cosmios 0.1.0

package/dist/index.js

@@ -0,0 +1,116 @@
+import { hostname, platform } from 'node:os';
+import { loadConfig, saveConfig } from './config.js';
+import { connectRunner } from './api-client.js';
+import { startHeartbeat } from './heartbeat.js';
+import { RunnerConnection } from './connection.js';
+import { handleRunDispatch } from './run-handler.js';
+import { startRunPoller } from './poller.js';
+import { startRollbackPoller } from './rollback-poller.js';
+import { startPreviewPoller } from './preview-poller.js';
+import { ClaudeCodeAdapter } from './adapters/claude-code.js';
+import { CodexAdapter } from './adapters/codex.js';
+import { createSnapshot } from './snapshot.js';
+import { log } from './logger.js';
+export { log, createLogger, setLogLevel } from './logger.js';
+export { loadConfig, saveConfig, getConfigPath, getConfigDir } from './config.js';
+export { connectRunner, sendHeartbeat, updateRunStatus, appendRunEvent } from './api-client.js';
+export { ClaudeCodeAdapter } from './adapters/claude-code.js';
+export { CodexAdapter } from './adapters/codex.js';
+export class CosmiosRunner {
+    config;
+    connection = null;
+    stopHeartbeat = null;
+    messageHandlers = new Map();
+    statusHandlers = [];
+    executor = {
+        adapter: new ClaudeCodeAdapter(),
+        adapters: {
+            'claude-code': new ClaudeCodeAdapter(),
+            'codex': new CodexAdapter()
+        },
+        snapshot: createSnapshot
+    };
+    stopPoller = null;
+    stopRollbackPoller = null;
+    stopPreviewPoller = null;
+    constructor(config) {
+        this.config = config;
+    }
+    static fromConfig() {
+        const config = loadConfig();
+        if (!config)
+            throw new Error('runner_not_registered');
+        return new CosmiosRunner(config);
+    }
+    async start() {
+        // Connect to server: mark online + get fresh supabase creds
+        const connectInfo = await connectRunner(this.config.server_url, this.config.api_key, {
+            hostname: hostname(),
+            os: platform()
+        });
+        this.config = {
+            ...this.config,
+            runner_id: connectInfo.runner_id,
+            supabase_url: connectInfo.supabase_url,
+            supabase_anon_key: connectInfo.supabase_anon_key
+        };
+        // Persist updated config (supabase creds may rotate)
+        saveConfig(this.config);
+        // Wire built-in run:dispatch handler
+        this.messageHandlers.set('run:dispatch', (payload) => {
+            handleRunDispatch(this.config.server_url, this.config.api_key, '', // userId resolved server-side via api_key
+            payload, this.executor).catch((err) => log.error(`run handler error: ${err.message}`));
+        });
+        // Open Supabase Realtime channel runner:{runner_id}
+        this.connection = new RunnerConnection({
+            config: this.config,
+            onStatusChange: (status) => {
+                for (const handler of this.statusHandlers)
+                    handler(status);
+            },
+            onMessage: (event, payload) => {
+                const handler = this.messageHandlers.get(event);
+                handler?.(payload);
+            }
+        });
+        this.connection.connect();
+        // Start heartbeat loop (every 30s)
+        this.stopHeartbeat = startHeartbeat(this.config.server_url, this.config.api_key, (err) => log.error(`heartbeat error: ${err.message}`));
+        // Poll for pending runs every 3s
+        this.stopPoller = startRunPoller(this.config.server_url, this.config.api_key, (run, policy) => {
+            handleRunDispatch(this.config.server_url, this.config.api_key, '', run, this.executor, policy).catch((err) => log.error(`run error: ${err.message}`));
+        }, (err) => log.error(`poller error: ${err.message}`));
+        // Poll for rollback requests every 5s
+        this.stopRollbackPoller = startRollbackPoller(this.config.server_url, this.config.api_key, (err) => log.error(`rollback poller error: ${err.message}`));
+        // Poll for preview requests every 3s
+        this.stopPreviewPoller = startPreviewPoller(this.config.server_url, this.config.api_key, (err) => log.error(`preview poller error: ${err.message}`));
+        // Ensure clean shutdown on Ctrl+C / kill / crash — kill all child
+        // process trees so dev servers, tunnels, etc. don't become zombies.
+        const gracefulStop = () => { this.stop(); process.exit(0); };
+        process.on('SIGINT', gracefulStop);
+        process.on('SIGTERM', gracefulStop);
+        process.on('beforeExit', () => this.stop());
+        log.info(`runner started — id: ${this.config.runner_id}`);
+    }
+    setExecutor(executor) {
+        this.executor = executor;
+    }
+    on(event, handler) {
+        this.messageHandlers.set(event, handler);
+    }
+    onStatusChange(handler) {
+        this.statusHandlers.push(handler);
+    }
+    stop() {
+        this.stopHeartbeat?.();
+        this.stopPoller?.();
+        this.stopRollbackPoller?.();
+        this.stopPreviewPoller?.();
+        this.connection?.disconnect();
+        log.info('runner stopped');
+    }
+    getRunnerId() {
+        return this.config.runner_id;
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAoB,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAGlC,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEhG,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAMnD,MAAM,OAAO,aAAa;IAChB,MAAM,CAAe;IACrB,UAAU,GAA4B,IAAI,CAAC;IAC3C,aAAa,GAAwB,IAAI,CAAC;IAC1C,eAAe,GAAG,IAAI,GAAG,EAA0B,CAAC;IACpD,cAAc,GAA8C,EAAE,CAAC;IAC/D,QAAQ,GAAgB;QAC9B,OAAO,EAAE,IAAI,iBAAiB,EAAE;QAChC,QAAQ,EAAE;YACR,aAAa,EAAE,IAAI,iBAAiB,EAAE;YACtC,OAAO,EAAE,IAAI,YAAY,EAAE;SAC5B;QACD,QAAQ,EAAE,cAAc;KACzB,CAAC;IACM,UAAU,GAAwB,IAAI,CAAC;IACvC,kBAAkB,GAAwB,IAAI,CAAC;IAC/C,iBAAiB,GAAwB,IAAI,CAAC;IAEtD,YAAY,MAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,UAAU;QACf,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACtD,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,4DAA4D;QAC5D,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;YACnF,QAAQ,EAAE,QAAQ,EAAE;YACpB,EAAE,EAAE,QAAQ,EAAE;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,IAAI,CAAC,MAAM;YACd,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,iBAAiB,EAAE,WAAW,CAAC,iBAAiB;SACjD,CAAC;QAEF,qDAAqD;QACrD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAExB,qCAAqC;QACrC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE;YACnD,iBAAiB,CACf,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,MAAM,CAAC,OAAO,EACnB,EAAE,EAAE,0CAA0C;YAC9C,OAAO,EACP,IAAI,CAAC,QAAQ,CACd,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,sBAAsB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QAEH,oDAAoD;QACpD,IAAI,CAAC,UAAU,GAAG,IAAI,gBAAgB,CAAC;YACrC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE;gBACzB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,cAAc;oBAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7D,CAAC;YACD,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAChD,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAE1B,mCAAmC;QACnC,IAAI,CAAC,aAAa,GAAG,cAAc,CACjC,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,MAAM,CAAC,OAAO,EACnB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,OAAO,EAAE,CAAC,CACtD,CAAC;QAEF,iCAAiC;QACjC,IAAI,CAAC,UAAU,GAAG,cAAc,CAC9B,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,MAAM,CAAC,OAAO,EACnB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YACd,iBAAiB,CACf,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,MAAM,CAAC,OAAO,EACnB,EAAE,EACF,GAAG,EACH,IAAI,CAAC,QAAQ,EACb,MAAM,CACP,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC,EACD,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,GAAG,CAAC,OAAO,EAAE,CAAC,CACnD,CAAC;QAEF,sCAAsC;QACtC,IAAI,CAAC,kBAAkB,GAAG,mBAAmB,CAC3C,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,MAAM,CAAC,OAAO,EACnB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,CAAC,CAC5D,CAAC;QAEF,qCAAqC;QACrC,IAAI,CAAC,iBAAiB,GAAG,kBAAkB,CACzC,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,MAAM,CAAC,OAAO,EACnB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,CAAC,CAC3D,CAAC;QAEF,kEAAkE;QAClE,oEAAoE;QACpE,MAAM,YAAY,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACnC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACpC,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAE5C,GAAG,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,WAAW,CAAC,QAAqB;QAC/B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,EAAE,CAAC,KAAa,EAAE,OAAuB;QACvC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,cAAc,CAAC,OAA2C;QACxD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,IAAI;QACF,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QACvB,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QACpB,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7B,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;IAC/B,CAAC;CACF"}

package/dist/journal.d.ts

@@ -0,0 +1,13 @@
+export type JournalEntryType = 'run_status' | 'run_event';
+export interface JournalEntry {
+    id: string;
+    type: JournalEntryType;
+    run_id: string;
+    payload: Record<string, unknown>;
+    created_at: string;
+}
+export declare function writeJournal(type: JournalEntryType, run_id: string, payload: Record<string, unknown>): void;
+export declare function readJournal(): JournalEntry[];
+export declare function clearJournal(): void;
+export declare function journalSize(): number;
+//# sourceMappingURL=journal.d.ts.map

package/dist/journal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal.d.ts","sourceRoot":"","sources":["../src/journal.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,WAAW,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,IAAI,CAeN;AAED,wBAAgB,WAAW,IAAI,YAAY,EAAE,CAU5C;AAED,wBAAgB,YAAY,IAAI,IAAI,CAMnC;AAED,wBAAgB,WAAW,IAAI,MAAM,CAEpC"}

package/dist/journal.js

@@ -0,0 +1,47 @@
+import { readFileSync, appendFileSync, mkdirSync, existsSync, unlinkSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+const JOURNAL_PATH = join(homedir(), '.cosmios', 'journal.jsonl');
+export function writeJournal(type, run_id, payload) {
+    const entry = {
+        id: randomUUID(),
+        type,
+        run_id,
+        payload,
+        created_at: new Date().toISOString()
+    };
+    try {
+        mkdirSync(join(homedir(), '.cosmios'), { recursive: true });
+        appendFileSync(JOURNAL_PATH, JSON.stringify(entry) + '\n', 'utf8');
+    }
+    catch {
+        // Journal write failure is non-fatal
+    }
+}
+export function readJournal() {
+    if (!existsSync(JOURNAL_PATH))
+        return [];
+    try {
+        return readFileSync(JOURNAL_PATH, 'utf8')
+            .split('\n')
+            .filter(Boolean)
+            .map(line => JSON.parse(line));
+    }
+    catch {
+        return [];
+    }
+}
+export function clearJournal() {
+    try {
+        if (existsSync(JOURNAL_PATH))
+            unlinkSync(JOURNAL_PATH);
+    }
+    catch {
+        // non-fatal
+    }
+}
+export function journalSize() {
+    return readJournal().length;
+}
+//# sourceMappingURL=journal.js.map

package/dist/journal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal.js","sourceRoot":"","sources":["../src/journal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAiB,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACzG,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;AAYlE,MAAM,UAAU,YAAY,CAC1B,IAAsB,EACtB,MAAc,EACd,OAAgC;IAEhC,MAAM,KAAK,GAAiB;QAC1B,EAAE,EAAE,UAAU,EAAE;QAChB,IAAI;QACJ,MAAM;QACN,OAAO;QACP,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC;IAEF,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,cAAc,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC;aACtC,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,YAAY,CAAC;YAAE,UAAU,CAAC,YAAY,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,WAAW,EAAE,CAAC,MAAM,CAAC;AAC9B,CAAC"}

package/dist/log-sanitizer.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Redact secrets from log lines before they leave the machine.
+ * Patterns cover common API keys, tokens, passwords, and env vars.
+ */
+export declare function sanitizeLogLine(line: string): string;
+//# sourceMappingURL=log-sanitizer.d.ts.map

package/dist/log-sanitizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-sanitizer.d.ts","sourceRoot":"","sources":["../src/log-sanitizer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAyBH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQpD"}

package/dist/log-sanitizer.js

@@ -0,0 +1,36 @@
+/**
+ * Redact secrets from log lines before they leave the machine.
+ * Patterns cover common API keys, tokens, passwords, and env vars.
+ */
+const SECRET_PATTERNS = [
+    // Generic API keys (sk_live_, sk_test_, pk_live_, pk_test_)
+    { pattern: /\b(sk_live_|sk_test_|pk_live_|pk_test_)[A-Za-z0-9]{10,}/g, replacement: '$1[REDACTED]' },
+    // Anthropic API keys
+    { pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}/g, replacement: 'sk-ant-[REDACTED]' },
+    // OpenAI API keys
+    { pattern: /\bsk-[A-Za-z0-9]{20,}/g, replacement: 'sk-[REDACTED]' },
+    // AWS keys
+    { pattern: /\b(AKIA|ASIA)[A-Z0-9]{16}\b/g, replacement: '$1[REDACTED]' },
+    // AWS secret keys (40 char base64-ish)
+    { pattern: /\b[A-Za-z0-9/+=]{40}\b(?=.*(?:aws|secret|key))/gi, replacement: '[REDACTED]' },
+    // Bearer tokens
+    { pattern: /(Bearer\s+)[A-Za-z0-9._\-]{20,}/gi, replacement: '$1[REDACTED]' },
+    // COSMIOS runner keys
+    { pattern: /\brs_live_[a-f0-9]{20,}/g, replacement: 'rs_live_[REDACTED]' },
+    // Generic tokens/secrets in env-like assignments (KEY=value, SECRET=value)
+    { pattern: /\b((?:API_KEY|SECRET|TOKEN|PASSWORD|PRIVATE_KEY|ACCESS_KEY)\s*[=:]\s*)\S{8,}/gi, replacement: '$1[REDACTED]' },
+    // GitHub tokens
+    { pattern: /\b(ghp_|gho_|ghu_|ghs_|ghr_)[A-Za-z0-9]{20,}/g, replacement: '$1[REDACTED]' },
+    // Supabase keys (eyJ... JWT format)
+    { pattern: /\beyJ[A-Za-z0-9_-]{50,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, replacement: '[REDACTED_JWT]' },
+];
+export function sanitizeLogLine(line) {
+    let result = line;
+    for (const { pattern, replacement } of SECRET_PATTERNS) {
+        // Reset lastIndex for global regexes
+        pattern.lastIndex = 0;
+        result = result.replace(pattern, replacement);
+    }
+    return result;
+}
+//# sourceMappingURL=log-sanitizer.js.map

package/dist/log-sanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-sanitizer.js","sourceRoot":"","sources":["../src/log-sanitizer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,eAAe,GAAoD;IACvE,4DAA4D;IAC5D,EAAE,OAAO,EAAE,0DAA0D,EAAE,WAAW,EAAE,cAAc,EAAE;IACpG,qBAAqB;IACrB,EAAE,OAAO,EAAE,8BAA8B,EAAE,WAAW,EAAE,mBAAmB,EAAE;IAC7E,kBAAkB;IAClB,EAAE,OAAO,EAAE,wBAAwB,EAAE,WAAW,EAAE,eAAe,EAAE;IACnE,WAAW;IACX,EAAE,OAAO,EAAE,8BAA8B,EAAE,WAAW,EAAE,cAAc,EAAE;IACxE,uCAAuC;IACvC,EAAE,OAAO,EAAE,kDAAkD,EAAE,WAAW,EAAE,YAAY,EAAE;IAC1F,gBAAgB;IAChB,EAAE,OAAO,EAAE,mCAAmC,EAAE,WAAW,EAAE,cAAc,EAAE;IAC7E,sBAAsB;IACtB,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,oBAAoB,EAAE;IAC1E,2EAA2E;IAC3E,EAAE,OAAO,EAAE,gFAAgF,EAAE,WAAW,EAAE,cAAc,EAAE;IAC1H,gBAAgB;IAChB,EAAE,OAAO,EAAE,+CAA+C,EAAE,WAAW,EAAE,cAAc,EAAE;IACzF,oCAAoC;IACpC,EAAE,OAAO,EAAE,0DAA0D,EAAE,WAAW,EAAE,gBAAgB,EAAE;CACvG,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,eAAe,EAAE,CAAC;QACvD,qCAAqC;QACrC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/logger.d.ts

@@ -0,0 +1,12 @@
+type LogLevel = 'debug' | 'info' | 'warn' | 'error';
+export declare function setLogLevel(level: LogLevel): void;
+export interface Logger {
+    debug(msg: string, extra?: Record<string, unknown>): void;
+    info(msg: string, extra?: Record<string, unknown>): void;
+    warn(msg: string, extra?: Record<string, unknown>): void;
+    error(msg: string, extra?: Record<string, unknown>): void;
+}
+export declare function createLogger(tag: string): Logger;
+export declare const log: Logger;
+export {};
+//# sourceMappingURL=logger.d.ts.map

package/dist/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,KAAK,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAMpD,wBAAgB,WAAW,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAEjD;AAaD,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzD,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzD,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3D;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOhD;AAED,eAAO,MAAM,GAAG,QAA0B,CAAC"}

package/dist/logger.js

@@ -0,0 +1,32 @@
+const LEVEL_RANK = { debug: 0, info: 1, warn: 2, error: 3 };
+let minLevel = 'info';
+export function setLogLevel(level) {
+    minLevel = level;
+}
+function emit(level, tag, message, extra) {
+    if (LEVEL_RANK[level] < LEVEL_RANK[minLevel])
+        return;
+    const prefix = `[${tag}]`;
+    const line = extra ? `${prefix} ${message} ${JSON.stringify(extra)}` : `${prefix} ${message}`;
+    switch (level) {
+        case 'error':
+            console.error(line);
+            break;
+        case 'warn':
+            console.warn(line);
+            break;
+        default:
+            console.log(line);
+            break;
+    }
+}
+export function createLogger(tag) {
+    return {
+        debug: (msg, extra) => emit('debug', tag, msg, extra),
+        info: (msg, extra) => emit('info', tag, msg, extra),
+        warn: (msg, extra) => emit('warn', tag, msg, extra),
+        error: (msg, extra) => emit('error', tag, msg, extra),
+    };
+}
+export const log = createLogger('cosmios');
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAEtF,IAAI,QAAQ,GAAa,MAAM,CAAC;AAEhC,MAAM,UAAU,WAAW,CAAC,KAAe;IACzC,QAAQ,GAAG,KAAK,CAAC;AACnB,CAAC;AAED,SAAS,IAAI,CAAC,KAAe,EAAE,GAAW,EAAE,OAAe,EAAE,KAA+B;IAC1F,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,GAAG,CAAC;IAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;IAC9F,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,OAAO;YAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAC,MAAM;QACzC,KAAK,MAAM;YAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,MAAM;QACxC;YAAc,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAAC,MAAM;IACzC,CAAC;AACH,CAAC;AASD,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC;QACrD,IAAI,EAAG,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC;QACpD,IAAI,EAAG,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC;QACpD,KAAK,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC"}

package/dist/poller.d.ts

@@ -0,0 +1,8 @@
+import type { RunDispatch } from './run-handler.js';
+import type { RunPolicy } from './types.js';
+export interface PendingRunResult {
+    run: RunDispatch;
+    policy: RunPolicy | null;
+}
+export declare function startRunPoller(serverUrl: string, apiKey: string, onDispatch: (run: RunDispatch, policy: RunPolicy | null) => void, onError?: (err: Error) => void): () => void;
+//# sourceMappingURL=poller.d.ts.map

package/dist/poller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"poller.d.ts","sourceRoot":"","sources":["../src/poller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAM5C,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;CAC1B;AA6CD,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,KAAK,IAAI,EAChE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,GAC7B,MAAM,IAAI,CAeZ"}

package/dist/poller.js

@@ -0,0 +1,52 @@
+import { verifyCommandSignature } from '@cosmios/shared';
+import { log } from './logger.js';
+const POLL_INTERVAL_MS = 3_000;
+async function fetchPendingRun(serverUrl, apiKey) {
+    const res = await fetch(`${serverUrl}/api/runs/pending`, {
+        headers: { authorization: `Bearer ${apiKey}` }
+    });
+    if (!res.ok)
+        return null;
+    const body = await res.json().catch(() => null);
+    if (!body?.run)
+        return null;
+    const r = body.run;
+    if (!r.run_id || !r.workspace)
+        return null;
+    // Verify command signature if present (defense-in-depth)
+    if (body.signature) {
+        const valid = verifyCommandSignature({ run_id: r.run_id, workspace: r.workspace, agent: r.agent ?? 'claude-code', command: r.command ?? '' }, body.signature, apiKey);
+        if (!valid) {
+            log.error(`Signature verification failed for run ${r.run_id} — skipping`);
+            return null;
+        }
+    }
+    const policy = body.policy ?? null;
+    return {
+        run: {
+            run_id: r.run_id,
+            workspace: r.workspace,
+            agent: r.agent ?? 'claude-code',
+            command: r.command ?? '',
+            agent_options: body.run.agent_options
+        },
+        policy
+    };
+}
+export function startRunPoller(serverUrl, apiKey, onDispatch, onError) {
+    const interval = setInterval(async () => {
+        try {
+            const result = await fetchPendingRun(serverUrl, apiKey);
+            if (result)
+                onDispatch(result.run, result.policy);
+        }
+        catch (err) {
+            onError?.(err instanceof Error ? err : new Error(String(err)));
+        }
+    }, POLL_INTERVAL_MS);
+    if (typeof interval === 'object' && 'unref' in interval) {
+        interval.unref();
+    }
+    return () => clearInterval(interval);
+}
+//# sourceMappingURL=poller.js.map

package/dist/poller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"poller.js","sourceRoot":"","sources":["../src/poller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAO/B,KAAK,UAAU,eAAe,CAC5B,SAAiB,EACjB,MAAc;IAEd,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,mBAAmB,EAAE;QACvD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;KAC/C,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,GAAG;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,CAAC,GAAG,IAAI,CAAC,GAA6B,CAAC;IAC7C,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE3C,yDAAyD;IACzD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,sBAAsB,CAClC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,EACvG,IAAI,CAAC,SAAmB,EACxB,MAAM,CACP,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAA0B,IAAI,IAAI,CAAC;IAEvD,OAAO;QACL,GAAG,EAAE;YACH,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,aAAa;YAC/B,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;YACxB,aAAa,EAAG,IAAI,CAAC,GAA+B,CAAC,aAAoD;SAC1G;QACD,MAAM;KACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,MAAc,EACd,UAAgE,EAChE,OAA8B;IAE9B,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACxD,IAAI,MAAM;gBAAE,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAErB,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACvD,QAA2B,CAAC,KAAK,EAAE,CAAC;IACvC,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC"}

package/dist/preview-poller.d.ts

@@ -0,0 +1,3 @@
+export declare function stopAllPreviews(): void;
+export declare function startPreviewPoller(serverUrl: string, apiKey: string, onError?: (err: Error) => void): () => void;
+//# sourceMappingURL=preview-poller.d.ts.map

package/dist/preview-poller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview-poller.d.ts","sourceRoot":"","sources":["../src/preview-poller.ts"],"names":[],"mappings":"AA2gBA,wBAAgB,eAAe,IAAI,IAAI,CAMtC;AAED,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,GAC7B,MAAM,IAAI,CA+BZ"}