harness-engineering-agent 0.1.0

package/dist/tools/lsp-client.js

@@ -0,0 +1,234 @@
+import { accessSync, constants } from "node:fs";
+import { mkdir, readFile, rm } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { delimiter, join, relative, resolve } from "node:path";
+import { z } from "zod";
+import { resolveWorkspacePath } from "../path/workspace-path.js";
+import { createLspConnection } from "./lsp-json-rpc.js";
+export class LspError extends Error {
+    code;
+    name = "LspError";
+    constructor(message, code, options) {
+        super(message, options);
+        this.code = code;
+    }
+}
+export const createLspClient = (input = {}) => {
+    const servers = new Map();
+    const timeoutMs = input.timeoutMs ?? 10_000;
+    const tempRoot = input.tempRoot ?? join("/tmp", "harness-engineering-agent", "lsp");
+    const getServer = async (workspaceRoot, language) => {
+        const key = `${workspaceRoot}:${language}`;
+        const existing = servers.get(key);
+        if (existing !== undefined)
+            return existing;
+        const command = (input.serverCommandResolver ?? findServerCommand)(language);
+        if (command === undefined) {
+            throw new LspError(`No LSP server available for ${language}`, "server_unavailable");
+        }
+        const dataDirectory = language === "java" ? join(tempRoot, encodeWorkspace(workspaceRoot)) : undefined;
+        if (dataDirectory !== undefined)
+            await mkdir(dataDirectory, { recursive: true });
+        const diagnostics = new Map();
+        const connection = (input.connectionFactory ?? createLspConnection)({
+            command: command.command,
+            args: dataDirectory === undefined ? command.args : [...command.args, "-data", dataDirectory],
+            cwd: workspaceRoot,
+            ...(language === "java" ? { env: { JAVA_HOME: "/usr/lib/jvm/java-21-openjdk-amd64" } } : {}),
+            onNotification: (method, params) => {
+                if (method !== "textDocument/publishDiagnostics")
+                    return;
+                const payload = readDiagnosticNotification(params);
+                if (payload !== undefined)
+                    diagnostics.set(payload.uri, payload.diagnostics);
+            },
+        });
+        try {
+            await withTimeout(connection.request("initialize", {
+                processId: process.pid,
+                rootUri: `file://${workspaceRoot}`,
+                capabilities: { textDocument: { publishDiagnostics: { relatedInformation: true } } },
+                workspaceFolders: [{ uri: `file://${workspaceRoot}`, name: "harness" }],
+            }), timeoutMs);
+        }
+        catch (error) {
+            await connection.close().catch(() => { });
+            throw normalizeLspError(error);
+        }
+        connection.notify("initialized", {});
+        const server = { language, connection, diagnostics, dataDirectory };
+        servers.set(key, server);
+        return server;
+    };
+    const prepare = async (request) => {
+        const workspaceRoot = resolve(request.workspaceRoot);
+        const filePath = resolveWorkspacePath(workspaceRoot, request.filePath);
+        const language = languageForPath(filePath);
+        const server = await getServer(workspaceRoot, language);
+        const uri = `file://${filePath}`;
+        const text = await readFile(filePath, "utf8");
+        server.connection.notify("textDocument/didOpen", {
+            textDocument: { uri, languageId: language, version: 1, text },
+        });
+        return {
+            server,
+            uri,
+            position: { line: Math.max(0, request.line - 1), character: Math.max(0, request.column - 1) },
+        };
+    };
+    return {
+        status: async () => Promise.all(["java", "typescript", "javascript"].map(async (language) => ({
+            language,
+            available: (input.serverCommandResolver ?? findServerCommand)(language) !== undefined,
+            status: (input.serverCommandResolver ?? findServerCommand)(language) === undefined
+                ? "unavailable"
+                : "available",
+        }))),
+        diagnostics: async (request) => {
+            const prepared = await prepare(request);
+            await new Promise((resolve) => setTimeout(resolve, 500));
+            return { uri: prepared.uri, diagnostics: prepared.server.diagnostics.get(prepared.uri) ?? [] };
+        },
+        definition: async (request) => {
+            const prepared = await prepare(request);
+            return withTimeout(prepared.server.connection
+                .request("textDocument/definition", {
+                textDocument: { uri: prepared.uri },
+                position: prepared.position,
+            })
+                .then(parseDefinitionResponse), timeoutMs).catch((error) => {
+                throw normalizeLspError(error);
+            });
+        },
+        references: async (request) => {
+            const prepared = await prepare(request);
+            return withTimeout(prepared.server.connection
+                .request("textDocument/references", {
+                textDocument: { uri: prepared.uri },
+                position: prepared.position,
+                context: { includeDeclaration: true },
+            })
+                .then(parseReferenceResponse), timeoutMs).catch((error) => {
+                throw normalizeLspError(error);
+            });
+        },
+        close: async () => {
+            await Promise.all([...servers.values()].map((server) => server.connection.close()));
+            await Promise.all([...servers.values()]
+                .map((server) => server.dataDirectory)
+                .filter((path) => path !== undefined)
+                .map((path) => rm(path, { recursive: true, force: true })));
+            servers.clear();
+        },
+    };
+};
+const findServerCommand = (language) => {
+    if (language === "java") {
+        const configuredCommand = process.env[String("HARNESS_JDTLS_COMMAND")];
+        const command = configuredCommand ??
+            which("jdtls") ??
+            "/persist/users/kasm-user/.vscode/extensions/redhat.java-1.55.0-linux-x64/server/bin/jdtls";
+        return exists(command) ? { command, args: [] } : undefined;
+    }
+    try {
+        const require = createRequire(import.meta.url);
+        return {
+            command: process.execPath,
+            args: [require.resolve("typescript-language-server/lib/cli.mjs"), "--stdio"],
+        };
+    }
+    catch {
+        return undefined;
+    }
+};
+const which = (command) => {
+    if (command.includes("/") || command.includes("\\")) {
+        return exists(command) ? command : undefined;
+    }
+    const { PATH: pathValue } = process.env;
+    if (pathValue === undefined || pathValue.length === 0) {
+        return undefined;
+    }
+    for (const entry of pathValue.split(delimiter)) {
+        const candidate = join(entry, command);
+        if (exists(candidate)) {
+            return candidate;
+        }
+    }
+    return undefined;
+};
+const exists = (path) => {
+    try {
+        accessSync(path, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+const languageForPath = (path) => {
+    if (path.endsWith(".java"))
+        return "java";
+    if (path.endsWith(".jsx") || path.endsWith(".js"))
+        return "javascript";
+    if (path.endsWith(".tsx") || path.endsWith(".ts"))
+        return "typescript";
+    throw new LspError(`Unsupported LSP file extension: ${relative(process.cwd(), path)}`, "request_failed");
+};
+const encodeWorkspace = (workspaceRoot) => workspaceRoot.replace(/[^a-zA-Z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+const readDiagnosticNotification = (params) => {
+    if (typeof params !== "object" || params === null)
+        return undefined;
+    const uri = Reflect.get(params, "uri");
+    const diagnostics = Reflect.get(params, "diagnostics");
+    return typeof uri === "string" && Array.isArray(diagnostics) ? { uri, diagnostics } : undefined;
+};
+const withTimeout = async (promise, timeoutMs) => Promise.race([
+    promise,
+    new Promise((_, reject) => setTimeout(() => reject(new LspError("LSP request timed out", "request_timeout")), timeoutMs)),
+]);
+const LocationSchema = z
+    .object({
+    uri: z.string(),
+    range: z.object({
+        start: z.object({ line: z.number(), character: z.number() }),
+        end: z.object({ line: z.number(), character: z.number() }),
+    }),
+})
+    .passthrough();
+const parseDefinitionResponse = (value) => {
+    try {
+        return z.union([LocationSchema, z.array(LocationSchema), z.null()]).parse(value);
+    }
+    catch (error) {
+        throw new LspError("LSP returned malformed definition payload", "protocol_failure", {
+            cause: error,
+        });
+    }
+};
+const parseReferenceResponse = (value) => {
+    try {
+        return z.array(LocationSchema).parse(value);
+    }
+    catch (error) {
+        throw new LspError("LSP returned malformed references payload", "protocol_failure", {
+            cause: error,
+        });
+    }
+};
+const normalizeLspError = (error) => {
+    if (error instanceof LspError) {
+        return error;
+    }
+    if (error instanceof Error) {
+        if (error.message.includes("timed out")) {
+            return new LspError(error.message, "request_timeout", { cause: error });
+        }
+        if (error.message.includes("exited") || error.message.includes("closed")) {
+            return new LspError(error.message, "process_failure", { cause: error });
+        }
+        return new LspError(error.message, "request_failed", { cause: error });
+    }
+    return new LspError("LSP request failed", "request_failed");
+};
+//# sourceMappingURL=lsp-client.js.map

package/dist/tools/lsp-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lsp-client.js","sourceRoot":"","sources":["../../src/tools/lsp-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAC/C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC9D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,mBAAmB,EAAsB,MAAM,mBAAmB,CAAA;AAkB3E,MAAM,OAAO,QAAS,SAAQ,KAAK;IAKtB;IAJF,IAAI,GAAG,UAAU,CAAA;IAE1B,YACE,OAAe,EACN,IAKW,EACpB,OAAsB;QAEtB,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QARd,SAAI,GAAJ,IAAI,CAKO;IAItB,CAAC;CACF;AASD,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,QAKI,EAAE,EACK,EAAE;IACb,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAA;IACjD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,CAAA;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAA;IAEnF,MAAM,SAAS,GAAG,KAAK,EACrB,aAAqB,EACrB,QAAqB,EACI,EAAE;QAC3B,MAAM,GAAG,GAAG,GAAG,aAAa,IAAI,QAAQ,EAAE,CAAA;QAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAA;QAC3C,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,qBAAqB,IAAI,iBAAiB,CAAC,CAAC,QAAQ,CAAC,CAAA;QAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,QAAQ,CAAC,+BAA+B,QAAQ,EAAE,EAAE,oBAAoB,CAAC,CAAA;QACrF,CAAC;QACD,MAAM,aAAa,GACjB,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAClF,IAAI,aAAa,KAAK,SAAS;YAAE,MAAM,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAChF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAmB,CAAA;QAC9C,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,iBAAiB,IAAI,mBAAmB,CAAC,CAAC;YAClE,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC;YAC5F,GAAG,EAAE,aAAa;YAClB,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,oCAAoC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;gBACjC,IAAI,MAAM,KAAK,iCAAiC;oBAAE,OAAM;gBACxD,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAA;gBAClD,IAAI,OAAO,KAAK,SAAS;oBAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;YAC9E,CAAC;SACF,CAAC,CAAA;QACF,IAAI,CAAC;YACH,MAAM,WAAW,CACf,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE;gBAC/B,SAAS,EAAE,OAAO,CAAC,GAAG;gBACtB,OAAO,EAAE,UAAU,aAAa,EAAE;gBAClC,YAAY,EAAE,EAAE,YAAY,EAAE,EAAE,kBAAkB,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,EAAE;gBACpF,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;aACxE,CAAC,EACF,SAAS,CACV,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACxC,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAA;QAChC,CAAC;QACD,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;QACpC,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,CAAA;QACnE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACxB,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,KAAK,EACnB,OAA2B,EAK1B,EAAE;QACH,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QACpD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;QACtE,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;QAC1C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;QACvD,MAAM,GAAG,GAAG,UAAU,QAAQ,EAAE,CAAA;QAChC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC7C,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,sBAAsB,EAAE;YAC/C,YAAY,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE;SAC9D,CAAC,CAAA;QACF,OAAO;YACL,MAAM;YACN,GAAG;YACH,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE;SAC9F,CAAA;IACH,CAAC,CAAA;IAED,OAAO;QACL,MAAM,EAAE,KAAK,IAAI,EAAE,CACjB,OAAO,CAAC,GAAG,CACR,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,CAAW,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YACvE,QAAQ;YACR,SAAS,EAAE,CAAC,KAAK,CAAC,qBAAqB,IAAI,iBAAiB,CAAC,CAAC,QAAQ,CAAC,KAAK,SAAS;YACrF,MAAM,EACJ,CAAC,KAAK,CAAC,qBAAqB,IAAI,iBAAiB,CAAC,CAAC,QAAQ,CAAC,KAAK,SAAS;gBACxE,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,WAAW;SAClB,CAAC,CAAC,CACJ;QACH,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC7B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;YACxD,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAA;QAChG,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC5B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YACvC,OAAO,WAAW,CAChB,QAAQ,CAAC,MAAM,CAAC,UAAU;iBACvB,OAAO,CAAC,yBAAyB,EAAE;gBAClC,YAAY,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE;gBACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC;iBACD,IAAI,CAAC,uBAAuB,CAAC,EAChC,SAAS,CACV,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBAChB,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAA;YAChC,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC5B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YACvC,OAAO,WAAW,CAChB,QAAQ,CAAC,MAAM,CAAC,UAAU;iBACvB,OAAO,CAAC,yBAAyB,EAAE;gBAClC,YAAY,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE;gBACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,OAAO,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE;aACtC,CAAC;iBACD,IAAI,CAAC,sBAAsB,CAAC,EAC/B,SAAS,CACV,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBAChB,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAA;YAChC,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YACnF,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;iBAClB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC;iBACrC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;iBACpD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAC7D,CAAA;YACD,OAAO,CAAC,KAAK,EAAE,CAAA;QACjB,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,CACxB,QAAqB,EAC8C,EAAE;IACrE,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAA;QACtE,MAAM,OAAO,GACX,iBAAiB;YACjB,KAAK,CAAC,OAAO,CAAC;YACd,2FAA2F,CAAA;QAC7F,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC9C,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,QAAQ;YACzB,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,wCAAwC,CAAC,EAAE,SAAS,CAAC;SAC7E,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED,MAAM,KAAK,GAAG,CAAC,OAAe,EAAsB,EAAE;IACpD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9C,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,GAAG,CAAA;IACvC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QACtC,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACtB,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAW,EAAE;IACvC,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;QAChC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,IAAY,EAAe,EAAE;IACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAA;IACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAA;IACtE,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAA;IACtE,MAAM,IAAI,QAAQ,CAChB,mCAAmC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,EAAE,EAClE,gBAAgB,CACjB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,aAAqB,EAAU,EAAE,CACxD,aAAa,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;AAEtE,MAAM,0BAA0B,GAAG,CACjC,MAAe,EACsD,EAAE;IACvE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;IACtD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AACjG,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,KAAK,EAAS,OAAuB,EAAE,SAAiB,EAAkB,EAAE,CAC9F,OAAO,CAAC,IAAI,CAAC;IACX,OAAO;IACP,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,uBAAuB,EAAE,iBAAiB,CAAC,CAAC,EAAE,SAAS,CAAC,CAC9F;CACF,CAAC,CAAA;AAEJ,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5D,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KAC3D,CAAC;CACH,CAAC;KACD,WAAW,EAAE,CAAA;AAEhB,MAAM,uBAAuB,GAAG,CAAC,KAAc,EAAW,EAAE;IAC1D,IAAI,CAAC;QACH,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAClF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAAC,2CAA2C,EAAE,kBAAkB,EAAE;YAClF,KAAK,EAAE,KAAK;SACb,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAA;AAED,MAAM,sBAAsB,GAAG,CAAC,KAAc,EAAW,EAAE;IACzD,IAAI,CAAC;QACH,OAAO,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAAC,2CAA2C,EAAE,kBAAkB,EAAE;YAClF,KAAK,EAAE,KAAK;SACb,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAY,EAAE;IACrD,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACxC,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QACzE,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QACzE,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACxE,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAA;AAC7D,CAAC,CAAA"}

package/dist/tools/lsp-json-rpc.d.ts

@@ -0,0 +1,13 @@
+export type LspConnection = {
+    readonly request: (method: string, params: unknown) => Promise<unknown>;
+    readonly notify: (method: string, params: unknown) => void;
+    readonly close: () => Promise<void>;
+};
+export declare const createLspConnection: (input: {
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly cwd: string;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly onNotification?: (method: string, params: unknown) => void;
+}) => LspConnection;
+//# sourceMappingURL=lsp-json-rpc.d.ts.map

package/dist/tools/lsp-json-rpc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lsp-json-rpc.d.ts","sourceRoot":"","sources":["../../src/tools/lsp-json-rpc.ts"],"names":[],"mappings":"AAuBA,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACvE,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAA;IAC1D,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CACpC,CAAA;AAED,eAAO,MAAM,mBAAmB,GAAI,OAAO;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAA;CACpE,KAAG,aAuFH,CAAA"}

package/dist/tools/lsp-json-rpc.js

@@ -0,0 +1,98 @@
+import { spawn } from "node:child_process";
+import { z } from "zod";
+const JsonRpcMessageSchema = z
+    .object({
+    jsonrpc: z.literal("2.0"),
+    id: z.number().optional(),
+    method: z.string().optional(),
+    params: z.unknown().optional(),
+    result: z.unknown().optional(),
+    error: z.object({ code: z.number(), message: z.string() }).optional(),
+})
+    .passthrough();
+export const createLspConnection = (input) => {
+    const child = spawn(input.command, [...input.args], {
+        cwd: input.cwd,
+        env: { ...process.env, ...input.env },
+        stdio: "pipe",
+    });
+    let nextId = 1;
+    let buffer = Buffer.alloc(0);
+    const pending = new Map();
+    child.stdout.on("data", (chunk) => {
+        buffer = Buffer.concat([buffer, chunk]);
+        parseMessages();
+    });
+    child.on("error", (error) => rejectAll(error));
+    child.on("exit", () => rejectAll(new Error("LSP server exited")));
+    const request = (method, params) => {
+        const id = nextId++;
+        const promise = new Promise((resolve, reject) => pending.set(id, { resolve, reject }));
+        send({ jsonrpc: "2.0", id, method, params });
+        return promise;
+    };
+    const notify = (method, params) => {
+        send({ jsonrpc: "2.0", method, params });
+    };
+    const close = async () => {
+        if (child.exitCode !== null)
+            return;
+        notify("shutdown", null);
+        child.stdin.end();
+        await new Promise((resolve) => {
+            const timer = setTimeout(() => {
+                child.kill();
+                resolve();
+            }, 1000);
+            child.once("exit", () => {
+                clearTimeout(timer);
+                resolve();
+            });
+        });
+    };
+    const parseMessages = () => {
+        while (true) {
+            const separator = buffer.indexOf("\r\n\r\n");
+            if (separator < 0)
+                return;
+            const header = buffer.subarray(0, separator).toString("ascii");
+            const length = /^Content-Length:\s*(\d+)$/im.exec(header)?.[1];
+            if (length === undefined) {
+                buffer = buffer.subarray(separator + 4);
+                continue;
+            }
+            const bodyStart = separator + 4;
+            const bodyEnd = bodyStart + Number(length);
+            if (buffer.length < bodyEnd)
+                return;
+            const body = buffer.subarray(bodyStart, bodyEnd).toString("utf8");
+            buffer = buffer.subarray(bodyEnd);
+            const raw = JSON.parse(body);
+            const message = JsonRpcMessageSchema.parse(raw);
+            if (message.id !== undefined) {
+                const current = pending.get(message.id);
+                if (current === undefined)
+                    continue;
+                pending.delete(message.id);
+                if (message.error !== undefined)
+                    current.reject(new Error(message.error.message));
+                else
+                    current.resolve(message.result);
+            }
+            else if (message.method !== undefined) {
+                input.onNotification?.(message.method, message.params);
+            }
+        }
+    };
+    const send = (message) => {
+        const body = JSON.stringify(message);
+        child.stdin.write(`Content-Length: ${Buffer.byteLength(body)}\r\n\r\n${body}`);
+    };
+    const rejectAll = (error) => {
+        for (const current of pending.values())
+            current.reject(error);
+        pending.clear();
+    };
+    return { request, notify, close };
+};
+//# sourceMappingURL=lsp-json-rpc.js.map

package/dist/tools/lsp-json-rpc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lsp-json-rpc.js","sourceRoot":"","sources":["../../src/tools/lsp-json-rpc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAWvB,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACzB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtE,CAAC;KACD,WAAW,EAAE,CAAA;AAQhB,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAMnC,EAAiB,EAAE;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE;QAClD,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE;QACrC,KAAK,EAAE,MAAM;KACd,CAAC,CAAA;IACF,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,EAGpB,CAAA;IAEH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;QACvC,aAAa,EAAE,CAAA;IACjB,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9C,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAA;IAEjE,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,MAAe,EAAoB,EAAE;QACpE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAA;QACnB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;QAC/F,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC5C,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IAED,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,MAAe,EAAQ,EAAE;QACvD,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAC1C,CAAC,CAAA;IAED,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;QACtC,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAM;QACnC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QACxB,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,KAAK,CAAC,IAAI,EAAE,CAAA;gBACZ,OAAO,EAAE,CAAA;YACX,CAAC,EAAE,IAAI,CAAC,CAAA;YACR,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;gBACtB,YAAY,CAAC,KAAK,CAAC,CAAA;gBACnB,OAAO,EAAE,CAAA;YACX,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,GAAS,EAAE;QAC/B,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;YAC5C,IAAI,SAAS,GAAG,CAAC;gBAAE,OAAM;YACzB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YAC9D,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAC9D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;gBACvC,SAAQ;YACV,CAAC;YACD,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAA;YAC/B,MAAM,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;YAC1C,IAAI,MAAM,CAAC,MAAM,GAAG,OAAO;gBAAE,OAAM;YACnC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YACjE,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACrC,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC/C,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBACvC,IAAI,OAAO,KAAK,SAAS;oBAAE,SAAQ;gBACnC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBAC1B,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;oBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;;oBAC5E,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACtC,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACxC,KAAK,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;YACxD,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,CAAC,OAAuB,EAAQ,EAAE;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QACpC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;IAChF,CAAC,CAAA;IAED,MAAM,SAAS,GAAG,CAAC,KAAY,EAAQ,EAAE;QACvC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC7D,OAAO,CAAC,KAAK,EAAE,CAAA;IACjB,CAAC,CAAA;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;AACnC,CAAC,CAAA"}

package/dist/verification/command-policy.d.ts

@@ -0,0 +1,11 @@
+import type { VerificationCommand } from "../domain/index.js";
+import type { ProcessRunnerCommand } from "./contracts.js";
+export declare class VerificationCommandPolicyError extends Error {
+    readonly name = "VerificationCommandPolicyError";
+}
+export declare const normalizeVerificationCommand: (input: {
+    readonly workspaceRoot: string;
+    readonly command: VerificationCommand;
+}) => ProcessRunnerCommand;
+export declare const sanitizeResearchToolOutput: (value: unknown) => unknown;
+//# sourceMappingURL=command-policy.d.ts.map

package/dist/verification/command-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-policy.d.ts","sourceRoot":"","sources":["../../src/verification/command-policy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAG7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAgE1D,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,QAAQ,CAAC,IAAI,oCAAmC;CACjD;AAED,eAAO,MAAM,4BAA4B,GAAI,OAAO;IAClD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;CACtC,KAAG,oBAuBH,CAAA;AA+PD,eAAO,MAAM,0BAA0B,GAAI,OAAO,OAAO,KAAG,OAa3D,CAAA"}

package/dist/verification/command-policy.js

@@ -0,0 +1,262 @@
+import { basename, resolve } from "node:path";
+import { redactEvidenceSummary } from "../domain/index.js";
+import { resolveWorkspacePath } from "../path/workspace-path.js";
+const DEFAULT_COMMAND_ORIGIN = "config";
+const READ_ONLY_EXECUTABLES = new Set([
+    "node",
+    "pnpm",
+    "npm",
+    "npx",
+    "bun",
+    "vitest",
+    "tsc",
+    "biome",
+]);
+const WORKSPACE_WRITE_EXECUTABLES = new Set([...READ_ONLY_EXECUTABLES, "git"]);
+const ENV_ALLOWLIST = new Set([
+    "CI",
+    "FORCE_COLOR",
+    "HARNESS_JDTLS_COMMAND",
+    "JAVA_HOME",
+    "NODE_ENV",
+    "NO_COLOR",
+    "PATH",
+    "PNPM_HOME",
+    "TMPDIR",
+    "TMP",
+    "TEMP",
+]);
+const DANGEROUS_TOKENS = new Set([
+    "curl",
+    "wget",
+    "rm",
+    "rmdir",
+    "mv",
+    "dd",
+    "mkfs",
+    "shutdown",
+    "reboot",
+    "poweroff",
+    "git-reset",
+    "git-clean",
+    "git-checkout",
+]);
+const SHELL_CONTROL_OPERATORS = new Set(["&&", "||", "|", ";", "$(", "`", ">", ">>", "<", "<<"]);
+const GIT_DESTRUCTIVE_SUBCOMMANDS = new Set(["reset", "clean", "checkout"]);
+const EXEC_WRAPPERS = new Set(["pnpm", "npm", "npx"]);
+const NODE_EVAL_FLAGS = new Set(["-e", "--eval"]);
+const ALLOWED_READ_ONLY_NODE_EVAL = {
+    command: "node",
+    args: ["--input-type=module", "-e", "import('./dist/index.js')"],
+};
+export class VerificationCommandPolicyError extends Error {
+    name = "VerificationCommandPolicyError";
+}
+export const normalizeVerificationCommand = (input) => {
+    const origin = input.command.origin ?? DEFAULT_COMMAND_ORIGIN;
+    const cwd = resolveWorkspacePath(input.workspaceRoot, input.command.workingDirectory);
+    assertContainedWorkspaceRoot(input.workspaceRoot, cwd);
+    const argv = input.command.args === undefined
+        ? parseCommandString(input.command.command)
+        : [input.command.command, ...input.command.args];
+    const executable = normalizeExecutable(argv[0] ?? "");
+    assertNoShellControlSyntax(argv);
+    assertExecutableAllowed(executable, input.command.sideEffectLevel);
+    assertNoDangerousNestedExecution(argv, input.command.sideEffectLevel);
+    assertOriginAllowed(origin, input.command.sideEffectLevel);
+    assertConfirmationSatisfied(input.command, executable);
+    const env = sanitizeEnvironment(input.command.allowedEnv);
+    return {
+        command: argv[0] ?? input.command.command,
+        args: argv.slice(1),
+        cwd,
+        timeoutMs: input.command.timeoutMs,
+        shell: false,
+        ...(env === undefined ? {} : { env }),
+    };
+};
+const assertContainedWorkspaceRoot = (workspaceRoot, cwd) => {
+    const workspace = resolve(workspaceRoot);
+    const candidate = resolve(cwd);
+    if (candidate !== workspace && !candidate.startsWith(`${workspace}/`)) {
+        throw new VerificationCommandPolicyError(`verification cwd must stay within the task workspace: ${candidate}`);
+    }
+};
+const assertExecutableAllowed = (executable, sideEffectLevel) => {
+    if (executable.length === 0) {
+        throw new VerificationCommandPolicyError("verification command cannot be empty");
+    }
+    switch (sideEffectLevel) {
+        case "read_only":
+            if (!READ_ONLY_EXECUTABLES.has(executable)) {
+                throw new VerificationCommandPolicyError(`command executable is not allowed for read-only verification: ${executable}`);
+            }
+            return;
+        case "workspace_write":
+            if (!WORKSPACE_WRITE_EXECUTABLES.has(executable)) {
+                throw new VerificationCommandPolicyError(`command executable is not allowlisted for workspace mutation: ${executable}`);
+            }
+            return;
+        case "external_side_effect":
+            throw new VerificationCommandPolicyError(`external side effects are not allowed for verification commands: ${executable}`);
+    }
+};
+const assertOriginAllowed = (origin, sideEffectLevel) => {
+    if (sideEffectLevel === "read_only") {
+        return;
+    }
+    if (origin === "worker") {
+        throw new VerificationCommandPolicyError(`worker-origin verification commands cannot request ${sideEffectLevel}`);
+    }
+};
+const assertConfirmationSatisfied = (command, executable) => {
+    const dangerous = isDangerousCommand(executable, command.command);
+    if (!dangerous && command.requiresConfirmation !== true) {
+        return;
+    }
+    if (command.confirmation === undefined) {
+        throw new VerificationCommandPolicyError(`verification command requires explicit confirmation before execution: ${command.name}`);
+    }
+};
+const isDangerousCommand = (executable, rawCommand) => {
+    if (DANGEROUS_TOKENS.has(executable)) {
+        return true;
+    }
+    if (executable === "git") {
+        return /\bgit\s+(?:reset|clean|checkout)\b/.test(rawCommand);
+    }
+    return false;
+};
+const assertNoShellControlSyntax = (argv) => {
+    for (const token of argv) {
+        if (containsShellControlSyntax(token)) {
+            throw new VerificationCommandPolicyError(`verification command contains disallowed shell control syntax: ${token}`);
+        }
+    }
+};
+const containsShellControlSyntax = (token) => {
+    if (token.length === 0) {
+        return false;
+    }
+    if (token.includes("$(") || token.includes("`") || token.includes("&&") || token.includes("||")) {
+        return true;
+    }
+    if (token === "|" ||
+        token === ";" ||
+        token === ">" ||
+        token === ">>" ||
+        token === "<" ||
+        token === "<<") {
+        return true;
+    }
+    return [...SHELL_CONTROL_OPERATORS].some((operator) => token !== operator && token.includes(operator));
+};
+const assertNoDangerousNestedExecution = (argv, sideEffectLevel) => {
+    const executable = normalizeExecutable(argv[0] ?? "");
+    if (executable === "git" && GIT_DESTRUCTIVE_SUBCOMMANDS.has(normalizeExecutable(argv[1] ?? ""))) {
+        throw new VerificationCommandPolicyError(`verification command cannot execute destructive git subcommand: ${argv[1]}`);
+    }
+    if (executable === "node") {
+        assertSafeNodeInvocation(argv, sideEffectLevel);
+        return;
+    }
+    if (EXEC_WRAPPERS.has(executable)) {
+        assertSafePackageManagerInvocation(executable, argv);
+    }
+};
+const assertSafeNodeInvocation = (argv, sideEffectLevel) => {
+    for (let index = 1; index < argv.length; index += 1) {
+        const token = argv[index];
+        if (token !== undefined && NODE_EVAL_FLAGS.has(token)) {
+            if (sideEffectLevel === "read_only" && isAllowedReadOnlyNodeEval(argv)) {
+                return;
+            }
+            if (sideEffectLevel === "read_only") {
+                throw new VerificationCommandPolicyError(`read-only verification cannot execute arbitrary node eval payloads: ${token}`);
+            }
+            const script = argv[index + 1] ?? "";
+            if (containsDangerousScriptToken(script)) {
+                throw new VerificationCommandPolicyError(`verification command cannot execute dangerous node eval payload: ${token}`);
+            }
+        }
+    }
+};
+const isAllowedReadOnlyNodeEval = (argv) => {
+    if (argv[0] !== ALLOWED_READ_ONLY_NODE_EVAL.command) {
+        return false;
+    }
+    return (argv.length === 1 + ALLOWED_READ_ONLY_NODE_EVAL.args.length &&
+        ALLOWED_READ_ONLY_NODE_EVAL.args.every((token, index) => argv[index + 1] === token));
+};
+const assertSafePackageManagerInvocation = (executable, argv) => {
+    if (executable === "npx") {
+        assertNestedExecutableAllowed(argv[1], "npx");
+        assertNestedGitSubcommandAllowed(argv.slice(1), "npx");
+        return;
+    }
+    for (let index = 1; index < argv.length; index += 1) {
+        const token = argv[index];
+        if (token === "exec") {
+            const nestedArgs = argv.slice(index + 1);
+            assertNestedExecutableAllowed(nestedArgs[0], `${executable} exec`);
+            assertNestedGitSubcommandAllowed(nestedArgs, `${executable} exec`);
+            return;
+        }
+    }
+};
+const assertNestedExecutableAllowed = (token, source) => {
+    const nested = normalizeExecutable(token ?? "");
+    if (nested.length === 0) {
+        return;
+    }
+    if (DANGEROUS_TOKENS.has(nested) || nested === "git") {
+        throw new VerificationCommandPolicyError(`verification command cannot launch nested executable via ${source}: ${nested}`);
+    }
+};
+const assertNestedGitSubcommandAllowed = (argv, source) => {
+    const nestedExecutable = normalizeExecutable(argv[0] ?? "");
+    if (nestedExecutable !== "git") {
+        return;
+    }
+    const subcommandIndex = argv[1] === "--" ? 2 : 1;
+    const subcommand = normalizeExecutable(argv[subcommandIndex] ?? "");
+    if (GIT_DESTRUCTIVE_SUBCOMMANDS.has(subcommand)) {
+        throw new VerificationCommandPolicyError(`verification command cannot launch destructive git subcommand via ${source}: ${subcommand}`);
+    }
+};
+const containsDangerousScriptToken = (script) => {
+    const lowered = script.toLowerCase();
+    const tokens = tokenizeScript(script).map((token) => normalizeExecutable(token));
+    return (tokens.some((token) => DANGEROUS_TOKENS.has(token)) ||
+        tokens.some((token, index) => token === "git" && GIT_DESTRUCTIVE_SUBCOMMANDS.has(tokens[index + 1] ?? "")) ||
+        /\bgit\s+reset\b/.test(lowered) ||
+        /\bgit\s+clean\b/.test(lowered) ||
+        /\bgit\s+checkout\b/.test(lowered) ||
+        containsShellControlSyntax(script));
+};
+const tokenizeScript = (value) => value.match(/[A-Za-z0-9_./:-]+/g) ?? [];
+const parseCommandString = (value) => {
+    const tokens = value.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
+    return tokens.map((token) => token.replace(/^['"]|['"]$/g, ""));
+};
+const normalizeExecutable = (value) => basename(value).toLowerCase();
+const sanitizeEnvironment = (env) => {
+    if (env === undefined) {
+        return undefined;
+    }
+    const filtered = Object.fromEntries(Object.entries(env).filter(([key]) => ENV_ALLOWLIST.has(key)));
+    return Object.keys(filtered).length === 0 ? undefined : filtered;
+};
+export const sanitizeResearchToolOutput = (value) => {
+    if (typeof value === "string") {
+        return redactEvidenceSummary(value).summary;
+    }
+    if (Array.isArray(value)) {
+        return value.map((entry) => sanitizeResearchToolOutput(entry));
+    }
+    if (typeof value === "object" && value !== null) {
+        return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, sanitizeResearchToolOutput(entry)]));
+    }
+    return value;
+};
+//# sourceMappingURL=command-policy.js.map