firedrill-run 2.2.5 → 3.0.1

package/dist/cli/src/http.js

@@ -0,0 +1,302 @@
+export const WORKOS_ORIGIN = 'https://api.workos.com';
+function safeRequestId(value) {
+    return typeof value === 'string' && (/^[a-f0-9]{32}$/.test(value)
+        || /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(value)) ? value : null;
+}
+export class CliError extends Error {
+    code;
+    exitCode;
+    httpStatus;
+    requestId;
+    constructor(code, message, exitCode = 1, httpStatus = null, requestId = null) {
+        super(message);
+        this.code = code;
+        this.exitCode = exitCode;
+        this.httpStatus = httpStatus;
+        this.requestId = safeRequestId(requestId);
+    }
+}
+/**
+ * Root's release gate refused this request (`release_capability_unavailable`).
+ * Root checks for a retained original before its gate, so the refusal proves no
+ * original exists under that key: the write is definitely not accepted, never
+ * "uncertain", and a read-back would only hide the real reason.
+ */
+export function releaseClosed(error) {
+    return error instanceof CliError && error.code === 'release_capability_unavailable';
+}
+function platformOrigins() {
+    const profile = process.env.FIREDRILL_PLATFORM;
+    const api = process.env.FIREDRILL_LOCAL_API_ORIGIN;
+    const app = process.env.FIREDRILL_LOCAL_APP_ORIGIN;
+    const local = process.env.FIREDRILL_LOCAL_PLATFORM;
+    const hasLocalConfiguration = api !== undefined || app !== undefined || local !== undefined;
+    if (profile !== undefined) {
+        if (profile !== 'sim-dev' || hasLocalConfiguration) {
+            throw new CliError('platform_configuration_invalid', 'Use FIREDRILL_PLATFORM=sim-dev for the isolated hosted development platform, without FIREDRILL_LOCAL_PLATFORM, FIREDRILL_LOCAL_API_ORIGIN or FIREDRILL_LOCAL_APP_ORIGIN. Unset all platform variables to select the public platform. Unknown or mixed profiles are refused.', 2);
+        }
+        return { api: 'https://api.sim-dev.firedrill.run', app: 'https://app.sim-dev.firedrill.run' };
+    }
+    if (!hasLocalConfiguration)
+        return { api: 'https://api.firedrill.run', app: 'https://app.firedrill.run' };
+    const valid = (raw) => {
+        if (!raw)
+            return false;
+        try {
+            const value = new URL(raw);
+            return value.origin === raw && value.protocol === 'http:'
+                && ['127.0.0.1', 'localhost', '[::1]'].includes(value.hostname) && !!value.port
+                && !value.username && !value.password && !value.search && !value.hash && value.pathname === '/';
+        }
+        catch {
+            return false;
+        }
+    };
+    if (local !== '1' || !valid(api) || !valid(app))
+        throw new CliError('local_platform_configuration_invalid', 'Local development requires explicit paired loopback API and app origins. Public, private-network and arbitrary cloud destination overrides are not allowed.', 2);
+    return { api: api, app: app };
+}
+// Resolve before credentials or requests can be used. Hosted development has
+// fixed HTTPS origins; the separate explicit localhost lane accepts loopback
+// only. There is no arbitrary service URL or production fallback for a profile.
+const origins = platformOrigins();
+export const API_ORIGIN = origins.api;
+export const APP_ORIGIN = origins.app;
+export async function jsonRequest(url, init = {}, maximumBytes = 2 * 1024 * 1024) {
+    if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1 || maximumBytes > 16 * 1024 * 1024) {
+        throw new CliError('response_capacity_invalid', 'The response capacity is not supported.');
+    }
+    if (![API_ORIGIN, WORKOS_ORIGIN].includes(url.origin) || url.username || url.password || url.hash) {
+        throw new CliError('destination_refused', 'The request destination is not allowed.');
+    }
+    let response;
+    try {
+        response = await fetch(url, { ...init, redirect: 'error', credentials: 'omit',
+            signal: init.signal ? AbortSignal.any([init.signal, AbortSignal.timeout(25000)]) : AbortSignal.timeout(25000) });
+    }
+    catch {
+        throw new CliError('connection_uncertain', 'The response was not received. No pending operation is retried automatically.');
+    }
+    const reader = response.body?.getReader();
+    if (!reader)
+        throw new CliError('response_unavailable', 'The service response is unavailable.');
+    let size = 0;
+    const chunks = [];
+    try {
+        while (true) {
+            const part = await reader.read();
+            if (part.done)
+                break;
+            size += part.value.length;
+            if (size > maximumBytes)
+                throw new Error();
+            chunks.push(part.value);
+        }
+        const retryAfter = response.headers.get('Retry-After');
+        const retryAfterMs = retryAfter === null ? undefined : /^\d+$/.test(retryAfter)
+            ? Number(retryAfter) * 1000 : Date.parse(retryAfter) - Date.now();
+        return { status: response.status, body: JSON.parse(Buffer.concat(chunks).toString('utf8')),
+            ...(retryAfterMs !== undefined && Number.isFinite(retryAfterMs) && retryAfterMs >= 0 ? { retryAfterMs } : {}) };
+    }
+    catch {
+        throw new CliError('response_unavailable', 'The service response could not be read safely.');
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+        reader.releaseLock();
+    }
+}
+export function endpoint(path) {
+    const url = new URL(path, API_ORIGIN);
+    if (!path.startsWith('/api/') || path.includes('\\') || url.origin !== API_ORIGIN || url.hash || url.username || url.password) {
+        throw new CliError('destination_refused', 'Choose a supported Firedrill operation.');
+    }
+    return url;
+}
+export function responseError(body, status) {
+    const error = body && typeof body === 'object' ? body.error : null;
+    const code = error && typeof error === 'object' ? error.code : null;
+    const requestId = error && typeof error === 'object' ? safeRequestId(error.request_id) : null;
+    const guidance = {
+        tool_package_upload_unconfirmed: 'The original upload could not be confirmed. Keep its request key and use tools complete <key> before any transfer. Do not create a replacement.',
+        tool_package_upload_integrity: 'The stored original file does not match its declared size. Preserve the request for review; do not overwrite it.',
+        tool_package_inspection_pending: 'The original inspection is still active or needs reconciliation. Use tools status <key>, then tools complete <key> when it is no longer active. Do not create a replacement.',
+        dependency_decision_invalid: 'Use the exact original decision metadata and digest. Catalog/generated choices need explicit coverage acknowledgement; continuation keeps its original catalog cursor. Do not include credentials.',
+        dependency_decision_access_required: 'Use the original requester with current access to this workspace. Accepted decision history does not grant permission for a new connection change.',
+        dependency_decision_unavailable: 'The original decision history cannot be confirmed. Keep its preparation ID and digest, then use connections preparation-decision to read it. Do not replace an uncertain decision or restart an active adoption.',
+        simulation_capture_policy_changed: 'The workspace browser capture preference changed. Refresh simulation setup before saving a new plan. No agent was run.',
+        desktop_capture_consent_required: 'This desktop input adapter needs explicit private-screen recording consent. Review a new simulation plan and use --record-desktop --acknowledge-desktop-screen-content only if authorized.',
+        agent_driver_input_required: 'Review the current agent input adapter and save a new simulation plan. Use --approve-agent-input only for explicitly authorized input.',
+        agent_execution_identity_changed: 'The prepared agent input adapter changed. Inspect the current world and its execution requirements before saving a new plan. No replacement adapter was selected.',
+        membership_discovery_running: 'Workspace access is already being refreshed. Use firedrill workspace list to see available workspaces.',
+        membership_discovery_request_invalid: 'Use the original workspace refresh request key.',
+        workspace_discovery_pending: 'Workspace access is still being checked. Use firedrill workspace list, then select an available workspace.',
+        vault_write_pending: 'Secure storage has not confirmed the original save. Use firedrill vault request <key> or vault resume <key>; do not create a replacement request.',
+        vault_rotation_pending: 'An original replacement is already pending. Inspect pending Vault values and recover that request before another rotation.',
+        vault_request_invalid: 'Use the original Vault request UUID. No value or replacement was saved.',
+        vault_request_not_received: 'This Vault request is not confirmed. Continue its exact saved metadata and original value, not a new key.',
+        vault_value_required: 'Re-enter the exact original value using hidden input, or pipe its exact UTF-8 bytes with --value-stdin. Never put it in command arguments.',
+        vault_rotation_conflict: 'Read the current value version and approve revoking old grants after its replacement is saved. Existing mappings are never changed automatically.',
+        vault_revision_changed: 'The expiry changed. Read the current Vault entry before submitting a reviewed edit.',
+        vault_expiry_invalid: 'Choose a future ISO expiry date including its timezone, or no expiry. Expired values cannot be reactivated.',
+        trial_dependency_evidence_invalid: 'This saved service receipt could not be confirmed. Inspect other retained drill evidence or contact support. No request was repeated.',
+        report_request_capacity: 'This service activity page exceeds inline processing capacity. Narrow its search or page selection, or contact support. No connection or operation was repeated.',
+        report_record_capacity: 'This record exceeds inline report capacity. Inspect its retained evidence file in the drill Files view. No content or score was substituted.',
+        report_record_unavailable: 'The retained record could not be opened safely. Inspect its original evidence file in the drill Files view.',
+        report_read_capacity: 'This report took too long to load. Narrow its filters or repeat the same read. No simulation or assessment was restarted.',
+        report_read_unavailable: 'This report is temporarily unavailable. Try the same read again later.',
+        recommendation_consent_required: 'Review the selected proposals and frozen context. Use --approve-assessment only to authorize that priority assessment.',
+        recommendation_context_changed: 'The world or selected proposal context changed. Inspect the saved world and its current proposals before a new request.',
+        recommendation_selection_changed: 'Some selected proposals are no longer pending. Inspect current proposals before creating another priority request.',
+        recommendation_context_unavailable: 'The original priority context is no longer retained or readable. No replacement evidence or new score was substituted.',
+        recommendation_request_withdrawn: 'This exact unaccepted priority request was canceled. It cannot start a later assessment.',
+        recommendation_access_revoked: 'Permission to assess these proposals changed. No new target run was started.',
+        assessment_context_capacity: 'Use a more focused retained evidence selection or contact support about evaluator processing capacity. No score was invented.',
+        assessment_private_input: 'Sensitive context could not be shared for assessment. Keep credentials in Vault; no substitute score was created.',
+        assessment_reply_unconfirmed: 'The original evaluator reply is unconfirmed. Inspect its saved report or check original saved replies; do not request a new evaluation just to recover the reply.',
+        assessment_configuration_required: 'The evaluator is not configured for this deployment. Saved results remain readable. Contact support.',
+        configuration_capacity: 'This world needs more configuration capacity. Contact support. No partial configuration or replacement run was saved.',
+        report_export_capacity: 'Use narrower drill filters or contact support about report export capacity. No partial report was published.',
+        report_export_inputs_changed: 'The export or some of its original evidence is unavailable. Inspect the report and create a current export if needed.',
+        report_export_access_ended: 'Export permission ended. Inspect the saved request using an authorized account.',
+        report_export_request_invalid: 'Use the original export request ID with unchanged drill filters.',
+        tool_access_configuration_required: 'Tool connections are not configured for this deployment. No new instance or connection was allocated. Contact support.',
+        tool_access_invalid: 'Choose explicit supported operations, protocols and duration. Use tools connect for the guided flow.',
+        tool_start_consent_required: 'Choose a saved tool version and approve its isolated setup. No instance was requested.',
+        tool_stop_consent_required: 'Approve stopping this exact instance. Existing history remains available.',
+        tool_instance_duration_invalid: 'Choose a duration within configured compute capacity, or omit --seconds to use the current default.',
+        tool_instance_input_unavailable: 'This exact tool version or saved input is unavailable. Inspect tools show before requesting another setup.',
+        tool_instance_not_ready: 'Wait for a current tool observation. Inspect firedrill tools instance <id>; no replacement instance was started.',
+        tool_command_pending: 'Read the original request with firedrill tools result <instance> <request>. Do not create another request.',
+        tool_previous_effect_unknown: 'An earlier operation has an uncertain effect. Inspect a declared read-only operation or stop this instance.',
+        tool_arguments_invalid: 'Arguments did not match the declared operation. Inspect firedrill tools operation before a new request.',
+        tool_arguments_private_value: 'Remove real credentials from synthetic tool arguments. Use Vault for real-account connections.',
+        tool_data_consent_required: 'Approve sending the selected arguments to this managed synthetic tool, or cancel.',
+        tool_operation_transport_unavailable: 'This instance operation does not have a supported execution transport yet. No call was submitted.',
+        tool_records_unavailable: 'The saved record pages are unavailable or expired. Choose another checkpoint with tools checkpoints. No live state was read.',
+        tool_records_not_applicable: 'This tool declares no persistent records. Use tools checkpoints to inspect its startup and closing records.',
+        tool_state_not_applicable: 'This tool declares no persistent data to checkpoint. Its startup and closing records remain in tools checkpoints.',
+        tool_records_integrity: 'The saved record bytes could not be confirmed. No replacement data was substituted. Inspect another saved capture or contact support.',
+        tool_dataset_base_unavailable: 'Choose a retained checkpoint with record pages using tools checkpoints. No tool state was changed.',
+        tool_dataset_version_conflict: 'Read tools datasets and choose the latest version before a new revision. Do not reuse a pending save request for different edits.',
+        tool_dataset_edits_invalid: 'Review captured collection keys, row positions and typed column values. Save only synthetic data, not real credentials.',
+        tool_dataset_unavailable: 'This dataset or its original checkpoint is withdrawn, expired or unavailable. No substitute was used.',
+        tool_dataset_integrity: 'The exact saved dataset bytes could not be confirmed. Contact support; do not replace an uncertain save automatically.',
+        tool_dataset_save_pending: 'Read tools dataset-request using the original request ID. Do not submit a new save request.',
+        tool_dataset_invalid: 'The original dataset and checkpoint could not be confirmed. No substitute data or replacement instance was used.',
+        tool_dataset_apply_failed: 'The dataset could not be applied under this tool database’s native rules. Review values, generated columns and relationships before a new setup.',
+        world_dataset_base_unavailable: 'Choose retained synthetic starting data in this world. No live account or running world was changed.',
+        world_dataset_version_conflict: 'Read firedrill datasets and choose the latest version before a new revision. Keep pending save requests unchanged.',
+        world_dataset_edits_invalid: 'Review captured collection keys, original row positions and typed column values. Save synthetic data only.',
+        world_dataset_private_key: 'This record has a redacted private primary key. Choose another record; hidden values cannot be restored.',
+        world_dataset_unavailable: 'The dataset or its original starting data is withdrawn, expired or unavailable. No substitute was used.',
+        world_dataset_integrity: 'The exact saved bytes could not be confirmed. Contact support; do not replace an uncertain save automatically.',
+        world_dataset_save_pending: 'Read datasets request with the original request ID. Do not submit another save request.',
+        state_search_capacity: 'Use a search of up to 200 characters.',
+        world_not_authored: 'Prepare this world before validating startup. Inspect its current state with firedrill worlds <id>.',
+        validation_active: 'Startup validation is already in progress. Inspect the saved world or its original setup request.',
+        world_execution_not_ready: 'Startup or selected connection checks are incomplete. New simulations use firedrill plan, apply and run.',
+        release_capability_unavailable: 'This action is not available in this release. Retained history, reports, cancellation, cleanup and original-request recovery stay available; new simulations use firedrill plan, apply and run.',
+        native_setup_withdrawn: 'This exact setup request was withdrawn. Review the current world before creating a new request.',
+        native_setup_resource_unavailable: 'The original setup was accepted but is no longer available. This request cannot create a replacement.',
+        local_campaign_permission_changed: 'The saved local permission changed. Review the original device, source and world configuration.',
+        local_grant_basis_changed: 'The source or configuration changed. Reopen local execution setup for the current world before approving or claiming work.',
+        source_set_component_unavailable: 'An original repository capture is unavailable. Review the connected source set; no replacement repository or file was selected.',
+        local_source_basis_invalid: 'Read the current local execution offer and use its exact source basis when inspecting repository roots.',
+        local_execution_access_removed: 'Local execution permission ended or changed. No replacement target was started.',
+        local_job_already_claimed: 'This job already has an ownership request. Inspect that original claim; it was not taken over.',
+        world_session_input_unavailable: 'Review startup checks for this exact source and configuration. Local manual sessions need completed validation on the same approved device and runtime. No replacement was started.',
+        world_session_inputs_changed: 'The source or configuration changed. Review the current world and original opening request before another action.',
+        world_session_exists: 'Inspect firedrill sessions. Close or reconcile the original session before opening another.',
+        world_session_bindings_changed: 'Repeat startup checks for this exact source and configuration before opening another world session. No replacement connection was used.',
+        world_session_operation_not_allowed: 'Choose a declared operation and its admitted connection using firedrill sessions call. No arbitrary endpoint or live fallback is available.',
+        world_session_observation_unavailable: 'Wait for a current session observation. Inspect sessions show before submitting another request.',
+        world_session_request_pending: 'A preceding command is being reconciled. Inspect sessions requests and recover its original key rather than repeating it.',
+        world_session_request_unknown: 'A prior result is uncertain. Inspect declared read-only operations or close the session. Do not repeat a possible effect.',
+        world_session_mcp_arguments_invalid: 'Use an MCP JSON argument object matching the selected operation. Inspect its declared inputs before a new request.',
+        world_session_request_capacity: 'This request exceeds current transport capacity. Reduce its body or headers before creating a new intent.',
+        service_directory_changed: 'The service evidence changed while reading this page. Reload its operation choices before submitting.',
+        world_session_request_withdrawn: 'This original opening was withdrawn. It cannot create or restart a session.',
+        native_tool_renewal_not_live: 'Only a running tool session can be extended, before it ends or is stopped. Nothing was reserved or extended.',
+        native_tool_renewal_owner_unavailable: 'The shared pool holding these tools cannot take an extension right now. Nothing was reserved or extended; check the session, then continue with the same request key.',
+        native_tool_renewal_scope_changed: 'The session changed since this renewal was reviewed (its tools, end time or pricing). Nothing was reserved or extended. Close this review and start a new renewal.',
+        native_tool_renewal_conflict: 'That request key or estimate belongs to a different renewal. Nothing was changed; read the original by its key.',
+        native_tool_renewal_limit: 'This tool session has reached its renewal limit. Start a new tool session instead.',
+        native_tool_renewal_duration_invalid: 'Use --seconds from 60 to 31536000 (one year).',
+        native_library_grant_invalid: 'Choose another workspace of this organization and read or use access. Nothing was shared or changed.',
+        native_library_grant_exists: 'That workspace already has an active grant for this version. List grants with firedrill library grants <version-id>; revoke it first to change its access.',
+        native_library_parameters_invalid: 'Use the version\'s declared parameters only, with values of the declared type and bounds and no credentials, and declare parameters only on allowed content fields. Nothing was saved.',
+        native_library_reference_unavailable: 'A library version is no longer available to this workspace: it was unshared, archived, replaced or is not usable here. Reference a current version you can use.',
+        native_library_filter_invalid: 'Use each supported filter once, within its bounds.',
+        native_standalone_duration_unavailable: 'That is longer than the maximum tool session lifetime allowed here. Choose a shorter length; nothing was reserved.',
+        native_reassessment_unavailable: 'This reassessment cannot continue in its current state or under this account. Its original evaluation must be finished and retained; only its reviewing member can approve or cancel it. Read the original status with firedrill report <campaign> drill <drill> reassessments before taking another action.',
+        native_reassessment_limit: 'This drill has reached its reassessment limit (64). Read its existing reassessments with firedrill report <campaign> drill <drill> reassessments.',
+        native_reassessment_original_pending: 'The original evaluation still has unfinished or unconfirmed criteria. Wait for its retained results before requesting a separate assessment. Nothing was reserved.',
+        billing_quote_expired: 'This estimate expired before approval. Recover the original request and review its current state before requesting a new estimate.',
+        native_evaluation_report_unavailable: 'The retained evaluation report is not available for this request. Read the original drill status before requesting another assessment.',
+        native_reassessment_quote_changed: 'That estimate is not this reassessment\'s current one. Nothing was reserved; continue with the same request key to see its estimate.',
+        native_reassessment_review_changed: 'The original evidence or the evaluator changed since this reassessment was reviewed. Nothing was reserved or evaluated. Cancel this review and start a new reassessment.',
+        native_reassessment_already_admitted: 'This reassessment was already approved, so it cannot be cancelled; nothing was undone. Read its results instead.',
+        native_reassessment_input_invalid: 'The reassessment request was not in the expected form. Nothing was reserved or changed; update the CLI and try again with the same request key.',
+        native_reassessment_consent_required: 'Approval is required. After the human approves this exact estimate, rerun with --usage-quote <quote-id> --approve-assessment.',
+        world_session_duration_invalid: 'Choose --seconds within the current runtime capacity, or omit it to use the returned default.',
+        local_world_session_duration_unavailable: 'Choose a shorter --seconds duration or renew the original device permission in your terminal. No local session was queued.',
+        local_world_session_access_removed: 'Review the original device’s world_session permission with evidence upload. The source, actor or configuration changed.',
+        world_session_real_consent_required: 'Approve real operations and shared state for this exact session. In automation use sessions open --approve-real-session --acknowledge-shared-state; --run is separate.',
+        world_session_real_owner_required: 'Only the member who approved real-account access can change this session. Open your own reviewed session instead.',
+        local_dataset_consent_required: 'Approve downloading this saved starting-data version to the selected local device. --run and Vault permission do not approve data downloads.',
+        local_dataset_consent_invalid: 'Use --share-dataset-with-device only with a saved dataset and local execution.',
+        local_checkpoint_consent_required: 'Approve downloading this exact saved checkpoint to the session’s original local device. --run does not approve a checkpoint download.',
+        local_checkpoint_consent_invalid: 'Use --share-checkpoint-with-device only with checkpoint restore or a separate local checkpoint opening.',
+        local_checkpoint_input_unavailable: 'The original local restore input changed or expired. Inspect checkpoint activity; do not repeat an uncertain restore.',
+        local_world_session_capacity: 'Choose CPU capacity supported by the current local manual runtime. No permission was granted.',
+        configuration_conflict: 'Configuration changed. Review the current world before creating another setup request.',
+        configuration_request_conflict: 'This request ID belongs to different configuration inputs. Inspect the exact saved request.',
+        configuration_request_withdrawn: 'This configuration request was withdrawn. It cannot change settings.',
+        real_binding_mapping_required: 'Keep real connection mappings at Runtime. The connection supplies its endpoint; credentials use secret saved values.',
+        real_binding_mapping_conflict: 'This variable has another phase or use. Review Configuration before selecting it for this connection.',
+        real_binding_variable_conflict: 'Use distinct endpoint and credential variables for model and service connections.',
+        real_binding_protocol_unsupported: 'This service needs a protocol-specific adapter before a real connection can be saved.',
+        real_binding_routes_required: 'Review the declared HTTP routes or Streamable HTTP MCP tools and input schemas for this connection.',
+        real_mcp_session_invalid: 'The real MCP session changed or could not be confirmed. Inspect its original request history before starting another session.',
+        real_mcp_catalog_required: 'Read tools/list on the connected MCP server before calling a reviewed tool.',
+        real_binding_address_mismatch: 'Use the address matching the reviewed operation paths. When the source expects an MCP endpoint, include its complete path.',
+        real_effect_consent_required: 'Review the selected real-account operations and explicitly authorize writes or unclassified effects if included.',
+        real_effect_review_required: 'Inspect firedrill real-operations. An administrator must review the real account before acknowledging an uncertain request. No operation was repeated.',
+        real_effect_review_conflict: 'This outcome was reviewed using another request. Read its current history; do not create a replacement operation.',
+        real_effect_review_unnecessary: 'This request already has a recorded transport outcome. Open its real-account history.',
+        real_effect_dispatch_pending: 'The original dispatch window is still open. Inspect the recorded review-available time before acknowledging the outcome.',
+        admin_required: 'An administrator is required for this action. History remains available if your account may read it.',
+        simulation_plan_conflict: 'Another tab changed the plan. Review the saved setup request and current selection.',
+        assessment_consent_required: 'Approve sharing selected drill evidence for assessment, or run without saved criteria.',
+        agent_change_stale: 'The original source, approval or evidence changed. Inspect the saved source change before proposing a current replacement.',
+        agent_change_source_unavailable: 'The baseline source snapshot is no longer available. It was not substituted with another revision.',
+        agent_change_approval_required: 'Source access needs explicit scoped approval by an active workspace writer. Only the approving user can continue drafting.',
+        agent_change_draft_required: 'Inspect a completed source diff before saving a separate candidate.',
+        agent_change_review_required: 'The reviewed draft or source scope changed. Inspect the current source change before accepting it.',
+        agent_change_retry_unavailable: 'This candidate has no failed save to retry. Inspect its current saved status instead.',
+        agent_change_conversation_required: 'This world has no saved preparation context for drafting. No source access was granted.',
+        agent_change_candidate_required: 'Save the reviewed candidate first. Source download does not create or run a candidate.',
+        agent_change_candidate_unavailable: 'The exact candidate source is unavailable. No different source revision was downloaded.',
+        agent_change_capacity: 'Select fewer source files for this focused change request.',
+        simulation_balance_insufficient: 'Open Billing to add credits or apply an event code. No extra run was admitted.',
+        billing_funding_pending: 'Funding did not finish. Inspect the saved simulation request, then continue that same request or cancel it before starting another. No operation was retried automatically.',
+        billing_adjustment_pending: 'A payment adjustment needs review before new simulations can start. Existing reports remain available. No extra run was admitted.',
+        billing_configuration_required: 'Payment setup is not available. Existing reports and usage remain accessible. No replacement payment was requested.',
+        billing_offer_unavailable: 'This offer is not available for the current organization. Inspect firedrill billing options or manage the existing subscription.',
+        billing_purchase_pending: 'Another subscription request is pending. Inspect firedrill billing purchases before creating another one.',
+        billing_idempotency_conflict: 'This request key belongs to different billing inputs or another actor. Recover the original request; do not change its offer.',
+        billing_response_unconfirmed: 'The payment link or response is not confirmed. Recover the original billing request rather than starting another purchase.',
+        promotion_configuration_required: 'Event-code redemption is not configured. Keep the code private and contact support.',
+        promotion_unavailable: 'This code is unavailable or not eligible for this account. No new allocation was confirmed.',
+        promotion_already_claimed: 'This event allocation was already claimed for this person or organization. Inspect billing balance and usage.',
+        promotion_idempotency_conflict: 'This request was used for another code or actor. Recover the original claim before making a different request.',
+        promotion_rate_limited: 'Too many event-code attempts. Wait a minute before trying again; keep the original request key.',
+    };
+    // Never echo provider bodies, arbitrary error text, authorization headers or
+    // source/target values through the terminal's catch handler.
+    return new CliError(typeof code === 'string' && /^[a-z_]{1,64}$/.test(code) ? code : 'request_failed', typeof code === 'string' && Object.hasOwn(guidance, code) ? guidance[code]
+        : code === 'native_account_changed' || code === 'native_workspace_changed' ? 'The terminal account or workspace changed. Reopen this world to continue.'
+            : status === 401 ? 'Sign in with firedrill login.' : status === 403 ? 'This account does not have access to that action.'
+                : status === 404 ? 'The requested item was not found in this workspace.' : 'The request was not accepted. Check its saved status before trying again.', status === 401 ? 2 : status === 403 ? 3 : 1, status, requestId);
+}

package/dist/cli/src/local-container-boundary.js

@@ -0,0 +1,38 @@
+import { CliError } from './http.js';
+import { policyMatches } from './local-container-policy.js';
+/** Exact selected boundary, before start and again during final observation. */
+export function requireContainerBoundary(row, policy, expected) {
+    const host = row?.HostConfig, configuration = row?.Config;
+    const tmpfs = host?.Tmpfs;
+    if (!host || !configuration || host.Privileged || host.NetworkMode !== 'none' || host.IpcMode !== 'private'
+        || host.PidMode || host.UTSMode || host.UsernsMode === 'host' || host.CgroupnsMode !== 'private'
+        || host.ReadonlyRootfs !== true || host.Init === true || host.AutoRemove === true
+        || host.PublishAllPorts || Object.keys(host.PortBindings ?? {}).length
+        || (host.Binds?.length ?? 0) || (host.Devices?.length ?? 0) || (host.DeviceRequests?.length ?? 0)
+        || (host.VolumesFrom?.length ?? 0) || (host.Links?.length ?? 0) || (host.ExtraHosts?.length ?? 0)
+        || configuration.Volumes && Object.keys(configuration.Volumes).length
+        || !Array.isArray(host.CapDrop) || host.CapDrop.length !== 1 || !['ALL', 'CAP_ALL'].includes(host.CapDrop[0])
+        || !Array.isArray(host.CapAdd) || host.CapAdd.length !== 2
+        || host.CapAdd.map((name) => name.replace(/^CAP_/, '')).sort().join(',') !== 'SETGID,SETUID'
+        || configuration.Image !== expected.image || configuration.User !== '2000:2000' || configuration.Tty !== false
+        || configuration.OpenStdin !== expected.interactive || configuration.StdinOnce === true
+        || configuration.Entrypoint?.length !== 1 || configuration.Entrypoint[0] !== '/opt/firedrill/bin/python'
+        || JSON.stringify(configuration.Cmd) !== JSON.stringify(expected.arguments)
+        || !tmpfs || Object.keys(tmpfs).sort().join(',') !== Object.keys(expected.tmpfs).sort().join(',')
+        || Object.entries(expected.tmpfs).some(([path, options]) => tmpfs[path] !== options)
+        || !Array.isArray(row.Mounts) || row.Mounts.some((mount) => mount.Type !== 'tmpfs' || !Object.hasOwn(tmpfs, mount.Destination))
+        || host.RestartPolicy?.Name !== 'no' || host.PidsLimit !== 256 || host.LogConfig?.Type !== 'none'
+        || host.Memory !== expected.memoryBytes || host.MemorySwap !== expected.memoryBytes || host.NanoCpus !== expected.nanoCpus
+        || !policyMatches(row, policy)) {
+        throw new CliError('container_boundary_mismatch', 'The container does not match the approved isolation. No weaker runtime was selected.');
+    }
+}
+export function boundaryArguments(value, policy) {
+    return ['--user', '2000:2000', '--network', 'none', '--ipc', 'private', '--cgroupns', 'private', '--read-only',
+        '--cap-drop', 'ALL', '--cap-add', 'SETUID', '--cap-add', 'SETGID', '--pids-limit', '256',
+        '--cpus', String(value.nanoCpus / 10 ** 9), '--memory', String(value.memoryBytes), '--memory-swap', String(value.memoryBytes),
+        ...policy.options.flatMap(option => ['--security-opt', option]), '--init=false', '--restart', 'no', '--log-driver', 'none',
+        ...(value.interactive ? ['--interactive'] : []),
+        ...Object.entries(value.tmpfs).flatMap(([path, options]) => ['--tmpfs', path + ':' + options]),
+        '--entrypoint', '/opt/firedrill/bin/python', value.image, ...value.arguments];
+}

package/dist/cli/src/local-container-policy.js

@@ -0,0 +1,201 @@
+import { createHash } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, mkdir, open } from 'node:fs/promises';
+import { join } from 'node:path';
+import { privateDirectory } from './credentials.js';
+import { CliError } from './http.js';
+// Original local-engine policy, not Docker's default profile or a downloaded
+// policy. The outer container still has no parent SYS_ADMIN/NET_ADMIN and no
+// host mounts/network. The retained guest enforces NEW inner namespaces and
+// drops capabilities/identities before any target/generated code is invoked.
+const CALLS = `accept accept4 access alarm arch_prctl bind brk capget capset chdir chmod chown chown32
+  clock_getres clock_getres_time64 clock_gettime clock_gettime64 clock_nanosleep clock_nanosleep_time64
+  clone close close_range connect copy_file_range creat dup dup2 dup3 epoll_create epoll_create1 epoll_ctl
+  epoll_pwait epoll_pwait2 epoll_wait eventfd eventfd2 execve execveat exit exit_group faccessat faccessat2
+  fadvise64 fallocate fchdir fchmod fchmodat fchmodat2 fchown fchown32 fchownat fcntl fcntl64 fdatasync
+  fgetxattr flistxattr flock fork fremovexattr fsetxattr fstat fstat64 fstatfs fstatfs64 fsync ftruncate ftruncate64
+  futex futex_time64 futex_waitv getcpu getcwd getdents getdents64 getegid getegid32 geteuid geteuid32
+  getgid getgid32 getgroups getgroups32 getitimer getpeername getpgid getpgrp getpid getppid getpriority
+  getrandom getresgid getresgid32 getresuid getresuid32 getrlimit get_robust_list getrusage getsid getsockname
+  getsockopt gettid gettimeofday getuid getuid32 getxattr inotify_add_watch inotify_init inotify_init1
+  inotify_rm_watch ioctl ipc kill landlock_add_rule landlock_create_ruleset landlock_restrict_self
+  lchown lchown32 lgetxattr link linkat listen listxattr llistxattr lremovexattr lseek lsetxattr lstat lstat64
+  madvise membarrier memfd_create mincore mkdir mkdirat mlock mlock2 mlockall mmap mmap2 mprotect
+  mq_getsetattr mq_notify mq_open mq_timedreceive mq_timedreceive_time64 mq_timedsend mq_timedsend_time64
+  mq_unlink mremap msgctl msgget msgrcv msgsnd msync munlock munlockall munmap nanosleep newfstatat
+  open openat openat2 pause pipe pipe2 poll ppoll ppoll_time64 prctl pread64 preadv preadv2 prlimit64
+  pselect6 pselect6_time64 pwrite64 pwritev pwritev2 read readahead readlink readlinkat readv recvfrom
+  recvmmsg recvmmsg_time64 recvmsg removexattr rename renameat renameat2 restart_syscall rmdir rseq
+  rt_sigaction rt_sigpending rt_sigprocmask rt_sigqueueinfo rt_sigreturn rt_sigsuspend rt_sigtimedwait
+  rt_sigtimedwait_time64 rt_tgsigqueueinfo sched_getaffinity sched_getattr sched_getparam sched_get_priority_max
+  sched_get_priority_min sched_getscheduler sched_rr_get_interval sched_rr_get_interval_time64 sched_setaffinity
+  sched_setattr sched_setparam sched_setscheduler sched_yield seccomp select semctl semget semop semtimedop
+  semtimedop_time64 sendfile sendfile64 sendmmsg sendmsg sendto setfsgid setfsgid32 setfsuid setfsuid32
+  setgid setgid32 setgroups setgroups32 setitimer setpgid setpriority setregid setregid32 setresgid setresgid32
+  setresuid setresuid32 setreuid setreuid32 setrlimit set_robust_list setsid setsockopt set_tid_address setuid
+  setuid32 setxattr shmat shmctl shmdt shmget shutdown sigaltstack signalfd signalfd4 splice stat stat64
+  statfs statfs64 statx symlink symlinkat sync sync_file_range syncfs sysinfo tee tgkill time timer_create
+  timer_delete timer_getoverrun timer_gettime timer_gettime64 timer_settime timer_settime64 timerfd_create
+  timerfd_gettime timerfd_gettime64 timerfd_settime timerfd_settime64 times tkill truncate truncate64 umask
+  uname unlink unlinkat utime utimensat utimensat_time64 utimes vfork vmsplice wait4 waitid waitpid write writev`;
+// Privileged namespace operations are still kernel-gated to the NEW user
+// namespace. Only mount/IPC setns is admitted for the fixed root entry's private
+// role descriptors. Kernel ownership/capability checks still apply. Host user/
+// PID/network namespace joins, time/keyring/BPF/module/perf/ptrace/handle/device/
+// uring operations remain absent, not broadly allowed.
+function seccomp(arch) {
+    const args = (index, value, valueTwo) => ({ index, value, ...(valueTwo === undefined
+            ? { op: 'SCMP_CMP_EQ' } : { op: 'SCMP_CMP_MASKED_EQ', valueTwo }) });
+    const allow = (names, arguments_ = []) => ({ names, action: 'SCMP_ACT_ALLOW', ...(arguments_.length ? { args: arguments_ } : {}) });
+    const sockets = [1, 2, 10].flatMap(family => (family === 1 ? [1, 2, 5] : [1, 2]).map(kind => allow(['socket'], [args(0, family), args(1, 15, kind)])));
+    sockets.push(...[2, 3].map(kind => allow(['socket'], [args(0, 16), args(1, 15, kind), args(2, 0)])));
+    const namespaceFlags = 0x10000000 | 0x00020000 | 0x20000000 | 0x08000000 | 0x40000000 | 0x00000200;
+    return JSON.stringify({ defaultAction: 'SCMP_ACT_ERRNO', defaultErrnoRet: 1,
+        architectures: [arch === 'amd64' ? 'SCMP_ARCH_X86_64' : 'SCMP_ARCH_AARCH64'], syscalls: [
+            allow(CALLS.trim().split(/\s+/).sort()),
+            // clone3's pointer-based flags cannot be argument-filtered. libc can use
+            // its ordinary clone fallback; no unrestricted clone3 exception.
+            { names: ['clone3'], action: 'SCMP_ACT_ERRNO', errnoRet: 38 },
+            // util-linux --kill-child opens its parent handle with flags0 before
+            // polling it. Keep that lifetime guard without admitting getfd/signals.
+            allow(['pidfd_open'], [args(1, 0)]),
+            allow(['unshare'], [args(0, (0xffffffff ^ namespaceFlags) >>> 0, 0)]),
+            ...[0x00020000, 0x08000000].map(kind => allow(['setns'], [args(1, kind)])),
+            allow(['mount', 'umount2']),
+            allow(['personality'], [args(0, 0)]),
+            allow(['personality'], [args(0, 0xffffffff)]),
+            ...sockets,
+            ...[1, 2, 5].map(kind => allow(['socketpair'], [args(0, 1), args(1, 15, kind)])),
+        ] }) + '\n';
+}
+// This named profile is selected only when the daemon advertises AppArmor.
+// It does not replace docker-default, restart a daemon, disable another LSM or
+// grant parent-namespace capabilities. A host administrator loads it separately.
+const APPARMOR_TEMPLATE = `abi <abi/4.0>,
+profile @PROFILE@ flags=(attach_disconnected,mediate_deleted) {
+  file,
+  userns create,
+  capability setuid,
+  capability setgid,
+  capability setpcap,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability fsetid,
+  capability kill,
+  capability sys_admin,
+  capability net_admin,
+  capability net_bind_service,
+  network unix,
+  network inet stream,
+  network inet dgram,
+  network inet6 stream,
+  network inet6 dgram,
+  network netlink raw,
+  network netlink dgram,
+  signal (send, receive) peer=@PROFILE@,
+  signal (receive) peer=unconfined,
+  ptrace (readby) peer=unconfined,
+  mount options=(rprivate) -> /,
+  mount fstype=proc -> /proc/,
+  mount fstype=tmpfs -> /tmp/,
+  mount fstype=tmpfs -> /var/tmp/,
+  mount fstype=tmpfs -> /dev/shm/,
+  mount fstype=tmpfs -> /work/,
+  mount fstype=tmpfs -> /home/,
+  mount fstype=mqueue -> /dev/mqueue/,
+  umount /proc/,
+  deny /sys/** wklx,
+  deny /proc/sys/** wklx,
+  deny /proc/sysrq-trigger rwklx,
+  deny /proc/kcore rwklx,
+  deny /proc/kallsyms rwklx,
+  deny /proc/*/mem rwklx,
+  deny /proc/*/attr/** wklx,
+}
+`;
+const sha256 = (value) => createHash('sha256').update(value).digest('hex');
+const APPARMOR_NAME = 'firedrill-local-' + sha256(APPARMOR_TEMPLATE).slice(0, 24);
+async function retain(directory, name, body) {
+    const path = join(directory, name);
+    try {
+        const file = await open(path, 'wx', 0o600);
+        try {
+            await file.writeFile(body);
+            await file.sync();
+        }
+        finally {
+            await file.close();
+        }
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+    const before = await lstat(path);
+    if (!before.isFile() || before.isSymbolicLink() || before.mode & 0o077 || before.size !== Buffer.byteLength(body)
+        || process.getuid && before.uid !== process.getuid())
+        throw new CliError('local_policy_storage_unsafe', 'The local policy file is not private or changed. It was not replaced.');
+    const file = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        const actual = await file.stat();
+        if (actual.ino !== before.ino || actual.dev !== before.dev || await file.readFile('utf8') !== body) {
+            throw new CliError('local_policy_storage_unsafe', 'The local policy bytes changed. No container was started.');
+        }
+    }
+    finally {
+        await file.close();
+    }
+    return path;
+}
+export async function containerPolicy(arch, securityOptions) {
+    if (!Array.isArray(securityOptions) || securityOptions.some(value => typeof value !== 'string')
+        || !securityOptions.some(value => /^name=seccomp(?:,|$)/.test(value))) {
+        throw new CliError('local_seccomp_required', 'The local Docker Engine must provide seccomp enforcement. No weaker runtime was selected.', 2);
+    }
+    const directory = join(await privateDirectory(), 'container-policy');
+    await mkdir(directory, { mode: 0o700 }).catch(error => { if (error.code !== 'EEXIST')
+        throw error; });
+    const value = await lstat(directory);
+    if (!value.isDirectory() || value.isSymbolicLink() || value.mode & 0o077 || process.getuid && value.uid !== process.getuid()) {
+        throw new CliError('local_policy_storage_unsafe', 'Use private policy storage owned by this OS user.');
+    }
+    const body = seccomp(arch), hash = sha256(body);
+    const path = await retain(directory, hash + '.seccomp.json', body);
+    const apparmorBody = APPARMOR_TEMPLATE.replaceAll('@PROFILE@', APPARMOR_NAME);
+    const apparmorPath = await retain(directory, APPARMOR_NAME + '.apparmor', apparmorBody);
+    const requiredApparmor = securityOptions.some(item => /^name=apparmor(?:,|$)/.test(item));
+    return { schema: 'firedrill.local-security.v1', arch, seccomp: { path, sha256: hash, body },
+        apparmor: { name: APPARMOR_NAME, path: apparmorPath, sha256: sha256(apparmorBody) }, requiredApparmor,
+        options: ['seccomp=' + path, ...(requiredApparmor ? ['apparmor=' + APPARMOR_NAME] : [])] };
+}
+export function policyMatches(row, policy) {
+    const options = row.HostConfig?.SecurityOpt;
+    if (!Array.isArray(options) || options.length !== policy.options.length || options.some(value => typeof value !== 'string'))
+        return false;
+    const profiles = options.filter((value) => value.startsWith('seccomp='));
+    if (profiles.length !== 1 || (policy.requiredApparmor ? row.AppArmorProfile !== policy.apparmor.name
+        || !options.includes('apparmor=' + policy.apparmor.name) : Boolean(row.AppArmorProfile)))
+        return false;
+    try {
+        const actual = JSON.parse(profiles[0].slice('seccomp='.length));
+        const expected = JSON.parse(policy.seccomp.body);
+        // All authored numeric fields are exact uint32 values. Key order is not
+        // authority; every scalar, syscall, condition and array order must match.
+        const canonical = (value) => {
+            if (Array.isArray(value))
+                return '[' + value.map(canonical).join(',') + ']';
+            if (value && typeof value === 'object')
+                return '{' + Object.keys(value).sort().map(key => JSON.stringify(key) + ':' + canonical(value[key])).join(',') + '}';
+            const encoded = JSON.stringify(value);
+            if (encoded === undefined)
+                throw new Error('invalid_policy');
+            return encoded;
+        };
+        return canonical(actual) === canonical(expected);
+    }
+    catch {
+        return false;
+    }
+}