dodo-mcp 1.0.0

package/dist/ipc/server.js

@@ -0,0 +1,108 @@
+import net from 'node:net';
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { ensurePrivateDirectory } from '../platform/privateFs.js';
+import { IPC_FRAME_BYTES, newIpcCredential, publishIpcCredential, removeIpcCredential, ipcMac, validMac } from './authentication.js';
+/** Authenticated one-shot IPC on Unix sockets / Windows named pipes. The
+ * token is never sent over the wire; both peers prove possession using fresh
+ * challenges, and request/response bodies are authenticated and bounded. */
+export async function startIpcServer(socketPath, handler, options = {}) {
+    ensurePrivateDirectory(path.dirname(socketPath));
+    const credential = newIpcCredential(socketPath, options.stableWindowsEndpoint === undefined ? {} : { stableWindowsEndpoint: options.stableWindowsEndpoint });
+    if (process.platform !== 'win32' && fs.existsSync(socketPath)) {
+        const stat = fs.lstatSync(socketPath);
+        if (!stat.isSocket() || stat.isSymbolicLink() || stat.uid !== process.getuid?.())
+            throw new Error('refusing unexpected IPC path');
+        if (options.replaceExisting === false)
+            throw new Error('authenticated IPC listener already exists');
+        // Preserve the legacy root alias: older clients retain their independent
+        // instance socket, while the newest local client owns this root alias.
+        fs.unlinkSync(socketPath);
+    }
+    const connections = new Set();
+    const server = net.createServer(conn => {
+        if (connections.size >= 64) {
+            conn.destroy();
+            return;
+        }
+        connections.add(conn);
+        let buffer = '', phase = 'hello';
+        let clientNonce = '', serverNonce = '';
+        conn.setEncoding('utf8');
+        conn.setTimeout(10000, () => conn.destroy());
+        conn.on('error', () => conn.destroy());
+        conn.on('close', () => connections.delete(conn));
+        conn.on('data', (chunk) => {
+            buffer += chunk;
+            if (Buffer.byteLength(buffer, 'utf8') > IPC_FRAME_BYTES) {
+                conn.destroy();
+                return;
+            }
+            const index = buffer.indexOf('\n');
+            if (index === -1)
+                return;
+            const line = buffer.slice(0, index);
+            buffer = buffer.slice(index + 1);
+            if (buffer.length || phase === 'done') {
+                conn.destroy();
+                return;
+            }
+            try {
+                const frame = JSON.parse(line);
+                if (phase === 'hello') {
+                    if (frame['version'] !== 1 || typeof frame['nonce'] !== 'string' || !/^[a-f0-9]{64}$/.test(frame['nonce']))
+                        throw new Error('bad hello');
+                    clientNonce = frame['nonce'];
+                    serverNonce = randomBytes(32).toString('hex');
+                    phase = 'request';
+                    conn.write(JSON.stringify({ version: 1, nonce: serverNonce, mac: ipcMac(credential.token, 'hello', clientNonce, serverNonce) }) + '\n');
+                    return;
+                }
+                phase = 'done'; // one-use even if parsing/dispatch fails
+                const payload = frame['payload'];
+                if (typeof payload !== 'string' || !validMac(frame['mac'], ipcMac(credential.token, 'request', clientNonce, serverNonce, payload)))
+                    throw new Error('bad request authentication');
+                const req = JSON.parse(payload);
+                if (!req || !Number.isSafeInteger(req.id) || typeof req.cmd !== 'string' || req.cmd.length > 100 || (req.args !== undefined && (!req.args || typeof req.args !== 'object' || Array.isArray(req.args))))
+                    throw new Error('invalid IPC request');
+                void (async () => {
+                    let response;
+                    try {
+                        response = { id: req.id, ok: true, data: await handler(req.cmd, req.args ?? {}) };
+                    }
+                    catch (error) {
+                        response = { id: req.id, ok: false, error: error instanceof Error ? error.message : 'owner request failed' };
+                    }
+                    const text = JSON.stringify(response);
+                    const wire = JSON.stringify({ payload: text, mac: ipcMac(credential.token, 'response', clientNonce, serverNonce, text) }) + '\n';
+                    if (Buffer.byteLength(wire, 'utf8') > IPC_FRAME_BYTES)
+                        conn.destroy();
+                    else
+                        conn.end(wire);
+                })().catch(() => conn.destroy());
+            }
+            catch {
+                conn.destroy();
+            }
+        });
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(credential.endpoint, () => { server.removeListener('error', reject); resolve(); });
+    });
+    try {
+        if (process.platform !== 'win32')
+            fs.chmodSync(socketPath, 0o600);
+        publishIpcCredential(socketPath, credential);
+    }
+    catch (error) {
+        server.close();
+        for (const conn of connections)
+            conn.destroy();
+        throw error;
+    }
+    server.on('close', () => removeIpcCredential(socketPath, credential));
+    return server;
+}
+//# sourceMappingURL=server.js.map

package/dist/ipc/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/ipc/server.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAIrI;;4EAE4E;AAC5E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB,EAAE,OAAmB,EAAE,UAA0E,EAAE;IACxJ,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC7J,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClI,IAAI,OAAO,CAAC,eAAe,KAAK,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACpG,yEAAyE;QACzE,uEAAuE;QACvE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAc,CAAC;IAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE;QACrC,IAAI,WAAW,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QACvD,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,MAAM,GAAG,EAAE,EAAE,KAAK,GAAiC,OAAO,CAAC;QAC/D,IAAI,WAAW,GAAG,EAAE,EAAE,WAAW,GAAG,EAAE,CAAC;QACvC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAChC,MAAM,IAAI,KAAK,CAAC;YAChB,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,eAAe,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YACpF,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,KAAK,KAAK,CAAC,CAAC;gBAAE,OAAO;YACzB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACpC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACjC,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YAClE,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;gBAC1D,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;oBACtB,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;oBACzI,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;oBAAC,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;oBAAC,KAAK,GAAG,SAAS,CAAC;oBAC/F,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;oBACxI,OAAO;gBACT,CAAC;gBACD,KAAK,GAAG,MAAM,CAAC,CAAC,yCAAyC;gBACzD,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;gBACjC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBAClL,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAe,CAAC;gBAC9C,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBAC/O,KAAK,CAAC,KAAK,IAAI,EAAE;oBACf,IAAI,QAAqB,CAAC;oBAC1B,IAAI,CAAC;wBAAC,QAAQ,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;oBAAC,CAAC;oBAC1F,OAAO,KAAK,EAAE,CAAC;wBAAC,QAAQ,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC;oBAAC,CAAC;oBAC/H,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;oBACtC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;oBACjI,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,eAAe;wBAAE,IAAI,CAAC,OAAO,EAAE,CAAC;;wBACjE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACtB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAClE,oBAAoB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAAC,KAAK,MAAM,IAAI,IAAI,WAAW;YAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;IAChG,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/platform/execResolve.js

@@ -0,0 +1,64 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { DodoError } from '../errors.js';
+import { buildChildEnv } from '../security/env.js';
+import { isWithinPath } from './pathPolicy.js';
+export function executableNames(name, pathext, platform = process.platform, allowBatch = true) {
+    if (!name || /[\\/:\u0000-\u001f]/u.test(name))
+        throw new DodoError('INVALID_INPUT', 'expected a bare executable name');
+    if (platform !== 'win32')
+        return [name];
+    const allowed = allowBatch ? ['.EXE', '.COM', '.CMD', '.BAT'] : ['.EXE', '.COM'];
+    const ext = path.win32.extname(name).toUpperCase();
+    if (ext)
+        return allowed.includes(ext) ? [name] : [];
+    const extensions = (pathext ?? '.COM;.EXE;.BAT;.CMD').split(';').map(e => e.toUpperCase()).filter(e => allowed.includes(e));
+    return [...new Set(extensions.length ? extensions : allowed)].map(e => name + e);
+}
+/** A repository may never supply an implicit helper (git, rg, node, LSP...). */
+export function trustedExecutable(abs, workspaceRoot, allowBatch = true) {
+    try {
+        if (!path.isAbsolute(abs) || isWithinPath(workspaceRoot, abs))
+            return undefined;
+        const real = fs.realpathSync.native(abs);
+        if (isWithinPath(fs.realpathSync.native(workspaceRoot), real))
+            return undefined;
+        const st = fs.statSync(real);
+        if (!st.isFile())
+            return undefined;
+        if (process.platform === 'win32') {
+            if (!/\.(?:exe|com)$/i.test(real) && !(allowBatch && /\.(?:cmd|bat)$/i.test(real)))
+                return undefined;
+        }
+        else if ((st.mode & 0o111) === 0)
+            return undefined;
+        return real;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function resolveTrustedExecutable(name, workspaceRoot, opts = {}) {
+    const allowBatch = opts.allowBatch ?? true;
+    if (opts.allowAbsolute && path.isAbsolute(name)) {
+        const resolved = trustedExecutable(name, workspaceRoot, allowBatch);
+        if (resolved)
+            return resolved;
+        throw new DodoError('PATH_DENIED', 'executable must be a supported regular file outside the workspace');
+    }
+    const env = buildChildEnv({ parentEnv: opts.env ?? process.env, workspaceRoot, extraAllowlist: [] });
+    const names = executableNames(name, env['PATHEXT'], process.platform, allowBatch);
+    for (const directory of (env['PATH'] ?? '').split(path.delimiter)) {
+        if (!directory || !path.isAbsolute(directory))
+            continue;
+        for (const candidate of names) {
+            const resolved = trustedExecutable(path.join(directory, candidate), workspaceRoot, allowBatch);
+            if (resolved)
+                return resolved;
+        }
+    }
+    throw new DodoError('NOT_FOUND', `program not found on trusted PATH: ${name}`, {
+        recovery: 'Install outside the workspace and add the directory to PATH. Windows LSP batch shims are refused; register node.exe with the server JavaScript path instead.',
+    });
+}
+//# sourceMappingURL=execResolve.js.map

package/dist/platform/execResolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execResolve.js","sourceRoot":"","sources":["../../src/platform/execResolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,OAA2B,EAAE,WAA4B,OAAO,CAAC,QAAQ,EAAE,UAAU,GAAG,IAAI;IACxI,IAAI,CAAC,IAAI,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,iCAAiC,CAAC,CAAC;IACxH,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,GAAG;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,UAAU,GAAG,CAAC,OAAO,IAAI,qBAAqB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,aAAqB,EAAE,UAAU,GAAG,IAAI;IACrF,IAAI,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAChF,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,YAAY,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAChF,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,OAAO,SAAS,CAAC;QACnC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;QACvG,CAAC;aAAM,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,aAAqB,EAAE,OAAmF,EAAE;IACjK,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;IAC3C,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;QACpE,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,mEAAmE,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;IACrG,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAClF,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS;QACxD,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;YAC/F,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;QAChC,CAAC;IACH,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,sCAAsC,IAAI,EAAE,EAAE;QAC7E,QAAQ,EAAE,8JAA8J;KACzK,CAAC,CAAC;AACL,CAAC"}

package/dist/platform/fileIdentity.js

@@ -0,0 +1,26 @@
+import { DodoError } from '../errors.js';
+const MAX_SAFE = BigInt(Number.MAX_SAFE_INTEGER);
+const MAX_U64 = (1n << 64n) - 1n;
+export function encodeFileIdentity(value) {
+    if (value < 0n || value > MAX_U64)
+        throw new DodoError('NOT_SUPPORTED', 'filesystem identity is outside the unsigned 64-bit range');
+    return value <= MAX_SAFE ? Number(value) : `u64:${value}`;
+}
+export function parseFileIdentity(value) {
+    if (typeof value === 'number' && Number.isSafeInteger(value) && value >= 0)
+        return value;
+    if (typeof value !== 'string' || !/^u64:[1-9][0-9]{0,19}$/.test(value))
+        return undefined;
+    const integer = BigInt(value.slice(4));
+    return integer > MAX_SAFE && integer <= MAX_U64 ? value : undefined;
+}
+export function requireFileIdentity(value) {
+    const identity = parseFileIdentity(value);
+    if (identity === undefined)
+        throw new DodoError('INTERNAL_ERROR', 'stored filesystem identity is invalid; owner review required');
+    return identity;
+}
+export function fileIdentityBigInt(value) {
+    return typeof value === 'number' ? BigInt(value) : BigInt(value.slice(4));
+}
+//# sourceMappingURL=fileIdentity.js.map

package/dist/platform/fileIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileIdentity.js","sourceRoot":"","sources":["../../src/platform/fileIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAKzC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AACjD,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;AAEjC,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,OAAO;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,0DAA0D,CAAC,CAAC;IACpI,OAAO,KAAK,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACzF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzF,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,OAAO,GAAG,QAAQ,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,KAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,8DAA8D,CAAC,CAAC;IAClI,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAmB;IACpD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC"}

package/dist/platform/fsRetry.js

@@ -0,0 +1,22 @@
+import fs from 'node:fs';
+/** Retry transient Windows sharing locks, never delete a destination or clear
+ * a read-only attribute to force an overwrite. Total delay is bounded. */
+export function retryWindowsFs(operation, platform = process.platform) {
+    const pauses = [10, 25, 50, 100];
+    for (let attempt = 0;; attempt++) {
+        try {
+            return operation();
+        }
+        catch (error) {
+            const code = error.code;
+            if (platform !== 'win32' || !['EPERM', 'EBUSY', 'EACCES'].includes(code ?? '') || attempt >= pauses.length)
+                throw error;
+            Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, pauses[attempt]);
+        }
+    }
+}
+export function renameWithRetry(source, destination) { retryWindowsFs(() => fs.renameSync(source, destination)); }
+export function removeWithRetry(target, recursive = false) {
+    retryWindowsFs(() => fs.rmSync(target, { recursive, force: true, maxRetries: process.platform === 'win32' ? 3 : 0, retryDelay: 40 }));
+}
+//# sourceMappingURL=fsRetry.js.map

package/dist/platform/fsRetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fsRetry.js","sourceRoot":"","sources":["../../src/platform/fsRetry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB;0EAC0E;AAC1E,MAAM,UAAU,cAAc,CAAI,SAAkB,EAAE,WAA4B,OAAO,CAAC,QAAQ;IAChG,MAAM,MAAM,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IACjC,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;QAAC,CAAC;QAC3B,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;YACnD,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM;gBAAE,MAAM,KAAK,CAAC;YACxH,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,OAAO,CAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;AACH,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,WAAmB,IAAU,cAAc,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;AACxI,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,SAAS,GAAG,KAAK;IAC/D,cAAc,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACxI,CAAC"}

package/dist/platform/pathPolicy.js

@@ -0,0 +1,29 @@
+import path from 'node:path';
+import { DodoError } from '../errors.js';
+/** Segment-aware containment, including drive/case semantics on Windows. */
+export function isWithinPath(root, target, platform = process.platform) {
+    const p = platform === 'win32' ? path.win32 : path.posix;
+    const rel = p.relative(p.resolve(root), p.resolve(target));
+    return rel === '' || (rel !== '..' && !rel.startsWith(`..${p.sep}`) && !p.isAbsolute(rel));
+}
+/** Reject ambiguous Win32/NTFS spellings before a filesystem call. */
+export function assertWindowsSegment(segment) {
+    if (/[<>:"|?*\u0000-\u001f]/u.test(segment) || /[ .]$/u.test(segment)) {
+        throw new DodoError('PATH_DENIED', 'Windows paths cannot contain ADS, control characters, wildcards, or trailing dots/spaces');
+    }
+    if (/^(?:con|prn|aux|nul|clock\$|conin\$|conout\$|com[1-9¹²³]|lpt[1-9¹²³])(?:[ .]|$)/iu.test(segment)) {
+        throw new DodoError('PATH_DENIED', 'Windows device names are not workspace files');
+    }
+    // Canonical resolution is still required: not all aliases contain a tilde.
+    if (/~[0-9]+(?:\.|$)/u.test(segment)) {
+        throw new DodoError('PATH_DENIED', 'Windows short-name aliases are refused; use the original long filename');
+    }
+}
+export function assertLocalWindowsRoot(root) {
+    if (!/^[a-z]:[\\/]/i.test(root) || root.startsWith('\\\\')) {
+        throw new DodoError('PATH_DENIED', 'Windows native workspaces require a local drive path; UNC and device namespaces are not supported');
+    }
+    for (const segment of root.slice(3).split(/[\\/]/u).filter(Boolean))
+        assertWindowsSegment(segment);
+}
+//# sourceMappingURL=pathPolicy.js.map

package/dist/platform/pathPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathPolicy.js","sourceRoot":"","sources":["../../src/platform/pathPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAc,EAAE,WAA4B,OAAO,CAAC,QAAQ;IACrG,MAAM,CAAC,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;IACzD,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,0FAA0F,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,mFAAmF,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtG,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,8CAA8C,CAAC,CAAC;IACrF,CAAC;IACD,2EAA2E;IAC3E,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,wEAAwE,CAAC,CAAC;IAC/G,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,mGAAmG,CAAC,CAAC;IAC1I,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC;AACrG,CAAC"}

package/dist/platform/privateFs.js

@@ -0,0 +1,116 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { DodoError } from '../errors.js';
+import { envValue, windowsSystemExecutable } from './system.js';
+// Constant PowerShell/.NET code: the path is data in the child's environment,
+// never interpolated into source. Only the current SID, SYSTEM and local
+// administrators may access state. A failed/unsupported ACL is a hard error.
+const ACL_SCRIPT = String.raw `
+$ErrorActionPreference = 'Stop'
+$p = $env:DODO_PRIVATE_PATH
+$item = Get-Item -LiteralPath $p -Force
+if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'reparse point' }
+$currentIdentity = [Security.Principal.WindowsIdentity]::GetCurrent()
+$sid = $currentIdentity.User
+$administratorsSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-32-544')
+$principal = [Security.Principal.WindowsPrincipal]::new($currentIdentity)
+$allowed = @($sid.Value, 'S-1-5-18', $administratorsSid.Value)
+
+function Assert-PrivateDacl($candidate) {
+  $rules = $candidate.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])
+  $ownerAllowed = $false
+  foreach ($rule in $rules) {
+    if ($rule.AccessControlType -eq 'Allow') {
+      if ($allowed -notcontains $rule.IdentityReference.Value) { throw 'non-private DACL' }
+      if ($rule.IdentityReference.Value -eq $sid.Value) { $ownerAllowed = $true }
+    }
+  }
+  if (-not $ownerAllowed) { throw 'owner access missing' }
+}
+
+$acl = Get-Acl -LiteralPath $p
+$owner = $acl.GetOwner([Security.Principal.SecurityIdentifier]).Value
+# An enabled Administrators token may normalize Windows' default group owner.
+# IsInRole checks the effective token; a UAC deny-only group does not qualify.
+$repairAdminOwner = ($owner -eq $administratorsSid.Value) -and $principal.IsInRole($administratorsSid)
+if ($owner -ne $sid.Value -and -not $repairAdminOwner) { throw 'unexpected owner' }
+if ($env:DODO_PRIVATE_MODE -eq 'protect') {
+  if (-not $item.PSIsContainer) { throw 'expected directory' }
+  $acl = New-Object Security.AccessControl.DirectorySecurity
+  $acl.SetOwner($sid)
+  $acl.SetAccessRuleProtection($true, $false)
+  foreach ($id in $allowed) {
+    $identity = New-Object Security.Principal.SecurityIdentifier($id)
+    $rule = New-Object Security.AccessControl.FileSystemAccessRule($identity, 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow')
+    $acl.AddAccessRule($rule)
+  }
+  Set-Acl -LiteralPath $p -AclObject $acl
+} elseif ($env:DODO_PRIVATE_MODE -eq 'verify') {
+  # Verify may repair ONLY the admitted group owner, never a permissive DACL.
+  # New files (notably IPC descriptors) can receive that default owner too.
+  Assert-PrivateDacl $acl
+  if ($repairAdminOwner) {
+    $beforeDacl = $acl.GetSecurityDescriptorSddlForm([Security.AccessControl.AccessControlSections]::Access)
+    $acl.SetOwner($sid)
+    Set-Acl -LiteralPath $p -AclObject $acl
+    $acl = Get-Acl -LiteralPath $p
+    if ($acl.GetSecurityDescriptorSddlForm([Security.AccessControl.AccessControlSections]::Access) -ne $beforeDacl) { throw 'DACL changed during owner repair' }
+  }
+} else { throw 'invalid private ACL mode' }
+# Do not trust Set-Acl succeeding: re-read the object and enforce the final
+# user-SID owner and the same private DACL in BOTH modes, after any repair.
+$item = Get-Item -LiteralPath $p -Force
+if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'reparse point' }
+$acl = Get-Acl -LiteralPath $p
+if ($acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -ne $sid.Value) { throw 'unexpected owner after ACL operation' }
+Assert-PrivateDacl $acl
+[Console]::Write('private')
+`;
+function windowsAcl(target, protect) {
+    const env = {
+        SYSTEMROOT: envValue(process.env, 'SystemRoot'),
+        WINDIR: envValue(process.env, 'windir'),
+        USERPROFILE: envValue(process.env, 'USERPROFILE'),
+        TEMP: envValue(process.env, 'TEMP'),
+        TMP: envValue(process.env, 'TMP'),
+        DODO_PRIVATE_PATH: target,
+        DODO_PRIVATE_MODE: protect ? 'protect' : 'verify',
+    };
+    try {
+        const output = execFileSync(windowsSystemExecutable('WindowsPowerShell/v1.0/powershell.exe'), ['-NoLogo', '-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(ACL_SCRIPT, 'utf16le').toString('base64')], { env, shell: false, windowsHide: true, timeout: 10000, maxBuffer: 4096, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+        if (output.trim() !== 'private')
+            throw new Error('ACL not verified');
+    }
+    catch {
+        throw new DodoError('PATH_DENIED', 'private Windows state ACL could not be established or verified; use a local NTFS directory owned by your user');
+    }
+}
+export function ensurePrivateDirectory(directory) {
+    if (!path.isAbsolute(directory) || directory === path.parse(directory).root)
+        throw new DodoError('PATH_DENIED', 'private state must use a dedicated absolute directory');
+    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const stat = fs.lstatSync(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw new DodoError('PATH_DENIED', 'private state directory must not be a link');
+    if (process.platform === 'win32')
+        windowsAcl(directory, true);
+    else {
+        if (stat.uid !== process.getuid?.())
+            throw new DodoError('PATH_DENIED', 'private state directory has a different owner');
+        fs.chmodSync(directory, 0o700);
+    }
+}
+/** Verify private access; on Windows, normalize an Administrators default owner
+ * only for an enabled admin token and an already-private DACL. Never widen ACLs. */
+export function assertPrivatePath(target, directory = false) {
+    const stat = fs.lstatSync(target);
+    if (stat.isSymbolicLink() || (directory ? !stat.isDirectory() : !stat.isFile() || stat.nlink !== 1))
+        throw new DodoError('PATH_DENIED', 'refusing non-private or unexpected IPC path');
+    if (process.platform === 'win32')
+        windowsAcl(target, false);
+    else if (stat.uid !== process.getuid?.() || (stat.mode & 0o077) !== 0)
+        throw new DodoError('PATH_DENIED', 'refusing non-private or unexpected IPC path');
+    return stat;
+}
+//# sourceMappingURL=privateFs.js.map

package/dist/platform/privateFs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privateFs.js","sourceRoot":"","sources":["../../src/platform/privateFs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEhE,8EAA8E;AAC9E,yEAAyE;AACzE,6EAA6E;AAC7E,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4D5B,CAAC;AAEF,SAAS,UAAU,CAAC,MAAc,EAAE,OAAgB;IAClD,MAAM,GAAG,GAAsB;QAC7B,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC;QAC/C,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC;QACvC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC;QACjD,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC;QACnC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;QACjC,iBAAiB,EAAE,MAAM;QACzB,iBAAiB,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;KAClD,CAAC;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,uBAAuB,CAAC,uCAAuC,CAAC,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACtV,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,+GAA+G,CAAC,CAAC;IACtJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,SAAS,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,uDAAuD,CAAC,CAAC;IACzK,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,4CAA4C,CAAC,CAAC;IACnI,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;SACzD,CAAC;QACJ,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,+CAA+C,CAAC,CAAC;QACzH,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED;oFACoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,SAAS,GAAG,KAAK;IACjE,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,6CAA6C,CAAC,CAAC;IACvL,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;SACvD,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,6CAA6C,CAAC,CAAC;IACzJ,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/platform/processTree.js

@@ -0,0 +1,31 @@
+import { execFileSync } from 'node:child_process';
+import { DodoError } from '../errors.js';
+import { windowsSystemExecutable } from './system.js';
+/** Only accepts a live owned ChildProcess, never a saved PID. Windows v1 is
+ * hard-kill only; Job Objects/escaped-descendant confinement are not claimed. */
+export function signalOwnedProcess(child, signal, processGroup = false) {
+    if (!child.pid || child.exitCode !== null || child.signalCode !== null)
+        return;
+    if (process.platform === 'win32') {
+        try {
+            execFileSync(windowsSystemExecutable('taskkill.exe'), ['/PID', String(child.pid), '/T', '/F'], { shell: false, windowsHide: true, timeout: 5000, stdio: 'ignore' });
+        }
+        catch {
+            throw new DodoError('INTERNAL_ERROR', 'Windows owned-process tree termination failed; termination was not confirmed');
+        }
+        return;
+    }
+    try {
+        if (processGroup)
+            process.kill(-child.pid, signal);
+        else
+            child.kill(signal);
+    }
+    catch {
+        try {
+            child.kill(signal);
+        }
+        catch { /* already closed */ }
+    }
+}
+//# sourceMappingURL=processTree.js.map

package/dist/platform/processTree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"processTree.js","sourceRoot":"","sources":["../../src/platform/processTree.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAqB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEtD;iFACiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,KAAmB,EAAE,MAAsB,EAAE,YAAY,GAAG,KAAK;IAClG,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO;IAC/E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,YAAY,CAAC,uBAAuB,CAAC,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtK,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,8EAA8E,CAAC,CAAC;QAAC,CAAC;QAClI,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,IAAI,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;;YAC9C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QAAC,IAAI,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAAC,CAAC;AACxE,CAAC"}

package/dist/platform/shell.js

@@ -0,0 +1,74 @@
+import path from 'node:path';
+import { DodoError } from '../errors.js';
+import { resolveTrustedExecutable, trustedExecutable } from './execResolve.js';
+import { envValue, windowsSystemExecutable } from './system.js';
+export function shellSpec(workspaceRoot) {
+    if (process.platform !== 'win32') {
+        for (const file of ['/bin/bash', '/usr/bin/bash', '/bin/sh']) {
+            const executable = trustedExecutable(file, workspaceRoot, false);
+            if (executable)
+                return { kind: 'posix', executable, extension: '.sh' };
+        }
+        throw new DodoError('NOT_FOUND', 'no trusted POSIX shell found');
+    }
+    const candidates = [];
+    try {
+        const git = resolveTrustedExecutable('git', workspaceRoot, { allowBatch: false });
+        for (const parent of [path.dirname(git), path.resolve(path.dirname(git), '..'), path.resolve(path.dirname(git), '../..')])
+            candidates.push(path.join(parent, 'bin', 'bash.exe'), path.join(parent, 'usr', 'bin', 'bash.exe'));
+    }
+    catch { /* cmd is the fallback when Git for Windows is absent. */ }
+    for (const key of ['ProgramFiles', 'ProgramFiles(x86)']) {
+        const base = envValue(process.env, key);
+        if (base)
+            candidates.push(path.join(base, 'Git', 'bin', 'bash.exe'));
+    }
+    for (const file of candidates) {
+        const executable = trustedExecutable(file, workspaceRoot, false);
+        if (executable)
+            return { kind: 'posix', executable, extension: '.sh' };
+    }
+    const executable = trustedExecutable(windowsSystemExecutable('cmd.exe'), workspaceRoot, false);
+    if (!executable)
+        throw new DodoError('NOT_SUPPORTED', 'trusted Windows cmd.exe is unavailable');
+    return { kind: 'cmd', executable, extension: '.cmd' };
+}
+/** Strict batch argv, not an escaping promise for arbitrary cmd.exe input. */
+export function quoteBatchArgument(argument) {
+    if (/[\u0000-\u001f%!"&|<>^()]/u.test(argument))
+        throw new DodoError('INVALID_INPUT', 'Windows batch arguments cannot contain control characters, %, !, quotes, or shell metacharacters; use a native executable or saved script');
+    return `"${argument}"`;
+}
+export function batchInvocation(program, args, workspaceRoot) {
+    const command = `"${[program, ...args].map(quoteBatchArgument).join(' ')}"`;
+    if (command.length > 8000)
+        throw new DodoError('RESOURCE_LIMIT', 'Windows batch command exceeds the cmd.exe budget; pass short file paths');
+    const executable = trustedExecutable(windowsSystemExecutable('cmd.exe'), workspaceRoot, false);
+    if (!executable)
+        throw new DodoError('NOT_SUPPORTED', 'trusted Windows cmd.exe is unavailable');
+    return { program: executable, args: ['/d', '/s', '/v:off', '/c', command], windowsVerbatimArguments: true };
+}
+export function shellInvocation(spec, command, scriptPath) {
+    if (spec.kind === 'posix')
+        return { program: spec.executable, args: scriptPath ? ['--', process.platform === 'win32' ? scriptPath.replace(/\\/g, '/') : scriptPath] : ['-c', command], windowsVerbatimArguments: false };
+    if (command.split(/\r?\n/u).some(line => line.length > 8000))
+        throw new DodoError('RESOURCE_LIMIT', 'a cmd.exe script line exceeds 8000 characters; install Git for Windows or use separate source files');
+    const source = scriptPath ? quoteBatchArgument(scriptPath) : command;
+    return { program: spec.executable, args: ['/d', '/s', '/v:off', '/c', `"${source}"`], windowsVerbatimArguments: true };
+}
+/** libuv-style quoting length counted in UTF-16 units including the final NUL. */
+export function windowsCommandLineLength(program, args, verbatim = false) {
+    const quote = (value) => {
+        if (value !== '' && !/[\s"]/u.test(value))
+            return value;
+        return '"' + value.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/g, '$1$1') + '"';
+    };
+    return quote(program).length + 1 + args.map(a => verbatim ? a : quote(a)).join(' ').length + 1;
+}
+export function assertWindowsArgv(program, args, verbatim = false) {
+    if ([program, ...args].some(a => a.includes('\0')))
+        throw new DodoError('INVALID_INPUT', 'native argv contains NUL');
+    if (windowsCommandLineLength(program, args, verbatim) > 32767)
+        throw new DodoError('RESOURCE_LIMIT', 'Windows native command line exceeds 32767 UTF-16 units; save source/data to files and pass short paths');
+}
+//# sourceMappingURL=shell.js.map

package/dist/platform/shell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../src/platform/shell.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAKhE,MAAM,UAAU,SAAS,CAAC,aAAqB;IAC7C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,eAAe,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7D,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;YACjE,IAAI,UAAU;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACzE,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,wBAAwB,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,KAAK,MAAM,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IAChO,CAAC;IAAC,MAAM,CAAC,CAAC,yDAAyD,CAAC,CAAC;IACrE,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,mBAAmB,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QACjE,IAAI,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACzE,CAAC;IACD,MAAM,UAAU,GAAG,iBAAiB,CAAC,uBAAuB,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;IAC/F,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,wCAAwC,CAAC,CAAC;IAChG,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,2IAA2I,CAAC,CAAC;IACnO,OAAO,IAAI,QAAQ,GAAG,CAAC;AACzB,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,IAAc,EAAE,aAAqB;IACpF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC5E,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,yEAAyE,CAAC,CAAC;IAC5I,MAAM,UAAU,GAAG,iBAAiB,CAAC,uBAAuB,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;IAC/F,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,wCAAwC,CAAC,CAAC;IAChG,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;AAC9G,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,IAAe,EAAE,OAAe,EAAE,UAAmB;IACnF,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;IACzN,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,qGAAqG,CAAC,CAAC;IAC3M,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACrE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,MAAM,GAAG,CAAC,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;AACzH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,IAAc,EAAE,QAAQ,GAAG,KAAK;IACxF,MAAM,KAAK,GAAG,CAAC,KAAa,EAAU,EAAE;QACtC,IAAI,KAAK,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACxD,OAAO,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC;IACpF,CAAC,CAAC;IACF,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACjG,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,IAAc,EAAE,QAAQ,GAAG,KAAK;IACjF,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;IACrH,IAAI,wBAAwB,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,wGAAwG,CAAC,CAAC;AACjN,CAAC"}

package/dist/platform/speech.js

@@ -0,0 +1,94 @@
+import fs from 'node:fs';
+import { spawn, spawnSync } from 'node:child_process';
+import { DodoError } from '../errors.js';
+import { resolveTrustedExecutable } from './execResolve.js';
+import { windowsSystemExecutable } from './system.js';
+import { signalOwnedProcess } from './processTree.js';
+/** Constant code: paths/voice are JSON on stdin, never interpolated PowerShell or SSML. */
+export const WINDOWS_SPEECH_SCRIPT = String.raw `
+$ErrorActionPreference = 'Stop'
+[Console]::InputEncoding = [Text.UTF8Encoding]::new($false)
+[Console]::OutputEncoding = [Text.UTF8Encoding]::new($false)
+Add-Type -AssemblyName System.Speech
+$s = [System.Speech.Synthesis.SpeechSynthesizer]::new()
+try {
+  $request = [Console]::In.ReadToEnd() | ConvertFrom-Json
+  $voices = @($s.GetInstalledVoices() | Where-Object { $_.Enabled })
+  if ($voices.Count -eq 0) { throw 'no installed speech voice' }
+  if ($request.mode -eq 'probe') { [Console]::Write('ready'); exit 0 }
+  if ($request.mode -ne 'speak') { throw 'invalid speech mode' }
+  if ($request.voice) { $s.SelectVoice([string]$request.voice) }
+  $text = [IO.File]::ReadAllText([string]$request.input, [Text.Encoding]::UTF8)
+  if ($text.Length -gt 8000) { throw 'speech input too large' }
+  if ([IO.File]::Exists([string]$request.output)) { throw 'speech output already exists' }
+  $s.SetOutputToWaveFile([string]$request.output)
+  $s.Speak($text)
+  $s.SetOutputToNull()
+  [Console]::Write('completed')
+} finally { $s.Dispose() }
+`;
+export const windowsSpeechArgs = () => ['-NoLogo', '-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(WINDOWS_SPEECH_SCRIPT, 'utf16le').toString('base64')];
+/** Availability is actually probed on Windows (a PowerShell binary alone is not a voice). */
+export function findSpeechEngine(root) {
+    if (process.platform === 'darwin') {
+        try {
+            return { kind: 'macos-say', program: resolveTrustedExecutable('say', root, { allowBatch: false }) };
+        }
+        catch { /* try portable engine */ }
+    }
+    if (process.platform === 'win32') {
+        try {
+            const program = windowsSystemExecutable('WindowsPowerShell/v1.0/powershell.exe');
+            const probe = spawnSync(program, windowsSpeechArgs(), { shell: false, windowsHide: true, input: JSON.stringify({ mode: 'probe' }), encoding: 'utf8', timeout: 10000, maxBuffer: 16384 });
+            if (!probe.error && probe.status === 0 && probe.stdout.trim() === 'ready')
+                return { kind: 'windows-sapi', program };
+        }
+        catch { /* an absent voice needs eSpeak, not an invented capability */ }
+    }
+    try {
+        const program = resolveTrustedExecutable('espeak-ng', root, { allowBatch: false });
+        const probe = spawnSync(program, ['--version'], { shell: false, windowsHide: true, timeout: 5000, maxBuffer: 16384 });
+        if (!probe.error && probe.status === 0)
+            return { kind: 'espeak-ng', program };
+    }
+    catch { /* reported by setup */ }
+    return undefined;
+}
+/** Render to a private file only. Never plays audio, opens a microphone or downloads a voice. */
+export async function renderSpeech(engine, input, output, voice) {
+    const st = fs.lstatSync(input);
+    if (!st.isFile() || st.isSymbolicLink() || st.nlink !== 1 || st.size > 32000)
+        throw new DodoError('PATH_DENIED', 'invalid private speech input');
+    if (fs.existsSync(output))
+        throw new DodoError('CONFLICT', 'speech output already exists');
+    const args = engine.kind === 'windows-sapi' ? windowsSpeechArgs() : engine.kind === 'macos-say'
+        ? [...(voice ? ['-v', voice] : []), '-f', input, '-o', output]
+        : ['-b', '1', ...(voice ? ['-v', voice] : []), '-f', input, '-w', output];
+    await new Promise((resolve, reject) => {
+        const child = spawn(engine.program, args, { shell: false, windowsHide: true, stdio: ['pipe', 'ignore', 'pipe'] });
+        let ended = false, failure;
+        const timer = setTimeout(() => { failure = new DodoError('TIMEOUT', 'speech synthesis timed out'); try {
+            signalOwnedProcess(child, 'SIGKILL');
+        }
+        catch { /* report failure, never success */ } }, 90000);
+        child.stderr.resume(); // Speech input and OS details must not leak in error text.
+        child.stdin.on('error', () => undefined);
+        child.on('error', () => { ended = true; clearTimeout(timer); reject(new DodoError('NOT_SUPPORTED', 'speech engine could not start')); });
+        child.on('close', code => {
+            clearTimeout(timer);
+            if (ended)
+                return;
+            if (failure)
+                reject(failure);
+            else if (code !== 0)
+                reject(new DodoError('NOT_SUPPORTED', 'speech engine failed; check the installed voice in dodo setup'));
+            else
+                resolve();
+        });
+        child.stdin.end(engine.kind === 'windows-sapi' ? JSON.stringify({ mode: 'speak', input, output, voice }) : undefined);
+    });
+    const result = fs.lstatSync(output);
+    if (!result.isFile() || result.isSymbolicLink() || result.nlink !== 1 || result.size < 44 || result.size > 32 * 1024 * 1024)
+        throw new DodoError('RESOURCE_LIMIT', 'speech output is missing, unsafe or oversized');
+}
+//# sourceMappingURL=speech.js.map