lastlight 0.1.15 → 0.2.1

package/dist/sandbox/index.js

@@ -1,65 +1,10 @@
 import { execFileSync } from "child_process";
-import { mkdirSync, writeFileSync, chmodSync } from "fs";
-import { join, resolve, sep } from "path";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { isAbsolute, join, relative, resolve, sep } from "path";
 import { DockerSandbox } from "./docker.js";
+import { SANDBOX_IMAGE, isSandboxAvailable } from "./images.js";
 export { DockerSandbox } from "./docker.js";
-/**
- * Refresh the project-local sandbox credentials from the macOS keychain
- * before spawning a sandbox.
- *
- * Why this exists:
- *   In LASTLIGHT_LOCAL_DEV mode the dev-local.sh script seeds
- *   ./data/sandbox-data/claude-home/.credentials.json from the host claude
- *   login at harness startup. But during a long dev session the host's
- *   `claude` CLI will refresh its OAuth token (rotating the access token in
- *   the keychain). When that happens the seeded file becomes stale — the
- *   server invalidates the old access token immediately on rotation, so the
- *   in-sandbox claude starts returning 401 even though the file's recorded
- *   expiresAt is still in the future.
- *
- *   Re-reading the keychain on every sandbox spawn keeps the in-sandbox
- *   credentials current without requiring the user to restart the harness.
- *
- * This is a no-op when:
- *   - LASTLIGHT_LOCAL_DEV is not set (production / Docker harness)
- *   - We're not on macOS
- *   - The keychain entry doesn't exist
- *   - SANDBOX_DATA_VOLUME doesn't look like a host path
- */
-function refreshLocalDevCredentials() {
-    if (process.env.LASTLIGHT_LOCAL_DEV !== "1")
-        return;
-    if (process.platform !== "darwin")
-        return;
-    const dataVolume = process.env.SANDBOX_DATA_VOLUME;
-    if (!dataVolume)
-        return;
-    // Only path-like values (the bind-mount form used in local dev)
-    if (!dataVolume.startsWith("/") &&
-        !dataVolume.startsWith("./") &&
-        !dataVolume.startsWith("../") &&
-        !dataVolume.startsWith("~")) {
-        return;
-    }
-    let dataDir = dataVolume;
-    if (dataDir.startsWith("~")) {
-        dataDir = (process.env.HOME || "") + dataDir.slice(1);
-    }
-    dataDir = resolve(dataDir);
-    try {
-        const creds = execFileSync("security", ["find-generic-password", "-s", "Claude Code-credentials", "-a", process.env.USER || "", "-w"], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 5000 }).trim();
-        if (!creds)
-            return;
-        const credPath = join(dataDir, "claude-home", ".credentials.json");
-        writeFileSync(credPath, creds);
-        chmodSync(credPath, 0o644);
-    }
-    catch {
-        // Keychain entry missing, security command unavailable, or write failed.
-        // Don't fail sandbox creation on this — the existing seeded file may
-        // still be valid.
-    }
-}
+export { SANDBOX_IMAGE, SANDBOX_IMAGE_QA, isSandboxAvailable, qaImageAvailable, } from "./images.js";
 /**
  * Clean up orphaned sandbox containers from previous runs.
  * Called on startup to remove containers that survived a harness restart.
@@ -79,34 +24,6 @@ export function cleanupOrphanedSandboxes() {
         // Docker not available or no containers — fine
     }
 }
-const SANDBOX_IMAGE = "lastlight-sandbox:latest";
-/**
- * Check if Docker sandbox mode is available.
- */
-export function isSandboxAvailable() {
-    return dockerAvailable() && sandboxImageExists(SANDBOX_IMAGE);
-}
-function dockerAvailable() {
-    try {
-        execFileSync("docker", ["info"], { stdio: "ignore", timeout: 5000 });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function sandboxImageExists(imageName) {
-    try {
-        const out = execFileSync("docker", ["images", "-q", imageName], {
-            encoding: "utf-8",
-            stdio: ["pipe", "pipe", "pipe"],
-        });
-        return out.trim().length > 0;
-    }
-    catch {
-        return false;
-    }
-}
 /** Cached check — only probe Docker once per process */
 let _sandboxAvailable = null;
 export function sandboxAvailable() {
@@ -124,6 +41,25 @@ export function sandboxAvailable() {
 function isWithinDir(parent, child) {
     return child === parent || child.startsWith(`${parent}${sep}`);
 }
+/**
+ * Set up the per-task worktree directory (mkdir + optional pre-clone) without
+ * touching Docker. Used by the non-docker sandbox modes (gondolin / none) where
+ * agentic-pi runs in-process or in a VM rather than a container, but still
+ * wants a per-task workspace cloned from the target branch.
+ */
+export function setupTaskWorktree(opts) {
+    const sandboxBase = resolve(opts.sandboxDir || join(opts.stateDir, "sandboxes"));
+    mkdirSync(sandboxBase, { recursive: true });
+    const workDir = resolve(sandboxBase, opts.taskId);
+    if (!isWithinDir(sandboxBase, workDir)) {
+        throw new Error(`Invalid taskId path escape attempt: ${opts.taskId}`);
+    }
+    mkdirSync(workDir, { recursive: true });
+    if (opts.prePopulate) {
+        prePopulateWorkspace(workDir, opts.prePopulate);
+    }
+    return workDir;
+}
 /**
  * Create a sandbox for a task. Returns the sandbox and a cleanup function.
  * If Docker is not available, returns null (caller should fall back to direct execution).
@@ -131,10 +67,6 @@ function isWithinDir(parent, child) {
 export async function createTaskSandbox(opts) {
     if (!sandboxAvailable())
         return null;
-    // In LASTLIGHT_LOCAL_DEV mode, refresh the project-local claude credentials
-    // from the host keychain before each sandbox spawn (handles token rotation
-    // during long dev sessions). No-op in production.
-    refreshLocalDevCredentials();
     const sandboxBase = resolve(opts.sandboxDir || join(opts.stateDir, "sandboxes"));
     mkdirSync(sandboxBase, { recursive: true });
     const workDir = resolve(sandboxBase, opts.taskId);
@@ -142,12 +74,21 @@ export async function createTaskSandbox(opts) {
         throw new Error(`Invalid taskId path escape attempt: ${opts.taskId}`);
     }
     mkdirSync(workDir, { recursive: true });
+    if (opts.prePopulate) {
+        prePopulateWorkspace(workDir, opts.prePopulate);
+    }
     const sandbox = new DockerSandbox({
-        imageName: SANDBOX_IMAGE,
+        imageName: opts.imageName || SANDBOX_IMAGE,
         env: opts.env || {},
+        memoryLimit: process.env.SANDBOX_MEMORY_LIMIT || undefined,
+        dnsIp: opts.dnsIp,
     });
     try {
-        await sandbox.create({ taskId: opts.taskId, worktreePath: workDir });
+        await sandbox.create({
+            taskId: opts.taskId,
+            worktreePath: workDir,
+            workspaceMount: resolveWorkspaceMount(opts.stateDir, workDir),
+        });
         return {
             sandbox,
             workDir,
@@ -159,4 +100,193 @@ export async function createTaskSandbox(opts) {
         return null;
     }
 }
+/**
+ * Decide how the sandbox container should mount `/home/agent/workspace`.
+ *
+ * The harness writes the per-task workspace to `workDir`, which is always
+ * under `stateDir` (`sandboxes/<taskId>/`). In production, `stateDir` is
+ * served by a named docker volume mounted into the harness container. A
+ * plain `-v workDir:/home/agent/workspace` bind makes the daemon resolve
+ * `workDir` against the *host* filesystem, where the named volume's
+ * content is not visible — docker silently creates an empty dir at that
+ * host path and mounts it, so the sandbox sees an empty workspace and the
+ * skills the harness staged are never reachable.
+ *
+ * In volume mode we ask docker for a `volume-subpath` mount instead, so
+ * the sandbox sees exactly the harness's view. In path mode (local dev,
+ * or any deployment where SANDBOX_DATA_VOLUME is a host path) a normal
+ * bind is correct because both views point at the same FS path.
+ *
+ * Edge case: if `opts.sandboxDir` was overridden to live outside `stateDir`,
+ * we can't carve a volume-subpath out of the data volume — fall back to
+ * a bind mount. That keeps the no-data-volume dev path working; the
+ * named-volume + custom-sandboxDir combination isn't currently used.
+ */
+function resolveWorkspaceMount(stateDir, workDir) {
+    const dataVolumeRaw = process.env.SANDBOX_DATA_VOLUME || "lastlight_agent-data";
+    if (isPathLike(dataVolumeRaw)) {
+        return { type: "bind", hostPath: workDir };
+    }
+    const rel = relative(resolve(stateDir), workDir);
+    if (rel === "" || rel.startsWith("..") || isAbsolute(rel)) {
+        return { type: "bind", hostPath: workDir };
+    }
+    return { type: "volume-subpath", volume: dataVolumeRaw, subpath: rel };
+}
+function isPathLike(value) {
+    return value.startsWith("/") ||
+        value.startsWith("./") ||
+        value.startsWith("../") ||
+        value.startsWith("~");
+}
+/** Marker file (at the workspace root, outside the repo so `git clean` can't
+ * touch it) recording which run last provisioned this workspace. */
+const RUN_MARKER = ".lastlight-run";
+/**
+ * Clone the repo into `<workDir>/<repo>` at the given branch.
+ *
+ * Three cases:
+ * - **Fresh dir** (no `.git`): clone. `--depth 1 --single-branch` for
+ *   read-only workflows (`pre.shallow`), `--depth 50` otherwise.
+ * - **Same run revisiting the workspace** (`.git` exists, run marker matches
+ *   `pre.runId`): preserve — this is a later phase of the same run reading
+ *   what an earlier phase wrote (architect's `plan.md`, the reviewer's
+ *   checkout). No git ops.
+ * - **A fresh run reusing an old per-PR workspace** (`.git` exists, marker
+ *   differs/absent): fetch + hard-reset to the remote branch + `git clean`
+ *   that **keeps `node_modules`** so the next `npm install` is incremental.
+ *   This is the re-review fast path from issue #107.
+ */
+export { prePopulateWorkspace as __prePopulateWorkspaceForTest };
+function prePopulateWorkspace(workDir, pre) {
+    // Token shape is asserted in src/engine/git-auth.ts before we get here,
+    // but re-check the narrow set here too — defense in depth, this string
+    // crosses a process boundary into git's command line.
+    if (!/^[A-Za-z0-9_-]+$/.test(pre.token)) {
+        throw new Error("prePopulate: refusing to embed a token outside [A-Za-z0-9_-]");
+    }
+    const url = `https://x-access-token:${pre.token}@github.com/${pre.owner}/${pre.repo}.git`;
+    // The agent's cwd is `workDir` (the workspace). The harness writes
+    // `AGENTS.md` there, so cloning into the workDir root would collide.
+    // Instead, clone into a `<repo>/` subdirectory — keeps the layout
+    // consistent regardless of whether the harness or the agent did the
+    // clone, and leaves room for `.lastlight/issue-N/` scratch space at
+    // the workspace root.
+    const repoDir = join(workDir, pre.repo);
+    const markerPath = join(workDir, RUN_MARKER);
+    // Repo dir might already exist — from a later phase of the same run, or a
+    // *different* run reusing a stable per-PR workspace (issue #107).
+    if (existsSync(join(repoDir, ".git"))) {
+        const lastRun = readMarker(markerPath);
+        // Same run (or a caller that doesn't track runs): preserve the workspace
+        // exactly — earlier phases may have written uncommitted scratch here.
+        if (!pre.runId || lastRun === pre.runId) {
+            console.log(`[sandbox] Pre-clone skipped: ${repoDir} already a git repo (same run).`);
+            return;
+        }
+        // Different run reusing this PR's workspace — refresh in place.
+        refreshExistingClone(repoDir, markerPath, pre);
+        return;
+    }
+    const scrub = (s) => typeof s === "string" ? s.replaceAll(pre.token, "[REDACTED-TOKEN]") : "";
+    const start = Date.now();
+    const depth = pre.shallow ? "1" : "50";
+    const shallowArgs = pre.shallow ? ["--single-branch"] : [];
+    try {
+        execFileSync("git", ["clone", "--branch", pre.branch, "--depth", depth, ...shallowArgs, url, repoDir], { stdio: "pipe", timeout: 120_000 });
+        writeMarker(markerPath, pre.runId);
+        const ms = Date.now() - start;
+        console.log(`[sandbox] Pre-cloned ${pre.owner}/${pre.repo}@${pre.branch} into ${repoDir} ` +
+            `(depth ${depth}, ${ms}ms)`);
+    }
+    catch (err) {
+        const firstError = scrub(err?.message) || scrub(err?.stderr?.toString?.()) || "unknown error";
+        const looksLikeMissingBranch = /Remote branch .* not found|not found in upstream/i.test(firstError);
+        if (looksLikeMissingBranch) {
+            // Build-style workflows create a brand-new branch (e.g. `lastlight/N-slug`)
+            // and push it later. The remote doesn't have it yet at pre-clone time —
+            // clone the default branch, then create the target branch locally so
+            // the agent enters a workspace already on the right branch with the
+            // right upstream URL configured.
+            try {
+                execFileSync("git", ["clone", "--depth", depth, ...shallowArgs, url, repoDir], { stdio: "pipe", timeout: 120_000 });
+                execFileSync("git", ["-C", repoDir, "checkout", "-b", pre.branch], { stdio: "pipe", timeout: 30_000 });
+                writeMarker(markerPath, pre.runId);
+                const ms = Date.now() - start;
+                console.log(`[sandbox] Pre-cloned ${pre.owner}/${pre.repo} (default branch) into ${repoDir} ` +
+                    `and created local branch ${pre.branch} (${ms}ms)`);
+                return;
+            }
+            catch (err2) {
+                const secondError = scrub(err2?.message) || scrub(err2?.stderr?.toString?.()) || "unknown error";
+                console.warn(`[sandbox] Pre-clone fallback of ${pre.owner}/${pre.repo} failed (${secondError}). ` +
+                    `Agent will need to clone via MCP.`);
+                return;
+            }
+        }
+        // Don't kill the run on a failed pre-clone — fall through to an empty
+        // workspace and let the agent clone via the MCP path as a backup.
+        //
+        // CRITICAL: execFileSync errors echo the failing command line, which
+        // includes the auth URL `https://x-access-token:<token>@github.com/…`.
+        // The token is scrubbed above before anything reaches the logs.
+        console.warn(`[sandbox] Pre-clone of ${pre.owner}/${pre.repo}@${pre.branch} failed (${firstError}). ` +
+            `Agent will need to clone via MCP.`);
+    }
+}
+function readMarker(markerPath) {
+    try {
+        return readFileSync(markerPath, "utf-8").trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeMarker(markerPath, runId) {
+    if (!runId)
+        return;
+    try {
+        writeFileSync(markerPath, runId);
+    }
+    catch {
+        // Best-effort — a missing marker just means the next reuse refreshes
+        // (the safe direction), never a wrong-preserve.
+    }
+}
+/**
+ * Refresh a reused per-PR workspace in place: fetch the branch, hard-reset the
+ * checkout to it, and `git clean` away stale tracked/untracked build output —
+ * but **keep `node_modules`** (and any nested ones) so the next install is
+ * incremental against a warm tree. The shared package cache (docker backend)
+ * lives on a separate mount and is untouched by `git clean`.
+ *
+ * On any failure we leave the workspace as-is and do NOT advance the marker,
+ * so the next run retries the refresh rather than reviewing a half-reset tree.
+ */
+function refreshExistingClone(repoDir, markerPath, pre) {
+    const scrub = (s) => typeof s === "string" ? s.replaceAll(pre.token, "[REDACTED-TOKEN]") : "";
+    const url = `https://x-access-token:${pre.token}@github.com/${pre.owner}/${pre.repo}.git`;
+    const depth = pre.shallow ? ["--depth", "1"] : ["--depth", "50"];
+    const start = Date.now();
+    try {
+        // Fetch the branch from the authenticated URL directly so we don't depend
+        // on the stored remote (and never persist the token into .git/config).
+        execFileSync("git", ["-C", repoDir, "fetch", ...depth, url, pre.branch], { stdio: "pipe", timeout: 120_000 });
+        execFileSync("git", ["-C", repoDir, "checkout", "-B", pre.branch, "FETCH_HEAD"], { stdio: "pipe", timeout: 30_000 });
+        execFileSync("git", ["-C", repoDir, "reset", "--hard", "FETCH_HEAD"], { stdio: "pipe", timeout: 30_000 });
+        // -x removes ignored files (stale dist/, .turbo, coverage, …); -e keeps the
+        // dependency trees warm so install is incremental. `node_modules` with no
+        // leading slash matches at any depth (monorepos / workspaces).
+        execFileSync("git", ["-C", repoDir, "clean", "-fdx", "-e", "node_modules"], { stdio: "pipe", timeout: 60_000 });
+        writeMarker(markerPath, pre.runId);
+        const ms = Date.now() - start;
+        console.log(`[sandbox] Refreshed reused workspace ${repoDir} → ${pre.branch} ` +
+            `(fetch+reset+clean, node_modules kept, ${ms}ms)`);
+    }
+    catch (err) {
+        const reason = scrub(err?.message) || scrub(err?.stderr?.toString?.()) || "unknown error";
+        console.warn(`[sandbox] Refresh of reused workspace ${repoDir} failed (${reason}). ` +
+            `Leaving it untouched; agent can re-fetch via MCP.`);
+    }
+}
 //# sourceMappingURL=index.js.map

package/dist/sandbox/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,0BAA0B;IACjC,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG;QAAE,OAAO;IACpD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO;IAE1C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACnD,IAAI,CAAC,UAAU;QAAE,OAAO;IACxB,gEAAgE;IAChE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAC3B,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QAC5B,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC7B,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,OAAO,GAAG,UAAU,CAAC;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CACxB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,EAC9F,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CACtE,CAAC,IAAI,EAAE,CAAC;QAET,IAAI,CAAC,KAAK;YAAE,OAAO;QAEnB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;QACnE,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC/B,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,qEAAqE;QACrE,kBAAkB;IACpB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE;YACjC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,wBAAwB;SACjD,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,MAAM,gCAAgC,CAAC,CAAC;YACjF,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;AACH,CAAC;AAED,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAEjD;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,eAAe,EAAE,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE;YAC9D,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,IAAI,iBAAiB,GAAmB,IAAI,CAAC;AAE7C,MAAM,UAAU,gBAAgB;IAC9B,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,iBAAiB,GAAG,kBAAkB,EAAE,CAAC;QACzC,IAAI,iBAAiB,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,8CAA8C,aAAa,GAAG,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,KAAa;IAChD,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAKvC;IACC,IAAI,CAAC,gBAAgB,EAAE;QAAE,OAAO,IAAI,CAAC;IAErC,4EAA4E;IAC5E,2EAA2E;IAC3E,kDAAkD;IAClD,0BAA0B,EAAE,CAAC;IAE7B,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACjF,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAExC,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;QAChC,SAAS,EAAE,aAAa;QACxB,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE;KACpB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,OAAO;YACL,OAAO;YACP,OAAO;YACP,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;SAC5C,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,uCAAuC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChE,OAAO,EAAE,aAAa,EAAuB,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB;;;GAGG;AACH,MAAM,UAAU,wBAAwB;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE;YACjC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,wBAAwB;SACjD,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,MAAM,gCAAgC,CAAC,CAAC;YACjF,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,IAAI,iBAAiB,GAAmB,IAAI,CAAC;AAE7C,MAAM,UAAU,gBAAgB;IAC9B,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,iBAAiB,GAAG,kBAAkB,EAAE,CAAC;QACzC,IAAI,iBAAiB,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,8CAA8C,aAAa,GAAG,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,KAAa;IAChD,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAejC;IACC,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACjF,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAExC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAwCvC;IACC,IAAI,CAAC,gBAAgB,EAAE;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACjF,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAExC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;QAChC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,aAAa;QAC1C,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE;QACnB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,SAAS;QAC1D,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,OAAO;YACrB,cAAc,EAAE,qBAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;SAC9D,CAAC,CAAC;QACH,OAAO;YACL,OAAO;YACP,OAAO;YACP,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;SAC5C,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,uCAAuC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,qBAAqB,CAC5B,QAAgB,EAChB,OAAe;IAEf,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,sBAAsB,CAAC;IAChF,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;IACjD,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAC1B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QACtB,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QACvB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED;oEACoE;AACpE,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAWpC;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,oBAAoB,IAAI,6BAA6B,EAAE,CAAC;AAEjE,SAAS,oBAAoB,CAC3B,OAAe,EACf,GAAgB;IAEhB,wEAAwE;IACxE,uEAAuE;IACvE,sDAAsD;IACtD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,GAAG,GAAG,0BAA0B,GAAG,CAAC,KAAK,eAAe,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC;IAC1F,mEAAmE;IACnE,qEAAqE;IACrE,kEAAkE;IAClE,oEAAoE;IACpE,oEAAoE;IACpE,sBAAsB;IACtB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,kEAAkE;IAClE,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACvC,yEAAyE;QACzE,sEAAsE;QACtE,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC;YACxC,OAAO,CAAC,GAAG,CACT,gCAAgC,OAAO,iCAAiC,CACzE,CAAC;YACF,OAAO;QACT,CAAC;QACD,gEAAgE;QAChE,oBAAoB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAU,EAAU,EAAE,CACnC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,IAAI,CAAC;QACH,YAAY,CACV,KAAK,EACL,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,EACjF,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CACpC,CAAC;QACF,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QAC9B,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,SAAS,OAAO,GAAG;YAC9E,UAAU,KAAK,KAAK,EAAE,KAAK,CAC5B,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC;QAC9F,MAAM,sBAAsB,GAAG,mDAAmD,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpG,IAAI,sBAAsB,EAAE,CAAC;YAC3B,4EAA4E;YAC5E,wEAAwE;YACxE,qEAAqE;YACrE,oEAAoE;YACpE,iCAAiC;YACjC,IAAI,CAAC;gBACH,YAAY,CACV,KAAK,EACL,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,EACzD,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CACpC,CAAC;gBACF,YAAY,CACV,KAAK,EACL,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAC7C,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CACnC,CAAC;gBACF,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;gBACnC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;gBAC9B,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,0BAA0B,OAAO,GAAG;oBACjF,4BAA4B,GAAG,CAAC,MAAM,KAAK,EAAE,KAAK,CACnD,CAAC;gBACF,OAAO;YACT,CAAC;YAAC,OAAO,IAAS,EAAE,CAAC;gBACnB,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC;gBACjG,OAAO,CAAC,IAAI,CACV,mCAAmC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,YAAY,WAAW,KAAK;oBACpF,mCAAmC,CACpC,CAAC;gBACF,OAAO;YACT,CAAC;QACH,CAAC;QACD,sEAAsE;QACtE,kEAAkE;QAClE,EAAE;QACF,qEAAqE;QACrE,uEAAuE;QACvE,gEAAgE;QAChE,OAAO,CAAC,IAAI,CACV,0BAA0B,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,YAAY,UAAU,KAAK;YACxF,mCAAmC,CACpC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,UAAkB;IACpC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,KAAyB;IAChE,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,CAAC;QACH,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,gDAAgD;IAClD,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAC3B,OAAe,EACf,UAAkB,EAClB,GAAgB;IAEhB,MAAM,KAAK,GAAG,CAAC,CAAU,EAAU,EAAE,CACnC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,GAAG,GAAG,0BAA0B,GAAG,CAAC,KAAK,eAAe,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC;IAC1F,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,0EAA0E;QAC1E,uEAAuE;QACvE,YAAY,CACV,KAAK,EACL,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,EACnD,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CACpC,CAAC;QACF,YAAY,CACV,KAAK,EACL,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,EAC3D,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CACnC,CAAC;QACF,YAAY,CACV,KAAK,EACL,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,EAChD,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CACnC,CAAC;QACF,4EAA4E;QAC5E,0EAA0E;QAC1E,+DAA+D;QAC/D,YAAY,CACV,KAAK,EACL,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,EACtD,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CACnC,CAAC;QACF,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QAC9B,OAAO,CAAC,GAAG,CACT,wCAAwC,OAAO,MAAM,GAAG,CAAC,MAAM,GAAG;YAClE,0CAA0C,EAAE,KAAK,CAClD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC;QAC1F,OAAO,CAAC,IAAI,CACV,yCAAyC,OAAO,YAAY,MAAM,KAAK;YACvE,mDAAmD,CACpD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/sandbox/index.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sandbox/index.test.js

@@ -0,0 +1,157 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+vi.mock("child_process", async (importOriginal) => {
+    const actual = await importOriginal();
+    return { ...actual, execFileSync: vi.fn() };
+});
+import { execFileSync } from "child_process";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync, } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import { __prePopulateWorkspaceForTest as prePopulateWorkspace } from "./index.js";
+const mockExec = vi.mocked(execFileSync);
+const TOKEN = "ghs_secret123ABC_xyz";
+/** Flatten every execFileSync invocation's argv (args[1]) for assertions. */
+function calledArgs() {
+    return mockExec.mock.calls.map((c) => c[1] ?? []);
+}
+describe("prePopulateWorkspace token-leak protection", () => {
+    afterEach(() => {
+        vi.restoreAllMocks();
+        mockExec.mockReset();
+    });
+    it("does not leak the token into the success log line", () => {
+        const logSpy = vi.spyOn(console, "log").mockImplementation(() => { });
+        mockExec.mockReturnValue(Buffer.from(""));
+        prePopulateWorkspace("/tmp/work", {
+            owner: "cliftonc",
+            repo: "lastlight",
+            branch: "opencode-fork",
+            token: TOKEN,
+        });
+        const joined = logSpy.mock.calls.flat().join("\n");
+        expect(joined).not.toContain(TOKEN);
+    });
+    it("redacts the token from the warning when git clone fails", () => {
+        const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => { });
+        // execFileSync surfaces command failures with an Error whose .message
+        // echoes the full command — including the authenticated URL. Reproduce
+        // that shape here.
+        const failure = new Error(`Command failed: git clone --branch opencode-fork --depth 50 ` +
+            `https://x-access-token:${TOKEN}@github.com/cliftonc/lastlight.git /tmp/work\n` +
+            `fatal: could not create work tree dir '/tmp/work'`);
+        mockExec.mockImplementation(() => { throw failure; });
+        prePopulateWorkspace("/tmp/work", {
+            owner: "cliftonc",
+            repo: "lastlight",
+            branch: "opencode-fork",
+            token: TOKEN,
+        });
+        expect(warnSpy).toHaveBeenCalledTimes(1);
+        const logged = warnSpy.mock.calls[0].join(" ");
+        expect(logged).not.toContain(TOKEN);
+        expect(logged).toContain("[REDACTED-TOKEN]");
+        // Sanity: the non-secret part of the diagnostic is preserved.
+        expect(logged).toContain("opencode-fork");
+        expect(logged).toContain("Pre-clone");
+    });
+    it("refuses to embed tokens containing characters outside [A-Za-z0-9_-]", () => {
+        const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => { });
+        expect(() => prePopulateWorkspace("/tmp/work", {
+            owner: "x",
+            repo: "y",
+            branch: "z",
+            token: 'evil";rm -rf /;"',
+        })).toThrow(/outside \[A-Za-z0-9_-\]/);
+        expect(mockExec).not.toHaveBeenCalled();
+        warnSpy.mockRestore();
+    });
+});
+describe("prePopulateWorkspace clone depth + per-PR reuse (issue #107)", () => {
+    let workDir;
+    const REPO = "lastlight";
+    beforeEach(() => {
+        workDir = mkdtempSync(join(tmpdir(), "ll-prepop-"));
+        vi.spyOn(console, "log").mockImplementation(() => { });
+        vi.spyOn(console, "warn").mockImplementation(() => { });
+        mockExec.mockReturnValue(Buffer.from(""));
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+        mockExec.mockReset();
+        rmSync(workDir, { recursive: true, force: true });
+    });
+    /** Pretend the workspace already has a clone, with `marker` as last run. */
+    function seedExistingClone(marker) {
+        mkdirSync(join(workDir, REPO, ".git"), { recursive: true });
+        if (marker !== undefined)
+            writeFileSync(join(workDir, ".lastlight-run"), marker);
+    }
+    it("clones read-only workflows shallow (--depth 1 --single-branch)", () => {
+        prePopulateWorkspace(workDir, {
+            owner: "cliftonc", repo: REPO, branch: "main", token: TOKEN,
+            runId: "run-1", shallow: true,
+        });
+        const clone = calledArgs().find((a) => a[0] === "clone");
+        expect(clone).toContain("--depth");
+        expect(clone[clone.indexOf("--depth") + 1]).toBe("1");
+        expect(clone).toContain("--single-branch");
+        // Marker stamped so a later same-run phase preserves the workspace.
+        expect(readFileSync(join(workDir, ".lastlight-run"), "utf-8")).toBe("run-1");
+    });
+    it("clones code-writing workflows deep (--depth 50, no --single-branch)", () => {
+        prePopulateWorkspace(workDir, {
+            owner: "cliftonc", repo: REPO, branch: "main", token: TOKEN,
+            runId: "run-1", shallow: false,
+        });
+        const clone = calledArgs().find((a) => a[0] === "clone");
+        expect(clone[clone.indexOf("--depth") + 1]).toBe("50");
+        expect(clone).not.toContain("--single-branch");
+    });
+    it("preserves the workspace when a later phase of the SAME run revisits it", () => {
+        seedExistingClone("run-1");
+        prePopulateWorkspace(workDir, {
+            owner: "cliftonc", repo: REPO, branch: "main", token: TOKEN, runId: "run-1",
+        });
+        // No git ops — the architect's uncommitted scratch must survive.
+        expect(mockExec).not.toHaveBeenCalled();
+    });
+    it("preserves the workspace for callers that don't track a run id", () => {
+        seedExistingClone();
+        prePopulateWorkspace(workDir, {
+            owner: "cliftonc", repo: REPO, branch: "main", token: TOKEN,
+        });
+        expect(mockExec).not.toHaveBeenCalled();
+    });
+    it("refreshes (fetch+reset+clean) when a DIFFERENT run reuses the PR dir", () => {
+        seedExistingClone("old-run");
+        prePopulateWorkspace(workDir, {
+            owner: "cliftonc", repo: REPO, branch: "pr-head", token: TOKEN,
+            runId: "new-run", shallow: true,
+        });
+        const verbs = calledArgs().map((a) => a[a.indexOf("-C") + 2]);
+        expect(verbs).toEqual(["fetch", "checkout", "reset", "clean"]);
+        // node_modules is kept warm so the next install is incremental.
+        const clean = calledArgs().find((a) => a.includes("clean"));
+        expect(clean).toContain("-e");
+        expect(clean).toContain("node_modules");
+        // Never re-clones from scratch.
+        expect(calledArgs().some((a) => a[0] === "clone")).toBe(false);
+        // Marker advanced to the new run.
+        expect(readFileSync(join(workDir, ".lastlight-run"), "utf-8")).toBe("new-run");
+    });
+    it("does not advance the marker if the refresh fetch fails", () => {
+        seedExistingClone("old-run");
+        mockExec.mockImplementation((_cmd, args) => {
+            if (args.includes("fetch"))
+                throw new Error("network down");
+            return Buffer.from("");
+        });
+        prePopulateWorkspace(workDir, {
+            owner: "cliftonc", repo: REPO, branch: "pr-head", token: TOKEN,
+            runId: "new-run", shallow: true,
+        });
+        // Stale marker retained → the next run retries the refresh.
+        expect(readFileSync(join(workDir, ".lastlight-run"), "utf-8")).toBe("old-run");
+    });
+});
+//# sourceMappingURL=index.test.js.map

package/dist/sandbox/index.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../../src/sandbox/index.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzE,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAChD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAkC,CAAC;IACtE,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;AAC9C,CAAC,CAAC,CAAC;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAEL,SAAS,EACT,WAAW,EACX,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,6BAA6B,IAAI,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEnF,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AAEzC,MAAM,KAAK,GAAG,sBAAsB,CAAC;AAErC,6EAA6E;AAC7E,SAAS,UAAU;IACjB,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,CAAC,CAAc,IAAI,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;QACrB,QAAQ,CAAC,SAAS,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrE,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1C,oBAAoB,CAAC,WAAW,EAAE;YAChC,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,eAAe;YACvB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,mBAAmB;QACnB,MAAM,OAAO,GAAG,IAAI,KAAK,CACvB,8DAA8D;YAC9D,0BAA0B,KAAK,gDAAgD;YAC/E,mDAAmD,CACpD,CAAC;QACF,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAEtD,oBAAoB,CAAC,WAAW,EAAE;YAChC,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,eAAe;YACvB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC7C,8DAA8D;QAC9D,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,WAAW,EAAE;YAC7C,KAAK,EAAE,GAAG;YACV,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,kBAAkB;SAC1B,CAAC,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;QACvC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACxC,OAAO,CAAC,WAAW,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8DAA8D,EAAE,GAAG,EAAE;IAC5E,IAAI,OAAe,CAAC;IACpB,MAAM,IAAI,GAAG,WAAW,CAAC;IAEzB,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;QACpD,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtD,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvD,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;QACrB,QAAQ,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,SAAS,iBAAiB,CAAC,MAAe;QACxC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,IAAI,MAAM,KAAK,SAAS;YAAE,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;IACnF,CAAC;IAED,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,oBAAoB,CAAC,OAAO,EAAE;YAC5B,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;YAC3D,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI;SAC9B,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAE,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC3C,oEAAoE;QACpE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,oBAAoB,CAAC,OAAO,EAAE;YAC5B,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;YAC3D,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK;SAC/B,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAE,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC3B,oBAAoB,CAAC,OAAO,EAAE;YAC5B,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO;SAC5E,CAAC,CAAC;QACH,iEAAiE;QACjE,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,iBAAiB,EAAE,CAAC;QACpB,oBAAoB,CAAC,OAAO,EAAE;YAC5B,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;SAC5D,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC7B,oBAAoB,CAAC,OAAO,EAAE;YAC5B,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK;YAC9D,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI;SAChC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,gEAAgE;QAChE,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAE,CAAC;QAC7D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACxC,gCAAgC;QAChC,MAAM,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,kCAAkC;QAClC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC7B,QAAQ,CAAC,kBAAkB,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;YACzC,IAAK,IAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;YAC1E,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,oBAAoB,CAAC,OAAO,EAAE;YAC5B,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK;YAC9D,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI;SAChC,CAAC,CAAC;QACH,4DAA4D;QAC5D,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/session-log.d.ts

@@ -0,0 +1,63 @@
+export declare const CHAT_PROJECT_SLUG = "-app";
+export type SessionLogScope = "sandbox" | "chat";
+/** Normalized message shape returned by session-log readers. */
+export interface JsonlMessage {
+    role: string;
+    content?: unknown;
+    tool_calls?: unknown;
+    tool_name?: string;
+    tool_call_id?: string;
+    timestamp?: string;
+    reasoning?: unknown;
+    finish_reason?: string;
+    [k: string]: unknown;
+}
+export interface SessionLogRef {
+    projectSlug: string;
+    sessionId: string;
+}
+export interface SessionLogEntry {
+    id: string;
+    filePath: string;
+    mtimeMs: number;
+    projectSlug: string;
+}
+export interface NormalizedLogRecord {
+    timestamp: string;
+    msg: JsonlMessage;
+    raw: Record<string, unknown>;
+}
+/**
+ * Filesystem cwd → project-dir slug (matches the SDK convention). The
+ * absolute path with `/` replaced by `-`. `/app` → `-app`,
+ * `/home/agent/workspace` → `-home-agent-workspace`.
+ */
+export declare function projectSlugForCwd(cwd: string): string;
+export declare class SessionLog {
+    private homeDir;
+    constructor(homeDir: string);
+    normalizeSessionId(sessionId: string): string | null;
+    pathForProject(projectSlug: string, sessionId: string, opts?: {
+        requireExists?: boolean;
+    }): string | null;
+    findSession(scope: SessionLogScope, sessionId: string): SessionLogEntry | null;
+    listSessions(scope: SessionLogScope): SessionLogEntry[];
+    relatedFilesForSession(scope: SessionLogScope, sessionId: string, opts?: {
+        includeAgents?: boolean;
+    }): string[];
+    appendEnvelopeLines(ref: SessionLogRef, lines: object[]): Promise<void>;
+    readNormalizedFile(filePath: string, opts?: {
+        skipEmptySystem?: boolean;
+    }): Promise<NormalizedLogRecord[]>;
+    readNormalizedSession(scope: SessionLogScope, sessionId: string, opts?: {
+        includeAgents?: boolean;
+        skipEmptySystem?: boolean;
+    }): Promise<Array<{
+        index: number;
+        msg: JsonlMessage;
+    }>>;
+    normalizeLine(raw: Record<string, unknown>): JsonlMessage[];
+    private isSafeProjectSlug;
+    private projectDirs;
+    private mtimeMs;
+}