mtech-ai-local-runner 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,3 @@
+Copyright (c) MTEC. All rights reserved.
+
+This software is proprietary and may be used only under an agreement with MTEC.

package/README.md

@@ -1,3 +1,9 @@
-# Temporary Holding Version
+# MTEC AI Local Runner
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Install and configure the employee-bound macOS daemon:
+
+```bash
+npx mtech-ai-local-runner setup
+```
+
+The package stores safe runner configuration locally and keeps OAuth refresh credentials in macOS Keychain when available.

package/dist/src/adapters/claude-code/adapter.js

@@ -0,0 +1,215 @@
+import path from "node:path";
+import { existsSync } from "node:fs";
+import { isTerminalEventType } from "../../protocol.js";
+import { parseClaudeLine } from "./stream-parser.js";
+import { compilePrompt } from "./prompt-compiler.js";
+import { buildHookPolicy, encodeHookPolicy } from "../../safety/hook-policy-builder.js";
+import { HOOK_POLICY_ENV_VAR } from "../../safety/hook-cli.js";
+const ALLOWED_ENV_KEYS = ["PATH", "HOME", "USER", "LOGNAME", "LANG", "LC_ALL", "TMPDIR", "NODE_ENV"];
+const ALLOWED_SUPERVISOR_COMMANDS = new Set(["continue", "answer_question", "request_revision", "request_checkpoint", "submit_for_review"]);
+const DEFAULT_BUILTIN_TOOL_SURFACE = ["Bash", "Edit", "Write", "MultiEdit", "NotebookEdit", "Read", "Glob", "Grep"];
+function defaultPathExists(p) {
+    return existsSync(p);
+}
+function allowlistedEnv(env) {
+    const result = {};
+    for (const key of ALLOWED_ENV_KEYS) {
+        const value = env[key];
+        if (value !== undefined)
+            result[key] = value;
+    }
+    return result;
+}
+function contractBudget(taskPackage) {
+    const pkg = taskPackage;
+    const execution = pkg.agent_execution;
+    const limits = execution?.limits;
+    const value = Number(limits?.max_estimated_cost_usd);
+    if (!Number.isFinite(value) || value <= 0) {
+        throw new Error("refusing to start: task package has no positive contract budget");
+    }
+    return value;
+}
+function isUnboundedLocalExecution(taskPackage) {
+    const pkg = taskPackage;
+    const execution = pkg.execution;
+    return execution?.mode === "employee_ai_work_session"
+        && execution?.runtime_adapter === "claude_code_cli"
+        && execution?.limits_mode === "unbounded";
+}
+function contractReadTools(taskPackage, registeredReadTools) {
+    const pkg = taskPackage;
+    const contract = pkg.contract;
+    const policy = contract?.policy;
+    const allowed = new Set(Array.isArray(policy?.allowed_gateway_tools)
+        ? policy.allowed_gateway_tools.filter((tool) => typeof tool === "string")
+        : []);
+    return [...new Set(registeredReadTools.filter((tool) => allowed.has(tool)))];
+}
+export class ClaudeCodeAdapter {
+    options;
+    handle = null;
+    constructor(options) {
+        this.options = options;
+    }
+    async start(ctx) {
+        const resolvedModelId = ctx.resolvedModelId;
+        if (!resolvedModelId) {
+            throw new Error("refusing to start: no Gateway-resolved model ID was supplied");
+        }
+        const unbounded = isUnboundedLocalExecution(ctx.taskPackage);
+        if (!unbounded && (!Number.isFinite(this.options.maxBudgetUsd) || this.options.maxBudgetUsd <= 0)) {
+            throw new Error("refusing to start: no positive remaining contract budget was supplied");
+        }
+        if (!this.options.worktreeRoot) {
+            throw new Error("refusing to start: no assigned worktree was supplied");
+        }
+        if (!ctx.sessionId) {
+            throw new Error("refusing to start: no runner-generated session ID was supplied");
+        }
+        const hookPath = this.requireTrustedHookPath();
+        const prompt = compilePrompt(ctx.taskPackage, { workItemLabel: this.options.workItemLabel });
+        const allowedReadTools = contractReadTools(ctx.taskPackage, this.options.registeredReadTools);
+        const mcpConfigPath = this.options.writeMcpConfig({ tools: { allow: allowedReadTools } });
+        const maxBudgetUsd = unbounded
+            ? null
+            : Math.min(this.options.maxBudgetUsd, contractBudget(ctx.taskPackage));
+        const hookPolicy = buildHookPolicy({
+            taskPackage: ctx.taskPackage,
+            worktreeRoot: this.options.worktreeRoot,
+            registeredReadTools: this.options.registeredReadTools,
+            generatedPaths: [mcpConfigPath],
+        });
+        const settings = {
+            hooks: {
+                PreToolUse: [{ matcher: "*", hooks: [{ type: "command", command: hookPath }] }],
+            },
+        };
+        const builtinToolSurface = this.options.builtinToolSurface ?? DEFAULT_BUILTIN_TOOL_SURFACE;
+        const mcpServerName = this.options.mcpServerName ?? "ai_gateway";
+        const toolSurface = [
+            ...builtinToolSurface,
+            ...allowedReadTools.map((tool) => `mcp__${mcpServerName}__${tool}`),
+        ];
+        const args = [
+            "--print",
+            "--input-format", "stream-json",
+            "--output-format", "stream-json",
+            "--verbose",
+            "--include-partial-messages",
+            "--no-chrome",
+            "--permission-mode", "bypassPermissions",
+            "--dangerously-skip-permissions",
+            "--model", resolvedModelId,
+            ...(maxBudgetUsd === null ? [] : ["--max-budget-usd", String(maxBudgetUsd)]),
+            "--name", this.options.workItemLabel.trim().slice(0, 80) || `work-item-${ctx.bindingId.slice(0, 8)}`,
+            "--strict-mcp-config",
+            "--mcp-config", mcpConfigPath,
+            "--settings", JSON.stringify(settings),
+            "--setting-sources", "user",
+            "--disable-slash-commands",
+            "--allowedTools", toolSurface.join(","),
+        ];
+        if (ctx.resumeSessionId) {
+            args.push("--resume", ctx.resumeSessionId);
+        }
+        else {
+            args.push("--session-id", ctx.sessionId);
+        }
+        const env = {
+            ...allowlistedEnv(this.options.env),
+            [HOOK_POLICY_ENV_VAR]: encodeHookPolicy(hookPolicy),
+        };
+        const handle = this.options.processHost.spawn(this.options.binaryPath ?? "claude", args, {
+            cwd: this.options.worktreeRoot,
+            env,
+        });
+        this.handle = handle;
+        handle.stdin.write(`${JSON.stringify({ type: "user", message: { role: "user", content: [{ type: "text", text: prompt }] } })}\n`);
+    }
+    async *events() {
+        const handle = this.requireHandle();
+        const exitInfo = { code: null, signal: null };
+        handle.once("exit", (code, signal) => {
+            exitInfo.code = code;
+            exitInfo.signal = signal;
+        });
+        let sawTerminal = false;
+        for await (const line of handle.stdout) {
+            const parsed = parseClaudeLine(line, this.options.worktreeRoot);
+            if (!parsed)
+                continue;
+            if (isTerminalEventType(parsed.eventType))
+                sawTerminal = true;
+            yield parsed;
+            if (sawTerminal) {
+                handle.stdin.end();
+                return;
+            }
+        }
+        if (!sawTerminal) {
+            yield { eventType: "failed", summary: `claude process exited unexpectedly (code ${exitInfo.code ?? "unknown"})` };
+        }
+    }
+    async command(command) {
+        if (!ALLOWED_SUPERVISOR_COMMANDS.has(command.command)) {
+            throw new Error(`unsupported supervisor command: ${command.command} is not allowed for this adapter`);
+        }
+        const handle = this.requireHandle();
+        const payload = { type: "supervisor_command", command: command.command };
+        if (command.command === "answer_question" && typeof command.arguments?.answer === "string") {
+            payload.answer = command.arguments.answer;
+        }
+        if (command.command === "request_revision" && Array.isArray(command.arguments?.acceptance_criterion_ids)) {
+            payload.acceptance_criterion_ids = command.arguments?.acceptance_criterion_ids;
+        }
+        handle.stdin.write(`${JSON.stringify({ type: "user", message: { role: "user", content: [{ type: "text", text: JSON.stringify(payload) }] } })}\n`);
+    }
+    async cancel() {
+        const handle = this.requireHandle();
+        handle.stdin.end();
+        handle.kill("SIGTERM");
+    }
+    requireTrustedHookPath() {
+        const hookPath = this.options.hookExecutablePath;
+        if (!hookPath || !path.isAbsolute(hookPath)) {
+            throw new Error("refusing to start: PreToolUse hook executable path must be an absolute path");
+        }
+        if (!/^[A-Za-z0-9._/:\\-]+$/.test(hookPath)) {
+            throw new Error("refusing to start: PreToolUse hook must use a safe executable path without shell metacharacters");
+        }
+        const worktreeRoot = path.resolve(this.options.worktreeRoot);
+        const rel = path.relative(worktreeRoot, path.resolve(hookPath));
+        const isInsideWorktree = rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+        if (isInsideWorktree) {
+            throw new Error("refusing to start: PreToolUse hook executable must live outside the assigned worktree");
+        }
+        const exists = this.options.hookExecutableExists ?? defaultPathExists;
+        if (!exists(hookPath)) {
+            throw new Error("refusing to start: PreToolUse hook executable was not found at the trusted path");
+        }
+        return hookPath;
+    }
+    requireHandle() {
+        if (!this.handle) {
+            throw new Error("adapter has not been started");
+        }
+        return this.handle;
+    }
+}
+export class ClaudeCodePlugin {
+    pluginOptions;
+    id = "claude_code_cli";
+    version = "1";
+    capabilities = ["repository_read", "repository_edit", "shell_test", "git_diff"];
+    constructor(pluginOptions) {
+        this.pluginOptions = pluginOptions;
+    }
+    async probe() {
+        const result = await this.pluginOptions.probe();
+        return { ...result, capabilities: result.capabilities ?? this.capabilities };
+    }
+    async create(input) {
+        return new ClaudeCodeAdapter(this.pluginOptions.options(input));
+    }
+}

package/dist/src/adapters/claude-code/prompt-compiler.js

@@ -0,0 +1,58 @@
+const STOP_BEFORE_PUBLICATION_RULE = "Stop before publication. Never run git commit, git push, create a pull request, merge, " +
+    "deploy, access production, send an external message, or write data outside this worktree.";
+const EVENT_SCHEMA_NOTICE = "Report progress only through the normalized event lifecycle (started, progress, file_changed, question, " +
+    "test_started, test_result, budget_warning, checkpoint_ready, blocked, completed, failed). " +
+    "Checkpoint your work with checkpoint_ready before stopping whenever it is safe to do so.";
+function requiredArray(value, label) {
+    if (!Array.isArray(value)) {
+        throw new Error(`task package is missing ${label}`);
+    }
+    return value.map((item) => String(item));
+}
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+export function compilePrompt(taskPackage, options) {
+    const contract = record(taskPackage.contract);
+    if (!contract) {
+        throw new Error("task package is missing a contract");
+    }
+    const agentExecution = record(taskPackage.agent_execution);
+    if (!agentExecution) {
+        throw new Error("task package is missing the implementation brief (agent_execution section)");
+    }
+    const brief = record(agentExecution.implementation_brief);
+    if (!brief) {
+        throw new Error("task package is missing the implementation brief");
+    }
+    const unresolvedQuestions = requiredArray(brief.unresolved_questions ?? [], "unresolved_questions");
+    if (unresolvedQuestions.length > 0) {
+        throw new Error(`task package has unresolved questions that must be resolved before dispatch: ${unresolvedQuestions.join("; ")}`);
+    }
+    const contractObjective = record(contract.objective);
+    const objective = String(brief.objective ?? contractObjective?.summary ?? "");
+    if (!objective) {
+        throw new Error("task package is missing an objective");
+    }
+    const acceptanceCriteria = requiredArray(brief.acceptance_criteria ?? contractObjective?.acceptance_criteria ?? [], "acceptance_criteria");
+    const prohibitedActions = requiredArray(agentExecution.prohibited_actions ?? [], "prohibited_actions");
+    const requiredChanges = requiredArray(brief.required_changes ?? [], "required_changes");
+    const invariants = requiredArray(brief.invariants ?? [], "invariants");
+    const nonGoals = requiredArray(brief.non_goals ?? [], "non_goals");
+    const requiredTests = requiredArray(brief.required_tests ?? [], "required_tests");
+    const sections = [
+        `# Bounded implementation brief: ${options.workItemLabel}`,
+        `## Objective\n${objective}`,
+        `## Required changes\n${requiredChanges.map((item) => `- ${item}`).join("\n")}`,
+        `## Invariants\n${invariants.map((item) => `- ${item}`).join("\n")}`,
+        `## Non-goals\n${nonGoals.map((item) => `- ${item}`).join("\n")}`,
+        `## Acceptance criteria\n${acceptanceCriteria.map((item) => `- ${item}`).join("\n")}`,
+        `## Required tests\n${requiredTests.map((item) => `- ${item}`).join("\n")}`,
+        `## Prohibited actions\n${prohibitedActions.map((item) => `- ${item}`).join("\n")}`,
+        `## Stop-before-publication rule\n${STOP_BEFORE_PUBLICATION_RULE}`,
+        `## Event and checkpoint obligations\n${EVENT_SCHEMA_NOTICE}`,
+    ];
+    return sections.join("\n\n");
+}

package/dist/src/adapters/claude-code/stream-parser.js

@@ -0,0 +1,128 @@
+import { isAbsolute, relative, resolve } from "node:path";
+import { MAX_EVENT_SUMMARY_CHARS } from "../../protocol.js";
+const EDIT_TOOL_NAMES = new Set(["Edit", "Write", "MultiEdit"]);
+function bounded(summary) {
+    return summary.length > MAX_EVENT_SUMMARY_CHARS ? summary.slice(0, MAX_EVENT_SUMMARY_CHARS) : summary;
+}
+function relativePath(absolutePath, worktreeRoot) {
+    if (!absolutePath || !isAbsolute(absolutePath))
+        return null;
+    const candidate = relative(resolve(worktreeRoot), resolve(absolutePath));
+    return candidate && candidate !== ".." && !candidate.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)
+        && !isAbsolute(candidate)
+        ? candidate
+        : null;
+}
+function parseToolResultPassed(text) {
+    try {
+        const parsed = JSON.parse(text);
+        return typeof parsed.passed === "boolean" ? parsed.passed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function parseAssistantMessage(message, worktreeRoot) {
+    const content = message.content ?? [];
+    for (const block of content) {
+        if (block.type !== "tool_use")
+            continue;
+        const name = String(block.name ?? "");
+        const input = block.input ?? {};
+        if (EDIT_TOOL_NAMES.has(name)) {
+            const filePath = String(input.file_path ?? "");
+            const relative = relativePath(filePath, worktreeRoot);
+            if (relative === null) {
+                return { eventType: "scope_conflict", summary: "edit targeted a path outside the assigned worktree" };
+            }
+            return { eventType: "file_changed", summary: bounded(`edited ${relative}`), payload: { file: relative } };
+        }
+        if (name === "Bash") {
+            return { eventType: "test_started", summary: "verification command started" };
+        }
+        if (name === "AskUserQuestion") {
+            const questions = Array.isArray(input.questions) ? input.questions : [];
+            const question = String(input.question ?? questions[0]?.question ?? "").trim() || "executor requested clarification";
+            return { eventType: "question", summary: bounded(question), payload: { question: bounded(question) } };
+        }
+    }
+    return null;
+}
+function parseUserMessage(message) {
+    const content = message.content ?? [];
+    for (const block of content) {
+        if (block.type !== "tool_result")
+            continue;
+        const isError = block.is_error === true;
+        const content = block.content;
+        const text = Array.isArray(content)
+            ? content.find((item) => typeof item === "object" && item !== null && item.type === "text")
+            : undefined;
+        const raw = typeof content === "string" ? content : text && typeof text.text === "string" ? text.text : "";
+        const passed = parseToolResultPassed(raw);
+        const resolvedPassed = passed ?? !isError;
+        return {
+            eventType: "test_result",
+            summary: resolvedPassed ? "verification passed" : "verification failed",
+            payload: { status: resolvedPassed ? "passed" : "failed" },
+        };
+    }
+    return null;
+}
+function parseSystemMessage(message) {
+    const subtype = String(message.subtype ?? "");
+    if (subtype === "init") {
+        return { eventType: "started", summary: "session initialized" };
+    }
+    if (subtype === "budget_warning") {
+        const remaining = typeof message.remaining_usd === "number" ? message.remaining_usd : undefined;
+        return {
+            eventType: "budget_warning",
+            summary: remaining !== undefined ? `budget warning: $${remaining.toFixed(2)} remaining` : "budget warning",
+            payload: remaining !== undefined ? { remaining_usd: remaining } : undefined,
+        };
+    }
+    if (subtype === "checkpoint") {
+        return { eventType: "checkpoint_ready", summary: "checkpoint ready" };
+    }
+    return null;
+}
+function parseResultMessage(message) {
+    const isError = message.is_error === true;
+    const costUsd = typeof message.total_cost_usd === "number" ? message.total_cost_usd : undefined;
+    if (!isError) {
+        const result = typeof message.result === "string" ? bounded(message.result.trim()) : "";
+        return {
+            eventType: "completed",
+            summary: result || "execution completed",
+            payload: {
+                ...(costUsd !== undefined ? { cost_usd: costUsd } : {}),
+                ...(result ? { investigation_summary: result } : {}),
+            },
+        };
+    }
+    const subtype = String(message.subtype ?? "");
+    const summary = subtype === "error_max_budget_exceeded" ? "execution failed: budget exceeded" : "execution failed";
+    return { eventType: "failed", summary, payload: costUsd !== undefined ? { cost_usd: costUsd } : undefined };
+}
+export function parseClaudeLine(line, worktreeRoot) {
+    let message;
+    try {
+        message = JSON.parse(line);
+    }
+    catch {
+        return null;
+    }
+    switch (message.type) {
+        case "system":
+            return parseSystemMessage(message);
+        case "assistant":
+            return parseAssistantMessage(message.message ?? {}, worktreeRoot);
+        case "user":
+            return parseUserMessage(message.message ?? {});
+        case "result":
+            return parseResultMessage(message);
+        default:
+            return null;
+    }
+}

package/dist/src/adapters/registry.js

@@ -0,0 +1,34 @@
+export class AdapterRegistry {
+    plugins;
+    constructor(plugins) {
+        this.plugins = new Map();
+        for (const plugin of plugins) {
+            if (this.plugins.has(plugin.id))
+                throw new Error(`Duplicate runtime adapter ${plugin.id}`);
+            this.plugins.set(plugin.id, plugin);
+        }
+    }
+    async probeAll() {
+        return Promise.all([...this.plugins.values()].map(async (plugin) => ({
+            id: plugin.id,
+            version: plugin.version,
+            ...await plugin.probe(),
+        })));
+    }
+    async select(id, version, input) {
+        const plugin = this.plugins.get(id);
+        if (!plugin)
+            throw new Error(`Unknown runtime adapter ${id}`);
+        if (plugin.version !== version)
+            throw new Error(`Runtime adapter ${id} version mismatch`);
+        const probe = await plugin.probe();
+        if (!probe.available)
+            throw new Error(`Runtime adapter ${id} is unavailable${probe.reason ? `: ${probe.reason}` : ""}`);
+        if (!probe.authenticated)
+            throw new Error(`Runtime adapter ${id} authentication is unavailable`);
+        const missing = plugin.capabilities.filter((capability) => !probe.capabilities.includes(capability));
+        if (missing.length > 0)
+            throw new Error(`Runtime adapter ${id} probe omitted capabilities: ${missing.join(", ")}`);
+        return plugin.create(input);
+    }
+}

package/dist/src/auth/browser-opener.js

@@ -0,0 +1,36 @@
+import { spawn } from "node:child_process";
+export async function createBrowserOpener() {
+    return async (url) => {
+        let command;
+        let args;
+        if (process.platform === "darwin") {
+            command = "open";
+            args = [url];
+        }
+        else if (process.platform === "linux") {
+            command = "xdg-open";
+            args = [url];
+        }
+        else if (process.platform === "win32") {
+            command = "rundll32";
+            args = ["url.dll,FileProtocolHandler", url];
+        }
+        else {
+            throw new Error(`Unsupported platform: ${process.platform}`);
+        }
+        return new Promise((resolve, reject) => {
+            const proc = spawn(command, args, {
+                stdio: "ignore",
+                detached: true,
+            });
+            proc.on("error", (err) => {
+                reject(err);
+            });
+            // Give the process a moment to start
+            setTimeout(() => {
+                proc.unref();
+                resolve();
+            }, 100);
+        });
+    };
+}

package/dist/src/auth/credential-store.js

@@ -0,0 +1,132 @@
+import { writeFile, readFile, chmod, rm, mkdir } from "node:fs/promises";
+import { statSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { randomBytes } from "node:crypto";
+export class FileOAuthCredentialStore {
+    stateRoot;
+    filePath;
+    constructor(stateRoot) {
+        this.stateRoot = stateRoot;
+        this.filePath = join(stateRoot, "auth.json");
+    }
+    async load(resource) {
+        if (!existsSync(this.filePath)) {
+            return null;
+        }
+        try {
+            // Check permissions before reading
+            const stat = statSync(this.filePath);
+            if ((stat.mode & 0o077) !== 0) {
+                // File has group or other access
+                return null;
+            }
+            const content = await readFile(this.filePath, "utf-8");
+            const store = JSON.parse(content);
+            // Backward compatibility: if it's a single credential with no __version__
+            if (store.schemaVersion === 1 && store.resource && typeof store.resource === "string" && store.resource === resource) {
+                const credential = store;
+                if (this.isValidCredential(credential)) {
+                    return credential;
+                }
+            }
+            // Multi-resource store format
+            if (store.__version__ === "multi" && typeof store.credentials === "object" && store.credentials !== null) {
+                const creds = store.credentials;
+                const cred = creds[resource];
+                if (cred && this.isValidCredential(cred)) {
+                    return cred;
+                }
+            }
+            return null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async save(credential) {
+        // Ensure parent directory exists with correct permissions
+        await mkdir(this.stateRoot, { mode: 0o700, recursive: true });
+        // Validate credential before writing
+        if (!this.isValidCredential(credential)) {
+            throw new Error("Invalid credential structure");
+        }
+        // Read existing store
+        let store = { __version__: "multi", credentials: {} };
+        if (existsSync(this.filePath)) {
+            try {
+                const stat = statSync(this.filePath);
+                if ((stat.mode & 0o077) === 0) {
+                    const content = await readFile(this.filePath, "utf-8");
+                    const existing = JSON.parse(content);
+                    if (existing.__version__ === "multi" && typeof existing.credentials === "object") {
+                        store = existing;
+                    }
+                }
+            }
+            catch {
+                // Ignore read errors; use fresh store
+            }
+        }
+        // Update the credential for this resource
+        if (!store.credentials || typeof store.credentials !== "object") {
+            store.credentials = {};
+        }
+        store.credentials[credential.resource] = credential;
+        const data = JSON.stringify(store);
+        // Write to temporary file with restricted permissions
+        const tmpFileName = `auth-${randomBytes(8).toString("hex")}.tmp`;
+        const tmpPath = join(this.stateRoot, tmpFileName);
+        try {
+            // Write with mode 0600 from the start
+            await writeFile(tmpPath, data, { mode: 0o600, flag: "wx" });
+            // Sync to disk
+            const fd = await import("node:fs/promises").then(m => m.open(tmpPath, "r"));
+            await fd.sync();
+            await fd.close();
+            // Atomic rename to final location
+            await import("node:fs/promises").then(m => m.rename(tmpPath, this.filePath));
+            // Ensure final file has correct mode
+            await chmod(this.filePath, 0o600);
+            // Ensure parent has correct mode
+            await chmod(this.stateRoot, 0o700);
+        }
+        catch (error) {
+            // Clean up temp file if it exists
+            try {
+                await rm(tmpPath, { force: true });
+            }
+            catch {
+                // Ignore cleanup errors
+            }
+            throw error;
+        }
+    }
+    async remove() {
+        try {
+            await rm(this.filePath, { force: true });
+        }
+        catch {
+            // Idempotent: ignore errors
+        }
+    }
+    isValidCredential(obj) {
+        if (!obj || typeof obj !== "object")
+            return false;
+        const cred = obj;
+        return (cred.schemaVersion === 1
+            && typeof cred.resource === "string"
+            && cred.resource.length > 0
+            && typeof cred.issuer === "string"
+            && cred.issuer.length > 0
+            && typeof cred.clientId === "string"
+            && cred.clientId.length > 0
+            && Array.isArray(cred.scope)
+            && cred.scope.length > 0
+            && cred.scope.every((s) => typeof s === "string")
+            && typeof cred.accessToken === "string"
+            && cred.accessToken.length > 0
+            && typeof cred.accessTokenExpiresAt === "string"
+            && cred.accessTokenExpiresAt.length > 0
+            && (cred.refreshToken === undefined || typeof cred.refreshToken === "string"));
+    }
+}