looply-cli 0.0.0-stage → 0.3.0

package/dist/setup.js

@@ -0,0 +1,283 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GATES_ARE_TOOLCHAIN = exports.DEFAULT_ANSWERS = exports.QUESTIONS = void 0;
+exports.suggestRails = suggestRails;
+exports.parseAnswer = parseAnswer;
+exports.renderConfig = renderConfig;
+exports.summarise = summarise;
+/**
+ * Guesses for the rails, by ecosystem.
+ *
+ * Offered rather than applied. A wrong guess that is presented as a suggestion
+ * costs a keystroke; a wrong guess applied silently costs a schema.
+ */
+function suggestRails(profile) {
+    const guesses = [];
+    const has = (p) => profile.workspaces.some((w) => w.includes(p)) || profile.name.includes(p);
+    // Anything that migrates a database, moves money, or decides who you are.
+    const candidates = [
+        'prisma/',
+        'migrations/',
+        'src/common/guards/',
+        'src/modules/payments/',
+        'src/modules/billing/',
+        'src/auth/',
+        'infra/',
+        '.github/workflows/',
+    ];
+    for (const c of candidates)
+        guesses.push(c);
+    if (has('api'))
+        guesses.push('api/prisma/');
+    return [...new Set(guesses)];
+}
+exports.QUESTIONS = [
+    {
+        key: 'rails',
+        ask: 'Which paths must looply never touch?',
+        why: 'Schema, migrations, auth and anything that moves money. It will report what it finds there and refuse to change it. This is the one answer worth taking a minute over.',
+        kind: 'paths',
+        default: '',
+        suggest: suggestRails,
+    },
+    {
+        key: 'prodDb',
+        ask: 'Can this machine reach a production database?',
+        why: 'If yes, looply refuses to start whenever it sees a live connection string — a loop that can write to production is not a loop, it is an incident.',
+        kind: 'confirm',
+        default: 'no',
+    },
+    {
+        key: 'push',
+        ask: 'May looply publish anything?',
+        why: 'Nothing leaves your machine unless you say so. Most people want the default.',
+        kind: 'choice',
+        default: 'never',
+        choices: [
+            { value: 'never', label: 'never', hint: 'commits stay on a local branch' },
+            { value: 'on-approval', label: 'on approval', hint: 'push once you approve, from the app' },
+            { value: 'manual', label: 'manual', hint: 'you push, by hand, as usual' },
+        ],
+    },
+    {
+        key: 'scope',
+        ask: 'What kind of work should it do?',
+        why: 'Improving what exists produces work you can review. Inventing new surface produces work nobody asked for, which is how an overnight run turns into a morning of reverting.',
+        kind: 'choice',
+        default: 'improve',
+        choices: [
+            { value: 'improve', label: 'improve what is there', hint: 'fixes, tests, missing states' },
+            { value: 'anything', label: 'anything', hint: 'including new screens and flows' },
+        ],
+    },
+    {
+        key: 'hours',
+        ask: 'How long should a run go by default?',
+        why: 'It finishes the round it is on rather than cutting it off, so this is a floor and not a deadline.',
+        kind: 'number',
+        default: '4',
+    },
+];
+exports.DEFAULT_ANSWERS = {
+    rails: [],
+    prodDb: false,
+    push: 'never',
+    scope: 'improve',
+    hours: 4,
+};
+/**
+ * Turn one raw answer into a value, or say why it cannot be.
+ *
+ * A blank answer always means the default — a setup that punishes pressing enter
+ * is a setup people abandon halfway.
+ */
+function parseAnswer(question, raw) {
+    const text = raw.trim();
+    // Blank is resolved here rather than by re-entering with the default: a
+    // question whose default is itself blank (rails, where "none" is the sane
+    // answer) recursed forever, which hung the CLI on the very first enter.
+    if (!text)
+        return { ok: true, value: emptyAnswer(question) };
+    switch (question.kind) {
+        case 'confirm': {
+            const yes = /^(y|yes|true)$/i.test(text);
+            const no = /^(n|no|false)$/i.test(text);
+            if (!yes && !no)
+                return { ok: false, error: 'answer yes or no' };
+            return { ok: true, value: yes };
+        }
+        case 'choice': {
+            const match = question.choices?.find((c) => c.value === text.toLowerCase() || c.label.toLowerCase() === text.toLowerCase());
+            // A number is accepted too, since the choices are printed numbered.
+            const asIndex = Number(text);
+            if (!match && Number.isInteger(asIndex) && question.choices?.[asIndex - 1]) {
+                return { ok: true, value: question.choices[asIndex - 1].value };
+            }
+            if (!match) {
+                return { ok: false, error: `pick one of: ${question.choices?.map((c) => c.value).join(', ')}` };
+            }
+            return { ok: true, value: match.value };
+        }
+        case 'number': {
+            const n = Number(text);
+            if (!Number.isFinite(n) || n <= 0)
+                return { ok: false, error: 'give a positive number of hours' };
+            if (n > 24)
+                return { ok: false, error: 'a run longer than 24 hours is almost certainly a mistake' };
+            return { ok: true, value: n };
+        }
+        case 'paths': {
+            const paths = text
+                .split(/[,\s]+/)
+                .map((p) => p.trim())
+                .filter(Boolean);
+            const bad = paths.find((p) => p.startsWith('/') || p.includes('..'));
+            if (bad) {
+                // An absolute or climbing path would either match nothing or match
+                // outside the repository, and both fail quietly at exactly the wrong time.
+                return { ok: false, error: `${bad} must be a path inside this repository` };
+            }
+            return { ok: true, value: paths };
+        }
+    }
+}
+/** What pressing enter means, per kind. Always a value, never another prompt. */
+function emptyAnswer(q) {
+    switch (q.kind) {
+        case 'paths':
+            return q.default ? q.default.split(/[,\s]+/).filter(Boolean) : [];
+        case 'confirm':
+            return /^(y|yes|true)$/i.test(q.default);
+        case 'number':
+            return Number(q.default) || 0;
+        case 'choice':
+            return q.default;
+    }
+}
+/**
+ * The config file, written from what was detected and what was answered.
+ *
+ * Commented throughout, because this file is meant to be read and edited after
+ * setup rather than treated as generated output nobody opens.
+ */
+/**
+ * What detection could see, said in the file it wrote.
+ *
+ * 🔴 THIS MODULE'S OWN RULE, APPLIED TO THE ONE THING IT SKIPPED (the audit's
+ * B-01). The docblock at the top of this file draws the line precisely:
+ * detection covers what the repository can tell you, and *"it cannot tell you
+ * the things that are expensive to get wrong… So those are asked."* Three are
+ * asked — forbidden paths, a reachable production database, whether anything
+ * may be published.
+ *
+ * `gates` is the most expensive thing in this file to get wrong, and it is the
+ * one that is **neither asked nor defaulted**: it is DETECTED, from the
+ * lockfile, `package.json` scripts and `tsconfig` — the toolchain, and nothing
+ * else. A person handed a populated list has no way to know that contracts,
+ * data and migrations were never candidates.
+ *
+ * ⚠️ AND THE FILE ALREADY KNEW HOW TO SAY IT — IN ONE BRANCH ONLY. When nothing
+ * is detected the list reads *"none detected — add at least one, or a green
+ * round proves nothing"*, which is exactly the right sentence. It appears only
+ * when the list is EMPTY, and *"a green round proves nothing about your
+ * migrations"* is just as true when it is full.
+ *
+ * ⚠️ IT CLAIMS NOTHING ABOUT THIS REPOSITORY. Not that migrations exist, not
+ * that a contract is unchecked, not that the gates are insufficient. It says
+ * what was looked for, which is the only thing detection can honestly report.
+ */
+exports.GATES_ARE_TOOLCHAIN = [
+    '# Detected from the toolchain: the lockfile, package.json scripts and tsconfig.',
+    '# Contracts, data and migrations are not looked for — so a green round says',
+    '# nothing about them. Add a gate for anything here that has to hold.',
+].join('\n');
+function renderConfig(profile, answers) {
+    const gates = [
+        profile.typecheck ? `  - { name: "${profile.typecheck.name}", run: "${profile.typecheck.run}", timeout_s: 300 }` : null,
+        profile.testRunner
+            ? `  - { name: "${profile.testRunner.name}", run: "${profile.testRunner.run}", timeout_s: 900, required: true }`
+            : null,
+    ].filter(Boolean);
+    // An empty list must be written as `[]`, not as a comment where a value
+    // belongs: YAML reads a key with only comments under it as null, and the
+    // config parser then rejects the very file setup just produced.
+    const rails = answers.rails.length
+        ? '\n' + answers.rails.map((p) => `    - "${p}"`).join('\n')
+        : ' []   # nothing is off limits until you list something here';
+    // Where work may happen. Detected workspaces become the free scope; without
+    // any, the whole repository is free, because a scope of nothing means a run
+    // that can never touch a file.
+    const free = profile.workspaces.length
+        ? profile.workspaces.map((w) => `${w}/**`)
+        : ['**'];
+    const additive = answers.scope === 'improve' ? free : [];
+    return `# .looply/config.yaml
+#
+# Written by \`looply init\`. Meant to be read and edited — every value here is
+# a decision, and the comments say what each one costs.
+
+project:
+  name: "${profile.name}"
+
+# Checks that decide whether a round's work is kept. Cheapest first: a broken
+# typecheck should not wait on a full test suite.
+#
+${exports.GATES_ARE_TOOLCHAIN}
+gates:
+${gates.length ? gates.join('\n') : '  # none detected — add at least one, or a green round proves nothing'}
+
+rails:
+  # looply reports what it finds in these and refuses to change them. A task
+  # that needs one becomes a question for you rather than an edit.
+  forbidden_paths:${rails}
+${answers.prodDb
+        ? `  # This machine can reach production, so a live connection string aborts the
+  # run before any check executes.
+  prod_patterns: [herokuapp, amazonaws, ".render.com", "supabase.co", ".neon.tech"]`
+        : `  prod_patterns: [herokuapp, amazonaws, ".render.com", "supabase.co", ".neon.tech"]`}
+  exemptions: ask   # it may ask to cross a rail once, for one file. "never" to refuse outright.
+
+run:
+  min_hours: ${answers.hours}
+  max_rounds: 400
+  cooldown_s: 5
+
+proof:
+  # A second agent, which did not write the code, checks the change against the
+  # task before it is kept. Turning this off means work is kept on a passing
+  # build alone — which proves it compiles, not that it was worth doing.
+  enabled: true
+  on_partial: ask
+
+queue:
+  topup_threshold: 5
+  topup_size: 10
+  # Caps near-identical chores in one batch. Without it a self-written queue
+  # drifts into seven versions of the same small fix.
+  max_same_shape: 3
+
+scope:
+  # ${answers.scope === 'improve' ? 'Improve what exists: fixes, tests, missing states. No new flows.' : 'Anything, including new screens and flows.'}
+  free: [${free.map((p) => `"${p}"`).join(', ')}]
+  # Paths where only new files may be added, never existing ones edited.
+  additive: [${additive.map((p) => `"${p}"`).join(', ')}]
+
+publish:
+  policy: ${answers.push}
+
+notify:
+  channel: push
+  every_min: 30
+`;
+}
+/** A short account of what was decided, shown when setup finishes. */
+function summarise(answers, profile) {
+    return [
+        `project    ${profile.name}`,
+        `checks     ${[profile.typecheck?.name, profile.testRunner?.name].filter(Boolean).join(', ') || 'none detected'}`,
+        `rails      ${answers.rails.length ? answers.rails.join(', ') : 'none — nothing is off limits'}`,
+        `publish    ${answers.push}`,
+        `run        ${answers.hours}h by default`,
+    ];
+}
+//# sourceMappingURL=setup.js.map

package/dist/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":";;;AA2CA,oCAkBC;AAwED,kCAuDC;AAsDD,oCAmFC;AAGD,8BAQC;AA3SD;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,OAAoB;IAC/C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAErG,0EAA0E;IAC1E,MAAM,UAAU,GAAG;QACjB,SAAS;QACT,aAAa;QACb,oBAAoB;QACpB,uBAAuB;QACvB,sBAAsB;QACtB,WAAW;QACX,QAAQ;QACR,oBAAoB;KACrB,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/B,CAAC;AAEY,QAAA,SAAS,GAAwB;IAC5C;QACE,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,sCAAsC;QAC3C,GAAG,EAAE,wKAAwK;QAC7K,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,YAAY;KACtB;IACD;QACE,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,+CAA+C;QACpD,GAAG,EAAE,mJAAmJ;QACxJ,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,IAAI;KACd;IACD;QACE,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,8BAA8B;QACnC,GAAG,EAAE,8EAA8E;QACnF,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE;YACP,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,gCAAgC,EAAE;YAC1E,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,qCAAqC,EAAE;YAC3F,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE;SAC1E;KACF;IACD;QACE,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,iCAAiC;QACtC,GAAG,EAAE,4KAA4K;QACjL,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE;YACP,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,8BAA8B,EAAE;YAC1F,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,iCAAiC,EAAE;SAClF;KACF;IACD;QACE,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,sCAAsC;QAC3C,GAAG,EAAE,mGAAmG;QACxG,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,GAAG;KACb;CACF,CAAC;AAUW,QAAA,eAAe,GAAiB;IAC3C,KAAK,EAAE,EAAE;IACT,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,SAAS;IAChB,KAAK,EAAE,CAAC;CACT,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,WAAW,CACzB,QAAkB,EAClB,GAAW;IAEX,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAExB,wEAAwE;IACxE,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;IAE7D,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzC,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;YACjE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAClC,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CACtF,CAAC;YACF,oEAAoE;YACpE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC3E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,CAAE,CAAC,KAAK,EAAE,CAAC;YACnE,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAClG,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAC1C,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;YAClG,IAAI,CAAC,GAAG,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0DAA0D,EAAE,CAAC;YACpG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAChC,CAAC;QAED,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,KAAK,GAAG,IAAI;iBACf,KAAK,CAAC,QAAQ,CAAC;iBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,OAAO,CAAC,CAAC;YACnB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YACrE,IAAI,GAAG,EAAE,CAAC;gBACR,mEAAmE;gBACnE,2EAA2E;gBAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,GAAG,wCAAwC,EAAE,CAAC;YAC9E,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC;IACH,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,WAAW,CAAC,CAAW;IAC9B,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,OAAO;YACV,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,KAAK,SAAS;YACZ,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3C,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC,OAAO,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACU,QAAA,mBAAmB,GAAG;IACjC,iFAAiF;IACjF,6EAA6E;IAC7E,sEAAsE;CACvE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,SAAgB,YAAY,CAAC,OAAoB,EAAE,OAAqB;IACtE,MAAM,KAAK,GAAG;QACZ,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,OAAO,CAAC,SAAS,CAAC,IAAI,YAAY,OAAO,CAAC,SAAS,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC,IAAI;QACvH,OAAO,CAAC,UAAU;YAChB,CAAC,CAAC,gBAAgB,OAAO,CAAC,UAAU,CAAC,IAAI,YAAY,OAAO,CAAC,UAAU,CAAC,GAAG,qCAAqC;YAChH,CAAC,CAAC,IAAI;KACT,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAElB,wEAAwE;IACxE,yEAAyE;IACzE,gEAAgE;IAChE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM;QAChC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5D,CAAC,CAAC,6DAA6D,CAAC;IAElE,4EAA4E;IAC5E,4EAA4E;IAC5E,+BAA+B;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM;QACpC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;QAC1C,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACX,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAEzD,OAAO;;;;;;WAME,OAAO,CAAC,IAAI;;;;;EAKrB,2BAAmB;;EAEnB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uEAAuE;;;;;oBAKvF,KAAK;EAEvB,OAAO,CAAC,MAAM;QACZ,CAAC,CAAC;;oFAE8E;QAChF,CAAC,CAAC,qFACN;;;;eAIe,OAAO,CAAC,KAAK;;;;;;;;;;;;;;;;;;;MAmBtB,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC,4CAA4C;WAC1I,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;eAEhC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;YAG3C,OAAO,CAAC,IAAI;;;;;CAKvB,CAAC;AACF,CAAC;AAED,sEAAsE;AACtE,SAAgB,SAAS,CAAC,OAAqB,EAAE,OAAoB;IACnE,OAAO;QACL,cAAc,OAAO,CAAC,IAAI,EAAE;QAC5B,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,EAAE;QACjH,cAAc,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,8BAA8B,EAAE;QAChG,cAAc,OAAO,CAAC,IAAI,EAAE;QAC5B,cAAc,OAAO,CAAC,KAAK,cAAc;KAC1C,CAAC;AACJ,CAAC"}

package/dist/shared-grants.d.ts

@@ -0,0 +1,164 @@
+/**
+ * WHO MAY READ THE SHARED DIRECTORIES, AND WHEN THAT STOPS BEING TRUE.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * 🔴 THE MEASUREMENT THIS EXISTS FOR. Two directories are shared by every
+ * workspace on the machine — the toolchain mirror and the tool-worker directory
+ * — and each contained execution added an inheritable ACE for its own container
+ * SID. Nothing ever removed one. Measured on a real machine before this module:
+ *
+ *   %TEMP%\looply-toolworker\<digest>        512 ACEs, 509 of them container SIDs
+ *   ~\.looply\toolchains\node-v20.19.4-<h>   266 ACEs, 262 of them container SIDs
+ *
+ * A Windows DACL is capped at about 64 KB. At the cap `Set-Acl` throws, the
+ * helper reports `stage: 'grant'`, and every contained run on the machine stops
+ * — it fails CLOSED, which is the only good thing about it.
+ *
+ * ⚠️ THE PROFILE COUNT IS NOT THE ACE COUNT. A previous note reasoned from
+ * "1,921 container profiles" to saturation. Those numbers are unrelated: the
+ * grant lands on the toolchain and worker CHILD directories, not their roots,
+ * and the roots carry zero container ACEs. Both figures above were read off the
+ * actual DACLs.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * WHY A LEDGER, AND NOT JUST THE SID.
+ *
+ * A workspace-derived SID names the PRINCIPAL. It does not enumerate where that
+ * principal was ever granted. The toolchain directory is versioned — a node
+ * upgrade moves the mirror to a new path — so a SID granted on
+ * `node-v20.19.4-<h>` cannot be cleaned up by looking at wherever the mirror
+ * lives today. The ledger records the path that was actually granted.
+ *
+ * ⚠️ AND IT RECORDS THE NUMERIC SID. After a profile is deleted, a friendly
+ * name no longer resolves; the numeric identity still does, and `icacls` takes
+ * it directly. Recording the container name too costs nothing and keeps the
+ * rows readable.
+ *
+ * ⚠️ INTENT IS RECORDED BEFORE THE GRANT, NOT AFTER. A crash between the two
+ * would otherwise leave an ACE nothing remembers — the exact shape of the leak
+ * this module removes. A record whose grant never landed is harmless: the purge
+ * is idempotent and removing an ACE that is not there succeeds.
+ *
+ * Append-only, with a LEADING newline per record, so a torn write costs one row
+ * rather than corrupting the row beside it.
+ */
+export interface SharedGrantRecord {
+    /** The container profile name — derivable from (kind, workspace), and readable. */
+    name: string;
+    /** NUMERIC. The identity that still resolves after the profile is gone. */
+    sid: string;
+    /** The exact directory granted, which a later mirror move would otherwise lose. */
+    path: string;
+    at: string;
+    state: 'granted' | 'released';
+}
+export declare function sharedGrantsPath(home?: string): string;
+/**
+ * F43: HOW LONG ONE GRANT WAITS FOR ANOTHER — longer than an ACL write takes.
+ *
+ * `icacls /grant (OI)(CI)` rewrites the entry on every file under the toolchain
+ * mirror, and the time grows with the list: 8–11 s on 09-15, 26–29 s on 09-26
+ * at ~1,230 entries. The shared mutex's default wait (5 s) is sized for
+ * check-and-claims that take microseconds, so a second identity arriving during
+ * a grant was refused ("could not be serialised") — a gate step or a tool call
+ * that did not run, and in the lane an inconclusive check nobody re-offers.
+ * A holder that dies is still broken at once (`withExclusiveLock`); this only
+ * bounds how long a LIVE holder is waited for.
+ */
+export declare const SHARED_GRANT_LOCK_WAIT_MS = 300000;
+/** Every row, oldest first. A row that will not parse is skipped, never fatal. */
+export declare function readSharedGrants(home?: string): SharedGrantRecord[];
+/**
+ * What is still granted: the last state wins, per (sid, path).
+ *
+ * Folded rather than filtered, because a path can legitimately be granted,
+ * released, and granted again when a workspace identity is reused.
+ */
+export declare function liveSharedGrants(home?: string): SharedGrantRecord[];
+export interface AclResult {
+    ok: boolean;
+    because?: string;
+}
+/**
+ * Add one inheritable read-and-execute ACE for a container SID.
+ *
+ * READ AND EXECUTE ONLY, on both shared paths, because both hold Looply's own
+ * artefacts: a container that could replace `node.exe` or the tool worker would
+ * be choosing what every later execution runs.
+ */
+export declare function grantAce(path: string, sid: string): AclResult;
+/**
+ * Remove every granted ACE for one SID from one path, and nothing else.
+ *
+ * `/remove:g` names a single principal. It cannot touch another SID's entry, an
+ * inherited entry, or the owner's own rights — which is what "without changing
+ * unrelated user permissions" has to mean in practice.
+ */
+export declare function removeAce(path: string, sid: string): AclResult;
+export interface SharedGrantDeps {
+    home?: string;
+    /** Overridable so tests drive the ledger and the lock without touching ACLs. */
+    grant?: (path: string, sid: string) => AclResult;
+    remove?: (path: string, sid: string) => AclResult;
+    now?: () => Date;
+}
+/**
+ * Make sure this identity may read a shared path, recording that it now may.
+ *
+ * 🔴 THE SAME LOCK AS THE REMOVAL, WHICH IS THE POINT. `Set-Acl` and `icacls`
+ * are both read-modify-write over one DACL, so an addition racing a removal
+ * loses whichever entry it did not see. Locking only the cleanup would leave
+ * exactly that race open on every launch.
+ *
+ * ⚠️ THE CRITICAL SECTION IS THE ACL WRITE, AND NOTHING MORE. The lock is taken
+ * here and released before the caller launches anything: it is never held
+ * across a provider invocation or a gate step.
+ *
+ * Idempotent: an identity already recorded as holding this path does no ACL work
+ * at all, so the cost is paid once per identity rather than once per launch.
+ */
+export declare function ensureSharedGrant(name: string, sid: string, path: string, deps?: SharedGrantDeps): AclResult;
+/** The narrow slice of the containment backend this needs: a SID lookup. */
+export interface SidSource {
+    call(req: {
+        action: string;
+        profile: string;
+    }): Promise<{
+        ok: boolean;
+        sid?: string;
+        error?: string;
+    }>;
+}
+/**
+ * Ensure one container identity may read the shared paths, before it launches.
+ *
+ * ⚠️ THE COMMON CASE COSTS NOTHING. An identity whose rows are already in the
+ * ledger takes no lock, makes no probe and touches no ACL — so the extra round
+ * trip is paid once per identity, not once per launch.
+ */
+export declare function ensureSharedAccess(backend: SidSource | null, name: string, paths: readonly string[], deps?: SharedGrantDeps): Promise<AclResult>;
+export interface ReleaseOutcome {
+    released: {
+        path: string;
+        sid: string;
+    }[];
+    pending: {
+        path: string;
+        sid: string;
+        because: string;
+    }[];
+}
+/**
+ * Give back every shared-path grant held by these identities.
+ *
+ * 🔴 CALLED ONLY FOR AN IDENTITY WHOSE WORKSPACE IS BEING RETIRED, and the
+ * caller establishes that. This function does not decide liveness; it does the
+ * ACL work for a decision already made, so a caller that skips the check cannot
+ * be rescued here.
+ *
+ * ⚠️ A FAILURE LEAVES THE ROW `granted`, DELIBERATELY. That is the truthful
+ * cleanup-pending state: the next retirement sweep finds the row and tries
+ * again, and nothing ever reports cleanup it did not do.
+ */
+export declare function releaseSharedGrants(names: readonly string[], deps?: SharedGrantDeps): ReleaseOutcome;
+//# sourceMappingURL=shared-grants.d.ts.map

package/dist/shared-grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-grants.d.ts","sourceRoot":"","sources":["../src/shared-grants.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,GAAG,EAAE,MAAM,CAAC;IACZ,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,SAAS,GAAG,UAAU,CAAC;CAC/B;AAED,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAEjE;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB,SAAU,CAAC;AAMjD,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,MAAkB,GAAG,iBAAiB,EAAE,CAqB9E;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,MAAkB,GAAG,iBAAiB,EAAE,CAI9E;AAYD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAO7D;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAO9D;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,SAAS,CAAC;IACjD,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,SAAS,CAAC;IAClD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,eAAoB,GACzB,SAAS,CAsBX;AAED,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxG;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,SAAS,GAAG,IAAI,EACzB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,SAAS,CAAC,CA8CpB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1C,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC3D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,GAAE,eAAoB,GAAG,cAAc,CAyBxG"}