lastlight 0.6.2 → 0.7.1

package/dist/sandbox/sandbox.d.ts

@@ -0,0 +1,189 @@
+import type { RunResult, ThinkingLevel } from "agentic-pi";
+import type { OtelConfig, SandboxBackend } from "../config/config.js";
+/**
+ * The **Sandbox port** — the single named interface every isolation backend
+ * (`docker`, `smol`, `gondolin`, `none`) implements. Before this seam existed,
+ * the orchestration around the four backends was copy-pasted twin-for-twin
+ * (`executeDocker` / `executeSmol` / `executeInProcess`). Now the orchestrator
+ * (`src/engine/executors/orchestrator.ts`) is written once and drives any
+ * adapter through these methods.
+ *
+ * See `CONTEXT.md` → "Sandbox execution" for the pinned vocabulary; in short:
+ *   - **Sandbox** (this interface) is the *port*.
+ *   - **adapters** are the concrete backends below (`DockerSandbox`,
+ *     `SmolSandbox`, `InProcessSandbox`, `FakeSandbox`). Each owns its
+ *     isolation mechanism + egress enforcement; none of that surfaces here.
+ *   - the **orchestrator** is the deep module that brackets a run.
+ *
+ * A Sandbox instance is created per task (the factory carries `taskId`), so the
+ * `taskId` argument on `runAgent` / `runCommand` is threaded purely for the
+ * underlying driver APIs.
+ */
+export interface Sandbox {
+    /** Which backend this adapter is — used only for telemetry tagging. */
+    readonly backend: SandboxBackend;
+    /**
+     * Provision the workspace and any isolation primitive (container / VM /
+     * worktree). **Owns provisioning** — each adapter orders its own
+     * clone-vs-boot internally (docker pre-clones then mounts; smol boots then
+     * probes the share then clones; in-process just sets up the worktree) and
+     * returns the two paths the orchestrator needs.
+     */
+    provision(prePopulate?: PrePopulateSpec): Promise<ProvisionResult>;
+    /**
+     * Stage this phase's skill bundle into the workspace and return the skill
+     * dirs to hand the agent (already mapped to sandbox-visible paths). The
+     * mode (symlink vs copy), root (workspace vs cwd), and any post-stage git
+     * exclusion are adapter-local. Returns undefined when the phase has none.
+     */
+    stageSkills(phaseKey: string, skillPaths: string[] | undefined): string[] | undefined;
+    /**
+     * Map a workspace-relative path (written to `hostWorkspaceDir`) to the
+     * absolute path the sandboxed process sees. Used for staged `type: script`
+     * source files. docker/smol prefix the in-sandbox workspace root; in-process
+     * returns the host path verbatim.
+     */
+    sandboxPathFor(relPath: string): string;
+    /**
+     * Run one agent turn. Emits **parsed** event records to `onEvent` — the
+     * `startsWith("{")` guard + `JSON.parse` of the subprocess line stream live
+     * inside the docker/smol adapters; the in-process adapter forwards
+     * agentic-pi's already-parsed events straight through. Returns the run's
+     * authoritative `RunResult` when the adapter has one (in-process), else
+     * `undefined` (docker/smol) — the orchestrator reconstructs it from the
+     * accumulated events in that case.
+     */
+    runAgent(taskId: string, prompt: string, opts: RunAgentOpts, onEvent: (record: SandboxEvent) => void): Promise<RunResult | undefined>;
+    /** Run a deterministic shell command (no LLM). Resolves with its raw result. */
+    runCommand(taskId: string, command: string, opts: RunCommandOpts): Promise<RawCommandResult>;
+    /** Tear down the isolation primitive (container/VM destroy; no-op in-process). */
+    dispose(): Promise<void> | void;
+}
+/**
+ * The **intent-only** egress value object. The orchestrator decides *what is
+ * allowed* once (hosts already merged with any OTEL collector hosts); each
+ * adapter translates it to its *mechanism* — docker `--dns` strict/open, smol
+ * `--allow-host`, in-process `allowedHttpHosts` / `["*"]`. The `172.30.0.x`
+ * constants and the `"*"` sentinel live inside the adapters, never here.
+ */
+export interface EgressPolicy {
+    /** True iff a phase opted out of the allowlist (`unrestricted_egress`). */
+    unrestricted: boolean;
+    /** Allowed apex hostnames when not unrestricted (incl. collector hosts). */
+    hosts: string[];
+}
+/** The repo pre-clone descriptor handed to {@link Sandbox.provision}. */
+export interface PrePopulateSpec {
+    owner: string;
+    repo: string;
+    branch: string;
+    token: string;
+    runId?: string;
+    shallow?: boolean;
+}
+/** What {@link Sandbox.provision} hands back to the orchestrator. */
+export interface ProvisionResult {
+    /** Host dir backing the workspace (where the orchestrator stages files). */
+    hostWorkspaceDir: string;
+    /** Working directory the agent/command process runs in (sandbox-visible). */
+    agentCwd: string;
+}
+export type SandboxEvent = Record<string, unknown>;
+export interface RunAgentOpts {
+    model: string;
+    thinking?: ThinkingLevel;
+    /** agentic-pi github profile (`read` | `issues-write` | … ). */
+    profile?: string;
+    /** Base inner-run env (git identity); adapters merge their own OTEL/HOME. */
+    sandboxEnv: Record<string, string>;
+    agentCwd: string;
+    skillDirs?: string[];
+    webSearch?: boolean;
+    webSearchProvider?: "tavily" | "brave" | "exa";
+    /** Test/eval escape hatch — only honoured by the in-process adapter. */
+    githubApiBaseUrl?: string;
+}
+export interface RunCommandOpts {
+    cwd: string;
+    /** Extra env forwarded into the command (upstream phase outputs, etc.). */
+    sandboxEnv?: Record<string, string>;
+    timeoutSeconds: number;
+}
+export interface RawCommandResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+    timedOut: boolean;
+}
+/** Construction-time opts for {@link sandboxFor} / each adapter. */
+export interface SandboxFactoryOpts {
+    taskId: string;
+    egress: EgressPolicy;
+    /** Env forwarded into the sandbox (provider keys, minted GITHUB_TOKEN, …). */
+    env: Record<string, string>;
+    stateDir: string;
+    sandboxDir?: string;
+    /** Docker image override (the browser-QA image for `sandbox_image: qa`). */
+    imageName?: string;
+    otel?: OtelConfig;
+    timeoutSeconds?: number;
+}
+export type SandboxFactory = (backend: SandboxBackend, opts: SandboxFactoryOpts) => Sandbox;
+/** The base (git-identity) sandbox env the orchestrator passes to `runAgent`. */
+export declare const AGENT_GIT_IDENTITY_ENV: Record<string, string>;
+/**
+ * The single factory replacing the `if (backend === …)` ladder. Given a
+ * backend and construction opts, returns the matching adapter. Docker's
+ * old null-fallback is now a thrown error from `provision` (the orchestrator's
+ * bracket surfaces it), so this never returns null.
+ */
+export declare function sandboxFor(backend: SandboxBackend, opts: SandboxFactoryOpts): Sandbox;
+export interface FakeBehavior {
+    /** Canned parsed pi-event records replayed through `onEvent`. */
+    events?: SandboxEvent[];
+    /** Throw from `runAgent` to exercise the fallback path. */
+    throwOnRunAgent?: Error | string;
+    /** Authoritative RunResult `runAgent` returns (else undefined → acc.build). */
+    returnRunResult?: RunResult;
+    /** Result `runCommand` resolves with (default exit 0, empty output). */
+    commandResult?: RawCommandResult;
+    /** Throw from `runCommand`. */
+    throwOnRunCommand?: Error | string;
+}
+/**
+ * In-memory `Sandbox` adapter for unit-testing the orchestrator without
+ * Docker/VMs. `provision()` returns a **real** `mkdtemp` workspace (so skill
+ * staging + artifact harvest run for real), `runAgent` replays a canned array
+ * of pi event records through `onEvent`, and it **records** the opts it
+ * received for assertions. Covers Last Light's orchestration, not agentic-pi's
+ * semantics.
+ *
+ * Inject it via the optional `sandboxFactory` on `executeAgent`/`executeCommand`
+ * — see {@link FakeSandbox.asFactory}.
+ */
+export declare class FakeSandbox implements Sandbox {
+    private readonly behavior;
+    backend: SandboxBackend;
+    egress?: EgressPolicy;
+    env?: Record<string, string>;
+    hostWorkspaceDir: string;
+    agentCwd: string;
+    stagedSkillDirs?: string[];
+    receivedAgentOpts?: RunAgentOpts;
+    receivedCommandOpts?: RunCommandOpts;
+    receivedCommand?: string;
+    provisionCalls: number;
+    disposed: boolean;
+    constructor(behavior?: FakeBehavior);
+    /**
+     * Build a {@link SandboxFactory} that always returns THIS instance, capturing
+     * the construction opts (egress, env, backend) for later inspection.
+     */
+    asFactory(): SandboxFactory;
+    provision(pre?: PrePopulateSpec): Promise<ProvisionResult>;
+    stageSkills(phaseKey: string, skillPaths: string[] | undefined): string[] | undefined;
+    sandboxPathFor(relPath: string): string;
+    runAgent(_taskId: string, _prompt: string, opts: RunAgentOpts, onEvent: (record: SandboxEvent) => void): Promise<RunResult | undefined>;
+    runCommand(_taskId: string, command: string, opts: RunCommandOpts): Promise<RawCommandResult>;
+    dispose(): void;
+}

package/dist/sandbox/sandbox.js

@@ -0,0 +1,429 @@
+import { join, relative } from "path";
+import { mkdtempSync, mkdirSync, rmSync } from "fs";
+import { tmpdir } from "os";
+import { spawnSync } from "child_process";
+import { createTaskSandbox, setupTaskWorktree, prePopulateWorkspace } from "./index.js";
+import { SmolSandbox as SmolDriver, smolAvailable, SMOL_WORKSPACE_DIR } from "./smol.js";
+import { ALLOW_ALL_SENTINEL } from "./egress-allowlist.js";
+import { getDockerSandboxOtelEnv, getOtelEnvForSandbox } from "../telemetry/index.js";
+import { DOCKER_WORKSPACE_DIR, SKILL_BUNDLE_ROOT, stageSkillBundle, excludeFromGit, applyEnv, } from "../engine/executors/shared.js";
+/** Inner-run git identity, shared by every adapter's agent path. */
+const GIT_IDENTITY_ENV = {
+    GIT_AUTHOR_NAME: "last-light[bot]",
+    GIT_AUTHOR_EMAIL: "last-light[bot]@users.noreply.github.com",
+    GIT_COMMITTER_NAME: "last-light[bot]",
+    GIT_COMMITTER_EMAIL: "last-light[bot]@users.noreply.github.com",
+    // /workspace is a host-UID bind mount into a different-UID guest; git refuses
+    // to operate without an explicit safe-directory. GIT_CONFIG_* avoids needing
+    // a writeable ~/.gitconfig.
+    GIT_CONFIG_COUNT: "1",
+    GIT_CONFIG_KEY_0: "safe.directory",
+    GIT_CONFIG_VALUE_0: "*",
+};
+/** The base (git-identity) sandbox env the orchestrator passes to `runAgent`. */
+export const AGENT_GIT_IDENTITY_ENV = GIT_IDENTITY_ENV;
+/**
+ * The single factory replacing the `if (backend === …)` ladder. Given a
+ * backend and construction opts, returns the matching adapter. Docker's
+ * old null-fallback is now a thrown error from `provision` (the orchestrator's
+ * bracket surfaces it), so this never returns null.
+ */
+export function sandboxFor(backend, opts) {
+    switch (backend) {
+        case "docker":
+            return new DockerSandbox(opts);
+        case "smol":
+            return new SmolSandbox(opts);
+        case "gondolin":
+            return new InProcessSandbox("gondolin", opts);
+        case "none":
+            return new InProcessSandbox("none", opts);
+    }
+}
+// ── Docker adapter ──────────────────────────────────────────────────
+/**
+ * Wraps the docker container driver ({@link DockerDriver}) + the
+ * `createTaskSandbox` provisioning helper. Egress is the strict/open coredns
+ * pair selected by `--dns`; the host constants live here.
+ */
+class DockerSandbox {
+    opts;
+    backend = "docker";
+    sbx;
+    agentCwd = DOCKER_WORKSPACE_DIR;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    async provision(pre) {
+        // Strict allowlist by default; an `unrestricted_egress` phase points at the
+        // open coredns sidecar instead. IPs match docker-compose.yml's static
+        // assignments (see src/sandbox/egress-firewall-config.ts).
+        const dnsIp = this.opts.egress.unrestricted
+            ? process.env.LASTLIGHT_DNS_OPEN || "172.30.0.11"
+            : process.env.LASTLIGHT_DNS_STRICT || "172.30.0.10";
+        const sbx = await createTaskSandbox({
+            taskId: this.opts.taskId,
+            stateDir: this.opts.stateDir,
+            sandboxDir: this.opts.sandboxDir,
+            env: this.opts.env,
+            prePopulate: pre,
+            dnsIp,
+            imageName: this.opts.imageName,
+        });
+        if (!sbx) {
+            throw new Error("LASTLIGHT_SANDBOX=docker but no docker sandbox was available. " +
+                "Install Docker and build the sandbox image, or set LASTLIGHT_SANDBOX=gondolin / none.");
+        }
+        this.sbx = sbx;
+        this.agentCwd = pre ? `${DOCKER_WORKSPACE_DIR}/${pre.repo}` : DOCKER_WORKSPACE_DIR;
+        return { hostWorkspaceDir: sbx.workDir, agentCwd: this.agentCwd };
+    }
+    stageSkills(phaseKey, skillPaths) {
+        if (!this.sbx)
+            throw new Error("DockerSandbox.stageSkills before provision");
+        // Copy (not symlink): the agent's tools run inside the container and host
+        // symlink targets wouldn't resolve there. Map host dests → in-container paths.
+        const staged = stageSkillBundle(this.sbx.workDir, phaseKey, skillPaths, "copy");
+        if (!staged)
+            return undefined;
+        return staged.map((d) => `${DOCKER_WORKSPACE_DIR}/${relative(this.sbx.workDir, d)}`);
+    }
+    sandboxPathFor(relPath) {
+        return `${DOCKER_WORKSPACE_DIR}/${relPath}`;
+    }
+    async runAgent(taskId, prompt, opts, onEvent) {
+        if (!this.sbx)
+            throw new Error("DockerSandbox.runAgent before provision");
+        await this.sbx.sandbox.runAgent(taskId, prompt, {
+            model: opts.model,
+            thinking: opts.thinking,
+            profile: opts.profile,
+            sandboxEnv: this.innerAgentEnv(opts.sandboxEnv),
+            agentCwd: opts.agentCwd,
+            skillDirs: opts.skillDirs,
+            webSearch: opts.webSearch,
+            webSearchProvider: opts.webSearchProvider,
+            onLine: parseLine(onEvent),
+        });
+        return undefined;
+    }
+    async runCommand(taskId, command, opts) {
+        if (!this.sbx)
+            throw new Error("DockerSandbox.runCommand before provision");
+        return this.sbx.sandbox.runCommand(taskId, command, {
+            cwd: opts.cwd,
+            sandboxEnv: opts.sandboxEnv,
+            timeoutSeconds: opts.timeoutSeconds,
+            onLine: () => { },
+        });
+    }
+    async dispose() {
+        if (this.sbx)
+            await this.sbx.cleanup();
+    }
+    /** Git identity + (inside-container) OTEL collector env. */
+    innerAgentEnv(base) {
+        const otel = this.opts.otel?.enabled && this.opts.otel.forwardToSandbox ? getDockerSandboxOtelEnv() : {};
+        return { ...otel, ...base };
+    }
+}
+// ── smol adapter ────────────────────────────────────────────────────
+/**
+ * Wraps the smolvm micro-VM driver ({@link SmolDriver}). Egress is native
+ * per-machine `--allow-host`; unrestricted → null (open). Provisioning boots
+ * the VM first, then probes the share-backed host dir before cloning into it.
+ */
+class SmolSandbox {
+    opts;
+    backend = "smol";
+    driver;
+    agentCwd = SMOL_WORKSPACE_DIR;
+    hostWorkspaceDir = "";
+    constructor(opts) {
+        this.opts = opts;
+    }
+    async provision(pre) {
+        if (!smolAvailable()) {
+            throw new Error("LASTLIGHT_SANDBOX=smol but the smolvm CLI is not available. " +
+                "Install smolvm (https://smolmachines.com) and start `smolvm serve`, " +
+                "or set LASTLIGHT_SANDBOX=docker / gondolin / none.");
+        }
+        // Boot FIRST (workspace dir mounted), then provision the probed share. No
+        // pre-clone here — see SmolSandbox.resolveHostWorkspace for why the mount
+        // source isn't always the share root.
+        const workDir = setupTaskWorktree({
+            taskId: this.opts.taskId,
+            stateDir: this.opts.stateDir,
+            sandboxDir: this.opts.sandboxDir,
+        });
+        this.driver = new SmolDriver({
+            env: this.opts.env,
+            allowHosts: this.opts.egress.unrestricted ? null : this.opts.egress.hosts,
+        });
+        const machine = await this.driver.create({ taskId: this.opts.taskId, worktreePath: workDir });
+        const hostWs = machine.hostWorkspace;
+        if (pre)
+            prePopulateWorkspace(hostWs, pre);
+        this.hostWorkspaceDir = hostWs;
+        this.agentCwd = pre ? `${SMOL_WORKSPACE_DIR}/${pre.repo}` : SMOL_WORKSPACE_DIR;
+        return { hostWorkspaceDir: hostWs, agentCwd: this.agentCwd };
+    }
+    stageSkills(phaseKey, skillPaths) {
+        const staged = stageSkillBundle(this.hostWorkspaceDir, phaseKey, skillPaths, "copy");
+        if (!staged)
+            return undefined;
+        return staged.map((d) => `${SMOL_WORKSPACE_DIR}/${relative(this.hostWorkspaceDir, d)}`);
+    }
+    sandboxPathFor(relPath) {
+        return `${SMOL_WORKSPACE_DIR}/${relPath}`;
+    }
+    async runAgent(taskId, prompt, opts, onEvent) {
+        if (!this.driver)
+            throw new Error("SmolSandbox.runAgent before provision");
+        await this.driver.runAgent(taskId, prompt, {
+            model: opts.model,
+            thinking: opts.thinking,
+            profile: opts.profile,
+            sandboxEnv: opts.sandboxEnv,
+            agentCwd: opts.agentCwd,
+            skillDirs: opts.skillDirs,
+            webSearch: opts.webSearch,
+            webSearchProvider: opts.webSearchProvider,
+            onLine: parseLine(onEvent),
+        });
+        return undefined;
+    }
+    async runCommand(taskId, command, opts) {
+        if (!this.driver)
+            throw new Error("SmolSandbox.runCommand before provision");
+        return this.driver.runCommand(taskId, command, {
+            cwd: opts.cwd,
+            sandboxEnv: opts.sandboxEnv,
+            timeoutSeconds: opts.timeoutSeconds,
+            onLine: () => { },
+        });
+    }
+    async dispose() {
+        if (this.driver)
+            await this.driver.destroy(this.opts.taskId);
+    }
+}
+// ── In-process adapter (gondolin / none) ────────────────────────────
+/**
+ * **One** adapter for the two in-process backends, parameterized by
+ * `mode: 'gondolin' | 'none'`. The two differ only in agentic-pi's `sandbox`
+ * arg and a `HOME` override. Owns the `applyEnv`/restore `process.env` splice
+ * and the lazy `import("agentic-pi")`.
+ *
+ * The `mode` flag is a **tombstone** for gondolin's planned removal — when
+ * gondolin is retired it collapses to single-mode `none`.
+ */
+class InProcessSandbox {
+    mode;
+    opts;
+    backend;
+    hostWorkspaceDir = "";
+    agentCwd = "";
+    constructor(mode, opts) {
+        this.mode = mode;
+        this.opts = opts;
+        this.backend = mode;
+    }
+    async provision(pre) {
+        const workDir = setupTaskWorktree({
+            taskId: this.opts.taskId,
+            stateDir: this.opts.stateDir,
+            sandboxDir: this.opts.sandboxDir,
+            prePopulate: pre,
+        });
+        this.hostWorkspaceDir = workDir;
+        // When pre-cloned, cwd is the checkout so the agent runs inside the repo
+        // with no `cd` preamble; otherwise the workspace root.
+        this.agentCwd = pre ? join(workDir, pre.repo) : workDir;
+        return { hostWorkspaceDir: workDir, agentCwd: this.agentCwd };
+    }
+    stageSkills(phaseKey, skillPaths) {
+        // none: stage at the workspace ROOT (host FS fully visible). gondolin
+        // mounts only cwd, so its bundle is staged under the repo + added to the
+        // checkout's local `.git/info/exclude` so the agent can't commit it.
+        const gondolin = this.mode === "gondolin";
+        const skillRoot = gondolin ? this.agentCwd : this.hostWorkspaceDir;
+        const staged = stageSkillBundle(skillRoot, phaseKey, skillPaths, "symlink");
+        if (staged && gondolin)
+            excludeFromGit(this.agentCwd, SKILL_BUNDLE_ROOT);
+        return staged; // host paths — passed through to agentic-pi's skillPaths
+    }
+    sandboxPathFor(relPath) {
+        return join(this.hostWorkspaceDir, relPath);
+    }
+    async runAgent(_taskId, prompt, opts, onEvent) {
+        // agentic-pi reads its own env (provider keys, App PEM, …) from
+        // process.env. Splice in our scoped values for the call, then restore.
+        const restore = applyEnv(this.opts.env);
+        const allowedHttpHosts = this.opts.egress.unrestricted ? [ALLOW_ALL_SENTINEL] : this.opts.egress.hosts;
+        try {
+            // Loaded lazily: agentic-pi transitively poisons the global undici
+            // dispatcher on import, which would break the harness's own fetch. The
+            // dynamic import keeps the harness clean unless an in-process run happens.
+            const { run: agenticRun } = await import("agentic-pi");
+            return await agenticRun({
+                model: opts.model,
+                prompt,
+                thinking: opts.thinking,
+                profile: opts.profile,
+                githubApiBaseUrl: opts.githubApiBaseUrl,
+                sandbox: this.mode === "gondolin" ? "gondolin" : "none",
+                sandboxEnv: this.innerAgentEnv(opts.sandboxEnv),
+                cwd: opts.agentCwd,
+                noSession: true,
+                skillPaths: opts.skillDirs,
+                allowedHttpHosts,
+                webSearch: opts.webSearch === true,
+                webSearchProvider: opts.webSearchProvider,
+                onEvent,
+                onWarn: (msg) => console.warn(`[agentic] ${msg}`),
+            });
+        }
+        finally {
+            restore();
+        }
+    }
+    async runCommand(_taskId, command, opts) {
+        // gondolin / none run the command on the host worktree via spawnSync — the
+        // same degraded model those backends already used.
+        const proc = spawnSync("sh", ["-c", command], {
+            cwd: opts.cwd,
+            env: { ...process.env, ...this.opts.env, ...(opts.sandboxEnv ?? {}) },
+            encoding: "utf-8",
+            timeout: opts.timeoutSeconds * 1000,
+            maxBuffer: 256 * 1024 * 1024,
+        });
+        const exitCode = proc.status ?? (proc.signal ? 124 : 1);
+        return {
+            exitCode,
+            stdout: proc.stdout ?? "",
+            stderr: proc.stderr ?? "",
+            timedOut: proc.signal === "SIGTERM",
+        };
+    }
+    dispose() {
+        // No isolation primitive to tear down — the env splice is restored inside
+        // runAgent, and the worktree is reaped elsewhere.
+    }
+    /** Git identity + OTEL env + (gondolin only) a HOME override into the VM. */
+    innerAgentEnv(base) {
+        const otel = this.opts.otel?.enabled && this.opts.otel.forwardToSandbox ? getOtelEnvForSandbox() : {};
+        // gondolin: the VM user inherits HOME from the agentic-pi process (the
+        // host's HOME leaks in). Force HOME=/root so `git config --global` /
+        // `gh auth status` write to a real path inside the VM. none runs on the
+        // host — never override HOME.
+        const homeOverride = this.mode === "gondolin" ? { HOME: "/root", USER: "root", LOGNAME: "root" } : {};
+        return { ...otel, ...base, ...homeOverride };
+    }
+}
+/**
+ * In-memory `Sandbox` adapter for unit-testing the orchestrator without
+ * Docker/VMs. `provision()` returns a **real** `mkdtemp` workspace (so skill
+ * staging + artifact harvest run for real), `runAgent` replays a canned array
+ * of pi event records through `onEvent`, and it **records** the opts it
+ * received for assertions. Covers Last Light's orchestration, not agentic-pi's
+ * semantics.
+ *
+ * Inject it via the optional `sandboxFactory` on `executeAgent`/`executeCommand`
+ * — see {@link FakeSandbox.asFactory}.
+ */
+export class FakeSandbox {
+    behavior;
+    backend = "none";
+    // Recorded for assertions.
+    egress;
+    env;
+    hostWorkspaceDir = "";
+    agentCwd = "";
+    stagedSkillDirs;
+    receivedAgentOpts;
+    receivedCommandOpts;
+    receivedCommand;
+    provisionCalls = 0;
+    disposed = false;
+    constructor(behavior = {}) {
+        this.behavior = behavior;
+    }
+    /**
+     * Build a {@link SandboxFactory} that always returns THIS instance, capturing
+     * the construction opts (egress, env, backend) for later inspection.
+     */
+    asFactory() {
+        return (backend, opts) => {
+            this.backend = backend;
+            this.egress = opts.egress;
+            this.env = opts.env;
+            return this;
+        };
+    }
+    async provision(pre) {
+        this.provisionCalls += 1;
+        const dir = mkdtempSync(join(tmpdir(), "fake-sbx-"));
+        this.hostWorkspaceDir = dir;
+        this.agentCwd = pre ? join(dir, pre.repo) : dir;
+        if (pre)
+            mkdirSync(this.agentCwd, { recursive: true });
+        return { hostWorkspaceDir: dir, agentCwd: this.agentCwd };
+    }
+    stageSkills(phaseKey, skillPaths) {
+        this.stagedSkillDirs = stageSkillBundle(this.hostWorkspaceDir, phaseKey, skillPaths, "symlink");
+        return this.stagedSkillDirs;
+    }
+    sandboxPathFor(relPath) {
+        return join(this.hostWorkspaceDir, relPath);
+    }
+    async runAgent(_taskId, _prompt, opts, onEvent) {
+        this.receivedAgentOpts = opts;
+        if (this.behavior.throwOnRunAgent)
+            throw asError(this.behavior.throwOnRunAgent);
+        for (const record of this.behavior.events ?? [])
+            onEvent(record);
+        return this.behavior.returnRunResult;
+    }
+    async runCommand(_taskId, command, opts) {
+        this.receivedCommand = command;
+        this.receivedCommandOpts = opts;
+        if (this.behavior.throwOnRunCommand)
+            throw asError(this.behavior.throwOnRunCommand);
+        return this.behavior.commandResult ?? { exitCode: 0, stdout: "", stderr: "", timedOut: false };
+    }
+    dispose() {
+        this.disposed = true;
+        try {
+            if (this.hostWorkspaceDir)
+                rmSync(this.hostWorkspaceDir, { recursive: true, force: true });
+        }
+        catch {
+            /* best effort */
+        }
+    }
+}
+// ── helpers ─────────────────────────────────────────────────────────
+function asError(e) {
+    return e instanceof Error ? e : new Error(e);
+}
+/**
+ * Wrap an `onEvent(record)` consumer as an `onLine(line)` handler for the
+ * subprocess (docker/smol) drivers: apply the cheap `{`-prefix guard, parse
+ * JSON, and forward the parsed record. Non-JSON / malformed lines are dropped.
+ */
+function parseLine(onEvent) {
+    return (line) => {
+        if (!line.startsWith("{"))
+            return;
+        let record;
+        try {
+            record = JSON.parse(line);
+        }
+        catch {
+            return;
+        }
+        onEvent(record);
+    };
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/sandbox/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/sandbox/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAG1C,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAExF,OAAO,EAAE,WAAW,IAAI,UAAU,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,QAAQ,GACT,MAAM,+BAA+B,CAAC;AAkJvC,oEAAoE;AACpE,MAAM,gBAAgB,GAA2B;IAC/C,eAAe,EAAE,iBAAiB;IAClC,gBAAgB,EAAE,0CAA0C;IAC5D,kBAAkB,EAAE,iBAAiB;IACrC,mBAAmB,EAAE,0CAA0C;IAC/D,8EAA8E;IAC9E,6EAA6E;IAC7E,4BAA4B;IAC5B,gBAAgB,EAAE,GAAG;IACrB,gBAAgB,EAAE,gBAAgB;IAClC,kBAAkB,EAAE,GAAG;CACxB,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAA2B,gBAAgB,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,OAAuB,EAAE,IAAwB;IAC1E,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC;QACjC,KAAK,MAAM;YACT,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,KAAK,UAAU;YACb,OAAO,IAAI,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAChD,KAAK,MAAM;YACT,OAAO,IAAI,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,uEAAuE;AAEvE;;;;GAIG;AACH,MAAM,aAAa;IAKY;IAJpB,OAAO,GAAmB,QAAQ,CAAC;IACpC,GAAG,CAA4E;IAC/E,QAAQ,GAAG,oBAAoB,CAAC;IAExC,YAA6B,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;IAAG,CAAC;IAEzD,KAAK,CAAC,SAAS,CAAC,GAAqB;QACnC,4EAA4E;QAC5E,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY;YACzC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,aAAa;YACjD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,aAAa,CAAC;QAEtD,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC;YAClC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;YACxB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAC5B,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;YAClB,WAAW,EAAE,GAAG;YAChB,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,gEAAgE;gBAC9D,uFAAuF,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,oBAAoB,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC;QACnF,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IACpE,CAAC;IAED,WAAW,CAAC,QAAgB,EAAE,UAAgC;QAC5D,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC7E,0EAA0E;QAC1E,+EAA+E;QAC/E,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,oBAAoB,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAI,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,cAAc,CAAC,OAAe;QAC5B,OAAO,GAAG,oBAAoB,IAAI,OAAO,EAAE,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,MAAc,EACd,MAAc,EACd,IAAkB,EAClB,OAAuC;QAEvC,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC1E,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE;YAC9C,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;YAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC;SAC3B,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,OAAe,EAAE,IAAoB;QACpE,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE;YAClD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACzC,CAAC;IAED,4DAA4D;IACpD,aAAa,CAAC,IAA4B;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;IAC9B,CAAC;CACF;AAED,uEAAuE;AAEvE;;;;GAIG;AACH,MAAM,WAAW;IAMc;IALpB,OAAO,GAAmB,MAAM,CAAC;IAClC,MAAM,CAAc;IACpB,QAAQ,GAAG,kBAAkB,CAAC;IAC9B,gBAAgB,GAAG,EAAE,CAAC;IAE9B,YAA6B,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;IAAG,CAAC;IAEzD,KAAK,CAAC,SAAS,CAAC,GAAqB;QACnC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,8DAA8D;gBAC5D,sEAAsE;gBACtE,oDAAoD,CACvD,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,sCAAsC;QACtC,MAAM,OAAO,GAAG,iBAAiB,CAAC;YAChC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;YACxB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAC5B,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,CAAC;YAC3B,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;YAClB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK;SAC1E,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;QACrC,IAAI,GAAG;YAAE,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,kBAAkB,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC/D,CAAC;IAED,WAAW,CAAC,QAAgB,EAAE,UAAgC;QAC5D,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACrF,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,kBAAkB,IAAI,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,cAAc,CAAC,OAAe;QAC5B,OAAO,GAAG,kBAAkB,IAAI,OAAO,EAAE,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,MAAc,EACd,MAAc,EACd,IAAkB,EAClB,OAAuC;QAEvC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3E,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE;YACzC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC;SAC3B,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,OAAe,EAAE,IAAoB;QACpE,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE;YAC7C,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,uEAAuE;AAEvE;;;;;;;;GAQG;AACH,MAAM,gBAAgB;IAMD;IACA;IANV,OAAO,CAAiB;IACzB,gBAAgB,GAAG,EAAE,CAAC;IACtB,QAAQ,GAAG,EAAE,CAAC;IAEtB,YACmB,IAAyB,EACzB,IAAwB;QADxB,SAAI,GAAJ,IAAI,CAAqB;QACzB,SAAI,GAAJ,IAAI,CAAoB;QAEzC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAqB;QACnC,MAAM,OAAO,GAAG,iBAAiB,CAAC;YAChC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;YACxB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAC5B,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,WAAW,EAAE,GAAG;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;QAChC,yEAAyE;QACzE,uDAAuD;QACvD,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACxD,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAChE,CAAC;IAED,WAAW,CAAC,QAAgB,EAAE,UAAgC;QAC5D,sEAAsE;QACtE,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC;QAC1C,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;QACnE,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAC5E,IAAI,MAAM,IAAI,QAAQ;YAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC,CAAC,yDAAyD;IAC1E,CAAC;IAED,cAAc,CAAC,OAAe;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,OAAe,EACf,MAAc,EACd,IAAkB,EAClB,OAAuC;QAEvC,gEAAgE;QAChE,uEAAuE;QACvE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QACvG,IAAI,CAAC;YACH,mEAAmE;YACnE,uEAAuE;YACvE,2EAA2E;YAC3E,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAmC,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YACvF,OAAO,MAAM,UAAU,CAAC;gBACtB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,OAAO,EAAE,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;gBACvD,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;gBAC/C,GAAG,EAAE,IAAI,CAAC,QAAQ;gBAClB,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI,CAAC,SAAS;gBAC1B,gBAAgB;gBAChB,SAAS,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI;gBAClC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;gBACzC,OAAO;gBACP,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,GAAG,EAAE,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,OAAe,EAAE,IAAoB;QACrE,2EAA2E;QAC3E,mDAAmD;QACnD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;YAC5C,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE;YACrE,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI;YACnC,SAAS,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;SAC7B,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;YACzB,QAAQ,EAAE,IAAI,CAAC,MAAM,KAAK,SAAS;SACpC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,0EAA0E;QAC1E,kDAAkD;IACpD,CAAC;IAED,6EAA6E;IACrE,aAAa,CAAC,IAA4B;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,uEAAuE;QACvE,qEAAqE;QACrE,wEAAwE;QACxE,8BAA8B;QAC9B,MAAM,YAAY,GAChB,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,YAAY,EAAE,CAAC;IAC/C,CAAC;CACF;AAiBD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,WAAW;IAcO;IAb7B,OAAO,GAAmB,MAAM,CAAC;IACjC,2BAA2B;IAC3B,MAAM,CAAgB;IACtB,GAAG,CAA0B;IAC7B,gBAAgB,GAAG,EAAE,CAAC;IACtB,QAAQ,GAAG,EAAE,CAAC;IACd,eAAe,CAAY;IAC3B,iBAAiB,CAAgB;IACjC,mBAAmB,CAAkB;IACrC,eAAe,CAAU;IACzB,cAAc,GAAG,CAAC,CAAC;IACnB,QAAQ,GAAG,KAAK,CAAC;IAEjB,YAA6B,WAAyB,EAAE;QAA3B,aAAQ,GAAR,QAAQ,CAAmB;IAAG,CAAC;IAE5D;;;OAGG;IACH,SAAS;QACP,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;YACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;YACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC1B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAqB;QACnC,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAChD,IAAI,GAAG;YAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,OAAO,EAAE,gBAAgB,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC5D,CAAC;IAED,WAAW,CAAC,QAAgB,EAAE,UAAgC;QAC5D,IAAI,CAAC,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,cAAc,CAAC,OAAe;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,OAAe,EACf,OAAe,EACf,IAAkB,EAClB,OAAuC;QAEvC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC9B,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe;YAAE,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAChF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE;YAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,OAAe,EAAE,IAAoB;QACrE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC;QAC/B,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAChC,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB;YAAE,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACjG,CAAC;IAED,OAAO;QACL,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,gBAAgB;gBAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;CACF;AAED,uEAAuE;AAEvE,SAAS,OAAO,CAAC,CAAiB;IAChC,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,OAAuC;IACxD,OAAO,CAAC,IAAY,EAAE,EAAE;QACtB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAClC,IAAI,MAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC"}

package/dist/state/workflow-run-store.d.ts

@@ -93,6 +93,13 @@ export declare class WorkflowRunStore {
     getRun(id: string): WorkflowRun | null;
     /** Find the most recent active (running or paused) workflow run for a trigger */
     getByTrigger(triggerId: string): WorkflowRun | null;
+    /**
+     * True if any run of `workflowName` exists for this trigger, in ANY status.
+     * Unlike `getByTrigger` (active runs only), this also sees a build that has
+     * already succeeded/failed/cancelled — the signal the router uses to gate
+     * reporter-driven re-triage to the pre-build window.
+     */
+    hasRunForTrigger(triggerId: string, workflowName: string): boolean;
     /** List all active (running or paused) workflow runs */
     listActive(): WorkflowRun[];
     /** List recent workflow runs, ordered by start time descending */