looply-cli 0.5.21 → 0.5.23

package/dist/preview-wiring.js

@@ -7,6 +7,8 @@ const heroku_api_1 = require("./heroku-api");
 const preview_environments_1 = require("./preview-environments");
 const preview_github_1 = require("./preview-github");
 const preview_settings_cache_1 = require("./preview-settings-cache");
+const feature_settings_cache_1 = require("./feature-settings-cache");
+const remote_command_1 = require("./remote-command");
 function makePreviewAdvancer(opts) {
     const now = opts.now ?? (() => Date.now());
     const pull = (0, preview_settings_cache_1.makePreviewSettingsPull)({
@@ -27,10 +29,27 @@ function makePreviewAdvancer(opts) {
             const t = (0, heroku_api_1.herokuToken)();
             return t === null ? null : (0, heroku_api_1.makeHerokuApi)({ token: t.token });
         });
-    const run = opts.runCommand ?? (0, preview_environments_1.makePreviewCommandRunner)(opts.cwd, opts.stateDir);
     const settings = () => (0, preview_settings_cache_1.resolvePreview)(opts.config.preview?.settings, opts.stateDir).settings;
+    /**
+     * THE COMMAND: the repository's own `preview.command` (run as before, the project's code), else the one
+     * an owner set and confirmed in AutoRyn — read fresh each time, and run ONLY in the gate sandbox with
+     * internet access and the secrets it names (`remote-command.ts`).
+     */
+    const local = opts.config.preview?.command?.trim() ? opts.config.preview : null;
+    const remote = () => (local === null ? (0, feature_settings_cache_1.readFeatureSettingsCache)(opts.stateDir)?.settings?.previewCommand ?? null : null);
+    const decl = {
+        get command() {
+            return local?.command ?? remote()?.command;
+        },
+        get teardown() {
+            return local !== null ? local.teardown : remote()?.teardown;
+        },
+    };
+    const host = opts.runCommand ?? (0, preview_environments_1.makePreviewCommandRunner)(opts.cwd, opts.stateDir);
+    const contained = opts.runContained ?? (0, remote_command_1.makeContainedCommandRunner)(opts.cwd, opts.stateDir, 'preview.log', remote);
+    const run = (cmd, env, timeoutMs) => (local !== null ? host(cmd, env, timeoutMs) : contained(cmd, env, timeoutMs));
     /** One command driver for the life of the daemon: it holds the background builds. */
-    const command = (0, preview_environments_1.commandDriver)({ ...(opts.config.preview?.command ? { command: opts.config.preview.command } : {}), ...(opts.config.preview?.teardown ? { teardown: opts.config.preview.teardown } : {}) }, run);
+    const command = (0, preview_environments_1.commandDriver)(decl, run);
     const store = (0, preview_environments_1.filePreviewStore)(opts.stateDir);
     const deliveries = (0, branch_delivery_1.fileDeliveryStore)(opts.stateDir);
     return {

package/dist/preview-wiring.js.map

@@ -1 +1 @@
-{"version":3,"file":"preview-wiring.js","sourceRoot":"","sources":["../src/preview-wiring.ts"],"names":[],"mappings":";;AA8CA,kDAkEC;AA/GD,uDAAsD;AAEtD,6CAA0E;AAC1E,6CAA0E;AAC1E,iEAUgC;AAChC,qDAAqF;AACrF,qEAAmF;AA6BnF,SAAgB,mBAAmB,CAAC,IAAuB;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAA,gDAAuB,EAAC;QACnC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC;QAC/D,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG;KACJ,CAAC,CAAC;IACH,MAAM,MAAM,GACV,IAAI,CAAC,MAAM;QACX,CAAC,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE;YACrC,MAAM,CAAC,GAAG,MAAM,IAAA,wBAAW,GAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC5B,OAAO,EAAE,GAAG,EAAE,IAAA,0BAAa,EAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAA,wCAAuB,EAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QACnI,CAAC,CAAC,CAAC;IACL,MAAM,MAAM,GACV,IAAI,CAAC,MAAM;QACX,CAAC,GAAG,EAAE;YACJ,MAAM,CAAC,GAAG,IAAA,wBAAW,GAAE,CAAC;YACxB,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,0BAAa,EAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,IAAA,+CAAwB,EAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,GAA2B,EAAE,CAAC,IAAA,uCAAc,EAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC;IACrH,qFAAqF;IACrF,MAAM,OAAO,GAAG,IAAA,oCAAa,EAAC,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAChN,MAAM,KAAK,GAAG,IAAA,uCAAgB,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAA,mCAAiB,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEpD,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,IAAI,EAAE,CAAC;YACb,8DAA8D;YAC9D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkE,CAAC;YAC1F,MAAM,SAAS,GAAG,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE;gBACtD,MAAM,CAAC,GAAG,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC;gBAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;YACzB,CAAC,CAAC;YACF,IAAI,OAAO,GAA2D,IAAI,CAAC;YAC3E,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,CAAC,QAAkC,EAAwB,EAAE;gBAC1E,IAAI,OAAO,KAAK,IAAI;oBAAE,OAAO,IAAI,CAAC;gBAClC,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;gBACrB,IAAI,QAAQ,KAAK,SAAS;oBAAE,OAAO,OAAO,CAAC;gBAC3C,IAAI,QAAQ,KAAK,SAAS;oBAAE,OAAO,IAAA,oCAAa,EAAC,CAAC,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBACrG,0GAA0G;gBAC1G,IAAI,CAAC,EAAE,QAAQ,KAAK,QAAQ;oBAAE,OAAO,IAAA,mCAAY,EAAC,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBAChF,OAAO,IAAI,CAAC;YACd,CAAC,CAAC;YACF,MAAM,IAAA,sCAAe,EAAC;gBACpB,QAAQ;gBACR,MAAM;gBACN,UAAU;gBACV,KAAK;gBACL,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;oBAC5B,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;oBACvC,OAAO,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC;gBAC9B,CAAC;gBACD,MAAM,EAAE,KAAK,EAAE,MAAc,EAAE,MAAqB,EAAE,EAAE;oBACtD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;wBAAE,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBACjG,CAAC;gBACD,GAAG;gBACH,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"preview-wiring.js","sourceRoot":"","sources":["../src/preview-wiring.ts"],"names":[],"mappings":";;AAkDA,kDAmFC;AApID,uDAAsD;AAEtD,6CAA0E;AAC1E,6CAA0E;AAC1E,iEAUgC;AAChC,qDAAqF;AACrF,qEAAmF;AACnF,qEAAoE;AACpE,qDAA8D;AA+B9D,SAAgB,mBAAmB,CAAC,IAAuB;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAA,gDAAuB,EAAC;QACnC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC;QAC/D,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG;KACJ,CAAC,CAAC;IACH,MAAM,MAAM,GACV,IAAI,CAAC,MAAM;QACX,CAAC,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE;YACrC,MAAM,CAAC,GAAG,MAAM,IAAA,wBAAW,GAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC5B,OAAO,EAAE,GAAG,EAAE,IAAA,0BAAa,EAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAA,wCAAuB,EAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QACnI,CAAC,CAAC,CAAC;IACL,MAAM,MAAM,GACV,IAAI,CAAC,MAAM;QACX,CAAC,GAAG,EAAE;YACJ,MAAM,CAAC,GAAG,IAAA,wBAAW,GAAE,CAAC;YACxB,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,0BAAa,EAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,MAAM,QAAQ,GAAG,GAA2B,EAAE,CAAC,IAAA,uCAAc,EAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC;IACrH;;;;OAIG;IACH,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAA,iDAAwB,EAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzH,MAAM,IAAI,GAAG;QACX,IAAI,OAAO;YACT,OAAO,KAAK,EAAE,OAAO,IAAI,MAAM,EAAE,EAAE,OAAO,CAAC;QAC7C,CAAC;QACD,IAAI,QAAQ;YACV,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC;QAC9D,CAAC;KACF,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,IAAA,+CAAwB,EAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,IAAI,IAAA,2CAA0B,EAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IAClH,MAAM,GAAG,GAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IACzI,qFAAqF;IACrF,MAAM,OAAO,GAAG,IAAA,oCAAa,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAA,uCAAgB,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAA,mCAAiB,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEpD,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,IAAI,EAAE,CAAC;YACb,8DAA8D;YAC9D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkE,CAAC;YAC1F,MAAM,SAAS,GAAG,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE;gBACtD,MAAM,CAAC,GAAG,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC;gBAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;YACzB,CAAC,CAAC;YACF,IAAI,OAAO,GAA2D,IAAI,CAAC;YAC3E,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,CAAC,QAAkC,EAAwB,EAAE;gBAC1E,IAAI,OAAO,KAAK,IAAI;oBAAE,OAAO,IAAI,CAAC;gBAClC,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;gBACrB,IAAI,QAAQ,KAAK,SAAS;oBAAE,OAAO,OAAO,CAAC;gBAC3C,IAAI,QAAQ,KAAK,SAAS;oBAAE,OAAO,IAAA,oCAAa,EAAC,CAAC,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBACrG,0GAA0G;gBAC1G,IAAI,CAAC,EAAE,QAAQ,KAAK,QAAQ;oBAAE,OAAO,IAAA,mCAAY,EAAC,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBAChF,OAAO,IAAI,CAAC;YACd,CAAC,CAAC;YACF,MAAM,IAAA,sCAAe,EAAC;gBACpB,QAAQ;gBACR,MAAM;gBACN,UAAU;gBACV,KAAK;gBACL,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;oBAC5B,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;oBACvC,OAAO,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC;gBAC9B,CAAC;gBACD,MAAM,EAAE,KAAK,EAAE,MAAc,EAAE,MAAqB,EAAE,EAAE;oBACtD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;wBAAE,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBACjG,CAAC;gBACD,GAAG;gBACH,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/remote-command.d.ts

@@ -0,0 +1,34 @@
+import type { RemoteCommand } from '@looply/core';
+import { type UntrustedGateDeps } from './untrusted-gate';
+/**
+ * A COMMAND AN OWNER SET IN AUTORYN (a preview site's build, a release step),
+ * RUN WHERE GATES RUN — NEVER ON THE HOST.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * A command written in the repository's own `.looply/config.yaml` is the
+ * project's code, and runs as before. A command that arrived as a remote
+ * setting is a code-execution path from outside this machine, so:
+ *
+ *   - it runs in the gate sandbox (AppContainer), granted the project folder
+ *     and nothing else of this machine — not the user's profile, not other
+ *     repositories, not Looply's state or keys;
+ *   - it gets internet access (`internet-client`), because a preview or a
+ *     deploy must reach its host;
+ *   - its environment is the sandbox's own plus the secrets the owner named
+ *     for it (delivered sealed to this machine) and the LOOPLY_* facts —
+ *     never the daemon's environment;
+ *   - the owner confirmed exactly this text in AutoRyn (`confirmedBy`), and the
+ *     log line says so.
+ *
+ * Its output goes to `.looply/state/run-logs/<log>`, secrets masked; what is
+ * reported anywhere else is a sentence, never the output.
+ */
+export interface CommandOutcome {
+    code: number;
+    stdout: string;
+}
+export type ContainedCommandRunner = (command: string, env: Record<string, string>, timeoutMs: number) => Promise<CommandOutcome>;
+export declare function makeContainedCommandRunner(projectDir: string, stateDir: string, logName: string, remote: () => RemoteCommand | null, deps?: Pick<UntrustedGateDeps, 'backend' | 'toolchain'> & {
+    home?: string;
+}): ContainedCommandRunner;
+//# sourceMappingURL=remote-command.d.ts.map

package/dist/remote-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-command.d.ts","sourceRoot":"","sources":["../src/remote-command.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlD,OAAO,EAA2B,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAEnF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;AAElI,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,aAAa,GAAG,IAAI,EAClC,IAAI,GAAE,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,WAAW,CAAC,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9E,sBAAsB,CA0BxB"}

package/dist/remote-command.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makeContainedCommandRunner = makeContainedCommandRunner;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const machine_secrets_1 = require("./machine-secrets");
+const preview_environments_1 = require("./preview-environments");
+const untrusted_gate_1 = require("./untrusted-gate");
+function makeContainedCommandRunner(projectDir, stateDir, logName, remote, deps = {}) {
+    return async (command, env, timeoutMs) => {
+        const r = remote();
+        const { env: secrets, missing } = (0, machine_secrets_1.secretEnv)(r?.secrets, deps.home);
+        const values = Object.values(secrets);
+        const mask = (s) => values.reduce((acc, v) => (v.length >= 6 ? acc.split(v).join('***') : acc), (0, preview_environments_1.redactSecrets)(s));
+        const note = (s) => {
+            try {
+                const dir = (0, node_path_1.join)(stateDir, 'run-logs');
+                (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+                (0, node_fs_1.appendFileSync)((0, node_path_1.join)(dir, logName), mask(s), 'utf8');
+            }
+            catch {
+                /* the log is a convenience */
+            }
+        };
+        note(`\n=== ${new Date().toISOString()} [sandbox, internet] ${command}${r ? ` (set in AutoRyn, confirmed by ${r.confirmedBy} at ${r.confirmedAt})` : ''}\n`);
+        if (missing.length > 0) {
+            const why = `the secret${missing.length === 1 ? '' : 's'} ${missing.join(', ')} ${missing.length === 1 ? 'is' : 'are'} not on this machine yet (AutoRyn → Software execution → Machine secrets)`;
+            note(`${why}\n`);
+            return { code: -1, stdout: why };
+        }
+        const run = (0, untrusted_gate_1.makeUntrustedGateRunner)(projectDir, { ...deps, network: 'internet-client', extraEnv: { ...secrets, ...env } });
+        const out = await run(command, timeoutMs);
+        note(out.output ?? '');
+        return { code: out.ok ? 0 : (out.exitCode ?? -1), stdout: (out.output ?? '').slice(-20_000) };
+    };
+}
+//# sourceMappingURL=remote-command.js.map

package/dist/remote-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-command.js","sourceRoot":"","sources":["../src/remote-command.ts"],"names":[],"mappings":";;AAsCA,gEAgCC;AAtED,qCAAoD;AACpD,yCAAiC;AAEjC,uDAA8C;AAC9C,iEAAuD;AACvD,qDAAmF;AAiCnF,SAAgB,0BAA0B,CACxC,UAAkB,EAClB,QAAgB,EAChB,OAAe,EACf,MAAkC,EAClC,OAA6E,EAAE;IAE/E,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE;QACvC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAA,2BAAS,EAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAA,oCAAa,EAAC,CAAC,CAAC,CAAC,CAAC;QAClI,MAAM,IAAI,GAAG,CAAC,CAAS,EAAQ,EAAE;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAA,gBAAI,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBACvC,IAAA,mBAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpC,IAAA,wBAAc,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,8BAA8B;YAChC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,wBAAwB,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,WAAW,OAAO,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7J,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,aAAa,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,2EAA2E,CAAC;YACjM,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YACjB,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,GAAG,GAAG,IAAA,wCAAuB,EAAC,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3H,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;IAChG,CAAC,CAAC;AACJ,CAAC"}

package/dist/run-cmd.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-cmd.d.ts","sourceRoot":"","sources":["../src/run-cmd.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAOvD,OAAO,EAGL,KAAK,cAAc,EAKnB,KAAK,IAAI,EAaT,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AACzD,OAAO,EAA6B,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAiC/E,OAAO,EAGL,KAAK,aAAa,EAIlB,KAAK,UAAU,EAChB,MAAM,gBAAgB,CAAC;AAoBxB,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AA0C9E,OAAO,EAGL,KAAK,yBAAyB,EAE/B,MAAM,uBAAuB,CAAC;AAe/B,OAAO,EAaL,KAAK,cAAc,EAEpB,MAAM,cAAc,CAAC;AAetB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAmBpD,OAAO,EAIL,KAAK,2BAA2B,EAEjC,MAAM,gBAAgB,CAAC;AAIxB;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,YAAY,GACpB,iBAAiB,GACjB,YAAY,GACZ,gBAAgB,GAChB,eAAe,GACf,iBAAiB,GACjB,qBAAqB,CAAC;AAE1B,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAC5D,oEAAoE;IACpE,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;;;;;OAUG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,qBAAa,UAAW,SAAQ,KAAK;IAcjC,QAAQ,CAAC,IAAI,EAAE,cAAc;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;IACxB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,eAAe;IA/BxC;;;;;;;;;;OAUG;gBAED,OAAO,EAAE,MAAM,EACN,IAAI,GAAE,cAA8B;IAC7C;;;;;OAKG;IACM,MAAM,CAAC,EAAE,MAAM,YAAA;IACxB;;;;OAIG;IACM,QAAQ,CAAC,EAAE,WAAW,YAAA;IAC/B;;;OAGG;IACM,WAAW,CAAC,EAAE,eAAe,YAAA;CAIzC;AAED,6DAA6D;AAC7D,eAAO,MAAM,YAAY,IAAI,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE;IAAE,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,EACxD,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE,EAC5G,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC1B,OAAO,CAAC,IAAI,CAAC,CAmCf;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAYtC,4EAA4E;AAC5E,eAAO,MAAM,8BAA8B,QAAY,CAAC;AACxD,iGAAiG;AACjG,eAAO,MAAM,6BAA6B,QAAY,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CA+D5D;AA6MD,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,YAAY;AACjB;;;;;;;;GAQG;AACH,UAAU,CAAC,EAAE,yBAAyB;AACtC;;;;;;GAMG;AACH,QAAQ,CAAC,EAAE,2BAA2B;AACtC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;AACtB;;;;;;;;GAQG;AACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;AACzB;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,EAAE,aAAa;AACtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI;AACpB;;;;;;;;;;;;GAYG;AACH,IAAI,CAAC,EAAE,cAAc,GACpB,MAAM,CA4FR;AAED;;;;;;;;;;;GAWG;AACH;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,GAAG,CAAC,IAAI,EAAE,mBAAmB,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChF,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;CACnF;AAiID;;;GAGG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAksInE"}
+{"version":3,"file":"run-cmd.d.ts","sourceRoot":"","sources":["../src/run-cmd.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAOvD,OAAO,EAGL,KAAK,cAAc,EAKnB,KAAK,IAAI,EAaT,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AACzD,OAAO,EAA6B,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAiC/E,OAAO,EAGL,KAAK,aAAa,EAIlB,KAAK,UAAU,EAChB,MAAM,gBAAgB,CAAC;AAoBxB,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AA0C9E,OAAO,EAGL,KAAK,yBAAyB,EAE/B,MAAM,uBAAuB,CAAC;AAe/B,OAAO,EAaL,KAAK,cAAc,EAEpB,MAAM,cAAc,CAAC;AAiBtB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAmBpD,OAAO,EAIL,KAAK,2BAA2B,EAEjC,MAAM,gBAAgB,CAAC;AAIxB;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,YAAY,GACpB,iBAAiB,GACjB,YAAY,GACZ,gBAAgB,GAChB,eAAe,GACf,iBAAiB,GACjB,qBAAqB,CAAC;AAE1B,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAC5D,oEAAoE;IACpE,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;;;;;OAUG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,qBAAa,UAAW,SAAQ,KAAK;IAcjC,QAAQ,CAAC,IAAI,EAAE,cAAc;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;IACxB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,eAAe;IA/BxC;;;;;;;;;;OAUG;gBAED,OAAO,EAAE,MAAM,EACN,IAAI,GAAE,cAA8B;IAC7C;;;;;OAKG;IACM,MAAM,CAAC,EAAE,MAAM,YAAA;IACxB;;;;OAIG;IACM,QAAQ,CAAC,EAAE,WAAW,YAAA;IAC/B;;;OAGG;IACM,WAAW,CAAC,EAAE,eAAe,YAAA;CAIzC;AAED,6DAA6D;AAC7D,eAAO,MAAM,YAAY,IAAI,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE;IAAE,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,EACxD,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE,EAC5G,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC1B,OAAO,CAAC,IAAI,CAAC,CAmCf;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAYtC,4EAA4E;AAC5E,eAAO,MAAM,8BAA8B,QAAY,CAAC;AACxD,iGAAiG;AACjG,eAAO,MAAM,6BAA6B,QAAY,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CA+D5D;AA6MD,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,YAAY;AACjB;;;;;;;;GAQG;AACH,UAAU,CAAC,EAAE,yBAAyB;AACtC;;;;;;GAMG;AACH,QAAQ,CAAC,EAAE,2BAA2B;AACtC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;AACtB;;;;;;;;GAQG;AACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;AACzB;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,EAAE,aAAa;AACtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI;AACpB;;;;;;;;;;;;GAYG;AACH,IAAI,CAAC,EAAE,cAAc,GACpB,MAAM,CA4FR;AAED;;;;;;;;;;;GAWG;AACH;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,GAAG,CAAC,IAAI,EAAE,mBAAmB,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChF,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;CACnF;AAiID;;;GAGG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAusInE"}

package/dist/run-cmd.js

@@ -99,6 +99,8 @@ const provider_identity_1 = require("./provider-identity");
 const agent_exec_1 = require("./agent-exec");
 const providers_1 = require("./providers");
 const core_4 = require("@looply/core");
+const core_5 = require("@looply/core");
+const feature_settings_cache_1 = require("./feature-settings-cache");
 const queue_write_lease_1 = require("./queue-write-lease");
 const surface_lease_1 = require("./surface-lease");
 const spend_ledger_1 = require("./spend-ledger");
@@ -2993,7 +2995,12 @@ async function runLoop(opts) {
          * A bug that does not show asks one question instead of spending a fix attempt — only when the
          * reproduction happened in THIS Start, so a resumed goal is never asked the same thing twice.
          */
-        if (verdict.compile && scope !== null && binding.kind === 'bound' && (0, bug_repro_1.isBugGoal)(binding.goal.text)) {
+        // On unless switched off: config.yaml `bug_repro.enabled`, else the switch in AutoRyn (feature switches).
+        const reproSwitch = (0, core_5.bugReproEnabled)(config.bugRepro?.enabled, (0, feature_settings_cache_1.remoteFeaturesFor)(opts.cwd));
+        if (!reproSwitch.enabled && binding.kind === 'bound' && (0, bug_repro_1.isBugGoal)(binding.goal.text)) {
+            log(`repro   : this is a bug, but reproduction-first is switched off (${reproSwitch.from === 'remote' ? 'in AutoRyn' : 'in .looply/config.yaml'}); planning the fix directly`);
+        }
+        if (reproSwitch.enabled && verdict.compile && scope !== null && binding.kind === 'bound' && (0, bug_repro_1.isBugGoal)(binding.goal.text)) {
             let repro = reproStore.read(binding.goal.id, binding.goal.version);
             if (repro === null) {
                 log('repro   : this is a bug — writing a test that shows it before planning the fix');