duckhunt-runner 0.2.0

package/LICENSE

@@ -0,0 +1,135 @@
+# PolyForm Noncommercial License 1.0.0
+
+<https://polyformproject.org/licenses/noncommercial/1.0.0>
+
+## Acceptance
+
+In order to get any license under these terms, you must agree
+to them as both strict obligations and conditions to all
+your licenses.
+
+## Copyright License
+
+The licensor grants you a copyright license for the
+software to do everything you might do with the software
+that would otherwise infringe the licensor's copyright
+in it for any permitted purpose.  However, you may
+only distribute the software according to [Distribution
+License](#distribution-license) and make changes or new works
+based on the software according to [Changes and New Works
+License](#changes-and-new-works-license).
+
+## Distribution License
+
+The licensor grants you an additional copyright license
+to distribute copies of the software.  Your license
+to distribute covers distributing the software with
+changes and new works permitted by [Changes and New Works
+License](#changes-and-new-works-license).
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of
+the software from you also gets a copy of these terms or the
+URL for them above, as well as copies of any plain-text lines
+beginning with `Required Notice:` that the licensor provided
+with the software.  For example:
+
+> Required Notice: Copyright Yoyodyne, Inc. (http://example.com)
+
+## Changes and New Works License
+
+The licensor grants you an additional copyright license to
+make changes and new works based on the software for any
+permitted purpose.
+
+## Patent License
+
+The licensor grants you a patent license for the software that
+covers patent claims the licensor can license, or becomes able
+to license, that you would infringe by using the software.
+
+## Noncommercial Purposes
+
+Any noncommercial purpose is a permitted purpose.
+
+## Personal Uses
+
+Personal use for research, experiment, and testing for
+the benefit of public knowledge, personal study, private
+entertainment, hobby projects, amateur pursuits, or religious
+observance, without any anticipated commercial application,
+is use for a permitted purpose.
+
+## Noncommercial Organizations
+
+Use by any charitable organization, educational institution,
+public research organization, public safety or health
+organization, environmental protection organization,
+or government institution is use for a permitted purpose
+regardless of the source of funding or obligations resulting
+from the funding.
+
+## Fair Use
+
+You may have "fair use" rights for the software under the
+law. These terms do not limit them.
+
+## No Other Rights
+
+These terms do not allow you to sublicense or transfer any of
+your licenses to anyone else, or prevent the licensor from
+granting licenses to anyone else.  These terms do not imply
+any other licenses.
+
+## Patent Defense
+
+If you make any written claim that the software infringes or
+contributes to infringement of any patent, your patent license
+for the software granted under these terms ends immediately. If
+your company makes such a claim, your patent license ends
+immediately for work on behalf of your company.
+
+## Violations
+
+The first time you are notified in writing that you have
+violated any of these terms, or done anything with the software
+not covered by your licenses, your licenses can nonetheless
+continue if you come into full compliance with these terms,
+and take practical steps to correct past violations, within
+32 days of receiving notice.  Otherwise, all your licenses
+end immediately.
+
+## No Liability
+
+***As far as the law allows, the software comes as is, without
+any warranty or condition, and the licensor will not be liable
+to you for any damages arising out of these terms or the use
+or nature of the software, under any kind of legal claim.***
+
+## Definitions
+
+The **licensor** is the individual or entity offering these
+terms, and the **software** is the software the licensor makes
+available under these terms.
+
+**You** refers to the individual or entity agreeing to these
+terms.
+
+**Your company** is any legal entity, sole proprietorship,
+or other kind of organization that you work for, plus all
+organizations that have control over, are under the control of,
+or are under common control with that organization.  **Control**
+means ownership of substantially all the assets of an entity,
+or the power to direct its management and policies by vote,
+contract, or otherwise.  Control can be direct or indirect.
+
+**Your licenses** are all the licenses granted to you for the
+software under these terms.
+
+**Use** means anything you do with the software requiring one
+of your licenses.
+
+---
+
+Required Notice: Copyright 2026 miermontoto (https://github.com/miermontoto)

package/README.md

@@ -0,0 +1,96 @@
+# duckhunt-runner
+
+Local daemon for [duckhunt](https://duckhunt.info) agent runs.
+
+When something needs investigating — a CloudWatch alarm, a failing check, an issue — duckhunt
+queues an *agent run*. This daemon claims it and launches **Claude Code headless on your own
+machine**, so the agent works with your Claude login, your git checkouts and your AWS CLI. It
+writes the verdict back to duckhunt as a work note, which reaches you as a push notification.
+
+The server never sees your credentials, your filesystem paths or your git tokens. It only ever
+learns a repo's `workspace/slug` key and, optionally, an AWS account id — never where they live on
+disk.
+
+## Requirements
+
+- **Node 22+**
+- **[Claude Code](https://claude.com/claude-code)** installed and logged in on this machine
+  (`claude`). The daemon runs `claude -p` with your session.
+- A duckhunt account on the instance you are connecting to.
+
+> `ANTHROPIC_API_KEY` in your environment silently shadows your Claude subscription login. If it is
+> set and you did not mean to bill the API, unset it for the daemon's environment.
+
+## Setup
+
+```sh
+npx duckhunt-runner login https://duckhunt.info
+npx duckhunt-runner repos discover ~/dev
+npx duckhunt-runner start
+```
+
+That is the whole thing. Step by step:
+
+| Command | What it does |
+| --- | --- |
+| `login <base-url> [label]` | Connects the daemon to your account. Opens the browser, you paste the code back. The label distinguishes machines if you run more than one. |
+| `repos discover [dir]` | Scans a directory for git checkouts and maps each one by its `origin` remote, so an agent can read the code behind an alarm. Add `--dry-run` to see what it would map. Only the `workspace/slug` key reaches the server. |
+| `repos list\|add\|remove` | Manage that map by hand: `repos add <workspace/slug> <path>`. |
+| `aws add <accountId> <profile>` | Optional. Binds an AWS account id to a profile of your local AWS CLI, so the agent can read metrics, logs and resource state for that account. |
+| `aws list\|remove` | Manage the AWS map. |
+| `status` | Reports this machine's kit: Claude version, which credential it will use, AWS profiles and mapped repos. Run this first when something does not work. |
+| `start [--verbose]` | Starts the claim loop. |
+
+Configuration lives in `~/.duckhunt-runner.json`. It holds the base URL, the OAuth credential, the
+repo and AWS maps, and optional defaults (`model`, `maxBudgetUsd`).
+
+### Keeping it running
+
+`start` runs in the foreground and has to stay alive to claim runs. Use whatever your machine
+already does for this — a `screen`/`tmux` session, a systemd user service, `launchd`:
+
+```ini
+# ~/.config/systemd/user/duckhunt-runner.service
+[Unit]
+Description=duckhunt runner
+
+[Service]
+ExecStart=/usr/bin/npx duckhunt-runner start
+Restart=always
+
+[Install]
+WantedBy=default.target
+```
+
+## How a run works
+
+1. **A run is queued** from duckhunt: the *investigate with agent* action on an entry, the same
+   button on an alert notification, or an automation rule with that action.
+2. **The daemon claims it** and gets a prompt, a tool profile and a short-lived MCP token scoped to
+   that single run. It launches `claude -p` in the mapped checkout (or a scratch directory when the
+   alarm has no repo).
+3. **The agent investigates** and leaves its verdict as a work note on the entry. You get a push
+   with a one-line summary on top and can reply to it straight from the notification.
+4. **If it needs a decision from you**, it asks and ends its turn. Your answer resumes it in the
+   *same* Claude session, so nothing it had already found is lost.
+
+### What an agent is allowed to touch
+
+Permission is derived from the conversation, and the server enforces it on the run's token:
+
+| The run | Can |
+| --- | --- |
+| Started automatically | Read only. |
+| Born from an instruction of yours | Also write inside duckhunt (create tasks, snooze the inbox, label). |
+| Born from a yes/no you confirmed | Also touch the outside world — the ticket, AWS. |
+
+So an unattended run can never change anything, and anything that leaves duckhunt needs you to have
+said yes to that specific action, spelled out with the literal command.
+
+## Licence
+
+Copyright © 2026 miermontoto.
+
+Licensed under [PolyForm Noncommercial 1.0.0](https://polyformproject.org/licenses/noncommercial/1.0.0/):
+you may use, modify and share it for any noncommercial purpose, keeping this notice with any copy.
+Commercial use needs a separate licence. See [`LICENSE`](./LICENSE).

package/dist/aws.d.ts

@@ -0,0 +1,2 @@
+export declare function awsCommand(args: string[]): void;
+//# sourceMappingURL=aws.d.ts.map

package/dist/aws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../src/aws.ts"],"names":[],"mappings":"AAcA,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAoD/C"}

package/dist/aws.js

@@ -0,0 +1,60 @@
+// subcomandos `duckhunt-runner aws ...`: mapa id de cuenta aws → perfil local de la aws cli. el
+// claim trae solo el id de cuenta (y región) de la conexión del entry; el daemon lo traduce a
+// AWS_PROFILE/AWS_DEFAULT_REGION del proceso claude. el server nunca ve perfiles ni credenciales.
+import { configPath, loadConfig, saveConfig } from './config.js';
+const ACCOUNT_ID_RE = /^\d{12}$/;
+const USAGE = `uso:
+  duckhunt-runner aws list
+  duckhunt-runner aws add <account-id> <profile> [region]
+  duckhunt-runner aws remove <account-id>
+`;
+export function awsCommand(args) {
+    const cfg = loadConfig();
+    if (!cfg) {
+        console.error('sin config: ejecuta `duckhunt-runner login <base-url>` primero');
+        process.exitCode = 1;
+        return;
+    }
+    const [sub, ...rest] = args;
+    if (sub === 'list') {
+        const entries = Object.entries(cfg.aws);
+        if (entries.length === 0) {
+            console.log('sin cuentas aws mapeadas. añade con `duckhunt-runner aws add <account-id> <profile> [region]`');
+            return;
+        }
+        entries.forEach(([account, a]) => console.log(`  ${account} → perfil ${a.profile}${a.region ? ` (${a.region})` : ''}`));
+        return;
+    }
+    if (sub === 'add') {
+        const [account, profile, region] = rest;
+        if (!account || !profile) {
+            console.error(USAGE);
+            process.exitCode = 1;
+            return;
+        }
+        if (!ACCOUNT_ID_RE.test(account)) {
+            console.error(`id de cuenta inválido: "${account}" (12 dígitos)`);
+            process.exitCode = 1;
+            return;
+        }
+        cfg.aws[account] = { profile, ...(region ? { region } : {}) };
+        saveConfig(cfg);
+        console.log(`mapeada la cuenta ${account} → perfil ${profile}${region ? ` (${region})` : ''} en ${configPath()}`);
+        return;
+    }
+    if (sub === 'remove') {
+        const [account] = rest;
+        if (!account || !(account in cfg.aws)) {
+            console.error(account ? `cuenta no mapeada: ${account}` : USAGE);
+            process.exitCode = 1;
+            return;
+        }
+        delete cfg.aws[account];
+        saveConfig(cfg);
+        console.log(`eliminada la cuenta ${account}`);
+        return;
+    }
+    console.error(USAGE);
+    process.exitCode = 1;
+}
+//# sourceMappingURL=aws.js.map

package/dist/aws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.js","sourceRoot":"","sources":["../src/aws.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,8FAA8F;AAC9F,kGAAkG;AAElG,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEjE,MAAM,aAAa,GAAG,UAAU,CAAC;AAEjC,MAAM,KAAK,GAAG;;;;CAIb,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAChF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAE5B,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,+FAA+F,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,aAAa,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACxH,OAAO;IACT,CAAC;IAED,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;QACxC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,2BAA2B,OAAO,gBAAgB,CAAC,CAAC;YAClE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9D,UAAU,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,qBAAqB,OAAO,aAAa,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,UAAU,EAAE,EAAE,CAAC,CAAC;QAClH,OAAO;IACT,CAAC;IAED,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACjE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxB,UAAU,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC"}

package/dist/claude.d.ts

@@ -0,0 +1,27 @@
+export declare const OPTIONAL_FLAGS: readonly ["--max-turns", "--max-budget-usd", "--strict-mcp-config", "--permission-mode", "--disallowedTools", "--verbose"];
+export type OptionalFlag = (typeof OPTIONAL_FLAGS)[number];
+export interface ClaudeInfo {
+    version: string | null;
+    supported: Set<OptionalFlag>;
+}
+/** `claude --version` + flags soportados según `claude --help`. version null si el cli no arranca. */
+export declare function detectClaude(): Promise<ClaudeInfo>;
+export interface StreamResult {
+    subtype: string | null;
+    isError: boolean;
+    result: string | null;
+    costUsd: number | null;
+    numTurns: number | null;
+    sessionId: string | null;
+    model: string | null;
+}
+export interface StreamState {
+    toolCalls: number;
+    sawAssistant: boolean;
+    sessionId: string | null;
+    result: StreamResult | null;
+}
+export declare function newStreamState(): StreamState;
+/** consume una línea de stdout (stream-json). ignora líneas que no son json. */
+export declare function consumeStreamLine(state: StreamState, line: string): void;
+//# sourceMappingURL=claude.d.ts.map

package/dist/claude.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude.d.ts","sourceRoot":"","sources":["../src/claude.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,cAAc,4HAA6H,CAAC;AACzJ,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;CAC9B;AAED,sGAAsG;AACtG,wBAAsB,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,CAexD;AAGD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAGlB,YAAY,EAAE,OAAO,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAgB,cAAc,IAAI,WAAW,CAE5C;AAkBD,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CA2BxE"}

package/dist/claude.js

@@ -0,0 +1,68 @@
+// integración con el cli de claude code: detección de flags soportados (el cli cambia entre
+// versiones; los flags opcionales se pasan solo si `claude --help` los lista) y parseo del
+// stream-json de un run headless (contadores de tool calls, objeto result final).
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileP = promisify(execFile);
+// flags que el daemon quiere pasar pero que no todas las versiones del cli aceptan; un flag
+// desconocido aborta el proceso, así que se detectan una vez por arranque.
+export const OPTIONAL_FLAGS = ['--max-turns', '--max-budget-usd', '--strict-mcp-config', '--permission-mode', '--disallowedTools', '--verbose'];
+/** `claude --version` + flags soportados según `claude --help`. version null si el cli no arranca. */
+export async function detectClaude() {
+    const supported = new Set();
+    let version = null;
+    try {
+        version = (await execFileP('claude', ['--version'], { encoding: 'utf-8' })).stdout.trim() || null;
+    }
+    catch {
+        return { version: null, supported };
+    }
+    try {
+        const help = (await execFileP('claude', ['--help'], { encoding: 'utf-8', maxBuffer: 4 * 1024 * 1024 })).stdout;
+        OPTIONAL_FLAGS.filter((f) => help.includes(f)).forEach((f) => supported.add(f));
+    }
+    catch (err) {
+        console.error(`[runner] claude --help falló (se asumen flags mínimos): ${err.message}`);
+    }
+    return { version, supported };
+}
+export function newStreamState() {
+    return { toolCalls: 0, sawAssistant: false, sessionId: null, result: null };
+}
+function num(v) {
+    return typeof v === 'number' && Number.isFinite(v) ? v : null;
+}
+/** consume una línea de stdout (stream-json). ignora líneas que no son json. */
+export function consumeStreamLine(state, line) {
+    if (!line.startsWith('{'))
+        return;
+    let ev;
+    try {
+        ev = JSON.parse(line);
+    }
+    catch {
+        return;
+    }
+    if (typeof ev.session_id === 'string' && ev.session_id)
+        state.sessionId = ev.session_id;
+    if (ev.type === 'assistant') {
+        state.sawAssistant = true;
+        const content = ev.message?.content;
+        if (Array.isArray(content))
+            state.toolCalls += content.filter((c) => c?.type === 'tool_use').length;
+        return;
+    }
+    if (ev.type === 'result') {
+        const models = ev.modelUsage ? Object.keys(ev.modelUsage) : [];
+        state.result = {
+            subtype: ev.subtype ?? null,
+            isError: ev.is_error === true,
+            result: typeof ev.result === 'string' ? ev.result : null,
+            costUsd: num(ev.total_cost_usd),
+            numTurns: num(ev.num_turns),
+            sessionId: typeof ev.session_id === 'string' ? ev.session_id : state.sessionId,
+            model: models[0] ?? null,
+        };
+    }
+}
+//# sourceMappingURL=claude.js.map

package/dist/claude.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude.js","sourceRoot":"","sources":["../src/claude.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,2FAA2F;AAC3F,kFAAkF;AAElF,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEtC,4FAA4F;AAC5F,2EAA2E;AAC3E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,WAAW,CAAU,CAAC;AAQzJ,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAgB,CAAC;IAC1C,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAC/G,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,2DAA4D,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAsBD,MAAM,UAAU,cAAc;IAC5B,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC9E,CAAC;AAcD,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,KAAkB,EAAE,IAAY;IAChE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAClC,IAAI,EAAc,CAAC;IACnB,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ,IAAI,EAAE,CAAC,UAAU;QAAE,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC,UAAU,CAAC;IACxF,IAAI,EAAE,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC5B,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;QAC1B,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QACpC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;QACpG,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,KAAK,CAAC,MAAM,GAAG;YACb,OAAO,EAAE,EAAE,CAAC,OAAO,IAAI,IAAI;YAC3B,OAAO,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI;YAC7B,MAAM,EAAE,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YACxD,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC;YAC/B,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC;YAC3B,SAAS,EAAE,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;YAC9E,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI;SACzB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,35 @@
+export interface RepoConfig {
+    path: string;
+    dangerouslySkipPermissions?: boolean;
+    worktree?: boolean;
+}
+export interface AwsAccountConfig {
+    profile: string;
+    region?: string;
+}
+export interface RunnerDefaults {
+    model?: string;
+    maxConcurrent?: number;
+    maxBudgetUsd?: number;
+}
+export interface RunnerConfig {
+    baseUrl: string;
+    clientId: string;
+    refreshToken: string;
+    label?: string;
+    repos: Record<string, RepoConfig>;
+    aws: Record<string, AwsAccountConfig>;
+    defaults: RunnerDefaults;
+}
+export declare function configPath(): string;
+/** directorio de estado del daemon (scratch + logs). */
+export declare function runnerHome(): string;
+/** cwd FIJO de los runs sin repo: la auto-memory de claude code se indexa por ruta, así el
+ *  conocimiento de infra (alarmas sin código) acumula entre runs. */
+export declare function scratchDir(): string;
+export declare function logsDir(): string;
+/** carga la config; null si no existe (login pendiente). lanza si el json es inválido. */
+export declare function loadConfig(): RunnerConfig | null;
+/** persiste la config con permisos 600 (contiene el refresh token). */
+export declare function saveConfig(cfg: RunnerConfig): void;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,UAAU;IAEzB,IAAI,EAAE,MAAM,CAAC;IAEb,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAErC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAE/B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAE7B,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,aAAa,CAAC,EAAE,MAAM,CAAC;IAIvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IAErB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAElC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACtC,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED,wDAAwD;AACxD,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED;qEACqE;AACrE,wBAAgB,UAAU,IAAI,MAAM,CAInC;AAED,wBAAgB,OAAO,IAAI,MAAM,CAIhC;AAED,0FAA0F;AAC1F,wBAAgB,UAAU,IAAI,YAAY,GAAG,IAAI,CAuBhD;AAED,uEAAuE;AACvE,wBAAgB,UAAU,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI,CAGlD"}

package/dist/config.js

@@ -0,0 +1,59 @@
+// config del daemon (~/.duckhunt-runner.json): credencial oauth + mapa repo→path local + mapa
+// cuenta aws→perfil local + defaults. el server jamás ve estos paths ni perfiles — la resolución
+// repo→checkout y cuenta→perfil vive SOLO aquí. ~/.duckhunt-runner/ guarda el scratch dir (runs
+// sin repo, donde claude code acumula memoria) y los logs opcionales.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+export function configPath() {
+    return process.env.DUCKHUNT_RUNNER_CONFIG ?? path.join(os.homedir(), '.duckhunt-runner.json');
+}
+/** directorio de estado del daemon (scratch + logs). */
+export function runnerHome() {
+    return process.env.DUCKHUNT_RUNNER_HOME ?? path.join(os.homedir(), '.duckhunt-runner');
+}
+/** cwd FIJO de los runs sin repo: la auto-memory de claude code se indexa por ruta, así el
+ *  conocimiento de infra (alarmas sin código) acumula entre runs. */
+export function scratchDir() {
+    const dir = path.join(runnerHome(), 'scratch');
+    fs.mkdirSync(dir, { recursive: true });
+    return dir;
+}
+export function logsDir() {
+    const dir = path.join(runnerHome(), 'logs');
+    fs.mkdirSync(dir, { recursive: true });
+    return dir;
+}
+/** carga la config; null si no existe (login pendiente). lanza si el json es inválido. */
+export function loadConfig() {
+    const file = configPath();
+    if (!fs.existsSync(file))
+        return null;
+    const raw = fs.readFileSync(file, 'utf-8');
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`config inválida en ${file}: ${err.message}`);
+    }
+    const cfg = parsed;
+    if (!cfg.baseUrl || !cfg.clientId || !cfg.refreshToken) {
+        throw new Error(`config incompleta en ${file}: ejecuta \`duckhunt-runner login <base-url>\``);
+    }
+    return {
+        baseUrl: cfg.baseUrl,
+        clientId: cfg.clientId,
+        refreshToken: cfg.refreshToken,
+        label: cfg.label,
+        repos: cfg.repos ?? {},
+        aws: cfg.aws ?? {},
+        defaults: cfg.defaults ?? {},
+    };
+}
+/** persiste la config con permisos 600 (contiene el refresh token). */
+export function saveConfig(cfg) {
+    const file = configPath();
+    fs.writeFileSync(file, `${JSON.stringify(cfg, null, 2)}\n`, { mode: 0o600 });
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,iGAAiG;AACjG,gGAAgG;AAChG,sEAAsE;AAEtE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAyC7B,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,uBAAuB,CAAC,CAAC;AAChG,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,kBAAkB,CAAC,CAAC;AACzF,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,UAAU;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,CAAC,CAAC;IAC/C,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5C,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,UAAU;IACxB,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,GAAG,GAAG,MAA+B,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,gDAAgD,CAAC,CAAC;IAChG,CAAC;IACD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE;QACtB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE;QAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE;KAC7B,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,UAAU,CAAC,GAAiB;IAC1C,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/E,CAAC"}

package/dist/daemon.d.ts

@@ -0,0 +1,26 @@
+import { type RunnerConfig } from './config.js';
+export interface DaemonOptions {
+    verboseLog?: boolean;
+}
+export declare class RunnerDaemon {
+    private readonly cfg;
+    private readonly opts;
+    private access;
+    private claude;
+    private hasAws;
+    constructor(cfg: RunnerConfig, opts?: DaemonOptions);
+    private accessToken;
+    private api;
+    private label;
+    /** loop principal: claim → ejecutar → repetir. nunca retorna (ctrl-c para salir). */
+    run(): Promise<never>;
+    private prepareWorkdir;
+    private removeWorktree;
+    private envFor;
+    private claudeArgs;
+    private executeRun;
+    private reportFor;
+    private spawnClaude;
+    private postStatus;
+}
+//# sourceMappingURL=daemon.d.ts.map

package/dist/daemon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAcA,OAAO,EAAwC,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAoEtF,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,qBAAa,YAAY;IAMrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IANvB,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,MAAM,CAAuD;IACrE,OAAO,CAAC,MAAM,CAAS;gBAGJ,GAAG,EAAE,YAAY,EACjB,IAAI,GAAE,aAAkB;YAG7B,WAAW;YAQX,GAAG;IAgBjB,OAAO,CAAC,KAAK;IAIb,qFAAqF;IAC/E,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC;YAqCb,cAAc;YA2Bd,cAAc;IAQ5B,OAAO,CAAC,MAAM;IAed,OAAO,CAAC,UAAU;YAwBJ,UAAU;IAuDxB,OAAO,CAAC,SAAS;IA0BjB,OAAO,CAAC,WAAW;YAyFL,UAAU;CAUzB"}