glimmervoid 0.32.1 → 0.34.0

package/README.md

@@ -57,7 +57,7 @@ Update a clone with `git pull --ff-only && npm ci && npm run build`, then restar
 - **Claude Code CLI** on PATH, or another supported agent below.
 - **git** on PATH, for per-session worktrees.
 - **Linux only:** `build-essential` and `python3` for node-pty.
-- **Linux only:** `bubblewrap` (`bwrap`), `socat` and `ripgrep` (`rg`) for the sandbox that sandboxed sessions and factory checks run in (`sudo apt install bubblewrap socat ripgrep`). `glimmervoid doctor` reports all three.
+- **Linux only:** `bubblewrap` (`bwrap`), `socat` and `ripgrep` (`rg`) for the sandbox runtime behind session guardrails and factory checks (`sudo apt install bubblewrap socat ripgrep`). `glimmervoid doctor` reports all three.
 
 ## Supported agents
 

package/dist/bin/glimmervoid.js

@@ -2,11 +2,11 @@
 import { o as nodePtyRebuildHint, r as firstLine, t as probeNodePty } from "../chunks/node-pty-preflight-C8QIlrtU.js";
 import { i as errorText } from "../chunks/text-DoirglWV.js";
 import { a as packageRoot } from "../chunks/runtime-paths-BPoxENmK.js";
-import { t as AGENT_API_VERBS } from "../chunks/session-Dtkp9o3r.js";
+import { t as AGENT_API_VERBS } from "../chunks/session-C7rstCmA.js";
 import { i as execSync } from "../chunks/child-process-safe-DDELk9XC.js";
 import { t as renderTable } from "../chunks/ascii-figure-core-pDAwtlKO.js";
 import { n as glimmervoidHomeDir, t as decideConfigPath } from "../chunks/config-path-core-DFt-TemS.js";
-import { i as sandboxDoctorRows, r as probeSandboxDependencies } from "../chunks/sandbox-deps-DuaNFq7n.js";
+import { i as sandboxDoctorRows, r as probeSandboxDependencies } from "../chunks/sandbox-deps-C63o3mZs.js";
 import { r as gitDoctorRows, t as probeGitVersion } from "../chunks/git-version-CrLW4a6r.js";
 import { i as pnpmGlobalBinDir, n as npmGlobalBinDir, r as onPath, t as formatPathNotice } from "../chunks/path-doctor-C23VAqeu.js";
 import fs from "node:fs";
@@ -109,6 +109,7 @@ Commands:
   board             From inside a Glimmervoid session, list the live sessions
   push              From inside a Glimmervoid session, land its commits on the integration branch and push it
   edit <path>       From inside a Glimmervoid session, surface a text file for the operator to edit in the dashboard
+  ssh-sign          What git runs inside a Glimmervoid session to sign a commit with the operator's forwarded ssh agent
   kg [command]      Experimental typed knowledge and task graph (Settings > Lanes > Knowledge graph)
 
 Options:
@@ -134,23 +135,27 @@ var SUBCOMMAND_RUNNERS = new Map([
 		return 0;
 	}],
 	["pair", async (subcommandArgs) => {
-		const { runPairCli } = await import("../chunks/pair-cli-DQkrt_-s.js");
+		const { runPairCli } = await import("../chunks/pair-cli-Nnrd0il_.js");
 		return runPairCli(subcommandArgs);
 	}],
 	["agent", async (subcommandArgs) => {
-		const { runAgentSetupCli } = await import("../chunks/agent-setup-cli-BqYcwfOs.js");
+		const { runAgentSetupCli } = await import("../chunks/agent-setup-cli-CFielF2o.js");
 		return runAgentSetupCli(subcommandArgs);
 	}],
 	["kg", async (subcommandArgs) => {
-		const { runKnowledgeGraphCommand } = await import("../chunks/knowledge-graph-cli-D5Gf87Y7.js");
+		const { runKnowledgeGraphCommand } = await import("../chunks/knowledge-graph-cli-BBE3R9DJ.js");
 		return runKnowledgeGraphCommand(subcommandArgs);
 	}],
 	["visions", async (subcommandArgs) => {
 		const { runVisionsCli } = await import("../chunks/visions-cli-BhFdym5n.js");
 		return runVisionsCli(subcommandArgs);
 	}],
+	["ssh-sign", async (subcommandArgs) => {
+		const { runSshSignCli } = await import("../chunks/ssh-sign-cli-SWtTF00D.js");
+		return runSshSignCli(subcommandArgs);
+	}],
 	...AGENT_API_VERBS.map((verb) => [verb, async (subcommandArgs, subcommandName) => {
-		const { runAgentApiCli } = await import("../chunks/agent-api-cli-BR0GVDn6.js");
+		const { runAgentApiCli } = await import("../chunks/agent-api-cli-CRJYxzVU.js");
 		return runAgentApiCli([subcommandName, ...subcommandArgs]);
 	}])
 ]);
@@ -204,7 +209,7 @@ async function readDeclaredCustomAgents() {
 		declared: [],
 		error: null
 	};
-	const { loadConfigFile } = await import("../chunks/config-store-C8Ry8ZFD.js");
+	const { loadConfigFile } = await import("../chunks/config-store-BmdXeUz1.js");
 	try {
 		const loaded = loadConfigFile(decided.path, { exitOnError: false });
 		if (!loaded.config) return {
@@ -280,7 +285,7 @@ async function runDoctor() {
 	}
 	switchSection("Agents");
 	try {
-		const { listAgentIds, describeAgentResolvability, setCustomAgents } = await import("../chunks/adapters-Bn-dQ02i.js");
+		const { listAgentIds, describeAgentResolvability, setCustomAgents } = await import("../chunks/adapters-_HwpLy0R.js");
 		const declaredCustomAgents = await readDeclaredCustomAgents();
 		if (declaredCustomAgents.error) line("config", declaredCustomAgents.error);
 		setCustomAgents(declaredCustomAgents.declared);
@@ -288,7 +293,7 @@ async function runDoctor() {
 			const { label, path: resolvedPath } = describeAgentResolvability(id);
 			line(`${id} (${label})`, resolvedPath ?? "not found on PATH");
 		}
-		const { inspectGrokAgentSetup } = await import("../chunks/agent-setup-cli-BqYcwfOs.js");
+		const { inspectGrokAgentSetup } = await import("../chunks/agent-setup-cli-CFielF2o.js");
 		const grokSetup = inspectGrokAgentSetup();
 		line("grok hook setup", `${grokSetup.classification}: ${grokSetup.filePath}`);
 	} catch (err) {
@@ -305,7 +310,7 @@ async function runDoctor() {
 	try {
 		const { resolvePackageBin } = await import("../chunks/runtime-paths-DU5jBEEO.js");
 		const { execFileSync } = await import("../chunks/child-process-safe-B3zcPdFM.js");
-		const { inspectGrokAgentSetup } = await import("../chunks/agent-setup-cli-BqYcwfOs.js");
+		const { inspectGrokAgentSetup } = await import("../chunks/agent-setup-cli-CFielF2o.js");
 		const binPath = resolvePackageBin("cc-safety-net", "cc-safety-net");
 		line("Sane YOLO", binPath || "not installed");
 		if (binPath) line("cc-safety-net version", execFileSync(process.execPath, [binPath, "--version"], {

package/dist/chunks/{adapters-BS_7o8fj.js → adapters-BY8slY95.js}

@@ -1,11 +1,11 @@
 import { o as relayPath } from "./runtime-paths-BPoxENmK.js";
-import { C as firstDetailLine, f as PendingPromptQuestion, u as PROMPT_DETAIL_HIDDEN_CHARACTERS, w as toolDetailFieldValue } from "./session-Dtkp9o3r.js";
+import { D as firstDetailLine, O as toolDetailFieldValue, f as PendingPromptQuestion, u as PROMPT_DETAIL_HIDDEN_CHARACTERS } from "./session-C7rstCmA.js";
 import { r as execFileSync } from "./child-process-safe-DDELk9XC.js";
 import { n as resolveAgentCommand, t as buildAgentSpawnCommand } from "./spawn-command-Cc40FiZI.js";
 import { n as isRecord } from "./coerce-NSst8oRP.js";
-import { c as buildAgentEnv, i as isSpinnerChar, n as classifyAgentTitle, r as isBrailleChar, t as grok } from "./grok-7Z5KcgcY.js";
+import { c as buildAgentEnv, i as isSpinnerChar, n as classifyAgentTitle, r as isBrailleChar, t as grok } from "./grok-BYKnBgdr.js";
 import { t as buildHookCommand } from "./hook-command-core-DclEoE9e.js";
-import "./contracts-DzDg-Z9I.js";
+import "./contracts-D1wLN5iO.js";
 import { n as mergeCodexPreToolUse, t as HOOK_TOOLS } from "./hook-tools-UX2fmt81.js";
 import fs from "node:fs";
 //#region session/adapters/claude-code.ts

package/dist/chunks/{adapters-Bn-dQ02i.js → adapters-_HwpLy0R.js}

@@ -1,2 +1,2 @@
-import { a as describeAgentResolvability, d as setCustomAgents, l as listAgentIds } from "./adapters-BS_7o8fj.js";
+import { a as describeAgentResolvability, d as setCustomAgents, l as listAgentIds } from "./adapters-BY8slY95.js";
 export { describeAgentResolvability, listAgentIds, setCustomAgents };

package/dist/chunks/agent-api-cli-CRJYxzVU.js

@@ -0,0 +1,2 @@
+import { n as runAgentApiCli } from "./agent-api-cli-DuT7437B.js";
+export { runAgentApiCli };

package/dist/chunks/{agent-api-cli-BR0GVDn6.js → agent-api-cli-DuT7437B.js}

@@ -1,8 +1,8 @@
 import { t as errorCode } from "./text-DoirglWV.js";
-import { a as AgentDispatchRequest, c as AgentTicketRequest, n as AGENT_URL_ENV } from "./session-Dtkp9o3r.js";
+import { a as AgentDispatchRequest, c as AgentTicketRequest, n as AGENT_URL_ENV } from "./session-C7rstCmA.js";
 import { i as resolveHookTarget } from "./hook-relay-core-DA_bz2KA.js";
 import { n as decideSandboxProxy } from "./sandbox-proxy-core-hnQgKR0T.js";
-import { c as isAgentApiVerb, l as isOrchestratorAgentVerb } from "./agent-api-core-DUiWHSHg.js";
+import { c as isAgentApiVerb, l as isOrchestratorAgentVerb } from "./agent-api-core-Ddg15j2j.js";
 import path from "node:path";
 import http from "node:http";
 //#region server/agent-api-cli.ts
@@ -148,4 +148,4 @@ async function runAgentApiCli(args) {
 	return reply.hasSuccessStatus && bodySaysOk(reply.text) ? 0 : 1;
 }
 //#endregion
-export { runAgentApiCli };
+export { runAgentApiCli as n, postToAgentIngress as t };

package/dist/chunks/{agent-api-core-DUiWHSHg.js → agent-api-core-Ddg15j2j.js}

@@ -1,4 +1,4 @@
-import { a as AgentDispatchRequest, i as AgentAttentionRequest, l as ORCHESTRATOR_AGENT_VERBS, o as AgentEditRequest, s as AgentSpawnRequest, t as AGENT_API_VERBS } from "./session-Dtkp9o3r.js";
+import { a as AgentDispatchRequest, i as AgentAttentionRequest, l as ORCHESTRATOR_AGENT_VERBS, o as AgentEditRequest, s as AgentSpawnRequest, t as AGENT_API_VERBS } from "./session-C7rstCmA.js";
 import crypto from "node:crypto";
 var MAX_SPAWNS_IN_FLIGHT = 1;
 var SPAWNABLE_DEPTH = 0;

package/dist/chunks/{agent-setup-cli-BqYcwfOs.js → agent-setup-cli-CFielF2o.js}

@@ -1,5 +1,5 @@
 import { a as isMissingFileError, r as errorMessage } from "./text-DoirglWV.js";
-import { a as classifyGrokHooksFile, o as renderGrokHooksFile, t as grok } from "./grok-7Z5KcgcY.js";
+import { a as classifyGrokHooksFile, o as renderGrokHooksFile, t as grok } from "./grok-BYKnBgdr.js";
 import { p as writeTextAtomicSync } from "./json-file-oEH9vt-0.js";
 import fs from "node:fs";
 import path from "node:path";

package/dist/chunks/{config-B6BkTOcE.js → config-DTwMFUjx.js}

@@ -1,4 +1,4 @@
-import { x as TaskTitle } from "./session-Dtkp9o3r.js";
+import { T as TaskTitle } from "./session-C7rstCmA.js";
 import { n as isRecord } from "./coerce-NSst8oRP.js";
 import path from "node:path";
 import { z } from "zod";
@@ -143,10 +143,6 @@ var CoherenceWorkCreated = z.looseObject({
 var CoherenceTicketCreated = CoherenceWorkCreated.extend({ parent: z.string().regex(/^wrk-[a-f0-9]{16}$/) });
 //#endregion
 //#region shared/settings-ranges.ts
-var FACTORY_WATCH_WINDOW_RANGE = Object.freeze({
-	min: 1,
-	max: 1440
-});
 var FACTORY_MAX_LIVE_WORKERS_RANGE = Object.freeze({ min: 1 });
 var POSITIVE_NUMBER_RANGE = Object.freeze({
 	min: 0,
@@ -249,7 +245,6 @@ var WORKFLOWS_MAX_ACTIONS_PER_POLL_RANGE = Object.freeze({
 Object.freeze({
 	NON_NEGATIVE_NUMBER_RANGE,
 	FACTORY_MAX_LIVE_WORKERS_RANGE,
-	FACTORY_WATCH_WINDOW_RANGE,
 	FLYING_ANIMALS_GAP_RANGE,
 	FLYING_ANIMALS_DURATION_RANGE,
 	FLYING_ANIMALS_SCALE_RANGE,
@@ -1393,11 +1388,6 @@ var FactorySettings = z.object({
 	checks: z.array(z.string().trim().min(1)).optional(),
 	protectedPaths: z.array(z.string().trim().min(1)).optional(),
 	reviewerModel: z.string().trim().min(1).nullable().optional(),
-	watchWindowMinutes: z.number().int().min(FACTORY_WATCH_WINDOW_RANGE.min).max(FACTORY_WATCH_WINDOW_RANGE.max).optional(),
-	watchProjects: z.array(z.object({
-		project: z.string().trim().min(1),
-		posthogProjectId: z.number().int().positive()
-	})).optional(),
 	dailyBudgetUsd: z.number().finite().nonnegative().nullable().optional(),
 	verifierModel: z.string().trim().min(1).nullable().optional(),
 	mirrorHarnessRuns: optionalBoolean("factory.mirrorHarnessRuns")
@@ -1458,12 +1448,16 @@ var AgentApiSettings = z.object(agentApiShape, { error: "agentApi must be an obj
 var AgentApiFileSettings = z.object(agentApiShape, { error: "agentApi must be an object" }).passthrough().optional();
 var optionalPathList = (field) => z.array(z.string({ error: `${field} must be an array of paths` }).trim().min(1, { error: `${field} must be an array of paths` }), { error: `${field} must be an array of paths` }).optional();
 var sandboxShape = {
-	unconfinedRepos: optionalPathList("sandbox.unconfinedRepos"),
-	writablePaths: optionalPathList("sandbox.writablePaths"),
-	unreadablePaths: optionalPathList("sandbox.unreadablePaths")
+	unguardedRepos: optionalPathList("guardrails.unguardedRepos"),
+	blockedPaths: optionalPathList("guardrails.blockedPaths"),
+	unreadablePaths: optionalPathList("guardrails.unreadablePaths")
 };
-var SandboxSettings = z.object(sandboxShape, { error: "sandbox must be an object" }).strict().optional();
-var SandboxFileSettings = z.object(sandboxShape, { error: "sandbox must be an object" }).passthrough().optional();
+var isHomeRelativePath = (entry) => entry === "~" || entry.startsWith("~/") || entry.startsWith("~\\");
+var createSandboxSettings = (isAbsolutePath) => z.object({
+	...sandboxShape,
+	blockedPaths: z.array(z.string({ error: "guardrails.blockedPaths must be an array of paths" }).trim().min(1, { error: "guardrails.blockedPaths must be an array of paths" }).refine((entry) => isHomeRelativePath(entry) || isAbsolutePath(entry), { message: "guardrails.blockedPaths entries must be absolute paths or start with ~/" }), { error: "guardrails.blockedPaths must be an array of paths" }).optional()
+}, { error: "guardrails must be an object" }).strict().optional();
+var SandboxFileSettings = z.object(sandboxShape, { error: "guardrails must be an object" }).passthrough().optional();
 var telemetryShape = { enabled: optionalBoolean("telemetry.enabled") };
 var TelemetrySettings = z.object(telemetryShape, { error: "telemetry must be an object" }).strict().optional();
 var TelemetryFileSettings = z.object(telemetryShape, { error: "telemetry must be an object" }).passthrough().optional();
@@ -1506,7 +1500,7 @@ var createBrowserConfigShape = (isAbsolutePath) => ({
 	telegram: TelegramSettings,
 	ingest: IngestSettings,
 	agentApi: AgentApiSettings,
-	sandbox: SandboxSettings,
+	guardrails: createSandboxSettings(isAbsolutePath),
 	telemetry: TelemetrySettings,
 	workflows: WorkflowsSettings.nullable().optional()
 });
@@ -1603,7 +1597,7 @@ var ProjectConfig = z.object({
 	agent: z.string({ error: "projects[].agent must be a string" }).regex(AGENT_ID_RE, { error: `projects[].agent must be ${AGENT_ID_SHAPE_MESSAGE}` }).optional(),
 	codexBypassHookTrust: z.boolean().optional(),
 	dangerouslySkipPermissions: z.boolean({ error: "projects[].dangerouslySkipPermissions must be a boolean" }).optional(),
-	unconfined: z.boolean({ error: "projects[].unconfined must be a boolean" }).optional()
+	unguarded: z.boolean({ error: "projects[].unguarded must be a boolean" }).optional()
 }).passthrough();
 var FILE_CONFIG_SHAPE = {
 	...BROWSER_CONFIG_SHAPE,
@@ -1622,7 +1616,7 @@ var FILE_CONFIG_SHAPE = {
 	ingest: optionalLooseObject("ingest"),
 	workflows: optionalLooseObject("workflows"),
 	agentApi: AgentApiFileSettings,
-	sandbox: SandboxFileSettings,
+	guardrails: SandboxFileSettings,
 	telemetry: TelemetryFileSettings,
 	trace: TraceSettings,
 	planReview: PlanReviewSettings,
@@ -1679,7 +1673,7 @@ var CONFIG_BLOCK_KEYS = Object.freeze([
 	"telegram",
 	"ingest",
 	"agentApi",
-	"sandbox",
+	"guardrails",
 	"telemetry",
 	"workflows",
 	"coder"

package/dist/chunks/config-store-BmdXeUz1.js

@@ -0,0 +1,2 @@
+import { c as loadConfigFile } from "./config-store-CggAQLUB.js";
+export { loadConfigFile };

package/dist/chunks/{config-store-aZpWeX92.js → config-store-CggAQLUB.js}

@@ -3,8 +3,8 @@ import { i as equalsIgnoringCaseOnWindows, t as canonicalizePath } from "./paths
 import { n as glimmervoidHomeDir$1, t as decideConfigPath } from "./config-path-core-DFt-TemS.js";
 import { a as positiveIntOr, c as textOr, n as isRecord } from "./coerce-NSst8oRP.js";
 import { d as writeJsonAtomicSync, f as writeTextAtomic, p as writeTextAtomicSync } from "./json-file-oEH9vt-0.js";
-import { St as normalizeLegacyConfigNumbers, f as BranchGcFileSettings, i as Config, l as configIssueMessage, m as DEFAULT_FACTORY_PROTECTED_PATHS, n as BUILTIN_AGENT_IDS, p as DEFAULT_FACTORY_CHECKS, s as RUNTIME_CONFIG_SCALAR_KEYS, t as AGENT_ID_SHAPE_MESSAGE } from "./config-B6BkTOcE.js";
-import { V as FeatureFlagsResponse, W as TELEMETRY_KILL_SWITCH_FLAG } from "./contracts-DzDg-Z9I.js";
+import { St as normalizeLegacyConfigNumbers, f as BranchGcFileSettings, i as Config, l as configIssueMessage, m as DEFAULT_FACTORY_PROTECTED_PATHS, n as BUILTIN_AGENT_IDS, p as DEFAULT_FACTORY_CHECKS, s as RUNTIME_CONFIG_SCALAR_KEYS, t as AGENT_ID_SHAPE_MESSAGE } from "./config-DTwMFUjx.js";
+import { V as FeatureFlagsResponse, W as TELEMETRY_KILL_SWITCH_FLAG } from "./contracts-D1wLN5iO.js";
 import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
@@ -1108,16 +1108,14 @@ var DEFAULT_CONFIG = {
 		checks: DEFAULT_FACTORY_CHECKS,
 		protectedPaths: DEFAULT_FACTORY_PROTECTED_PATHS,
 		reviewerModel: null,
-		watchWindowMinutes: 30,
-		watchProjects: [],
 		dailyBudgetUsd: null,
 		verifierModel: null,
 		mirrorHarnessRuns: false
 	},
 	agentApi: { enabled: false },
-	sandbox: {
-		unconfinedRepos: [],
-		writablePaths: ["~/.npm", "~/.cache"],
+	guardrails: {
+		unguardedRepos: [],
+		blockedPaths: [],
 		unreadablePaths: []
 	},
 	telemetry: { enabled: true },
@@ -1390,6 +1388,12 @@ function pickRedactedBlock(stored, allowedKeys, secretKeys) {
 	}
 	return redacted;
 }
+function retiredGuardrailKeysWarning(config) {
+	const projects = Array.isArray(config.projects) ? config.projects : [];
+	const retiredKeys = [...Object.hasOwn(config, "sandbox") ? ["sandbox (move it to guardrails, renaming unconfinedRepos to unguardedRepos)"] : [], ...projects.some((project) => isRecord(project) && Object.hasOwn(project, "unconfined")) ? ["projects[].unconfined (rename it to unguarded)"] : []];
+	if (retiredKeys.length === 0) return null;
+	return `[guardrails] config.json still has ${retiredKeys.join(" and ")}. These keys are ignored, so their unreadable paths and opt-outs do not apply until you move them.`;
+}
 function createConfigStore({ settingsDefaults } = {}) {
 	const configPath = resolveConfigPath();
 	const effectiveDefaults = {
@@ -1403,6 +1407,8 @@ function createConfigStore({ settingsDefaults } = {}) {
 	writeBackupContent(`${configPath}.boot.bak`, loadedConfig.loadedContent);
 	config.repoRoots = config.repoRoots || [];
 	config.branchGc = resolveBranchGcAndWarn(config.branchGc);
+	const retiredGuardrailKeys = retiredGuardrailKeysWarning(config);
+	if (retiredGuardrailKeys !== null) console.warn(retiredGuardrailKeys);
 	if (Array.isArray(config.projects) && ensureProjectIds(config.projects)) try {
 		writeJsonAtomicSync(configPath, withoutEnvSecrets(config, envSecrets), { mode: 384 });
 		console.log("[config] Auto-assigned IDs to projects missing them");
@@ -1522,9 +1528,9 @@ function createConfigStore({ settingsDefaults } = {}) {
 			recordSignals: config.recordSignals ?? effectiveDefaults.recordSignals,
 			trace: { enabled: config.trace?.enabled ?? DEFAULT_CONFIG.trace.enabled },
 			agentApi: { enabled: config.agentApi?.enabled ?? DEFAULT_CONFIG.agentApi.enabled },
-			sandbox: {
-				...DEFAULT_CONFIG.sandbox,
-				...config.sandbox
+			guardrails: {
+				...DEFAULT_CONFIG.guardrails,
+				...config.guardrails
 			},
 			telemetry: { enabled: config.telemetry?.enabled ?? DEFAULT_CONFIG.telemetry.enabled },
 			telemetryForcedOff: isTelemetryForcedOff(process.env),
@@ -1600,7 +1606,7 @@ function createConfigStore({ settingsDefaults } = {}) {
 		if (newConfig.telegram != null) config.telegram = newConfig.telegram;
 		if (newConfig.ingest != null) config.ingest = newConfig.ingest;
 		if (newConfig.agentApi != null) config.agentApi = newConfig.agentApi;
-		if (newConfig.sandbox != null) config.sandbox = newConfig.sandbox;
+		if (newConfig.guardrails != null) config.guardrails = newConfig.guardrails;
 		if (newConfig.telemetry != null) config.telemetry = newConfig.telemetry;
 		if (newConfig.workflows == null) delete config.workflows;
 		if (newConfig.workflows != null) config.workflows = newConfig.workflows;

package/dist/chunks/{contracts-DzDg-Z9I.js → contracts-D1wLN5iO.js}

@@ -1,27 +1,7 @@
-import { _ as SessionDoc, d as PendingPromptDetail, g as SESSION_DOC_PATH_MAX_CHARS, p as PendingWakeup, v as SessionSnapshot, x as TaskTitle, y as SessionState } from "./session-Dtkp9o3r.js";
-import { D as MyPrMergeWhenReadyRequest, Dt as CoherenceRisk, Et as CoherenceReadiness, F as CommitSha, O as MyPrMergeWhenReadyResult, P as MyPrsStatus, Q as TeamReviewActionResult, S as MyPrKeepMergeableResult, T as MyPrMergeResult, Tt as CoherenceOrient, Z as TeamReviewActionRequest, _t as ReviewsRefreshResult, gt as ReviewsRefreshRequest, jt as CoherenceWorkState, mt as REPO_SLUG_RE, n as BUILTIN_AGENT_IDS, nt as TeamReviewStatus, vt as reviewsPollingShape, w as MyPrMergeRequest, x as MyPrKeepMergeableRequest } from "./config-B6BkTOcE.js";
+import { T as TaskTitle, b as SessionSnapshot, d as PendingPromptDetail, g as SESSION_DOC_PATH_MAX_CHARS, p as PendingWakeup, x as SessionState, y as SessionDoc } from "./session-C7rstCmA.js";
+import { D as MyPrMergeWhenReadyRequest, Dt as CoherenceRisk, Et as CoherenceReadiness, F as CommitSha, O as MyPrMergeWhenReadyResult, P as MyPrsStatus, Q as TeamReviewActionResult, S as MyPrKeepMergeableResult, T as MyPrMergeResult, Tt as CoherenceOrient, Z as TeamReviewActionRequest, _t as ReviewsRefreshResult, gt as ReviewsRefreshRequest, jt as CoherenceWorkState, mt as REPO_SLUG_RE, n as BUILTIN_AGENT_IDS, nt as TeamReviewStatus, vt as reviewsPollingShape, w as MyPrMergeRequest, x as MyPrKeepMergeableRequest } from "./config-DTwMFUjx.js";
 import { z } from "zod";
 //#region shared/contracts/factory.ts
-var FactoryIssue = z.object({
-	issueId: z.string().min(1),
-	firstSeenMs: z.number().finite(),
-	framePaths: z.array(z.string())
-});
-var FactoryWatchEntry = z.object({
-	workId: z.string().min(1),
-	intentId: z.string().min(1),
-	projectId: z.string().min(1),
-	mergedSha: z.string().regex(/^[a-f0-9]{40,64}$/),
-	mergedAt: z.iso.datetime(),
-	writeScopes: z.array(z.string()),
-	breaches: z.array(FactoryIssue).optional()
-});
-var FactoryHogQLResponse = z.looseObject({ results: z.array(z.unknown()) });
-var FactoryIssueQueryRow = z.object({
-	issueId: z.string().min(1),
-	firstSeen: z.string().min(1),
-	framePaths: z.array(z.string())
-});
 var FactoryConsequences = z.looseObject({ records: z.array(z.looseObject({
 	from: z.object({
 		kind: z.string(),
@@ -50,7 +30,6 @@ var FactoryProjectState = z.object({
 		sessionId: z.string()
 	})).optional(),
 	reviewing: z.array(z.string()).optional(),
-	watches: z.array(FactoryWatchEntry).optional(),
 	note: z.string().nullable().optional(),
 	spentTodayUsd: z.number().finite().nonnegative().optional(),
 	dailyBudgetUsd: z.number().finite().nonnegative().nullable().optional(),
@@ -189,7 +168,6 @@ var FactoryLaneState = z.object({
 	ledgerPath: z.string().min(1).max(4096).nullable(),
 	ledgerBranch: z.string().min(1).max(1024).nullable(),
 	paused: z.boolean(),
-	watch: z.array(FactoryWatchEntry).optional(),
 	trustedVerifications: z.array(z.object({
 		id: z.string().min(1),
 		sha: z.string().regex(/^[a-f0-9]{40,64}$/)
@@ -210,7 +188,6 @@ var FactoryLaneState = z.object({
 		tickets: z.array(FactoryIntentTicket).min(1).max(FACTORY_INTENT_TICKET_LIMIT)
 	})).optional(),
 	intentBaseShas: z.record(z.string().min(1), z.string().regex(/^[a-f0-9]{40,64}$/)).optional(),
-	filedBreaches: z.array(z.string().min(1)).optional(),
 	factoryLandedShas: z.array(z.string().regex(/^[a-f0-9]{40,64}$/)).optional(),
 	unlandedFactoryRecords: z.array(FactoryUnlandedRecord).optional(),
 	ticketBlockCounts: z.record(z.string().min(1), z.number().int().nonnegative()).optional(),
@@ -236,7 +213,6 @@ var FactoryDecisionKind = z.enum([
 	"admission",
 	"closeout",
 	"merge",
-	"watch",
 	"verification",
 	"exception",
 	"landing",
@@ -251,9 +227,6 @@ var FactoryDecisionOutcome = z.enum([
 	"block",
 	"merge",
 	"merged",
-	"breach",
-	"verified",
-	"verified-unwatched",
 	"failed",
 	"stale",
 	"passed",
@@ -269,7 +242,6 @@ var FactoryDecisionFailureClass = z.enum([
 	"check",
 	"review",
 	"closeout",
-	"breach",
 	"verification",
 	"stale",
 	"exception",
@@ -331,15 +303,6 @@ var FactoryDecisionLogLine = z.discriminatedUnion("kind", [
 		outcome: z.literal("merged"),
 		mergedSha: z.string().regex(/^[a-f0-9]{40,64}$/)
 	}),
-	z.strictObject({
-		...decisionFields,
-		kind: z.literal("watch"),
-		outcome: z.enum([
-			"breach",
-			"verified",
-			"verified-unwatched"
-		])
-	}),
 	z.strictObject({
 		...decisionFields,
 		kind: z.literal("verification"),
@@ -369,7 +332,6 @@ var FactoryDecisionLogLine = z.discriminatedUnion("kind", [
 		"refused",
 		"retry",
 		"block",
-		"breach",
 		"failed",
 		"stale",
 		"raised",
@@ -2168,4 +2130,4 @@ z.object({
 	projects: z.array(z.string()).optional()
 }).passthrough();
 //#endregion
-export { FactoryHarnessVerdict as $, BenchmarkActionRequest as A, PrCheckoutCaseInput as B, IssueKey as C, IssuesStatus as D, IssuesState as E, BenchmarkStatus as F, TelemetryState as G, PendingCrashReport as H, BenchmarkSuite as I, FACTORY_ERROR_MAX_CHARS as J, FACTORY_DECISION_OUTPUT_MAX_BYTES as K, CommitComparison as L, BenchmarkId as M, BenchmarkJudgement as N, ChangeMap as O, BenchmarkRun as P, FactoryHarnessStateLine as Q, MergedPrListing as R, GithubIssueResponse as S, IssuesSearchResponse as T, TELEMETRY_EVENT_SCHEMAS as U, FeatureFlagsResponse as V, TELEMETRY_KILL_SWITCH_FLAG as W, FactoryConsequences as X, FACTORY_PROTECTED_PATH_FLOOR as Y, FactoryControlRequest as Z, PlanDecision as _, ClientMessage as a, FactoryQueueIntentRequest as at, planTitle as b, UpdateJournal as c, FactoryWorkerEvent as ct, TraceRecord as d, FactoryHogQLResponse as et, PLAN_BODY_CAP_BYTES as f, PLAN_TOOL_NAME as g, PLAN_RESULT_HOOK_EVENT as h, CONTROL_FRAME_MAX_BYTES as i, FactoryProjectState as it, BenchmarkCase as j, changeMapFactId as k, MAX_RAW_LINE_CHARS as l, isSingleFactoryPathSegment as lt, PLAN_HOOK_OUTPUT_MAX_CHARS as m, HookEnvelope as n, FactoryIssueQueryRow as nt, DIFF_ANNOTATION_NOTE_MAX_CHARS as o, FactoryReviewVerdict as ot, PLAN_HOOK_EVENT as p, FactoryDecisionLogLine as q, parseDataClientMessage as r, FactoryLaneState as rt, InstallFlavor as s, FactoryReviewerOutput as st, HTTP_URL_RE as t, FactoryIssue as tt, TraceCheckpoint as u, PlanRevision as v, IssueUpdate as w, GithubIssuePullRequestsRepository as x, parseExitPlanModeHookPayload as y, MinedPrReviewData as z };
+export { FactoryHarnessVerdict as $, BenchmarkActionRequest as A, PrCheckoutCaseInput as B, IssueKey as C, IssuesStatus as D, IssuesState as E, BenchmarkStatus as F, TelemetryState as G, PendingCrashReport as H, BenchmarkSuite as I, FACTORY_ERROR_MAX_CHARS as J, FACTORY_DECISION_OUTPUT_MAX_BYTES as K, CommitComparison as L, BenchmarkId as M, BenchmarkJudgement as N, ChangeMap as O, BenchmarkRun as P, FactoryHarnessStateLine as Q, MergedPrListing as R, GithubIssueResponse as S, IssuesSearchResponse as T, TELEMETRY_EVENT_SCHEMAS as U, FeatureFlagsResponse as V, TELEMETRY_KILL_SWITCH_FLAG as W, FactoryConsequences as X, FACTORY_PROTECTED_PATH_FLOOR as Y, FactoryControlRequest as Z, PlanDecision as _, ClientMessage as a, FactoryWorkerEvent as at, planTitle as b, UpdateJournal as c, TraceRecord as d, FactoryLaneState as et, PLAN_BODY_CAP_BYTES as f, PLAN_TOOL_NAME as g, PLAN_RESULT_HOOK_EVENT as h, CONTROL_FRAME_MAX_BYTES as i, FactoryReviewerOutput as it, BenchmarkCase as j, changeMapFactId as k, MAX_RAW_LINE_CHARS as l, PLAN_HOOK_OUTPUT_MAX_CHARS as m, HookEnvelope as n, FactoryQueueIntentRequest as nt, DIFF_ANNOTATION_NOTE_MAX_CHARS as o, isSingleFactoryPathSegment as ot, PLAN_HOOK_EVENT as p, FactoryDecisionLogLine as q, parseDataClientMessage as r, FactoryReviewVerdict as rt, InstallFlavor as s, HTTP_URL_RE as t, FactoryProjectState as tt, TraceCheckpoint as u, PlanRevision as v, IssueUpdate as w, GithubIssuePullRequestsRepository as x, parseExitPlanModeHookPayload as y, MinedPrReviewData as z };

package/dist/chunks/{grok-7Z5KcgcY.js → grok-BYKnBgdr.js}

@@ -1,6 +1,6 @@
 import { r as errorMessage } from "./text-DoirglWV.js";
 import { o as relayPath } from "./runtime-paths-BPoxENmK.js";
-import { n as AGENT_URL_ENV } from "./session-Dtkp9o3r.js";
+import { _ as SIGN_URL_ENV, n as AGENT_URL_ENV } from "./session-C7rstCmA.js";
 import { t as HOOK_URL_ENV } from "./hook-relay-core-DA_bz2KA.js";
 import { n as isRecord } from "./coerce-NSst8oRP.js";
 import { a as SANE_YOLO_PATH_ENV, n as RTK_PATH_ENV, o as saneYoloEnv } from "./rtk-hook-core-BmEz2aq9.js";
@@ -19,6 +19,7 @@ var GLIMMERVOID_SCRUB_KEYS = [
 	"GLIMMERVOID_CONFIG",
 	HOOK_URL_ENV,
 	AGENT_URL_ENV,
+	SIGN_URL_ENV,
 	RTK_PATH_ENV,
 	SANE_YOLO_PATH_ENV,
 	...GLIMMERVOID_SECRET_KEYS

package/dist/chunks/{knowledge-graph-cli-D5Gf87Y7.js → knowledge-graph-cli-BBE3R9DJ.js}

@@ -2,7 +2,7 @@ import { r as errorMessage } from "./text-DoirglWV.js";
 import { s as resolvePackageBin } from "./runtime-paths-BPoxENmK.js";
 import { r as execFileSync } from "./child-process-safe-DDELk9XC.js";
 import { n as glimmervoidHomeDir, t as decideConfigPath } from "./config-path-core-DFt-TemS.js";
-import { r as BrowserConfig } from "./config-B6BkTOcE.js";
+import { r as BrowserConfig } from "./config-DTwMFUjx.js";
 import fs, { closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync } from "node:fs";
 import path, { dirname, join, posix, resolve, win32 } from "node:path";
 import { parseArgs } from "node:util";