codex-orchestrator 0.1.51 → 2.0.0

package/dist/src/runner/mission-runtime-owner.d.ts

@@ -1,36 +0,0 @@
-import type { MissionDeploymentRecord } from './mission-deployment.js';
-export interface RuntimeOwnerRecord {
-    version: 1;
-    repository: string;
-    deploymentId: string;
-    githubAppInstallationId: string;
-    credentialGeneration: string;
-    compatibilityEpoch: number;
-    deploymentRecordHash: string;
-    approvedByCommit: string;
-    fencingEpoch: number;
-}
-export interface RuntimeOwnerObservation {
-    sha: string;
-    record: RuntimeOwnerRecord;
-}
-export interface RuntimeOwnerRefAdapter {
-    read(): Promise<RuntimeOwnerObservation | undefined>;
-    compareAndSwap(expectedSha: string | undefined, record: RuntimeOwnerRecord): Promise<RuntimeOwnerObservation>;
-}
-export declare function canonicalRuntimeOwnerRecord(record: RuntimeOwnerRecord): string;
-export declare function parseRuntimeOwnerRecord(content: string): RuntimeOwnerRecord;
-export declare function assertRuntimeOwnerRecord(value: unknown): asserts value is RuntimeOwnerRecord;
-export declare class RuntimeOwnerConflictError extends Error {
-    constructor(message: string);
-}
-export declare class MissionRuntimeOwnership {
-    private readonly adapter;
-    constructor(adapter: RuntimeOwnerRefAdapter);
-    acquireInitial(deployment: MissionDeploymentRecord): Promise<RuntimeOwnerObservation>;
-    transfer(deployment: MissionDeploymentRecord, githubServerTime: string): Promise<RuntimeOwnerObservation>;
-    assertMutationFence(deployment: MissionDeploymentRecord, expectedFencingEpoch: number): Promise<RuntimeOwnerObservation>;
-    runFencedMutation<T>(deployment: MissionDeploymentRecord, expectedFencingEpoch: number, mutation: (fence: RuntimeOwnerObservation) => Promise<T>): Promise<T>;
-}
-export declare function ownerRecord(deployment: MissionDeploymentRecord, fencingEpoch: number): RuntimeOwnerRecord;
-//# sourceMappingURL=mission-runtime-owner.d.ts.map

package/dist/src/runner/mission-runtime-owner.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mission-runtime-owner.d.ts","sourceRoot":"","sources":["../../../src/runner/mission-runtime-owner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAGvE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,uBAAuB,EAAE,MAAM,CAAC;IAChC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,IAAI,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAAC;IACrD,cAAc,CACZ,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACrC;AAcD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAG9E;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,CAY3E;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,kBAAkB,CAwC5F;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAInC;AAED,qBAAa,uBAAuB;IACf,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,sBAAsB;IAEtD,cAAc,CAAC,UAAU,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQrF,QAAQ,CACnB,UAAU,EAAE,uBAAuB,EACnC,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,uBAAuB,CAAC;IA+BtB,mBAAmB,CAC9B,UAAU,EAAE,uBAAuB,EACnC,oBAAoB,EAAE,MAAM,GAC3B,OAAO,CAAC,uBAAuB,CAAC;IA8BtB,iBAAiB,CAAC,CAAC,EAC9B,UAAU,EAAE,uBAAuB,EACnC,oBAAoB,EAAE,MAAM,EAC5B,QAAQ,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,CAAC,CAAC,GACvD,OAAO,CAAC,CAAC,CAAC;CAId;AAED,wBAAgB,WAAW,CACzB,UAAU,EAAE,uBAAuB,EACnC,YAAY,EAAE,MAAM,GACnB,kBAAkB,CAepB"}

package/dist/src/runner/mission-runtime-owner.js

@@ -1,174 +0,0 @@
-import { missionDeploymentRecordHash } from './mission-deployment.js';
-const runtimeOwnerFields = [
-    'version',
-    'repository',
-    'deploymentId',
-    'githubAppInstallationId',
-    'credentialGeneration',
-    'compatibilityEpoch',
-    'deploymentRecordHash',
-    'approvedByCommit',
-    'fencingEpoch',
-];
-export function canonicalRuntimeOwnerRecord(record) {
-    assertRuntimeOwnerRecord(record);
-    return JSON.stringify(Object.fromEntries(runtimeOwnerFields.map((field) => [field, record[field]])));
-}
-export function parseRuntimeOwnerRecord(content) {
-    let parsed;
-    try {
-        parsed = JSON.parse(content);
-    }
-    catch {
-        throw new Error('Invalid Mission runtime owner record: expected JSON.');
-    }
-    assertRuntimeOwnerRecord(parsed);
-    if (content !== canonicalRuntimeOwnerRecord(parsed)) {
-        throw new Error('Invalid Mission runtime owner record: expected canonical JSON.');
-    }
-    return parsed;
-}
-export function assertRuntimeOwnerRecord(value) {
-    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
-        throw new Error('Invalid Mission runtime owner record: root must be an object.');
-    }
-    const record = value;
-    const allowed = new Set(runtimeOwnerFields);
-    for (const key of Object.keys(record)) {
-        if (!allowed.has(key)) {
-            throw new Error(`Invalid Mission runtime owner record: unexpected field ${key}.`);
-        }
-    }
-    if (Object.keys(record).length !== runtimeOwnerFields.length
-        || runtimeOwnerFields.some((field) => !(field in record))) {
-        throw new Error('Invalid Mission runtime owner record: exact fields are required.');
-    }
-    if (record.version !== 1) {
-        throw new Error('Invalid Mission runtime owner record: version must be 1.');
-    }
-    for (const field of [
-        'repository',
-        'deploymentId',
-        'githubAppInstallationId',
-        'credentialGeneration',
-    ]) {
-        if (typeof record[field] !== 'string' || record[field].trim().length === 0) {
-            throw new Error(`Invalid Mission runtime owner record: ${field} must be non-empty.`);
-        }
-    }
-    if (!Number.isSafeInteger(record.compatibilityEpoch) || record.compatibilityEpoch <= 0
-        || !Number.isSafeInteger(record.fencingEpoch) || record.fencingEpoch <= 0) {
-        throw new Error('Invalid Mission runtime owner record: epochs must be positive integers.');
-    }
-    if (typeof record.deploymentRecordHash !== 'string'
-        || !/^sha256:[a-f0-9]{64}$/u.test(record.deploymentRecordHash)) {
-        throw new Error('Invalid Mission runtime owner record: deploymentRecordHash must be SHA-256.');
-    }
-    if (typeof record.approvedByCommit !== 'string'
-        || !/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/u.test(record.approvedByCommit)) {
-        throw new Error('Invalid Mission runtime owner record: approvedByCommit must be a Git object ID.');
-    }
-}
-export class RuntimeOwnerConflictError extends Error {
-    constructor(message) {
-        super(`Mission runtime owner conflict: ${message}`);
-        this.name = 'RuntimeOwnerConflictError';
-    }
-}
-export class MissionRuntimeOwnership {
-    adapter;
-    constructor(adapter) {
-        this.adapter = adapter;
-    }
-    async acquireInitial(deployment) {
-        const observed = await this.adapter.read();
-        if (observed) {
-            throw new RuntimeOwnerConflictError(`already owned by ${observed.record.deploymentId}`);
-        }
-        return this.adapter.compareAndSwap(undefined, ownerRecord(deployment, 1));
-    }
-    async transfer(deployment, githubServerTime) {
-        const observed = await this.adapter.read();
-        if (!observed) {
-            throw new RuntimeOwnerConflictError('cannot transfer an absent owner; use initial acquisition');
-        }
-        if (deployment.repository !== observed.record.repository) {
-            throw new RuntimeOwnerConflictError('repository does not match current owner');
-        }
-        if (deployment.deploymentId === observed.record.deploymentId) {
-            throw new RuntimeOwnerConflictError('transfer requires a different deployment ID');
-        }
-        const now = exactTimestamp(githubServerTime, 'GitHub server time');
-        const notBefore = exactTimestamp(deployment.takeoverNotBefore, 'takeoverNotBefore');
-        if (now < notBefore) {
-            throw new RuntimeOwnerConflictError(`takeoverNotBefore is ${deployment.takeoverNotBefore}`);
-        }
-        if (exactTimestamp(deployment.priorCredentialRevokedAt, 'priorCredentialRevokedAt') > now) {
-            throw new RuntimeOwnerConflictError('prior credential revocation is not yet observed');
-        }
-        if (deployment.credentialGeneration === observed.record.credentialGeneration) {
-            throw new RuntimeOwnerConflictError('transfer requires a new credential generation');
-        }
-        if (deployment.compatibilityEpoch < observed.record.compatibilityEpoch) {
-            throw new RuntimeOwnerConflictError('compatibility epoch cannot move backward');
-        }
-        return this.adapter.compareAndSwap(observed.sha, ownerRecord(deployment, observed.record.fencingEpoch + 1));
-    }
-    async assertMutationFence(deployment, expectedFencingEpoch) {
-        if (!Number.isSafeInteger(expectedFencingEpoch) || expectedFencingEpoch <= 0) {
-            throw new RuntimeOwnerConflictError('fencing epoch must be a positive integer');
-        }
-        const observed = await this.adapter.read();
-        if (!observed) {
-            throw new RuntimeOwnerConflictError('owner ref is absent');
-        }
-        const expected = ownerRecord(deployment, expectedFencingEpoch);
-        if (observed.record.credentialGeneration !== expected.credentialGeneration) {
-            throw new RuntimeOwnerConflictError('credential generation does not match current owner');
-        }
-        for (const field of [
-            'repository',
-            'deploymentId',
-            'githubAppInstallationId',
-            'compatibilityEpoch',
-            'deploymentRecordHash',
-            'approvedByCommit',
-        ]) {
-            if (observed.record[field] !== expected[field]) {
-                throw new RuntimeOwnerConflictError(`${field} does not match the protected deployment record`);
-            }
-        }
-        if (observed.record.fencingEpoch !== expectedFencingEpoch) {
-            throw new RuntimeOwnerConflictError('fencing epoch does not match current owner');
-        }
-        return observed;
-    }
-    async runFencedMutation(deployment, expectedFencingEpoch, mutation) {
-        const fence = await this.assertMutationFence(deployment, expectedFencingEpoch);
-        return mutation(fence);
-    }
-}
-export function ownerRecord(deployment, fencingEpoch) {
-    if (!Number.isSafeInteger(fencingEpoch) || fencingEpoch <= 0) {
-        throw new Error('Mission runtime owner fencingEpoch must be a positive integer.');
-    }
-    return {
-        version: 1,
-        repository: deployment.repository,
-        deploymentId: deployment.deploymentId,
-        githubAppInstallationId: deployment.githubAppInstallationId,
-        credentialGeneration: deployment.credentialGeneration,
-        compatibilityEpoch: deployment.compatibilityEpoch,
-        deploymentRecordHash: missionDeploymentRecordHash(deployment),
-        approvedByCommit: deployment.approvedByCommit,
-        fencingEpoch,
-    };
-}
-function exactTimestamp(value, field) {
-    const parsed = Date.parse(value);
-    if (!Number.isFinite(parsed) || new Date(parsed).toISOString() !== value) {
-        throw new RuntimeOwnerConflictError(`${field} is not an exact UTC ISO timestamp`);
-    }
-    return parsed;
-}
-//# sourceMappingURL=mission-runtime-owner.js.map

package/dist/src/runner/mission-runtime-owner.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mission-runtime-owner.js","sourceRoot":"","sources":["../../../src/runner/mission-runtime-owner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AA2BtE,MAAM,kBAAkB,GAA4C;IAClE,SAAS;IACT,YAAY;IACZ,cAAc;IACd,yBAAyB;IACzB,sBAAsB;IACtB,oBAAoB;IACpB,sBAAsB;IACtB,kBAAkB;IAClB,cAAc;CACf,CAAC;AAEF,MAAM,UAAU,2BAA2B,CAAC,MAA0B;IACpE,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,OAAO,KAAK,2BAA2B,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,kBAAkB,CAAC,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,0DAA0D,GAAG,GAAG,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM;WACvD,kBAAkB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,KAAK,MAAM,KAAK,IAAI;QAClB,YAAY;QACZ,cAAc;QACd,yBAAyB;QACzB,sBAAsB;KACvB,EAAE,CAAC;QACF,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,MAAM,CAAC,KAAK,CAAY,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,qBAAqB,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAK,MAAM,CAAC,kBAA6B,IAAI,CAAC;WAC7F,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,IAAK,MAAM,CAAC,YAAuB,IAAI,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,oBAAoB,KAAK,QAAQ;WAC9C,CAAC,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ;WAC1C,CAAC,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAmB,OAAe;QAChC,KAAK,CAAC,mCAAmC,OAAO,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,uBAAuB;IACE;IAApC,YAAoC,OAA+B;QAA/B,YAAO,GAAP,OAAO,CAAwB;IAAG,CAAC;IAEhE,KAAK,CAAC,cAAc,CAAC,UAAmC;QAC7D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,yBAAyB,CAAC,oBAAoB,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IAEM,KAAK,CAAC,QAAQ,CACnB,UAAmC,EACnC,gBAAwB;QAExB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,yBAAyB,CAAC,0DAA0D,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,KAAK,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACzD,MAAM,IAAI,yBAAyB,CAAC,yCAAyC,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,UAAU,CAAC,YAAY,KAAK,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC7D,MAAM,IAAI,yBAAyB,CAAC,6CAA6C,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,GAAG,cAAc,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,cAAc,CAAC,UAAU,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QACpF,IAAI,GAAG,GAAG,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,yBAAyB,CAAC,wBAAwB,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,cAAc,CAAC,UAAU,CAAC,wBAAwB,EAAE,0BAA0B,CAAC,GAAG,GAAG,EAAE,CAAC;YAC1F,MAAM,IAAI,yBAAyB,CAAC,iDAAiD,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,UAAU,CAAC,oBAAoB,KAAK,QAAQ,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;YAC7E,MAAM,IAAI,yBAAyB,CAAC,+CAA+C,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,UAAU,CAAC,kBAAkB,GAAG,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACvE,MAAM,IAAI,yBAAyB,CAAC,0CAA0C,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAChC,QAAQ,CAAC,GAAG,EACZ,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,CAC1D,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAC9B,UAAmC,EACnC,oBAA4B;QAE5B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,oBAAoB,CAAC,IAAI,oBAAoB,IAAI,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,yBAAyB,CAAC,0CAA0C,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,yBAAyB,CAAC,qBAAqB,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;QAC/D,IAAI,QAAQ,CAAC,MAAM,CAAC,oBAAoB,KAAK,QAAQ,CAAC,oBAAoB,EAAE,CAAC;YAC3E,MAAM,IAAI,yBAAyB,CAAC,oDAAoD,CAAC,CAAC;QAC5F,CAAC;QACD,KAAK,MAAM,KAAK,IAAI;YAClB,YAAY;YACZ,cAAc;YACd,yBAAyB;YACzB,oBAAoB;YACpB,sBAAsB;YACtB,kBAAkB;SACV,EAAE,CAAC;YACX,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,iDAAiD,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;YAC1D,MAAM,IAAI,yBAAyB,CAAC,4CAA4C,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAC5B,UAAmC,EACnC,oBAA4B,EAC5B,QAAwD;QAExD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;QAC/E,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;CACF;AAED,MAAM,UAAU,WAAW,CACzB,UAAmC,EACnC,YAAoB;IAEpB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,uBAAuB,EAAE,UAAU,CAAC,uBAAuB;QAC3D,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;QACrD,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;QACjD,oBAAoB,EAAE,2BAA2B,CAAC,UAAU,CAAC;QAC7D,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,YAAY;KACb,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,KAAa;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;QACzE,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/runner/mission-safe-executor.d.ts

@@ -1,96 +0,0 @@
-import { type MissionExecutorProbeResult } from './mission-executor-probe.js';
-import { type MissionProcessInput, type MissionProcessResult } from './mission-process-executor.js';
-import type { MissionSandboxBackend } from './mission-capability-kernel.js';
-export declare const missionSafeExecutorKinds: readonly ["completion-report-repair", "review-evidence-repair", "acceptance-proof-repair", "configured-check"];
-export type MissionSafeExecutorKind = (typeof missionSafeExecutorKinds)[number];
-export interface MissionSafeExecutorDescriptor {
-    id: string;
-    kind: MissionSafeExecutorKind;
-    executable: string;
-    args: string[];
-    readPaths: string[];
-    writePaths: string[];
-    network: 'deny';
-    idempotency: 'repeat-safe' | 'reconcile';
-}
-export interface MissionSafeExecutorPermit extends MissionSafeExecutorDescriptor {
-    missionId: string;
-    actionKey: string;
-    executorId: string;
-    grantedPaths: string[];
-    inputSnapshot: string;
-    fencingEpoch: number;
-    expiresAt: string;
-    descriptorFingerprint: string;
-}
-export interface MissionSafeExecutorAuthorizationRequest {
-    missionId: string;
-    actionKey: string;
-    executorId: string;
-    grantedPaths: string[];
-    inputSnapshot: string;
-    fencingEpoch: number;
-    expiresAt: string;
-}
-export type MissionSafeExecutorClassification = {
-    kind: 'safe-executor';
-    descriptor: MissionSafeExecutorDescriptor;
-} | {
-    kind: 'external-input-required';
-    reason: 'legacy-shell-executor-unavailable-in-mission-mode';
-    migration: 'register an exact argv Mission safe executor';
-};
-export interface MissionSafeExecutorOptions {
-    backend: MissionSandboxBackend;
-    workspaceRoot: string;
-    quarantineRoot: string;
-    deniedReadPaths: string[];
-    sourceEnv: NodeJS.ProcessEnv;
-    allowedEnvKeys: string[];
-    timeoutMs: number;
-    capabilityProof: MissionExecutorProbeResult;
-}
-export interface MissionSafeExecutorReceipt {
-    version: 1;
-    missionId: string;
-    actionKey: string;
-    executorId: string;
-    descriptorFingerprint: string;
-    exitCode: number;
-    termination: MissionProcessResult['termination'];
-    stdoutSha256: string;
-    stderrSha256: string;
-    outputs: Array<{
-        path: string;
-        size: number;
-        sha256: string;
-    }>;
-}
-export interface MissionSafeExecutorResult {
-    process: MissionProcessResult;
-    receipt: MissionSafeExecutorReceipt;
-}
-export interface MissionSafeExecutorDependencies {
-    runProcess?: (input: MissionProcessInput) => Promise<MissionProcessResult>;
-    now?: () => Date;
-}
-export declare class MissionSafeExecutorRegistry {
-    private readonly descriptors;
-    constructor(descriptors: MissionSafeExecutorDescriptor[]);
-    authorize(request: MissionSafeExecutorAuthorizationRequest): MissionSafeExecutorPermit;
-    classify(input: string | {
-        executorId: string;
-    }): MissionSafeExecutorClassification;
-    kinds(): MissionSafeExecutorKind[];
-    validatePermit(permit: MissionSafeExecutorPermit, now: Date): MissionSafeExecutorPermit;
-}
-export declare class MissionSafeExecutor {
-    private readonly registry;
-    private readonly options;
-    private readonly runProcess;
-    private readonly now;
-    constructor(registry: MissionSafeExecutorRegistry, options: MissionSafeExecutorOptions, dependencies?: MissionSafeExecutorDependencies);
-    execute(permit: MissionSafeExecutorPermit): Promise<MissionSafeExecutorResult>;
-}
-export declare function missionSafeExecutorPermitFingerprint(permit: MissionSafeExecutorPermit): string;
-//# sourceMappingURL=mission-safe-executor.d.ts.map

package/dist/src/runner/mission-safe-executor.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mission-safe-executor.d.ts","sourceRoot":"","sources":["../../../src/runner/mission-safe-executor.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,6BAA6B,CAAC;AAOrC,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAE5E,eAAO,MAAM,wBAAwB,gHAK3B,CAAC;AAEX,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF,MAAM,WAAW,6BAA6B;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,uBAAuB,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,aAAa,GAAG,WAAW,CAAC;CAC1C;AAED,MAAM,WAAW,yBAA0B,SAAQ,6BAA6B;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,uCAAuC;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,iCAAiC,GACzC;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,UAAU,EAAE,6BAA6B,CAAA;CAAE,GACpE;IACE,IAAI,EAAE,yBAAyB,CAAC;IAChC,MAAM,EAAE,mDAAmD,CAAC;IAC5D,SAAS,EAAE,8CAA8C,CAAC;CAC3D,CAAC;AAEN,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC;IAC7B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,0BAA0B,CAAC;CAC7C;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,OAAO,EAAE,0BAA0B,CAAC;CACrC;AAED,MAAM,WAAW,+BAA+B;IAC9C,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3E,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoD;gBAE7D,WAAW,EAAE,6BAA6B,EAAE;IAUxD,SAAS,CAAC,OAAO,EAAE,uCAAuC,GAAG,yBAAyB;IAoCtF,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,iCAAiC;IAenF,KAAK,IAAI,uBAAuB,EAAE;IAIlC,cAAc,CACnB,MAAM,EAAE,yBAAyB,EACjC,GAAG,EAAE,IAAI,GACR,yBAAyB;CA0B7B;AAED,qBAAa,mBAAmB;IAK5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgE;IAC3F,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;gBAGd,QAAQ,EAAE,2BAA2B,EACrC,OAAO,EAAE,0BAA0B,EACpD,YAAY,GAAE,+BAAoC;IAavC,OAAO,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC;CA4C5F;AAED,wBAAgB,oCAAoC,CAAC,MAAM,EAAE,yBAAyB,GAAG,MAAM,CAY9F"}

package/dist/src/runner/mission-safe-executor.js

@@ -1,288 +0,0 @@
-import { createHash } from 'node:crypto';
-import { lstat, readdir } from 'node:fs/promises';
-import { basename, isAbsolute, join } from 'node:path';
-import { globMatches, normalizePath, uniqueSortedPaths } from '../path-policy.js';
-import { inspectCanonicalFile } from './mission-canonical-path.js';
-import { missionExecutorRequiredChecks, } from './mission-executor-probe.js';
-import { assertMissionPathPattern, missionDefaultDeniedRepositoryPaths, missionPathPatternsOverlap, scopePatternContainedBy, } from './mission-path-language.js';
-import { runMissionProcess, } from './mission-process-executor.js';
-import { buildMissionSandboxInvocation } from './mission-sandbox.js';
-export const missionSafeExecutorKinds = [
-    'completion-report-repair',
-    'review-evidence-repair',
-    'acceptance-proof-repair',
-    'configured-check',
-];
-export class MissionSafeExecutorRegistry {
-    descriptors = new Map();
-    constructor(descriptors) {
-        for (const input of descriptors) {
-            const descriptor = normalizeDescriptor(input);
-            if (this.descriptors.has(descriptor.id)) {
-                throw new Error(`Mission safe executor id is duplicated: ${descriptor.id}.`);
-            }
-            this.descriptors.set(descriptor.id, descriptor);
-        }
-    }
-    authorize(request) {
-        requireText(request.missionId, 'missionId');
-        requireText(request.actionKey, 'actionKey');
-        requireText(request.inputSnapshot, 'inputSnapshot');
-        if (!Number.isSafeInteger(request.fencingEpoch) || request.fencingEpoch <= 0) {
-            throw new Error('Mission safe executor fencingEpoch must be a positive integer.');
-        }
-        if (!Number.isFinite(Date.parse(request.expiresAt))) {
-            throw new Error('Mission safe executor expiresAt must be an ISO timestamp.');
-        }
-        const descriptor = this.descriptors.get(request.executorId);
-        if (!descriptor) {
-            throw new Error(`Mission safe executor is not registered: ${request.executorId}.`);
-        }
-        const grantedPaths = uniqueSortedPaths(request.grantedPaths);
-        if (grantedPaths.length === 0) {
-            throw new Error('Mission safe executor granted scope must not be empty.');
-        }
-        for (const path of descriptor.readPaths) {
-            if (!grantedPaths.some((grant) => scopePatternContainedBy(path, grant))) {
-                throw new Error(`Mission safe executor path is outside granted scope: ${path}.`);
-            }
-        }
-        return {
-            ...structuredClone(descriptor),
-            missionId: request.missionId,
-            actionKey: request.actionKey,
-            executorId: descriptor.id,
-            grantedPaths,
-            inputSnapshot: request.inputSnapshot,
-            fencingEpoch: request.fencingEpoch,
-            expiresAt: request.expiresAt,
-            descriptorFingerprint: descriptorFingerprint(descriptor),
-        };
-    }
-    classify(input) {
-        if (typeof input === 'string') {
-            return {
-                kind: 'external-input-required',
-                reason: 'legacy-shell-executor-unavailable-in-mission-mode',
-                migration: 'register an exact argv Mission safe executor',
-            };
-        }
-        const descriptor = this.descriptors.get(input.executorId);
-        if (!descriptor) {
-            throw new Error(`Mission safe executor is not registered: ${input.executorId}.`);
-        }
-        return { kind: 'safe-executor', descriptor: structuredClone(descriptor) };
-    }
-    kinds() {
-        return Array.from(new Set([...this.descriptors.values()].map((descriptor) => descriptor.kind))).sort();
-    }
-    validatePermit(permit, now) {
-        const receivedDescriptor = normalizeDescriptor(permit);
-        const registered = this.descriptors.get(permit.executorId);
-        if (!registered
-            || descriptorFingerprint(receivedDescriptor) !== permit.descriptorFingerprint
-            || descriptorFingerprint(registered) !== permit.descriptorFingerprint) {
-            throw new Error('Mission safe executor permit descriptor was modified or unregistered.');
-        }
-        if (Date.parse(permit.expiresAt) <= now.getTime()) {
-            throw new Error('Mission safe executor permit has expired.');
-        }
-        const authorized = this.authorize({
-            missionId: permit.missionId,
-            actionKey: permit.actionKey,
-            executorId: permit.executorId,
-            grantedPaths: permit.grantedPaths,
-            inputSnapshot: permit.inputSnapshot,
-            fencingEpoch: permit.fencingEpoch,
-            expiresAt: permit.expiresAt,
-        });
-        if (missionSafeExecutorPermitFingerprint(authorized)
-            !== missionSafeExecutorPermitFingerprint(permit)) {
-            throw new Error('Mission safe executor permit identity was modified.');
-        }
-        return authorized;
-    }
-}
-export class MissionSafeExecutor {
-    registry;
-    options;
-    runProcess;
-    now;
-    constructor(registry, options, dependencies = {}) {
-        this.registry = registry;
-        this.options = options;
-        const checks = new Set(options.capabilityProof.checks);
-        if (!options.capabilityProof.supported
-            || options.capabilityProof.backend !== options.backend
-            || options.capabilityProof.failures.length > 0
-            || missionExecutorRequiredChecks.some((check) => !checks.has(check))) {
-            throw new Error('Mission safe executor requires a successful active capability proof.');
-        }
-        this.runProcess = dependencies.runProcess ?? runMissionProcess;
-        this.now = dependencies.now ?? (() => new Date());
-    }
-    async execute(permit) {
-        const authorized = this.registry.validatePermit(permit, this.now());
-        const existingOutputs = await inspectQuarantineOutputs(this.options.quarantineRoot);
-        if (existingOutputs.length > 0) {
-            throw new Error('Mission safe executor requires a fresh empty quarantine.');
-        }
-        const invocation = buildMissionSandboxInvocation({
-            backend: this.options.backend,
-            workspaceRoot: this.options.workspaceRoot,
-            quarantineRoot: this.options.quarantineRoot,
-            mode: authorized.writePaths.length > 0 ? 'quarantine-write' : 'read-only',
-            command: authorized.executable,
-            args: authorized.args,
-            deniedReadPaths: this.options.deniedReadPaths,
-        });
-        const process = await this.runProcess({
-            ...invocation,
-            cwd: this.options.workspaceRoot,
-            timeoutMs: this.options.timeoutMs,
-            sourceEnv: this.options.sourceEnv,
-            allowedEnvKeys: this.options.allowedEnvKeys,
-        });
-        const outputs = await inspectQuarantineOutputs(this.options.quarantineRoot);
-        const undeclared = outputs.filter((output) => !authorized.writePaths.some((pattern) => globMatches(pattern, output.path)));
-        if (undeclared.length > 0) {
-            throw new Error(`Mission safe executor produced undeclared quarantine output: ${undeclared[0].path}.`);
-        }
-        return {
-            process,
-            receipt: {
-                version: 1,
-                missionId: authorized.missionId,
-                actionKey: authorized.actionKey,
-                executorId: authorized.executorId,
-                descriptorFingerprint: authorized.descriptorFingerprint,
-                exitCode: process.exitCode,
-                termination: process.termination,
-                stdoutSha256: hash(process.stdout),
-                stderrSha256: hash(process.stderr),
-                outputs,
-            },
-        };
-    }
-}
-export function missionSafeExecutorPermitFingerprint(permit) {
-    return hash(JSON.stringify([
-        'mission-safe-executor-permit-v1',
-        permit.missionId,
-        permit.actionKey,
-        permit.executorId,
-        permit.descriptorFingerprint,
-        permit.grantedPaths,
-        permit.inputSnapshot,
-        permit.fencingEpoch,
-        permit.expiresAt,
-    ]));
-}
-function normalizeDescriptor(input) {
-    const id = requireText(input.id, 'id');
-    if (!missionSafeExecutorKinds.includes(input.kind)) {
-        throw new Error(`Mission safe executor kind is invalid: ${String(input.kind)}.`);
-    }
-    if (!isAbsolute(input.executable)) {
-        throw new Error('Mission safe executor executable must be absolute.');
-    }
-    if (['sh', 'bash', 'zsh', 'fish', 'dash', 'env'].includes(basename(input.executable))) {
-        throw new Error('Mission safe executor forbids shell executables.');
-    }
-    if (input.args.some((arg) => arg.includes('\0') || /\$\(|`|\|\||&&|[<>;]/u.test(arg))) {
-        throw new Error('Mission safe executor arguments contain shell-control syntax.');
-    }
-    if (input.network !== 'deny') {
-        throw new Error('Mission safe executor network must be denied.');
-    }
-    if (input.idempotency !== 'repeat-safe' && input.idempotency !== 'reconcile') {
-        throw new Error('Mission safe executor idempotency is invalid.');
-    }
-    const readPaths = uniqueSortedPaths(input.readPaths);
-    const writePaths = uniqueSortedPaths(input.writePaths);
-    if (readPaths.length === 0) {
-        throw new Error('Mission safe executor requires finite read scope.');
-    }
-    for (const path of [...readPaths, ...writePaths]) {
-        assertMissionPathPattern(path, 'Mission safe executor path');
-        if (missionDefaultDeniedRepositoryPaths.some((denied) => missionPathPatternsOverlap(path, denied))) {
-            throw new Error(`Mission safe executor path overlaps a denied repository path: ${path}.`);
-        }
-    }
-    return {
-        id,
-        kind: input.kind,
-        executable: input.executable,
-        args: [...input.args],
-        readPaths,
-        writePaths,
-        network: 'deny',
-        idempotency: input.idempotency,
-    };
-}
-function descriptorFingerprint(descriptor) {
-    return hash(JSON.stringify([
-        'mission-safe-executor-descriptor-v1',
-        descriptor.id,
-        descriptor.kind,
-        descriptor.executable,
-        descriptor.args,
-        descriptor.readPaths,
-        descriptor.writePaths,
-        descriptor.network,
-        descriptor.idempotency,
-    ]));
-}
-function hash(value) {
-    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
-}
-async function inspectQuarantineOutputs(root) {
-    const paths = [];
-    await walk('');
-    const outputs = [];
-    for (const path of paths.sort()) {
-        const inspected = await inspectCanonicalFile({
-            root,
-            path,
-            deniedPaths: [],
-            missing: 'reject',
-        });
-        if (!inspected)
-            throw new Error(`Mission safe executor quarantine output disappeared: ${path}.`);
-        outputs.push({
-            path,
-            size: inspected.identity.size,
-            sha256: `sha256:${inspected.identity.sha256}`,
-        });
-    }
-    return outputs;
-    async function walk(relativeDirectory) {
-        const directory = relativeDirectory ? join(root, relativeDirectory) : root;
-        const entries = await readdir(directory);
-        for (const entry of entries) {
-            const relativePath = normalizePath(relativeDirectory
-                ? `${relativeDirectory}/${entry}` : entry);
-            const info = await lstat(join(root, relativePath));
-            if (info.isSymbolicLink()) {
-                throw new Error(`Mission safe executor refuses symbolic quarantine output: ${relativePath}.`);
-            }
-            if (info.isDirectory()) {
-                await walk(relativePath);
-            }
-            else if (info.isFile()) {
-                paths.push(relativePath);
-            }
-            else {
-                throw new Error(`Mission safe executor refuses non-regular quarantine output: ${relativePath}.`);
-            }
-        }
-    }
-}
-function requireText(value, field) {
-    const normalized = value.trim();
-    if (normalized.length === 0) {
-        throw new Error(`Mission safe executor ${field} must be non-empty.`);
-    }
-    return normalized;
-}
-//# sourceMappingURL=mission-safe-executor.js.map

package/dist/src/runner/mission-safe-executor.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mission-safe-executor.js","sourceRoot":"","sources":["../../../src/runner/mission-safe-executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEvD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EACL,6BAA6B,GAE9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,wBAAwB,EACxB,mCAAmC,EACnC,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,GAGlB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AAGrE,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,0BAA0B;IAC1B,wBAAwB;IACxB,yBAAyB;IACzB,kBAAkB;CACV,CAAC;AAkFX,MAAM,OAAO,2BAA2B;IACrB,WAAW,GAAG,IAAI,GAAG,EAAyC,CAAC;IAEhF,YAAmB,WAA4C;QAC7D,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;YAChC,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,2CAA2C,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAEM,SAAS,CAAC,OAAgD;QAC/D,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5C,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5C,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,4CAA4C,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACxE,MAAM,IAAI,KAAK,CAAC,wDAAwD,IAAI,GAAG,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QACD,OAAO;YACL,GAAG,eAAe,CAAC,UAAU,CAAC;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,UAAU,CAAC,EAAE;YACzB,YAAY;YACZ,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,qBAAqB,EAAE,qBAAqB,CAAC,UAAU,CAAC;SACzD,CAAC;IACJ,CAAC;IAEM,QAAQ,CAAC,KAAsC;QACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO;gBACL,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EAAE,mDAAmD;gBAC3D,SAAS,EAAE,8CAA8C;aAC1D,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,4CAA4C,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;IAC5E,CAAC;IAEM,KAAK;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzG,CAAC;IAEM,cAAc,CACnB,MAAiC,EACjC,GAAS;QAET,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU;eACV,qBAAqB,CAAC,kBAAkB,CAAC,KAAK,MAAM,CAAC,qBAAqB;eAC1E,qBAAqB,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC,qBAAqB,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;YAChC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,IAAI,oCAAoC,CAAC,UAAU,CAAC;gBAC9C,oCAAoC,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;CACF;AAED,MAAM,OAAO,mBAAmB;IAKX;IACA;IALF,UAAU,CAAgE;IAC1E,GAAG,CAAa;IAEjC,YACmB,QAAqC,EACrC,OAAmC,EACpD,eAAgD,EAAE;QAFjC,aAAQ,GAAR,QAAQ,CAA6B;QACrC,YAAO,GAAP,OAAO,CAA4B;QAGpD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,SAAS;eACjC,OAAO,CAAC,eAAe,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;eACnD,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;eAC3C,6BAA6B,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU,IAAI,iBAAiB,CAAC;QAC/D,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,MAAiC;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACpE,MAAM,eAAe,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACpF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,UAAU,GAAG,6BAA6B,CAAC;YAC/C,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;YAC7B,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;YACzC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc;YAC3C,IAAI,EAAE,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,WAAW;YACzE,OAAO,EAAE,UAAU,CAAC,UAAU;YAC9B,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe;SAC9C,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC;YACpC,GAAG,UAAU;YACb,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;YAC/B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YACjC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YACjC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc;SAC5C,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAC3C,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,gEAAgE,UAAU,CAAC,CAAC,CAAE,CAAC,IAAI,GAAG,CAAC,CAAC;QAC1G,CAAC;QACD,OAAO;YACL,OAAO;YACP,OAAO,EAAE;gBACP,OAAO,EAAE,CAAC;gBACV,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,qBAAqB,EAAE,UAAU,CAAC,qBAAqB;gBACvD,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBAClC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBAClC,OAAO;aACR;SACF,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,oCAAoC,CAAC,MAAiC;IACpF,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QACzB,iCAAiC;QACjC,MAAM,CAAC,SAAS;QAChB,MAAM,CAAC,SAAS;QAChB,MAAM,CAAC,UAAU;QACjB,MAAM,CAAC,qBAAqB;QAC5B,MAAM,CAAC,YAAY;QACnB,MAAM,CAAC,aAAa;QACpB,MAAM,CAAC,YAAY;QACnB,MAAM,CAAC,SAAS;KACjB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAoC;IAC/D,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,0CAA0C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,aAAa,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,SAAS,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACjD,wBAAwB,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;QAC7D,IAAI,mCAAmC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACtD,0BAA0B,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,iEAAiE,IAAI,GAAG,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE;QACF,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;QACrB,SAAS;QACT,UAAU;QACV,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAyC;IACtE,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QACzB,qCAAqC;QACrC,UAAU,CAAC,EAAE;QACb,UAAU,CAAC,IAAI;QACf,UAAU,CAAC,UAAU;QACrB,UAAU,CAAC,IAAI;QACf,UAAU,CAAC,SAAS;QACpB,UAAU,CAAC,UAAU;QACrB,UAAU,CAAC,OAAO;QAClB,UAAU,CAAC,WAAW;KACvB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,IAAY;IAClD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,MAAM,OAAO,GAA0C,EAAE,CAAC;IAC1D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC;YAC3C,IAAI;YACJ,IAAI;YACJ,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,IAAI,GAAG,CAAC,CAAC;QACjG,OAAO,CAAC,IAAI,CAAC;YACX,IAAI;YACJ,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI;YAC7B,MAAM,EAAE,UAAU,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;IAEf,KAAK,UAAU,IAAI,CAAC,iBAAyB;QAC3C,MAAM,SAAS,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,YAAY,GAAG,aAAa,CAAC,iBAAiB;gBAClD,CAAC,CAAC,GAAG,iBAAiB,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;YACnD,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,6DAA6D,YAAY,GAAG,CAAC,CAAC;YAChG,CAAC;YACD,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC;YAC3B,CAAC;iBAAM,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,gEAAgE,YAAY,GAAG,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa;IAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,qBAAqB,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/src/runner/mission-sandbox.d.ts

@@ -1,16 +0,0 @@
-import type { MissionSandboxBackend } from './mission-capability-kernel.js';
-export interface MissionSandboxInput {
-    backend: MissionSandboxBackend;
-    workspaceRoot: string;
-    quarantineRoot: string;
-    mode: 'read-only' | 'quarantine-write';
-    command: string;
-    args: string[];
-    deniedReadPaths?: string[];
-}
-export interface MissionSandboxInvocation {
-    file: string;
-    args: string[];
-}
-export declare function buildMissionSandboxInvocation(input: MissionSandboxInput): MissionSandboxInvocation;
-//# sourceMappingURL=mission-sandbox.d.ts.map