codex-orchestrator 0.1.50 → 2.0.0

package/dist/src/v2/candidate-cli.d.ts

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+import type { SetupIntent, SetupOutcome } from './setup.js';
+import type { RunIssueResult } from './run-issue.js';
+export interface CandidateRunIntent {
+    targetRoot: string;
+    issueNumber: number;
+}
+export interface CandidateDaemonIntent {
+    targetRoot: string;
+    once: boolean;
+}
+export declare function parseCandidateRunArgs(argv: string[]): CandidateRunIntent;
+export declare function parseCandidateDaemonArgs(argv: string[]): CandidateDaemonIntent;
+export declare function runCandidateCli(argv: string[], dependencies?: {
+    executeRun?: (input: CandidateRunIntent) => Promise<RunIssueResult>;
+    executeDaemon?: (input: CandidateDaemonIntent, write: (text: string) => void) => Promise<number>;
+    executeSetup?: (input: SetupIntent) => Promise<SetupOutcome>;
+    packageVersion?: string;
+    write?: (text: string) => void;
+}): Promise<number>;
+export declare function isDirectCandidateExecution(entryPath: string, modulePath: string): boolean;
+//# sourceMappingURL=candidate-cli.d.ts.map

package/dist/src/v2/candidate-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"candidate-cli.d.ts","sourceRoot":"","sources":["../../../src/v2/candidate-cli.ts"],"names":[],"mappings":";AAeA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,MAAM,WAAW,kBAAkB;IAAG,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE;AAC/E,MAAM,WAAW,qBAAqB;IAAG,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE;AAE5E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAQxE;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,qBAAqB,CAU9E;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,YAAY,GAAE;IAClE,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACpE,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACjG,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3B,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBvB;AAwFD,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAGzF"}

package/dist/src/v2/candidate-cli.js

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+import { readFile } from 'node:fs/promises';
+import { realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { GhCliIssueAdapter } from './adapters/gh-issue-adapter.js';
+import { GhCliPullRequestAdapter } from './adapters/gh-pull-request-adapter.js';
+import { parseAgentAutoConfig } from './config.js';
+import { sha256 } from './containment.js';
+import { renderRunResultJson, runIssueExitCode } from './cli-contract.js';
+import { createV2Runtime } from './runtime.js';
+import { parseSetupArgs, renderSetupResultJson, setupOutcomeExitCode } from './setup-cli.js';
+import { createProductionSetup } from './setup-runtime.js';
+export function parseCandidateRunArgs(argv) {
+    if (argv.length !== 5 || argv[0] !== 'run' || argv[1] !== '--target' || argv[3] !== '--issue') {
+        throw new Error('usage: candidate-cli run --target <absolute-path> --issue <positive-integer>');
+    }
+    const targetRoot = argv[2];
+    const issueNumber = Number(argv[4]);
+    if (!isAbsolute(targetRoot) || !Number.isSafeInteger(issueNumber) || issueNumber <= 0)
+        throw new Error('candidate run intent is invalid');
+    return { targetRoot: resolve(targetRoot), issueNumber };
+}
+export function parseCandidateDaemonArgs(argv) {
+    if ((argv.length !== 3 && argv.length !== 4)
+        || argv[0] !== 'daemon'
+        || argv[1] !== '--target'
+        || (argv.length === 4 && argv[3] !== '--once')) {
+        throw new Error('usage: candidate-cli daemon --target <absolute-path> [--once]');
+    }
+    const targetRoot = argv[2];
+    if (!isAbsolute(targetRoot))
+        throw new Error('candidate daemon target is invalid');
+    return { targetRoot: resolve(targetRoot), once: argv[3] === '--once' };
+}
+export async function runCandidateCli(argv, dependencies = {}) {
+    const write = dependencies.write ?? ((text) => process.stdout.write(text));
+    if (argv.length === 1 && argv[0] === '--help') {
+        write(candidateHelp());
+        return 0;
+    }
+    if (argv.length === 1 && argv[0] === '--version') {
+        write(`${dependencies.packageVersion ?? await readPackageVersion()}\n`);
+        return 0;
+    }
+    if (argv[0] === 'setup' || argv[0] === 'doctor' || argv[0] === 'status') {
+        const intent = parseSetupArgs(argv);
+        const outcome = await (dependencies.executeSetup ?? executeProductionSetup)(intent);
+        write(renderSetupResultJson(outcome));
+        return setupOutcomeExitCode(outcome);
+    }
+    if (argv[0] === 'daemon') {
+        const intent = parseCandidateDaemonArgs(argv);
+        return (dependencies.executeDaemon ?? executeProductionDaemon)(intent, write);
+    }
+    const intent = parseCandidateRunArgs(argv);
+    const result = await (dependencies.executeRun ?? executeProductionRun)(intent);
+    write(renderRunResultJson(result));
+    return runIssueExitCode(result);
+}
+async function executeProductionDaemon(intent, write) {
+    const config = await readTargetConfig(intent.targetRoot);
+    const issues = new GhCliIssueAdapter(config.github.owner, config.github.repo);
+    let exitCode = 0;
+    do {
+        const candidates = await issues.listOpenIssuesWithAnyLabel([config.github.labels.auto.name]);
+        for (const issue of candidates) {
+            const result = await executeProductionRun({ targetRoot: intent.targetRoot, issueNumber: issue.number });
+            write(renderRunResultJson(result));
+            exitCode = Math.max(exitCode, runIssueExitCode(result));
+        }
+        if (intent.once)
+            return exitCode;
+        await new Promise((resolveDelay) => setTimeout(resolveDelay, config.runner.pollIntervalSeconds * 1_000));
+    } while (true);
+}
+async function executeProductionRun(intent) {
+    const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '../../..');
+    const packageVersion = await readPackageVersion();
+    const config = await readTargetConfig(intent.targetRoot);
+    const skillHashes = {
+        'agent-auto': sha256(await readFile(join(packageRoot, 'internal-skills', 'agent-auto', 'SKILL.md'))),
+        'acceptance-proof': sha256(await readFile(join(packageRoot, 'internal-skills', 'acceptance-proof', 'SKILL.md'))),
+    };
+    const runtime = createV2Runtime({
+        targetRoot: intent.targetRoot,
+        orchestratorHome: resolve(process.env.CODEX_ORCHESTRATOR_HOME ?? join(homedir(), '.codex-orchestrator')),
+        bootId: await readBootId(),
+        packageVersion,
+        skillHashes,
+        issues: new GhCliIssueAdapter(config.github.owner, config.github.repo),
+        pullRequests: new GhCliPullRequestAdapter(config.github.owner, config.github.repo),
+        packageRoot,
+        parentCodexHome: resolve(process.env.CODEX_HOME ?? join(homedir(), '.codex')),
+        safePath: process.env.CODEX_ORCHESTRATOR_SAFE_PATH ?? '/usr/bin:/bin:/usr/sbin:/sbin:/opt/homebrew/bin',
+    });
+    try {
+        return await runtime.runIssue(intent);
+    }
+    finally {
+        runtime.dispose();
+    }
+}
+async function readTargetConfig(targetRoot) {
+    return parseAgentAutoConfig(JSON.parse(await readFile(join(targetRoot, '.codex-orchestrator', 'config.json'), 'utf8')));
+}
+async function executeProductionSetup(intent) {
+    const setup = createProductionSetup({
+        orchestratorHome: resolve(process.env.CODEX_ORCHESTRATOR_HOME ?? join(homedir(), '.codex-orchestrator')),
+        bootId: await readBootId(),
+    });
+    return setup.execute(intent);
+}
+async function readPackageVersion() {
+    const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '../../..');
+    const packageJson = JSON.parse(await readFile(join(packageRoot, 'package.json'), 'utf8'));
+    if (typeof packageJson.version !== 'string')
+        throw new Error('package version is unavailable');
+    return packageJson.version;
+}
+function candidateHelp() {
+    return [
+        'codex-orchestrator',
+        '  setup --target <absolute-path> [--github-owner <owner> --github-repo <repo>] [--prepare-labels|--fresh] [--dry-run]',
+        '  doctor --target <absolute-path>',
+        '  status --target <absolute-path>',
+        '  run --target <absolute-path> --issue <positive-integer>',
+        '  daemon --target <absolute-path> [--once]',
+        '',
+    ].join('\n');
+}
+async function readBootId() {
+    if (process.platform === 'linux')
+        return (await readFile('/proc/sys/kernel/random/boot_id', 'utf8')).trim();
+    if (process.platform === 'darwin') {
+        const { execFile } = await import('node:child_process');
+        return await new Promise((resolveBoot, rejectBoot) => execFile('/usr/sbin/sysctl', ['-n', 'kern.boottime'], (error, stdout) => {
+            if (error || !stdout.trim())
+                rejectBoot(error ?? new Error('boot identity is unavailable'));
+            else
+                resolveBoot(stdout.trim());
+        }));
+    }
+    throw new Error(`platform ${process.platform} cannot prove boot identity`);
+}
+export function isDirectCandidateExecution(entryPath, modulePath) {
+    try {
+        return realpathSync.native(entryPath) === realpathSync.native(modulePath);
+    }
+    catch {
+        return false;
+    }
+}
+if (process.argv[1] && isDirectCandidateExecution(process.argv[1], fileURLToPath(import.meta.url))) {
+    runCandidateCli(process.argv.slice(2)).then((code) => { process.exitCode = code; }).catch((error) => {
+        process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+        process.exitCode = 70;
+    });
+}
+//# sourceMappingURL=candidate-cli.js.map

package/dist/src/v2/candidate-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"candidate-cli.js","sourceRoot":"","sources":["../../../src/v2/candidate-cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAO3D,MAAM,UAAU,qBAAqB,CAAC,IAAc;IAClD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IAC5B,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC1I,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAc;IACrD,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;WACvC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;WACpB,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU;WACtB,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACnF,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAc,EAAE,eAMlD,EAAE;IACJ,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACnF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC9C,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;QACvB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;QACjD,KAAK,CAAC,GAAG,YAAY,CAAC,cAAc,IAAI,MAAM,kBAAkB,EAAE,IAAI,CAAC,CAAC;QACxE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACxE,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,YAAY,IAAI,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;QACpF,KAAK,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,CAAC,YAAY,CAAC,aAAa,IAAI,uBAAuB,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,UAAU,IAAI,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/E,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACnC,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,MAA6B,EAC7B,KAA6B;IAE7B,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9E,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,GAAG,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7F,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACxG,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;YACnC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC;QACjC,MAAM,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,mBAAmB,GAAG,KAAK,CAAC,CAAC,CAAC;IAC3G,CAAC,QAAQ,IAAI,EAAE;AACjB,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,MAA0B;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACjF,MAAM,cAAc,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG;QAClB,YAAY,EAAE,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;QACpG,kBAAkB,EAAE,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC,CAAC;KACjH,CAAC;IACF,MAAM,OAAO,GAAG,eAAe,CAAC;QAC9B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,qBAAqB,CAAC,CAAC;QACxG,MAAM,EAAE,MAAM,UAAU,EAAE;QAC1B,cAAc;QACd,WAAW;QACX,MAAM,EAAE,IAAI,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QACtE,YAAY,EAAE,IAAI,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAClF,WAAW;QACX,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC7E,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,iDAAiD;KACxG,CAAC,CAAC;IACH,IAAI,CAAC;QAAC,OAAO,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;YACtC,CAAC;QAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,UAAkB;IAChD,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,qBAAqB,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AAC1H,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,MAAmB;IACvD,MAAM,KAAK,GAAG,qBAAqB,CAAC;QAClC,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,qBAAqB,CAAC,CAAC;QACxG,MAAM,EAAE,MAAM,UAAU,EAAE;KAC3B,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACjF,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAA0B,CAAC;IACnH,IAAI,OAAO,WAAW,CAAC,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC/F,OAAO,WAAW,CAAC,OAAO,CAAC;AAC7B,CAAC;AAED,SAAS,aAAa;IACpB,OAAO;QACL,oBAAoB;QACpB,uHAAuH;QACvH,mCAAmC;QACnC,mCAAmC;QACnC,2DAA2D;QAC3D,4CAA4C;QAC5C,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,CAAC,MAAM,QAAQ,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5G,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACxD,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAC5H,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;gBAAE,UAAU,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;;gBACvF,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC,CAAC;IACN,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,YAAY,OAAO,CAAC,QAAQ,6BAA6B,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,SAAiB,EAAE,UAAkB;IAC9E,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAAC,CAAC;IAClF,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACzB,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;IACnG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC3G,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpF,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/v2/checked-change.d.ts

@@ -0,0 +1,49 @@
+declare const checkedChangeBrand: unique symbol;
+export interface CheckedChangePayloadV1 {
+    version: 1;
+    canonicalRepository: string;
+    runId: string;
+    issueNumber: number;
+    cycle: 1 | 2 | 3 | 4 | 5;
+    baseSha: string;
+    headSha: string;
+    indexTreeSha: string;
+    trackedContentSha256: string;
+    untrackedContentSha256: string;
+    worktreeIdentity: string;
+    changedFiles: string[];
+    checks: Array<{
+        id: string;
+        command: string;
+        status: 'passed';
+        outputSha256: string;
+    }>;
+    checkPolicySha256: string;
+    packageVersion: string;
+    proofSchemaVersion: 1;
+}
+export interface CheckedChangeFreshness {
+    headSha: string;
+    indexTreeSha: string;
+    trackedContentSha256: string;
+    untrackedContentSha256: string;
+    worktreeIdentity: string;
+    checkPolicySha256: string;
+}
+export interface CheckedChange {
+    readonly [checkedChangeBrand]: true;
+}
+export interface CheckedChangeMintCapability {
+    mint(payload: CheckedChangePayloadV1): CheckedChange;
+}
+export interface CheckedChangeReadCapability {
+    verifyAndRead(value: CheckedChange): {
+        payload: CheckedChangePayloadV1;
+        checkedChangeSha256: string;
+    };
+}
+export declare function checkedChangePayloadSha256(payload: CheckedChangePayloadV1): string;
+export declare function createCheckedChangeCapabilities(): CheckedChangeMintCapability & CheckedChangeReadCapability;
+export declare function checkedChangeFreshnessMatches(payload: CheckedChangePayloadV1, current: CheckedChangeFreshness): boolean;
+export {};
+//# sourceMappingURL=checked-change.d.ts.map

package/dist/src/v2/checked-change.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checked-change.d.ts","sourceRoot":"","sources":["../../../src/v2/checked-change.ts"],"names":[],"mappings":"AAIA,QAAA,MAAM,kBAAkB,EAAE,OAAO,MAAgC,CAAC;AAMlE,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,CAAC,CAAC;IACX,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,QAAQ,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvF,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,CAAC,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa,CAAC;CACtD;AAED,MAAM,WAAW,2BAA2B;IAC1C,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG;QAAE,OAAO,EAAE,sBAAsB,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAC;CACvG;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,CAGlF;AAED,wBAAgB,+BAA+B,IAAI,2BAA2B,GAAG,2BAA2B,CAkB3G;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAOT"}

package/dist/src/v2/checked-change.js

@@ -0,0 +1,139 @@
+import { posix } from 'node:path';
+import { canonicalJson, sha256 } from './containment.js';
+const checkedChangeBrand = Symbol('CheckedChange');
+const SHA256_PATTERN = /^[0-9a-f]{64}$/;
+const GIT_SHA_PATTERN = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
+const UUID_V4_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const REPOSITORY_PATTERN = /^[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?\/[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?$/;
+export function checkedChangePayloadSha256(payload) {
+    validatePayload(payload);
+    return sha256(canonicalJson(payload));
+}
+export function createCheckedChangeCapabilities() {
+    const values = new WeakMap();
+    return {
+        mint(payload) {
+            validatePayload(payload);
+            const stored = structuredClone(payload);
+            deepFreeze(stored);
+            const value = Object.freeze({});
+            values.set(value, { payload: stored, checkedChangeSha256: checkedChangePayloadSha256(stored) });
+            return value;
+        },
+        verifyAndRead(value) {
+            if (typeof value !== 'object' || value === null)
+                throw new Error('CheckedChange was not minted by this capability');
+            const stored = values.get(value);
+            if (!stored)
+                throw new Error('CheckedChange was not minted by this capability');
+            return { payload: structuredClone(stored.payload), checkedChangeSha256: stored.checkedChangeSha256 };
+        },
+    };
+}
+export function checkedChangeFreshnessMatches(payload, current) {
+    return payload.headSha === current.headSha
+        && payload.indexTreeSha === current.indexTreeSha
+        && payload.trackedContentSha256 === current.trackedContentSha256
+        && payload.untrackedContentSha256 === current.untrackedContentSha256
+        && payload.worktreeIdentity === current.worktreeIdentity
+        && payload.checkPolicySha256 === current.checkPolicySha256;
+}
+function validatePayload(value) {
+    assertExactObject(value, [
+        'version',
+        'canonicalRepository',
+        'runId',
+        'issueNumber',
+        'cycle',
+        'baseSha',
+        'headSha',
+        'indexTreeSha',
+        'trackedContentSha256',
+        'untrackedContentSha256',
+        'worktreeIdentity',
+        'changedFiles',
+        'checks',
+        'checkPolicySha256',
+        'packageVersion',
+        'proofSchemaVersion',
+    ], 'CheckedChange payload');
+    if (value.version !== 1 || !Number.isSafeInteger(value.cycle) || value.cycle < 1 || value.cycle > 5 || value.proofSchemaVersion !== 1) {
+        throw new Error('CheckedChange payload versions/cycle are invalid');
+    }
+    if (typeof value.canonicalRepository !== 'string' || !REPOSITORY_PATTERN.test(value.canonicalRepository)) {
+        throw new Error('CheckedChange canonicalRepository is invalid');
+    }
+    if (typeof value.runId !== 'string' || !UUID_V4_PATTERN.test(value.runId))
+        throw new Error('CheckedChange runId is invalid');
+    if (!Number.isSafeInteger(value.issueNumber) || value.issueNumber <= 0)
+        throw new Error('CheckedChange issueNumber is invalid');
+    for (const field of ['baseSha', 'headSha', 'indexTreeSha'])
+        assertGitSha(value[field], `CheckedChange.${field}`);
+    for (const field of ['trackedContentSha256', 'untrackedContentSha256', 'checkPolicySha256']) {
+        assertSha256(value[field], `CheckedChange.${field}`);
+    }
+    assertNonEmptyString(value.worktreeIdentity, 'CheckedChange.worktreeIdentity');
+    if (!Array.isArray(value.changedFiles) || value.changedFiles.length === 0 || value.changedFiles.length > 256) {
+        throw new Error('CheckedChange changedFiles must contain 1 to 256 paths');
+    }
+    for (const path of value.changedFiles)
+        assertRelativePath(path, 'CheckedChange.changedFiles');
+    assertUnique(value.changedFiles, 'CheckedChange.changedFiles');
+    if (!Array.isArray(value.checks) || value.checks.length > 256)
+        throw new Error('CheckedChange checks are invalid');
+    const checkIds = [];
+    for (const [index, check] of value.checks.entries()) {
+        const field = `CheckedChange.checks[${index}]`;
+        assertExactObject(check, ['id', 'command', 'status', 'outputSha256'], field);
+        assertNonEmptyString(check.id, `${field}.id`);
+        assertNonEmptyString(check.command, `${field}.command`);
+        if (check.status !== 'passed')
+            throw new Error(`${field}.status must be passed`);
+        assertSha256(check.outputSha256, `${field}.outputSha256`);
+        checkIds.push(check.id);
+    }
+    assertUnique(checkIds, 'CheckedChange check ids');
+    assertNonEmptyString(value.packageVersion, 'CheckedChange.packageVersion');
+}
+function assertRelativePath(value, field) {
+    assertNonEmptyString(value, field);
+    if (value.startsWith('/') || value.includes('\\') || posix.normalize(value) !== value) {
+        throw new Error(`${field} must contain normalized repository-relative paths`);
+    }
+    if (value.split('/').some((segment) => segment === '' || segment === '.' || segment === '..')) {
+        throw new Error(`${field} contains an unsafe path segment`);
+    }
+}
+function assertGitSha(value, field) {
+    if (typeof value !== 'string' || !GIT_SHA_PATTERN.test(value))
+        throw new Error(`${field} must be a Git object ID`);
+}
+function assertSha256(value, field) {
+    if (typeof value !== 'string' || !SHA256_PATTERN.test(value))
+        throw new Error(`${field} must be lowercase SHA-256`);
+}
+function assertNonEmptyString(value, field) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > 16 * 1024)
+        throw new Error(`${field} is invalid`);
+}
+function assertUnique(values, field) {
+    if (new Set(values).size !== values.length)
+        throw new Error(`${field} must be unique`);
+}
+function assertExactObject(value, keys, field) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        throw new Error(`${field} must be an object`);
+    const actual = Object.keys(value).sort();
+    const expected = [...keys].sort();
+    if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index])) {
+        throw new Error(`${field} has unknown or missing keys`);
+    }
+}
+function deepFreeze(value) {
+    if (typeof value !== 'object' || value === null || Object.isFrozen(value))
+        return;
+    for (const child of Object.values(value))
+        deepFreeze(child);
+    Object.freeze(value);
+}
+//# sourceMappingURL=checked-change.js.map

package/dist/src/v2/checked-change.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checked-change.js","sourceRoot":"","sources":["../../../src/v2/checked-change.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEzD,MAAM,kBAAkB,GAAkB,MAAM,CAAC,eAAe,CAAC,CAAC;AAClE,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,MAAM,eAAe,GAAG,iCAAiC,CAAC;AAC1D,MAAM,eAAe,GAAG,uEAAuE,CAAC;AAChG,MAAM,kBAAkB,GAAG,wEAAwE,CAAC;AA0CpG,MAAM,UAAU,0BAA0B,CAAC,OAA+B;IACxE,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,+BAA+B;IAC7C,MAAM,MAAM,GAAG,IAAI,OAAO,EAA4E,CAAC;IACvG,OAAO;QACL,IAAI,CAAC,OAAO;YACV,eAAe,CAAC,OAAO,CAAC,CAAC;YACzB,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACxC,UAAU,CAAC,MAAM,CAAC,CAAC;YACnB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAkB,CAAC;YACjD,MAAM,CAAC,GAAG,CAAC,KAAe,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,0BAA0B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1G,OAAO,KAAK,CAAC;QACf,CAAC;QACD,aAAa,CAAC,KAAK;YACjB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACpH,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YAChF,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE,CAAC;QACvG,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAA+B,EAC/B,OAA+B;IAE/B,OAAO,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;WACrC,OAAO,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY;WAC7C,OAAO,CAAC,oBAAoB,KAAK,OAAO,CAAC,oBAAoB;WAC7D,OAAO,CAAC,sBAAsB,KAAK,OAAO,CAAC,sBAAsB;WACjE,OAAO,CAAC,gBAAgB,KAAK,OAAO,CAAC,gBAAgB;WACrD,OAAO,CAAC,iBAAiB,KAAK,OAAO,CAAC,iBAAiB,CAAC;AAC/D,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,iBAAiB,CAAC,KAAK,EAAE;QACvB,SAAS;QACT,qBAAqB;QACrB,OAAO;QACP,aAAa;QACb,OAAO;QACP,SAAS;QACT,SAAS;QACT,cAAc;QACd,sBAAsB;QACtB,wBAAwB;QACxB,kBAAkB;QAClB,cAAc;QACd,QAAQ;QACR,mBAAmB;QACnB,gBAAgB;QAChB,oBAAoB;KACrB,EAAE,uBAAuB,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,IAAK,KAAK,CAAC,KAAgB,GAAG,CAAC,IAAK,KAAK,CAAC,KAAgB,GAAG,CAAC,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,EAAE,CAAC;QAC9J,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,mBAAmB,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzG,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC7H,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,IAAK,KAAK,CAAC,WAAsB,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC5I,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,CAAU;QAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,iBAAiB,KAAK,EAAE,CAAC,CAAC;IAC1H,KAAK,MAAM,KAAK,IAAI,CAAC,sBAAsB,EAAE,wBAAwB,EAAE,mBAAmB,CAAU,EAAE,CAAC;QACrG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,iBAAiB,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,oBAAoB,CAAC,KAAK,CAAC,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;IAC/E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC7G,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,YAAY;QAAE,kBAAkB,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IAC9F,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,4BAA4B,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACnH,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,wBAAwB,KAAK,GAAG,CAAC;QAC/C,iBAAiB,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7E,oBAAoB,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,KAAK,KAAK,CAAC,CAAC;QAC9C,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC;QACxD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC;QACjF,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,KAAK,eAAe,CAAC,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IACD,YAAY,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;IAClD,oBAAoB,CAAC,KAAK,CAAC,cAAc,EAAE,8BAA8B,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,KAAa;IACvD,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oDAAoD,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kCAAkC,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;AACrH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;AACtH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,KAAa;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC;AAC1H,CAAC;AAED,SAAS,YAAY,CAAC,MAAgB,EAAE,KAAa;IACnD,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iBAAiB,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,IAAc,EAAE,KAAa;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IACvH,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO;IAClF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC"}

package/dist/src/v2/cli-contract.d.ts

@@ -0,0 +1,8 @@
+export declare const CANDIDATE_COMMANDS: readonly ["setup", "doctor", "status", "run", "daemon"];
+export declare const RUN_ISSUE_STATUSES: readonly ["review-ready", "not-eligible", "blocked", "transport-failed", "cancelled", "internal-error"];
+export type CandidateCommand = typeof CANDIDATE_COMMANDS[number];
+export type RunIssueStatus = typeof RUN_ISSUE_STATUSES[number];
+export declare function runIssueExitCode(result: RunIssueResult): 0 | 20 | 21 | 70 | 130;
+export declare function renderRunResultJson(result: RunIssueResult): string;
+import type { RunIssueResult } from './run-issue.js';
+//# sourceMappingURL=cli-contract.d.ts.map

package/dist/src/v2/cli-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-contract.d.ts","sourceRoot":"","sources":["../../../src/v2/cli-contract.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,kBAAkB,yDAA0D,CAAC;AAE1F,eAAO,MAAM,kBAAkB,yGAOrB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACjE,MAAM,MAAM,cAAc,GAAG,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAE/D,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAU/E;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAMlE;AAKD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/src/v2/cli-contract.js

@@ -0,0 +1,32 @@
+export const CANDIDATE_COMMANDS = ['setup', 'doctor', 'status', 'run', 'daemon'];
+export const RUN_ISSUE_STATUSES = [
+    'review-ready',
+    'not-eligible',
+    'blocked',
+    'transport-failed',
+    'cancelled',
+    'internal-error',
+];
+export function runIssueExitCode(result) {
+    switch (result.status) {
+        case 'review-ready': return 0;
+        case 'blocked': return 20;
+        case 'not-eligible': return 21;
+        case 'transport-failed':
+        case 'internal-error': return 70;
+        case 'cancelled': return 130;
+        default: return assertNever(result);
+    }
+}
+export function renderRunResultJson(result) {
+    return `${canonicalJson({
+        schema: 'codex-orchestrator.agent-auto-run-result',
+        version: 1,
+        result: structuredClone(result),
+    })}\n`;
+}
+function assertNever(value) {
+    throw new Error(`unmapped runIssue result: ${String(value)}`);
+}
+import { canonicalJson } from './containment.js';
+//# sourceMappingURL=cli-contract.js.map

package/dist/src/v2/cli-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-contract.js","sourceRoot":"","sources":["../../../src/v2/cli-contract.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAU,CAAC;AAE1F,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,cAAc;IACd,cAAc;IACd,SAAS;IACT,kBAAkB;IAClB,WAAW;IACX,gBAAgB;CACR,CAAC;AAKX,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9B,KAAK,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1B,KAAK,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC;QAC/B,KAAK,kBAAkB,CAAC;QACxB,KAAK,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC;QACjC,KAAK,WAAW,CAAC,CAAC,OAAO,GAAG,CAAC;QAC7B,OAAO,CAAC,CAAC,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAsB;IACxD,OAAO,GAAG,aAAa,CAAC;QACtB,MAAM,EAAE,0CAA0C;QAClD,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC;KAChC,CAAC,IAAI,CAAC;AACT,CAAC;AAED,SAAS,WAAW,CAAC,KAAY;IAC/B,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/src/v2/codex-process.d.ts

@@ -0,0 +1,71 @@
+export interface SpawnSpec {
+    file: string;
+    args: string[];
+    cwd: string;
+    env: Record<string, string>;
+    stdin: string;
+}
+export interface SupervisedChild {
+    pid: number;
+    processGroupId: number;
+    lastActivityAt(): number;
+    writeStdinAndClose(value: string): Promise<void>;
+    waitForExit(): Promise<{
+        exitCode: number | null;
+        signal: string | null;
+    }>;
+    terminateGroup(signal: 'SIGTERM' | 'SIGKILL'): Promise<void>;
+    waitForGroupAbsent(timeoutMs: number): Promise<void>;
+    waitForStreamsClosed(): Promise<{
+        stdout: Buffer;
+        stderr: Buffer;
+        truncated: boolean;
+    }>;
+}
+export type SpawnSupervisedProcess = (spec: SpawnSpec) => Promise<SupervisedChild>;
+export interface CodexProcessInput {
+    codexPath: string;
+    cwd: string;
+    schemaPath: string;
+    reportPath: string;
+    toolHome: string;
+    tmpDir: string;
+    safePath: string;
+    parentCodexHome: string;
+    parentEnv: NodeJS.ProcessEnv;
+    prompt: string;
+    timeoutMs: number;
+    idleTimeoutMs: number;
+}
+export type CodexReportRead = {
+    kind: 'available';
+    bytes: Buffer;
+} | {
+    kind: 'missing';
+} | {
+    kind: 'invalid';
+    reason: string;
+};
+export interface CodexProcessResult {
+    kind: 'completed' | 'exit-failed' | 'spawn-failed' | 'transport-failed' | 'timeout' | 'idle-timeout' | 'cancelled' | 'output-truncated' | 'report-failed';
+    pid?: number;
+    processGroupId?: number;
+    exitCode: number | null;
+    signal: string | null;
+    stdout: Buffer;
+    stderr: Buffer;
+    report: CodexReportRead;
+    error?: string;
+}
+export declare class ProcessQuiescenceError extends Error {
+    readonly pid: number;
+    readonly processGroupId: number;
+    constructor(message: string, child: SupervisedChild, options?: ErrorOptions);
+}
+export declare class CodexProcess {
+    private readonly spawnProcess;
+    constructor(spawnProcess?: SpawnSupervisedProcess);
+    run(input: CodexProcessInput, signal: AbortSignal): Promise<CodexProcessResult>;
+}
+export declare function spawnNodeSupervisedProcess(spec: SpawnSpec): Promise<SupervisedChild>;
+//# sourceMappingURL=codex-process.d.ts.map

package/dist/src/v2/codex-process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-process.d.ts","sourceRoot":"","sources":["../../../src/v2/codex-process.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,IAAI,MAAM,CAAC;IACzB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,WAAW,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAC3E,cAAc,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,oBAAoB,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACzF;AAED,MAAM,MAAM,sBAAsB,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAEnF,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC,MAAM,WAAW,kBAAkB;IACjC,IAAI,EACA,WAAW,GACX,aAAa,GACb,cAAc,GACd,kBAAkB,GAClB,SAAS,GACT,cAAc,GACd,WAAW,GACX,kBAAkB,GAClB,eAAe,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,eAAe,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;gBAEpB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,YAAY;CAM5E;AAED,qBAAa,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAAZ,YAAY,GAAE,sBAAmD;IAExF,GAAG,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAqEtF;AA6LD,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC,CA4D1F"}