAAO;YACL,sBAAsB,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;YAC5C,OAAO,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YAC3D,OAAO;SACR,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC;QAClF,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;aACzE,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;QAC3D,OAAO;YACL,sBAAsB,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;YAC5C,OAAO,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YACzD,OAAO;SACR,CAAC;IACJ,CAAC;IACD,OAAO;QACL,sBAAsB,EAAE,KAAK;QAC7B,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,CAAC,wBAAwB,KAAK,CAAC,QAAQ,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAAiC;IAEjC,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC5C,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC5C,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,iBAAiB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACrE,MAAM,cAAc,GAAG,cAAc,CAAC,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,UAAU,KAAK,WAAW,EAAE,CAAC;QACvC,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;eACrE,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,QAAQ;eACrE,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,YAAa,IAAI,CAAC;eACzE,OAAO,CAAC,YAAa,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;QACtG,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,CAAC,UAAU,4BAA4B,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,YAAY;WAClC,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,qDAAqD,IAAI,GAAG,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;QACvB,cAAc;QACd,YAAY;QACZ,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,WAAW,CAAC,CAAC,CAAC;YACvC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,MAAM;QACf,SAAS,EAAE,WAAW;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAAyB,EACzB,WAAqB;IAErB,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACnD,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,UAA6B,EAAE,IAAc;IACtE,MAAM,QAAQ,GAA0C;QACtD,YAAY,EAAE,CAAC,EAAE,CAAC;QAClB,WAAW,EAAE,CAAC,EAAE,CAAC;QACjB,gBAAgB,EAAE,CAAC,EAAE,CAAC;KACvB,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACrF,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,sBAAsB,UAAU,6BAA6B,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAe,EAAE,IAAY;IACnD,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IACD,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,EAAE,sBAAsB,IAAI,QAAQ,CAAC,CAAC,CAAC;IACjG,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,IAAc,EAAE,KAAe;IAClD,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa;IAC/C,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,qBAAqB,CAAC,CAAC;IACpE,CAAC;AACH,CAAC"}

package/dist/src/runner/mission-check-policy.d.ts

@@ -0,0 +1,17 @@
+import { type MissionCapability } from './mission-capability-kernel.js';
+export interface RunnerOwnedMissionCheck {
+    executable: string;
+    args: string[];
+    capability: MissionCapability;
+}
+export type MissionCheckClassification = {
+    kind: 'legacy-shell';
+    reason: 'string-command-has-no-enforced-argv-contract';
+} | {
+    kind: 'safe-runner-argv';
+    executable: string;
+    args: string[];
+    capability: MissionCapability;
+};
+export declare function classifyMissionCheck(check: string | RunnerOwnedMissionCheck): MissionCheckClassification;
+//# sourceMappingURL=mission-check-policy.d.ts.map

package/dist/src/runner/mission-check-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission-check-policy.d.ts","sourceRoot":"","sources":["../../../src/runner/mission-check-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,gCAAgC,CAAC;AAExC,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,UAAU,EAAE,iBAAiB,CAAC;CAC/B;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,8CAA8C,CAAA;CAAE,GAChF;IACE,IAAI,EAAE,kBAAkB,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,UAAU,EAAE,iBAAiB,CAAC;CAC/B,CAAC;AAEN,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,GAAG,uBAAuB,GACtC,0BAA0B,CA4B5B"}

package/dist/src/runner/mission-check-policy.js

@@ -0,0 +1,31 @@
+import { authorizeMissionCapability, missionGitStatusArgv, } from './mission-capability-kernel.js';
+export function classifyMissionCheck(check) {
+    if (typeof check === 'string') {
+        return {
+            kind: 'legacy-shell',
+            reason: 'string-command-has-no-enforced-argv-contract',
+        };
+    }
+    authorizeMissionCapability({
+        missionId: 'classification-probe',
+        actionKey: 'classification-probe',
+        capability: check.capability,
+        argv: [],
+        requestedPaths: ['**'],
+        grantedPaths: ['**'],
+        inputSnapshot: 'classification-probe',
+        fencingEpoch: 1,
+        expiresAt: '2099-01-01T00:00:00.000Z',
+    });
+    if (check.capability !== 'git-status'
+        || [check.executable, ...check.args].join('\0') !== missionGitStatusArgv.join('\0')) {
+        throw new Error(`Mission capability ${check.capability} requires allowlisted argv.`);
+    }
+    return {
+        kind: 'safe-runner-argv',
+        executable: check.executable,
+        args: [...check.args],
+        capability: check.capability,
+    };
+}
+//# sourceMappingURL=mission-check-policy.js.map

package/dist/src/runner/mission-check-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission-check-policy.js","sourceRoot":"","sources":["../../../src/runner/mission-check-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GAErB,MAAM,gCAAgC,CAAC;AAiBxC,MAAM,UAAU,oBAAoB,CAClC,KAAuC;IAEvC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,8CAA8C;SACvD,CAAC;IACJ,CAAC;IACD,0BAA0B,CAAC;QACzB,SAAS,EAAE,sBAAsB;QACjC,SAAS,EAAE,sBAAsB;QACjC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,IAAI,EAAE,EAAE;QACR,cAAc,EAAE,CAAC,IAAI,CAAC;QACtB,YAAY,EAAE,CAAC,IAAI,CAAC;QACpB,aAAa,EAAE,sBAAsB;QACrC,YAAY,EAAE,CAAC;QACf,SAAS,EAAE,0BAA0B;KACtC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,UAAU,KAAK,YAAY;WAChC,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,CAAC,UAAU,6BAA6B,CAAC,CAAC;IACvF,CAAC;IACD,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;QACrB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC"}

package/dist/src/runner/mission-coordinator-lock.d.ts

@@ -0,0 +1,16 @@
+export interface MissionCoordinatorLockInput {
+    targetRoot: string;
+    stateDir: string;
+    hostId: string;
+    bootNonce: string;
+    pid?: number;
+    now?: Date;
+    isProcessAlive?: (pid: number) => boolean;
+    waitTimeoutMs?: number;
+}
+export interface MissionCoordinatorLock {
+    metadataPath: string;
+    release(): Promise<void>;
+}
+export declare function acquireMissionCoordinatorLock(input: MissionCoordinatorLockInput): Promise<MissionCoordinatorLock>;
+//# sourceMappingURL=mission-coordinator-lock.d.ts.map

package/dist/src/runner/mission-coordinator-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission-coordinator-lock.d.ts","sourceRoot":"","sources":["../../../src/runner/mission-coordinator-lock.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC1C,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAWD,wBAAsB,6BAA6B,CACjD,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,sBAAsB,CAAC,CAwFjC"}

package/dist/src/runner/mission-coordinator-lock.js

@@ -0,0 +1,170 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+export async function acquireMissionCoordinatorLock(input) {
+    const lockDirectory = join(input.targetRoot, input.stateDir, 'mission-coordinator.lock');
+    const metadataPath = join(lockDirectory, 'owner.json');
+    const token = randomUUID();
+    const owner = {
+        version: 1,
+        token,
+        hostId: requireText(input.hostId, 'hostId'),
+        bootNonce: requireText(input.bootNonce, 'bootNonce'),
+        pid: input.pid ?? process.pid,
+        acquiredAt: (input.now ?? new Date()).toISOString(),
+    };
+    if (!Number.isSafeInteger(owner.pid) || owner.pid <= 0) {
+        throw new Error('Mission coordinator pid must be a positive integer.');
+    }
+    const alive = input.isProcessAlive ?? defaultProcessAlive;
+    let reclaimGuardPath;
+    const waitTimeoutMs = input.waitTimeoutMs ?? 0;
+    if (!Number.isSafeInteger(waitTimeoutMs) || waitTimeoutMs < 0) {
+        throw new Error('Mission coordinator waitTimeoutMs must be a non-negative integer.');
+    }
+    const deadline = Date.now() + waitTimeoutMs;
+    await mkdir(join(input.targetRoot, input.stateDir), { recursive: true });
+    while (true) {
+        const candidateDirectory = `${lockDirectory}.candidate.${token}.${randomUUID()}`;
+        try {
+            await mkdir(candidateDirectory);
+            try {
+                await writeFile(join(candidateDirectory, 'owner.json'), `${JSON.stringify(owner)}\n`, {
+                    encoding: 'utf8',
+                    flag: 'wx',
+                    mode: 0o600,
+                });
+                await rename(candidateDirectory, lockDirectory);
+            }
+            catch (error) {
+                await rm(candidateDirectory, { recursive: true, force: true });
+                throw error;
+            }
+            if (reclaimGuardPath) {
+                await rm(reclaimGuardPath, { recursive: true, force: true });
+            }
+            return {
+                metadataPath,
+                release: () => releaseLock(lockDirectory, metadataPath, token),
+            };
+        }
+        catch (error) {
+            if (!isCode(error, 'EEXIST') && !isCode(error, 'ENOTEMPTY')) {
+                throw error;
+            }
+            let existing;
+            try {
+                existing = await readLockOwner(metadataPath);
+            }
+            catch (readError) {
+                if (isCode(readError, 'ENOENT')) {
+                    await delay(5);
+                    continue;
+                }
+                throw readError;
+            }
+            if (existing.hostId !== owner.hostId) {
+                throw new Error(`Mission coordinator lock belongs to a different host: ${existing.hostId}.`);
+            }
+            const ownerStillAlive = existing.pid === owner.pid
+                ? existing.bootNonce === owner.bootNonce
+                : alive(existing.pid);
+            if (ownerStillAlive) {
+                if (Date.now() < deadline) {
+                    await delay(10);
+                    continue;
+                }
+                throw new Error(`Mission coordinator lock is already owned by pid ${existing.pid}.`);
+            }
+            const stalePath = `${lockDirectory}.stale.${existing.token}`;
+            try {
+                await rename(lockDirectory, stalePath);
+            }
+            catch (renameError) {
+                if (isCode(renameError, 'ENOENT')) {
+                    continue;
+                }
+                if (isCode(renameError, 'EEXIST') || isCode(renameError, 'ENOTEMPTY')) {
+                    throw new Error(`Mission coordinator stale reclaim guard already exists for token ${existing.token}.`);
+                }
+                throw renameError;
+            }
+            reclaimGuardPath = stalePath;
+        }
+    }
+}
+async function releaseLock(lockDirectory, metadataPath, token) {
+    let current;
+    try {
+        current = await readLockOwner(metadataPath);
+    }
+    catch (error) {
+        if (isCode(error, 'ENOENT')) {
+            return;
+        }
+        throw error;
+    }
+    if (current.token !== token) {
+        return;
+    }
+    const releasePath = `${lockDirectory}.release.${token}`;
+    try {
+        await rename(lockDirectory, releasePath);
+    }
+    catch (error) {
+        if (isCode(error, 'ENOENT')) {
+            return;
+        }
+        throw error;
+    }
+    await rm(releasePath, { recursive: true, force: true });
+}
+async function readLockOwner(path) {
+    let parsed;
+    try {
+        parsed = JSON.parse(await readFile(path, 'utf8'));
+    }
+    catch (error) {
+        if (isCode(error, 'ENOENT')) {
+            throw error;
+        }
+        throw new Error('Mission coordinator lock metadata is invalid and cannot be reclaimed safely.');
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new Error('Mission coordinator lock metadata is invalid and cannot be reclaimed safely.');
+    }
+    const record = parsed;
+    const exact = ['version', 'token', 'hostId', 'bootNonce', 'pid', 'acquiredAt'];
+    if (Object.keys(record).length !== exact.length || exact.some((key) => !(key in record))
+        || record.version !== 1
+        || typeof record.token !== 'string' || record.token.length === 0
+        || typeof record.hostId !== 'string' || record.hostId.length === 0
+        || typeof record.bootNonce !== 'string' || record.bootNonce.length === 0
+        || !Number.isSafeInteger(record.pid) || record.pid <= 0
+        || typeof record.acquiredAt !== 'string' || !Number.isFinite(Date.parse(record.acquiredAt))) {
+        throw new Error('Mission coordinator lock metadata is invalid and cannot be reclaimed safely.');
+    }
+    return record;
+}
+function defaultProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error instanceof Error && 'code' in error && error.code === 'EPERM';
+    }
+}
+function requireText(value, field) {
+    if (value.trim().length === 0) {
+        throw new Error(`Mission coordinator ${field} must be non-empty.`);
+    }
+    return value;
+}
+function isCode(error, code) {
+    return error instanceof Error && 'code' in error && error.code === code;
+}
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=mission-coordinator-lock.js.map

package/dist/src/runner/mission-coordinator-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission-coordinator-lock.js","sourceRoot":"","sources":["../../../src/runner/mission-coordinator-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA2BjC,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAkC;IAElC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;IACzF,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAc;QACvB,OAAO,EAAE,CAAC;QACV,KAAK;QACL,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC3C,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC;QACpD,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;QAC7B,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;KACpD,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,IAAI,mBAAmB,CAAC;IAC1D,IAAI,gBAAoC,CAAC;IACzC,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC;IAC5C,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzE,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,kBAAkB,GAAG,GAAG,aAAa,cAAc,KAAK,IAAI,UAAU,EAAE,EAAE,CAAC;QACjF,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE;oBACpF,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,IAAI;oBACV,IAAI,EAAE,KAAK;iBACZ,CAAC,CAAC;gBACH,MAAM,MAAM,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,EAAE,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/D,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,EAAE,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO;gBACL,YAAY;gBACZ,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,aAAa,EAAE,YAAY,EAAE,KAAK,CAAC;aAC/D,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC5D,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,QAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,CAAC;YAC/C,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACnB,IAAI,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;oBAChC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;oBACf,SAAS;gBACX,CAAC;gBACD,MAAM,SAAS,CAAC;YAClB,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,yDAAyD,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAC/F,CAAC;YACD,MAAM,eAAe,GAAG,QAAQ,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;gBAChD,CAAC,CAAC,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;gBACxC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;oBAC1B,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;oBAChB,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,SAAS,GAAG,GAAG,aAAa,UAAU,QAAQ,CAAC,KAAK,EAAE,CAAC;YAC7D,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,IAAI,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;oBAClC,SAAS;gBACX,CAAC;gBACD,IAAI,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;oBACtE,MAAM,IAAI,KAAK,CAAC,oEAAoE,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;gBACzG,CAAC;gBACD,MAAM,WAAW,CAAC;YACpB,CAAC;YACD,gBAAgB,GAAG,SAAS,CAAC;QAC/B,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,aAAqB,EAAE,YAAoB,EAAE,KAAa;IACnF,IAAI,OAAkB,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,aAAa,YAAY,KAAK,EAAE,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,KAAK,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC;WACnF,MAAM,CAAC,OAAO,KAAK,CAAC;WACpB,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;WAC7D,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;WAC/D,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;WACrE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAK,MAAM,CAAC,GAAc,IAAI,CAAC;WAChE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,MAA8B,CAAC;AACxC,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa;IAC/C,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,qBAAqB,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,IAAY;IAC1C,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AAC1E,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/src/runner/mission-deployment.d.ts

@@ -0,0 +1,21 @@
+export interface MissionDeploymentRecord {
+    version: 1;
+    repository: string;
+    deploymentId: string;
+    hostId: string;
+    serviceId: string;
+    githubAppInstallationId: string;
+    credentialGeneration: string;
+    compatibilityEpoch: number;
+    priorCredentialRevokedAt: string;
+    priorTokenExpiresAt: string;
+    takeoverGraceUntil: string;
+    takeoverNotBefore: string;
+    approvedByCommit: string;
+}
+export declare function canonicalMissionDeploymentRecord(record: MissionDeploymentRecord): string;
+export declare function parseMissionDeploymentRecord(content: string): MissionDeploymentRecord;
+export declare function missionDeploymentRecordHash(record: MissionDeploymentRecord): string;
+export declare function takeoverNotBefore(record: Pick<MissionDeploymentRecord, 'priorTokenExpiresAt' | 'takeoverGraceUntil'>): string;
+export declare function assertMissionDeploymentRecord(value: unknown): asserts value is MissionDeploymentRecord;
+//# sourceMappingURL=mission-deployment.d.ts.map

package/dist/src/runner/mission-deployment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission-deployment.d.ts","sourceRoot":"","sources":["../../../src/runner/mission-deployment.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,uBAAuB,EAAE,MAAM,CAAC;IAChC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,wBAAwB,EAAE,MAAM,CAAC;IACjC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAkBD,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,uBAAuB,GAAG,MAAM,CAGxF;AAED,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB,CAarF;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,uBAAuB,GAAG,MAAM,CAInF;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAC9C,uBAAuB,EACvB,qBAAqB,GAAG,oBAAoB,CAC3C,GAAG,MAAM,CAIT;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,uBAAuB,CA8CtG"}

package/dist/src/runner/mission-deployment.js

@@ -0,0 +1,108 @@
+import { createHash } from 'node:crypto';
+const deploymentFields = [
+    'version',
+    'repository',
+    'deploymentId',
+    'hostId',
+    'serviceId',
+    'githubAppInstallationId',
+    'credentialGeneration',
+    'compatibilityEpoch',
+    'priorCredentialRevokedAt',
+    'priorTokenExpiresAt',
+    'takeoverGraceUntil',
+    'takeoverNotBefore',
+    'approvedByCommit',
+];
+export function canonicalMissionDeploymentRecord(record) {
+    assertMissionDeploymentRecord(record);
+    return JSON.stringify(Object.fromEntries(deploymentFields.map((field) => [field, record[field]])));
+}
+export function parseMissionDeploymentRecord(content) {
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        throw new Error('Invalid Mission deployment record: expected JSON.');
+    }
+    assertMissionDeploymentRecord(parsed);
+    const canonical = canonicalMissionDeploymentRecord(parsed);
+    if (content !== canonical) {
+        throw new Error('Invalid Mission deployment record: file must use canonical JSON.');
+    }
+    return parsed;
+}
+export function missionDeploymentRecordHash(record) {
+    return `sha256:${createHash('sha256')
+        .update(Buffer.from(canonicalMissionDeploymentRecord(record), 'utf8'))
+        .digest('hex')}`;
+}
+export function takeoverNotBefore(record) {
+    const tokenExpiry = parseExactTimestamp(record.priorTokenExpiresAt, 'priorTokenExpiresAt');
+    const grace = parseExactTimestamp(record.takeoverGraceUntil, 'takeoverGraceUntil');
+    return new Date(Math.max(tokenExpiry, grace)).toISOString();
+}
+export function assertMissionDeploymentRecord(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new Error('Invalid Mission deployment record: root must be an object.');
+    }
+    const record = value;
+    const allowed = new Set(deploymentFields);
+    for (const key of Object.keys(record)) {
+        if (!allowed.has(key)) {
+            throw new Error(`Invalid Mission deployment record: unexpected field ${key}.`);
+        }
+    }
+    for (const field of deploymentFields) {
+        if (!(field in record)) {
+            throw new Error(`Invalid Mission deployment record: missing field ${field}.`);
+        }
+    }
+    if (record.version !== 1) {
+        throw new Error('Invalid Mission deployment record: version must be 1.');
+    }
+    for (const field of [
+        'repository',
+        'deploymentId',
+        'hostId',
+        'serviceId',
+        'githubAppInstallationId',
+        'credentialGeneration',
+    ]) {
+        requireNonEmpty(record[field], field);
+    }
+    if (!Number.isSafeInteger(record.compatibilityEpoch) || record.compatibilityEpoch <= 0) {
+        throw new Error('Invalid Mission deployment record: compatibilityEpoch must be a positive integer.');
+    }
+    for (const field of [
+        'priorCredentialRevokedAt',
+        'priorTokenExpiresAt',
+        'takeoverGraceUntil',
+        'takeoverNotBefore',
+    ]) {
+        parseExactTimestamp(record[field], field);
+    }
+    if (record.takeoverNotBefore !== takeoverNotBefore(record)) {
+        throw new Error('Invalid Mission deployment record: takeoverNotBefore must equal the later token expiry or grace boundary.');
+    }
+    if (typeof record.approvedByCommit !== 'string' || !/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/u.test(record.approvedByCommit)) {
+        throw new Error('Invalid Mission deployment record: approvedByCommit must be a Git object ID.');
+    }
+}
+function parseExactTimestamp(value, field) {
+    if (typeof value !== 'string') {
+        throw new Error(`Invalid Mission deployment record: ${field} must be an ISO timestamp.`);
+    }
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed) || new Date(parsed).toISOString() !== value) {
+        throw new Error(`Invalid Mission deployment record: ${field} must be an exact UTC ISO timestamp.`);
+    }
+    return parsed;
+}
+function requireNonEmpty(value, field) {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+        throw new Error(`Invalid Mission deployment record: ${field} must be non-empty.`);
+    }
+}
+//# sourceMappingURL=mission-deployment.js.map

package/dist/src/runner/mission-deployment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission-deployment.js","sourceRoot":"","sources":["../../../src/runner/mission-deployment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAkBzC,MAAM,gBAAgB,GAAiD;IACrE,SAAS;IACT,YAAY;IACZ,cAAc;IACd,QAAQ;IACR,WAAW;IACX,yBAAyB;IACzB,sBAAsB;IACtB,oBAAoB;IACpB,0BAA0B;IAC1B,qBAAqB;IACrB,oBAAoB;IACpB,mBAAmB;IACnB,kBAAkB;CACnB,CAAC;AAEF,MAAM,UAAU,gCAAgC,CAAC,MAA+B;IAC9E,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,OAAe;IAC1D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAA+B;IACzE,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC;SAClC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;SACrE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAGjC;IACC,MAAM,WAAW,GAAG,mBAAmB,CAAC,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;IACnF,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,gBAAgB,CAAC,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,uDAAuD,GAAG,GAAG,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,oDAAoD,KAAK,GAAG,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,KAAK,MAAM,KAAK,IAAI;QAClB,YAAY;QACZ,cAAc;QACd,QAAQ;QACR,WAAW;QACX,yBAAyB;QACzB,sBAAsB;KACvB,EAAE,CAAC;QACF,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAK,MAAM,CAAC,kBAA6B,IAAI,CAAC,EAAE,CAAC;QACnG,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACvG,CAAC;IACD,KAAK,MAAM,KAAK,IAAI;QAClB,0BAA0B;QAC1B,qBAAqB;QACrB,oBAAoB;QACpB,mBAAmB;KACpB,EAAE,CAAC;QACF,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,MAAM,CAAC,iBAAiB,KAAK,iBAAiB,CAAC,MAA4C,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,KAAK,CAAC,2GAA2G,CAAC,CAAC;IAC/H,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrH,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,KAAa;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,KAAK,4BAA4B,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,sCAAsC,KAAK,sCAAsC,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,sCAAsC,KAAK,qBAAqB,CAAC,CAAC;IACpF,CAAC;AACH,CAAC"}