open-multi-agent-kit 0.92.0 → 0.94.0

package/dist/core/verified-bash-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verified-bash-adapter.d.ts","sourceRoot":"","sources":["../../src/core/verified-bash-adapter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEX,+BAA+B,EAC/B,wBAAwB,EACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,oBAAoB,EAA6B,MAAM,iBAAiB,CAAC;AAE5G,eAAO,MAAM,iCAAiC,yEACmC,CAAC;AAIlF,MAAM,WAAW,4BAA4B;IAC5C,QAAQ,CAAC,gBAAgB,EAAE,wBAAwB,CAAC;IACpD,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,WAAW,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC9B;AAED,MAAM,MAAM,iCAAiC,GAAG,IAAI,CAAC,4BAA4B,EAAE,YAAY,GAAG,OAAO,CAAC,GAAG;IAC5G,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;CAC9C,CAAC;AAEF,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,wBAAkC;IAE/C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACD;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,4BAA4B,GACnC,OAAO,CAAC,+BAA+B,CAAC,CAgE1C;AAED,+EAA+E;AAC/E,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,iCAAiC,GACxC,OAAO,CAAC,+BAA+B,CAAC,CAS1C","sourcesContent":["import { MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES } from \"../guardrails/evidence-receipt.ts\";\nimport type {\n\tVerifiedEvidenceExecutionOutcome,\n\tVerifiedEvidenceExecutionResult,\n\tVerifiedEvidenceExecutor,\n} from \"../guardrails/verified-executor.ts\";\nimport type { WorkspaceScope } from \"../types/evidence.ts\";\nimport { getShellConfig } from \"../utils/shell.ts\";\nimport { redactSensitiveText } from \"./redaction.ts\";\nimport { type BashOperations, type BashSandboxPreflight, createLocalBashOperations } from \"./tools/bash.ts\";\n\nexport const VERIFIED_BASH_REDACTION_POLICY_ID =\n\t\"omk-bash-combined-v1+omk-sensitive-text-v1+capture-tail-128k+tail-64k\" as const;\n\nconst MAX_CAPTURE_BYTES = MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES * 2;\n\nexport interface VerifiedBashExecutionRequest {\n\treadonly evidenceExecutor: VerifiedEvidenceExecutor;\n\treadonly operations: BashOperations;\n\treadonly goalId: string;\n\treadonly laneId?: string;\n\treadonly claim: string;\n\treadonly shell: string;\n\treadonly script: string;\n\treadonly cwd: string;\n\treadonly timeoutMs: number | null;\n\treadonly workspaceScope: WorkspaceScope;\n\treadonly executor?: \"bash-tool\" | \"ci-runner\";\n\treadonly toolCallId?: string;\n\treadonly signal?: AbortSignal;\n}\n\nexport type VerifiedLocalBashExecutionRequest = Omit<VerifiedBashExecutionRequest, \"operations\" | \"shell\"> & {\n\treadonly shellPath?: string;\n\treadonly sandboxPolicy?: BashSandboxPreflight;\n};\n\nexport class VerifiedBashAdapterError extends Error {\n\treadonly code = \"INVALID_RUNNER_EXIT\" as const;\n\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"VerifiedBashAdapterError\";\n\t}\n}\n\n/**\n * Bind an opt-in, caller-trusted BashOperations execution to a receipt.\n * BashOperations exposes a combined output stream, so the policy records the\n * redacted bounded stream as stdout and leaves stderr empty by construction.\n */\nexport async function executeVerifiedBash(\n\trequest: VerifiedBashExecutionRequest,\n): Promise<VerifiedEvidenceExecutionResult> {\n\tlet combined = Buffer.alloc(0);\n\n\tconst capture = (data: Buffer): void => {\n\t\t// ponytail: bounded concat is simpler than a chunk deque; split if profiling shows pressure.\n\t\tconst appended = Buffer.concat([combined, data]);\n\t\tcombined = appended.byteLength > MAX_CAPTURE_BYTES ? appended.subarray(-MAX_CAPTURE_BYTES) : appended;\n\t};\n\n\tconst alreadyRedactedOutput = () => {\n\t\tconst redacted = Buffer.from(redactSensitiveText(combined.toString(\"utf8\")));\n\t\tconst bounded =\n\t\t\tredacted.byteLength > MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES\n\t\t\t\t? redacted.subarray(-MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES)\n\t\t\t\t: redacted;\n\t\treturn {\n\t\t\tredactionPolicyId: VERIFIED_BASH_REDACTION_POLICY_ID,\n\t\t\tstdout: bounded,\n\t\t\tstderr: Buffer.alloc(0),\n\t\t};\n\t};\n\n\treturn request.evidenceExecutor.execute({\n\t\tgoalId: request.goalId,\n\t\t...(request.laneId !== undefined ? { laneId: request.laneId } : {}),\n\t\tclaim: request.claim,\n\t\tcommand: { kind: \"shell\", shell: request.shell, script: request.script },\n\t\tcwd: request.cwd,\n\t\ttimeoutMs: request.timeoutMs,\n\t\tworkspaceScope: request.workspaceScope,\n\t\texecutor: request.executor ?? \"bash-tool\",\n\t\t...(request.toolCallId !== undefined ? { toolCallId: request.toolCallId } : {}),\n\t\texecute: async (): Promise<VerifiedEvidenceExecutionOutcome> => {\n\t\t\tif (request.signal?.aborted) {\n\t\t\t\treturn { status: \"aborted\", exitCode: null, alreadyRedactedOutput: alreadyRedactedOutput() };\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tconst result = await request.operations.exec(request.script, request.cwd, {\n\t\t\t\t\tonData: capture,\n\t\t\t\t\t...(request.signal !== undefined ? { signal: request.signal } : {}),\n\t\t\t\t\t...(request.timeoutMs !== null ? { timeout: request.timeoutMs / 1000 } : {}),\n\t\t\t\t});\n\t\t\t\tif (request.signal?.aborted) {\n\t\t\t\t\treturn { status: \"aborted\", exitCode: null, alreadyRedactedOutput: alreadyRedactedOutput() };\n\t\t\t\t}\n\t\t\t\tif (result.exitCode === null || !Number.isSafeInteger(result.exitCode)) {\n\t\t\t\t\tthrow new VerifiedBashAdapterError(\n\t\t\t\t\t\t\"bash runner returned an invalid exit code without an abort or timeout signal\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn result.exitCode === 0\n\t\t\t\t\t? { status: \"passed\", exitCode: 0, alreadyRedactedOutput: alreadyRedactedOutput() }\n\t\t\t\t\t: { status: \"failed\", exitCode: result.exitCode, alreadyRedactedOutput: alreadyRedactedOutput() };\n\t\t\t} catch (error) {\n\t\t\t\tif (request.signal?.aborted || (error instanceof Error && error.message === \"aborted\")) {\n\t\t\t\t\treturn { status: \"aborted\", exitCode: null, alreadyRedactedOutput: alreadyRedactedOutput() };\n\t\t\t\t}\n\t\t\t\tif (error instanceof Error && error.message.startsWith(\"timeout:\")) {\n\t\t\t\t\treturn { status: \"timeout\", exitCode: null, alreadyRedactedOutput: alreadyRedactedOutput() };\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t},\n\t});\n}\n\n/** Bind OMK's first-party local shell backend to the verified bash adapter. */\nexport async function executeVerifiedLocalBash(\n\trequest: VerifiedLocalBashExecutionRequest,\n): Promise<VerifiedEvidenceExecutionResult> {\n\tconst { shellPath, sandboxPolicy, ...executionRequest } = request;\n\tconst { shell } = getShellConfig(shellPath);\n\tconst resolvedShellPath = shell === \"sh\" && shellPath === undefined ? undefined : shell;\n\tconst operations = createLocalBashOperations({\n\t\t...(resolvedShellPath !== undefined ? { shellPath: resolvedShellPath } : {}),\n\t\t...(sandboxPolicy !== undefined ? { sandboxPolicy } : {}),\n\t});\n\treturn executeVerifiedBash({ ...executionRequest, operations, shell });\n}\n"]}
+{"version":3,"file":"verified-bash-adapter.d.ts","sourceRoot":"","sources":["../../src/core/verified-bash-adapter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEX,+BAA+B,EAC/B,wBAAwB,EACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,oBAAoB,EAA6B,MAAM,iBAAiB,CAAC;AAE5G,eAAO,MAAM,iCAAiC,yEACmC,CAAC;AAIlF,MAAM,WAAW,4BAA4B;IAC5C,QAAQ,CAAC,gBAAgB,EAAE,wBAAwB,CAAC;IACpD,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,WAAW,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,uFAAuF;IACvF,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACzC;AAED,MAAM,MAAM,iCAAiC,GAAG,IAAI,CAAC,4BAA4B,EAAE,YAAY,GAAG,OAAO,CAAC,GAAG;IAC5G,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;CAC9C,CAAC;AAEF,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,wBAAkC;IAE/C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACD;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,4BAA4B,GACnC,OAAO,CAAC,+BAA+B,CAAC,CAkE1C;AAED,+EAA+E;AAC/E,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,iCAAiC,GACxC,OAAO,CAAC,+BAA+B,CAAC,CAS1C;AAED,MAAM,WAAW,6BAA6B;IAC7C,QAAQ,CAAC,gBAAgB,EAAE,wBAAwB,CAAC;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;CACzC;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC3C,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,6BAA6B,GACpC,cAAc,CA4BhB","sourcesContent":["import { MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES } from \"../guardrails/evidence-receipt.ts\";\nimport type {\n\tVerifiedEvidenceExecutionOutcome,\n\tVerifiedEvidenceExecutionResult,\n\tVerifiedEvidenceExecutor,\n} from \"../guardrails/verified-executor.ts\";\nimport type { WorkspaceScope } from \"../types/evidence.ts\";\nimport { getShellConfig } from \"../utils/shell.ts\";\nimport { redactSensitiveText } from \"./redaction.ts\";\nimport { type BashOperations, type BashSandboxPreflight, createLocalBashOperations } from \"./tools/bash.ts\";\n\nexport const VERIFIED_BASH_REDACTION_POLICY_ID =\n\t\"omk-bash-combined-v1+omk-sensitive-text-v1+capture-tail-128k+tail-64k\" as const;\n\nconst MAX_CAPTURE_BYTES = MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES * 2;\n\nexport interface VerifiedBashExecutionRequest {\n\treadonly evidenceExecutor: VerifiedEvidenceExecutor;\n\treadonly operations: BashOperations;\n\treadonly goalId: string;\n\treadonly laneId?: string;\n\treadonly claim: string;\n\treadonly shell: string;\n\treadonly script: string;\n\treadonly cwd: string;\n\treadonly timeoutMs: number | null;\n\treadonly workspaceScope: WorkspaceScope;\n\treadonly executor?: \"bash-tool\" | \"ci-runner\";\n\treadonly toolCallId?: string;\n\treadonly signal?: AbortSignal;\n\t/** Optional process env forwarded to BashOperations.exec (session PI_*, spawnHook). */\n\treadonly env?: NodeJS.ProcessEnv;\n\t/** Optional live output fan-out; receipt capture still runs independently. */\n\treadonly onData?: (data: Buffer) => void;\n}\n\nexport type VerifiedLocalBashExecutionRequest = Omit<VerifiedBashExecutionRequest, \"operations\" | \"shell\"> & {\n\treadonly shellPath?: string;\n\treadonly sandboxPolicy?: BashSandboxPreflight;\n};\n\nexport class VerifiedBashAdapterError extends Error {\n\treadonly code = \"INVALID_RUNNER_EXIT\" as const;\n\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"VerifiedBashAdapterError\";\n\t}\n}\n\n/**\n * Bind a caller-trusted BashOperations execution to a receipt.\n * Default session/CLI paths enable this adapter unless `OMK_VERIFIED_BASH=0`.\n * BashOperations exposes a combined output stream, so the policy records the\n * redacted bounded stream as stdout and leaves stderr empty by construction.\n */\nexport async function executeVerifiedBash(\n\trequest: VerifiedBashExecutionRequest,\n): Promise<VerifiedEvidenceExecutionResult> {\n\tlet combined = Buffer.alloc(0);\n\n\tconst capture = (data: Buffer): void => {\n\t\t// ponytail: bounded concat is simpler than a chunk deque; split if profiling shows pressure.\n\t\tconst appended = Buffer.concat([combined, data]);\n\t\tcombined = appended.byteLength > MAX_CAPTURE_BYTES ? appended.subarray(-MAX_CAPTURE_BYTES) : appended;\n\t\trequest.onData?.(data);\n\t};\n\n\tconst alreadyRedactedOutput = () => {\n\t\tconst redacted = Buffer.from(redactSensitiveText(combined.toString(\"utf8\")));\n\t\tconst bounded =\n\t\t\tredacted.byteLength > MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES\n\t\t\t\t? redacted.subarray(-MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES)\n\t\t\t\t: redacted;\n\t\treturn {\n\t\t\tredactionPolicyId: VERIFIED_BASH_REDACTION_POLICY_ID,\n\t\t\tstdout: bounded,\n\t\t\tstderr: Buffer.alloc(0),\n\t\t};\n\t};\n\n\treturn request.evidenceExecutor.execute({\n\t\tgoalId: request.goalId,\n\t\t...(request.laneId !== undefined ? { laneId: request.laneId } : {}),\n\t\tclaim: request.claim,\n\t\tcommand: { kind: \"shell\", shell: request.shell, script: request.script },\n\t\tcwd: request.cwd,\n\t\ttimeoutMs: request.timeoutMs,\n\t\tworkspaceScope: request.workspaceScope,\n\t\texecutor: request.executor ?? \"bash-tool\",\n\t\t...(request.toolCallId !== undefined ? { toolCallId: request.toolCallId } : {}),\n\t\texecute: async (): Promise<VerifiedEvidenceExecutionOutcome> => {\n\t\t\tif (request.signal?.aborted) {\n\t\t\t\treturn { status: \"aborted\", exitCode: null, alreadyRedactedOutput: alreadyRedactedOutput() };\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tconst result = await request.operations.exec(request.script, request.cwd, {\n\t\t\t\t\tonData: capture,\n\t\t\t\t\t...(request.signal !== undefined ? { signal: request.signal } : {}),\n\t\t\t\t\t...(request.timeoutMs !== null ? { timeout: request.timeoutMs / 1000 } : {}),\n\t\t\t\t\t...(request.env !== undefined ? { env: request.env } : {}),\n\t\t\t\t});\n\t\t\t\tif (request.signal?.aborted) {\n\t\t\t\t\treturn { status: \"aborted\", exitCode: null, alreadyRedactedOutput: alreadyRedactedOutput() };\n\t\t\t\t}\n\t\t\t\tif (result.exitCode === null || !Number.isSafeInteger(result.exitCode)) {\n\t\t\t\t\tthrow new VerifiedBashAdapterError(\n\t\t\t\t\t\t\"bash runner returned an invalid exit code without an abort or timeout signal\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn result.exitCode === 0\n\t\t\t\t\t? { status: \"passed\", exitCode: 0, alreadyRedactedOutput: alreadyRedactedOutput() }\n\t\t\t\t\t: { status: \"failed\", exitCode: result.exitCode, alreadyRedactedOutput: alreadyRedactedOutput() };\n\t\t\t} catch (error) {\n\t\t\t\tif (request.signal?.aborted || (error instanceof Error && error.message === \"aborted\")) {\n\t\t\t\t\treturn { status: \"aborted\", exitCode: null, alreadyRedactedOutput: alreadyRedactedOutput() };\n\t\t\t\t}\n\t\t\t\tif (error instanceof Error && error.message.startsWith(\"timeout:\")) {\n\t\t\t\t\treturn { status: \"timeout\", exitCode: null, alreadyRedactedOutput: alreadyRedactedOutput() };\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t},\n\t});\n}\n\n/** Bind OMK's first-party local shell backend to the verified bash adapter. */\nexport async function executeVerifiedLocalBash(\n\trequest: VerifiedLocalBashExecutionRequest,\n): Promise<VerifiedEvidenceExecutionResult> {\n\tconst { shellPath, sandboxPolicy, ...executionRequest } = request;\n\tconst { shell } = getShellConfig(shellPath);\n\tconst resolvedShellPath = shell === \"sh\" && shellPath === undefined ? undefined : shell;\n\tconst operations = createLocalBashOperations({\n\t\t...(resolvedShellPath !== undefined ? { shellPath: resolvedShellPath } : {}),\n\t\t...(sandboxPolicy !== undefined ? { sandboxPolicy } : {}),\n\t});\n\treturn executeVerifiedBash({ ...executionRequest, operations, shell });\n}\n\nexport interface VerifiedBashOperationsBinding {\n\treadonly evidenceExecutor: VerifiedEvidenceExecutor;\n\treadonly goalId: string;\n\treadonly laneId?: string;\n\treadonly shell: string;\n\treadonly workspaceScope?: WorkspaceScope;\n}\n\n/**\n * Wrap BashOperations so each exec is receipt-bound. Used by AgentSession to\n * inject the default-on verified path into createBashTool without circular imports.\n */\nexport function createVerifiedBashOperations(\n\tinner: BashOperations,\n\tbinding: VerifiedBashOperationsBinding,\n): BashOperations {\n\treturn {\n\t\texec: async (command, cwd, options) => {\n\t\t\tconst claim = command.length > 200 ? `bash: ${command.slice(0, 197)}...` : `bash: ${command}`;\n\t\t\tconst execution = await executeVerifiedBash({\n\t\t\t\tevidenceExecutor: binding.evidenceExecutor,\n\t\t\t\toperations: inner,\n\t\t\t\tgoalId: binding.goalId,\n\t\t\t\t...(binding.laneId !== undefined ? { laneId: binding.laneId } : {}),\n\t\t\t\tclaim,\n\t\t\t\tshell: binding.shell,\n\t\t\t\tscript: command,\n\t\t\t\tcwd,\n\t\t\t\ttimeoutMs: options.timeout !== undefined && options.timeout > 0 ? options.timeout * 1000 : null,\n\t\t\t\tworkspaceScope: binding.workspaceScope ?? { root: cwd, artifactPaths: [] },\n\t\t\t\texecutor: \"bash-tool\",\n\t\t\t\t...(options.signal !== undefined ? { signal: options.signal } : {}),\n\t\t\t\t...(options.env !== undefined ? { env: options.env } : {}),\n\t\t\t\tonData: options.onData,\n\t\t\t});\n\t\t\tconst status = execution.receipt.core.status;\n\t\t\tif (status === \"aborted\") throw new Error(\"aborted\");\n\t\t\tif (status === \"timeout\") {\n\t\t\t\tthrow new Error(`timeout:${options.timeout ?? 0}`);\n\t\t\t}\n\t\t\treturn { exitCode: execution.receipt.core.exitCode };\n\t\t},\n\t};\n}\n"]}

package/dist/core/verified-bash-adapter.js

@@ -12,7 +12,8 @@ export class VerifiedBashAdapterError extends Error {
     }
 }
 /**
- * Bind an opt-in, caller-trusted BashOperations execution to a receipt.
+ * Bind a caller-trusted BashOperations execution to a receipt.
+ * Default session/CLI paths enable this adapter unless `OMK_VERIFIED_BASH=0`.
  * BashOperations exposes a combined output stream, so the policy records the
  * redacted bounded stream as stdout and leaves stderr empty by construction.
  */
@@ -22,6 +23,7 @@ export async function executeVerifiedBash(request) {
         // ponytail: bounded concat is simpler than a chunk deque; split if profiling shows pressure.
         const appended = Buffer.concat([combined, data]);
         combined = appended.byteLength > MAX_CAPTURE_BYTES ? appended.subarray(-MAX_CAPTURE_BYTES) : appended;
+        request.onData?.(data);
     };
     const alreadyRedactedOutput = () => {
         const redacted = Buffer.from(redactSensitiveText(combined.toString("utf8")));
@@ -53,6 +55,7 @@ export async function executeVerifiedBash(request) {
                     onData: capture,
                     ...(request.signal !== undefined ? { signal: request.signal } : {}),
                     ...(request.timeoutMs !== null ? { timeout: request.timeoutMs / 1000 } : {}),
+                    ...(request.env !== undefined ? { env: request.env } : {}),
                 });
                 if (request.signal?.aborted) {
                     return { status: "aborted", exitCode: null, alreadyRedactedOutput: alreadyRedactedOutput() };
@@ -87,4 +90,38 @@ export async function executeVerifiedLocalBash(request) {
     });
     return executeVerifiedBash({ ...executionRequest, operations, shell });
 }
+/**
+ * Wrap BashOperations so each exec is receipt-bound. Used by AgentSession to
+ * inject the default-on verified path into createBashTool without circular imports.
+ */
+export function createVerifiedBashOperations(inner, binding) {
+    return {
+        exec: async (command, cwd, options) => {
+            const claim = command.length > 200 ? `bash: ${command.slice(0, 197)}...` : `bash: ${command}`;
+            const execution = await executeVerifiedBash({
+                evidenceExecutor: binding.evidenceExecutor,
+                operations: inner,
+                goalId: binding.goalId,
+                ...(binding.laneId !== undefined ? { laneId: binding.laneId } : {}),
+                claim,
+                shell: binding.shell,
+                script: command,
+                cwd,
+                timeoutMs: options.timeout !== undefined && options.timeout > 0 ? options.timeout * 1000 : null,
+                workspaceScope: binding.workspaceScope ?? { root: cwd, artifactPaths: [] },
+                executor: "bash-tool",
+                ...(options.signal !== undefined ? { signal: options.signal } : {}),
+                ...(options.env !== undefined ? { env: options.env } : {}),
+                onData: options.onData,
+            });
+            const status = execution.receipt.core.status;
+            if (status === "aborted")
+                throw new Error("aborted");
+            if (status === "timeout") {
+                throw new Error(`timeout:${options.timeout ?? 0}`);
+            }
+            return { exitCode: execution.receipt.core.exitCode };
+        },
+    };
+}
 //# sourceMappingURL=verified-bash-adapter.js.map

package/dist/core/verified-bash-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"verified-bash-adapter.js","sourceRoot":"","sources":["../../src/core/verified-bash-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,mCAAmC,CAAC;AAOtF,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAkD,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAE5G,MAAM,CAAC,MAAM,iCAAiC,GAC7C,uEAAgF,CAAC;AAElF,MAAM,iBAAiB,GAAG,iCAAiC,GAAG,CAAC,CAAC;AAuBhE,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACzC,IAAI,GAAG,qBAA8B,CAAC;IAE/C,YAAY,OAAe,EAAE;QAC5B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IAAA,CACvC;CACD;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAqC,EACM;IAC3C,IAAI,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE/B,MAAM,OAAO,GAAG,CAAC,IAAY,EAAQ,EAAE,CAAC;QACvC,6FAA6F;QAC7F,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QACjD,QAAQ,GAAG,QAAQ,CAAC,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAAA,CACtG,CAAC;IAEF,MAAM,qBAAqB,GAAG,GAAG,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7E,MAAM,OAAO,GACZ,QAAQ,CAAC,UAAU,GAAG,iCAAiC;YACtD,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,iCAAiC,CAAC;YACvD,CAAC,CAAC,QAAQ,CAAC;QACb,OAAO;YACN,iBAAiB,EAAE,iCAAiC;YACpD,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;SACvB,CAAC;IAAA,CACF,CAAC;IAEF,OAAO,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC;QACvC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;QACxE,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW;QACzC,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,KAAK,IAA+C,EAAE,CAAC;YAC/D,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC7B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,EAAE,CAAC;YAC9F,CAAC;YACD,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE;oBACzE,MAAM,EAAE,OAAO;oBACf,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnE,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5E,CAAC,CAAC;gBACH,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;oBAC7B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,EAAE,CAAC;gBAC9F,CAAC;gBACD,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACxE,MAAM,IAAI,wBAAwB,CACjC,8EAA8E,CAC9E,CAAC;gBACH,CAAC;gBACD,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC;oBAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,EAAE;oBACnF,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,EAAE,CAAC;YACpG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;oBACxF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,EAAE,CAAC;gBAC9F,CAAC;gBACD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBACpE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,EAAE,CAAC;gBAC9F,CAAC;gBACD,MAAM,KAAK,CAAC;YACb,CAAC;QAAA,CACD;KACD,CAAC,CAAC;AAAA,CACH;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAA0C,EACC;IAC3C,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAClE,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,iBAAiB,GAAG,KAAK,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IACxF,MAAM,UAAU,GAAG,yBAAyB,CAAC;QAC5C,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC,CAAC;IACH,OAAO,mBAAmB,CAAC,EAAE,GAAG,gBAAgB,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AAAA,CACvE","sourcesContent":["import { MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES } from \"../guardrails/evidence-receipt.ts\";\nimport type {\n\tVerifiedEvidenceExecutionOutcome,\n\tVerifiedEvidenceExecutionResult,\n\tVerifiedEvidenceExecutor,\n} from \"../guardrails/verified-executor.ts\";\nimport type { WorkspaceScope } from \"../types/evidence.ts\";\nimport { getShellConfig } from \"../utils/shell.ts\";\nimport { redactSensitiveText } from \"./redaction.ts\";\nimport { type BashOperations, type BashSandboxPreflight, createLocalBashOperations } from \"./tools/bash.ts\";\n\nexport const VERIFIED_BASH_REDACTION_POLICY_ID =\n\t\"omk-bash-combined-v1+omk-sensitive-text-v1+capture-tail-128k+tail-64k\" as const;\n\nconst MAX_CAPTURE_BYTES = MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES * 2;\n\nexport interface VerifiedBashExecutionRequest {\n\treadonly evidenceExecutor: VerifiedEvidenceExecutor;\n\treadonly operations: BashOperations;\n\treadonly goalId: string;\n\treadonly laneId?: string;\n\treadonly claim: string;\n\treadonly shell: string;\n\treadonly script: string;\n\treadonly cwd: string;\n\treadonly timeoutMs: number | null;\n\treadonly workspaceScope: WorkspaceScope;\n\treadonly executor?: \"bash-tool\" | \"ci-runner\";\n\treadonly toolCallId?: string;\n\treadonly signal?: AbortSignal;\n}\n\nexport type VerifiedLocalBashExecutionRequest = Omit<VerifiedBashExecutionRequest, \"operations\" | \"shell\"> & {\n\treadonly shellPath?: string;\n\treadonly sandboxPolicy?: BashSandboxPreflight;\n};\n\nexport class VerifiedBashAdapterError extends Error {\n\treadonly code = \"INVALID_RUNNER_EXIT\" as const;\n\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"VerifiedBashAdapterError\";\n\t}\n}\n\n/**\n * Bind an opt-in, caller-trusted BashOperations execution to a receipt.\n * BashOperations exposes a combined output stream, so the policy records the\n * redacted bounded stream as stdout and leaves stderr empty by construction.\n */\nexport async function executeVerifiedBash(\n\trequest: VerifiedBashExecutionRequest,\n): Promise<VerifiedEvidenceExecutionResult> {\n\tlet combined = Buffer.alloc(0);\n\n\tconst capture = (data: Buffer): void => {\n\t\t// ponytail: bounded concat is simpler than a chunk deque; split if profiling shows pressure.\n\t\tconst appended = Buffer.concat([combined, data]);\n\t\tcombined = appended.byteLength > MAX_CAPTURE_BYTES ? appended.subarray(-MAX_CAPTURE_BYTES) : appended;\n\t};\n\n\tconst alreadyRedactedOutput = () => {\n\t\tconst redacted = Buffer.from(redactSensitiveText(combined.toString(\"utf8\")));\n\t\tconst bounded =\n\t\t\tredacted.byteLength > MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES\n\t\t\t\t? redacted.subarray(-MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES)\n\t\t\t\t: redacted;\n\t\treturn {\n\t\t\tredactionPolicyId: VERIFIED_BASH_REDACTION_POLICY_ID,\n\t\t\tstdout: bounded,\n\t\t\tstderr: Buffer.alloc(0),\n\t\t};\n\t};\n\n\treturn request.evidenceExecutor.execute({\n\t\tgoalId: request.goalId,\n\t\t...(request.laneId !== undefined ? { laneId: request.laneId } : {}),\n\t\tclaim: request.claim,\n\t\tcommand: { kind: \"shell\", shell: request.shell, script: request.script },\n\t\tcwd: request.cwd,\n\t\ttimeoutMs: request.timeoutMs,\n\t\tworkspaceScope: request.workspaceScope,\n\t\texecutor: request.executor ?? \"bash-tool\",\n\t\t...(request.toolCallId !== undefined ? { toolCallId: request.toolCallId } : {}),\n\t\texecute: async (): Promise<VerifiedEvidenceExecutionOutcome> => {\n\t\t\tif (request.signal?.aborted) {\n\t\t\t\treturn { status: \"aborted\", exitCode: null, alreadyRedactedOutput: alreadyRedactedOutput() };\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tconst result = await request.operations.exec(request.script, request.cwd, {\n\t\t\t\t\tonData: capture,\n\t\t\t\t\t...(request.signal !== undefined ? { signal: request.signal } : {}),\n\t\t\t\t\t...(request.timeoutMs !== null ? { timeout: request.timeoutMs / 1000 } : {}),\n\t\t\t\t});\n\t\t\t\tif (request.signal?.aborted) {\n\t\t\t\t\treturn { status: \"aborted\", exitCode: null, alreadyRedactedOutput: alreadyRedactedOutput() };\n\t\t\t\t}\n\t\t\t\tif (result.exitCode === null || !Number.isSafeInteger(result.exitCode)) {\n\t\t\t\t\tthrow new VerifiedBashAdapterError(\n\t\t\t\t\t\t\"bash runner returned an invalid exit code without an abort or timeout signal\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn result.exitCode === 0\n\t\t\t\t\t? { status: \"passed\", exitCode: 0, alreadyRedactedOutput: alreadyRedactedOutput() }\n\t\t\t\t\t: { status: \"failed\", exitCode: result.exitCode, alreadyRedactedOutput: alreadyRedactedOutput() };\n\t\t\t} catch (error) {\n\t\t\t\tif (request.signal?.aborted || (error instanceof Error && error.message === \"aborted\")) {\n\t\t\t\t\treturn { status: \"aborted\", exitCode: null, alreadyRedactedOutput: alreadyRedactedOutput() };\n\t\t\t\t}\n\t\t\t\tif (error instanceof Error && error.message.startsWith(\"timeout:\")) {\n\t\t\t\t\treturn { status: \"timeout\", exitCode: null, alreadyRedactedOutput: alreadyRedactedOutput() };\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t},\n\t});\n}\n\n/** Bind OMK's first-party local shell backend to the verified bash adapter. */\nexport async function executeVerifiedLocalBash(\n\trequest: VerifiedLocalBashExecutionRequest,\n): Promise<VerifiedEvidenceExecutionResult> {\n\tconst { shellPath, sandboxPolicy, ...executionRequest } = request;\n\tconst { shell } = getShellConfig(shellPath);\n\tconst resolvedShellPath = shell === \"sh\" && shellPath === undefined ? undefined : shell;\n\tconst operations = createLocalBashOperations({\n\t\t...(resolvedShellPath !== undefined ? { shellPath: resolvedShellPath } : {}),\n\t\t...(sandboxPolicy !== undefined ? { sandboxPolicy } : {}),\n\t});\n\treturn executeVerifiedBash({ ...executionRequest, operations, shell });\n}\n"]}
+{"version":3,"file":"verified-bash-adapter.js","sourceRoot":"","sources":["../../src/core/verified-bash-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,mCAAmC,CAAC;AAOtF,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAkD,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAE5G,MAAM,CAAC,MAAM,iCAAiC,GAC7C,uEAAgF,CAAC;AAElF,MAAM,iBAAiB,GAAG,iCAAiC,GAAG,CAAC,CAAC;AA2BhE,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACzC,IAAI,GAAG,qBAA8B,CAAC;IAE/C,YAAY,OAAe,EAAE;QAC5B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IAAA,CACvC;CACD;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAqC,EACM;IAC3C,IAAI,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE/B,MAAM,OAAO,GAAG,CAAC,IAAY,EAAQ,EAAE,CAAC;QACvC,6FAA6F;QAC7F,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QACjD,QAAQ,GAAG,QAAQ,CAAC,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACtG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IAAA,CACvB,CAAC;IAEF,MAAM,qBAAqB,GAAG,GAAG,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7E,MAAM,OAAO,GACZ,QAAQ,CAAC,UAAU,GAAG,iCAAiC;YACtD,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,iCAAiC,CAAC;YACvD,CAAC,CAAC,QAAQ,CAAC;QACb,OAAO;YACN,iBAAiB,EAAE,iCAAiC;YACpD,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;SACvB,CAAC;IAAA,CACF,CAAC;IAEF,OAAO,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC;QACvC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;QACxE,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW;QACzC,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,KAAK,IAA+C,EAAE,CAAC;YAC/D,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC7B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,EAAE,CAAC;YAC9F,CAAC;YACD,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE;oBACzE,MAAM,EAAE,OAAO;oBACf,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnE,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5E,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1D,CAAC,CAAC;gBACH,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;oBAC7B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,EAAE,CAAC;gBAC9F,CAAC;gBACD,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACxE,MAAM,IAAI,wBAAwB,CACjC,8EAA8E,CAC9E,CAAC;gBACH,CAAC;gBACD,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC;oBAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,EAAE;oBACnF,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,EAAE,CAAC;YACpG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;oBACxF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,EAAE,CAAC;gBAC9F,CAAC;gBACD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBACpE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,EAAE,CAAC;gBAC9F,CAAC;gBACD,MAAM,KAAK,CAAC;YACb,CAAC;QAAA,CACD;KACD,CAAC,CAAC;AAAA,CACH;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAA0C,EACC;IAC3C,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAClE,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,iBAAiB,GAAG,KAAK,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IACxF,MAAM,UAAU,GAAG,yBAAyB,CAAC;QAC5C,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC,CAAC;IACH,OAAO,mBAAmB,CAAC,EAAE,GAAG,gBAAgB,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AAAA,CACvE;AAUD;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC3C,KAAqB,EACrB,OAAsC,EACrB;IACjB,OAAO;QACN,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,OAAO,EAAE,CAAC;YAC9F,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC;gBAC3C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,KAAK;gBACL,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM,EAAE,OAAO;gBACf,GAAG;gBACH,SAAS,EAAE,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI;gBAC/F,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE;gBAC1E,QAAQ,EAAE,WAAW;gBACrB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,MAAM,EAAE,OAAO,CAAC,MAAM;aACtB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAC7C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;YACrD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,WAAW,OAAO,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;YACpD,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAAA,CACrD;KACD,CAAC;AAAA,CACF","sourcesContent":["import { MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES } from \"../guardrails/evidence-receipt.ts\";\nimport type {\n\tVerifiedEvidenceExecutionOutcome,\n\tVerifiedEvidenceExecutionResult,\n\tVerifiedEvidenceExecutor,\n} from \"../guardrails/verified-executor.ts\";\nimport type { WorkspaceScope } from \"../types/evidence.ts\";\nimport { getShellConfig } from \"../utils/shell.ts\";\nimport { redactSensitiveText } from \"./redaction.ts\";\nimport { type BashOperations, type BashSandboxPreflight, createLocalBashOperations } from \"./tools/bash.ts\";\n\nexport const VERIFIED_BASH_REDACTION_POLICY_ID =\n\t\"omk-bash-combined-v1+omk-sensitive-text-v1+capture-tail-128k+tail-64k\" as const;\n\nconst MAX_CAPTURE_BYTES = MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES * 2;\n\nexport interface VerifiedBashExecutionRequest {\n\treadonly evidenceExecutor: VerifiedEvidenceExecutor;\n\treadonly operations: BashOperations;\n\treadonly goalId: string;\n\treadonly laneId?: string;\n\treadonly claim: string;\n\treadonly shell: string;\n\treadonly script: string;\n\treadonly cwd: string;\n\treadonly timeoutMs: number | null;\n\treadonly workspaceScope: WorkspaceScope;\n\treadonly executor?: \"bash-tool\" | \"ci-runner\";\n\treadonly toolCallId?: string;\n\treadonly signal?: AbortSignal;\n\t/** Optional process env forwarded to BashOperations.exec (session PI_*, spawnHook). */\n\treadonly env?: NodeJS.ProcessEnv;\n\t/** Optional live output fan-out; receipt capture still runs independently. */\n\treadonly onData?: (data: Buffer) => void;\n}\n\nexport type VerifiedLocalBashExecutionRequest = Omit<VerifiedBashExecutionRequest, \"operations\" | \"shell\"> & {\n\treadonly shellPath?: string;\n\treadonly sandboxPolicy?: BashSandboxPreflight;\n};\n\nexport class VerifiedBashAdapterError extends Error {\n\treadonly code = \"INVALID_RUNNER_EXIT\" as const;\n\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"VerifiedBashAdapterError\";\n\t}\n}\n\n/**\n * Bind a caller-trusted BashOperations execution to a receipt.\n * Default session/CLI paths enable this adapter unless `OMK_VERIFIED_BASH=0`.\n * BashOperations exposes a combined output stream, so the policy records the\n * redacted bounded stream as stdout and leaves stderr empty by construction.\n */\nexport async function executeVerifiedBash(\n\trequest: VerifiedBashExecutionRequest,\n): Promise<VerifiedEvidenceExecutionResult> {\n\tlet combined = Buffer.alloc(0);\n\n\tconst capture = (data: Buffer): void => {\n\t\t// ponytail: bounded concat is simpler than a chunk deque; split if profiling shows pressure.\n\t\tconst appended = Buffer.concat([combined, data]);\n\t\tcombined = appended.byteLength > MAX_CAPTURE_BYTES ? appended.subarray(-MAX_CAPTURE_BYTES) : appended;\n\t\trequest.onData?.(data);\n\t};\n\n\tconst alreadyRedactedOutput = () => {\n\t\tconst redacted = Buffer.from(redactSensitiveText(combined.toString(\"utf8\")));\n\t\tconst bounded =\n\t\t\tredacted.byteLength > MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES\n\t\t\t\t? redacted.subarray(-MAX_EVIDENCE_RECEIPT_OUTPUT_BYTES)\n\t\t\t\t: redacted;\n\t\treturn {\n\t\t\tredactionPolicyId: VERIFIED_BASH_REDACTION_POLICY_ID,\n\t\t\tstdout: bounded,\n\t\t\tstderr: Buffer.alloc(0),\n\t\t};\n\t};\n\n\treturn request.evidenceExecutor.execute({\n\t\tgoalId: request.goalId,\n\t\t...(request.laneId !== undefined ? { laneId: request.laneId } : {}),\n\t\tclaim: request.claim,\n\t\tcommand: { kind: \"shell\", shell: request.shell, script: request.script },\n\t\tcwd: request.cwd,\n\t\ttimeoutMs: request.timeoutMs,\n\t\tworkspaceScope: request.workspaceScope,\n\t\texecutor: request.executor ?? \"bash-tool\",\n\t\t...(request.toolCallId !== undefined ? { toolCallId: request.toolCallId } : {}),\n\t\texecute: async (): Promise<VerifiedEvidenceExecutionOutcome> => {\n\t\t\tif (request.signal?.aborted) {\n\t\t\t\treturn { status: \"aborted\", exitCode: null, alreadyRedactedOutput: alreadyRedactedOutput() };\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tconst result = await request.operations.exec(request.script, request.cwd, {\n\t\t\t\t\tonData: capture,\n\t\t\t\t\t...(request.signal !== undefined ? { signal: request.signal } : {}),\n\t\t\t\t\t...(request.timeoutMs !== null ? { timeout: request.timeoutMs / 1000 } : {}),\n\t\t\t\t\t...(request.env !== undefined ? { env: request.env } : {}),\n\t\t\t\t});\n\t\t\t\tif (request.signal?.aborted) {\n\t\t\t\t\treturn { status: \"aborted\", exitCode: null, alreadyRedactedOutput: alreadyRedactedOutput() };\n\t\t\t\t}\n\t\t\t\tif (result.exitCode === null || !Number.isSafeInteger(result.exitCode)) {\n\t\t\t\t\tthrow new VerifiedBashAdapterError(\n\t\t\t\t\t\t\"bash runner returned an invalid exit code without an abort or timeout signal\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn result.exitCode === 0\n\t\t\t\t\t? { status: \"passed\", exitCode: 0, alreadyRedactedOutput: alreadyRedactedOutput() }\n\t\t\t\t\t: { status: \"failed\", exitCode: result.exitCode, alreadyRedactedOutput: alreadyRedactedOutput() };\n\t\t\t} catch (error) {\n\t\t\t\tif (request.signal?.aborted || (error instanceof Error && error.message === \"aborted\")) {\n\t\t\t\t\treturn { status: \"aborted\", exitCode: null, alreadyRedactedOutput: alreadyRedactedOutput() };\n\t\t\t\t}\n\t\t\t\tif (error instanceof Error && error.message.startsWith(\"timeout:\")) {\n\t\t\t\t\treturn { status: \"timeout\", exitCode: null, alreadyRedactedOutput: alreadyRedactedOutput() };\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t},\n\t});\n}\n\n/** Bind OMK's first-party local shell backend to the verified bash adapter. */\nexport async function executeVerifiedLocalBash(\n\trequest: VerifiedLocalBashExecutionRequest,\n): Promise<VerifiedEvidenceExecutionResult> {\n\tconst { shellPath, sandboxPolicy, ...executionRequest } = request;\n\tconst { shell } = getShellConfig(shellPath);\n\tconst resolvedShellPath = shell === \"sh\" && shellPath === undefined ? undefined : shell;\n\tconst operations = createLocalBashOperations({\n\t\t...(resolvedShellPath !== undefined ? { shellPath: resolvedShellPath } : {}),\n\t\t...(sandboxPolicy !== undefined ? { sandboxPolicy } : {}),\n\t});\n\treturn executeVerifiedBash({ ...executionRequest, operations, shell });\n}\n\nexport interface VerifiedBashOperationsBinding {\n\treadonly evidenceExecutor: VerifiedEvidenceExecutor;\n\treadonly goalId: string;\n\treadonly laneId?: string;\n\treadonly shell: string;\n\treadonly workspaceScope?: WorkspaceScope;\n}\n\n/**\n * Wrap BashOperations so each exec is receipt-bound. Used by AgentSession to\n * inject the default-on verified path into createBashTool without circular imports.\n */\nexport function createVerifiedBashOperations(\n\tinner: BashOperations,\n\tbinding: VerifiedBashOperationsBinding,\n): BashOperations {\n\treturn {\n\t\texec: async (command, cwd, options) => {\n\t\t\tconst claim = command.length > 200 ? `bash: ${command.slice(0, 197)}...` : `bash: ${command}`;\n\t\t\tconst execution = await executeVerifiedBash({\n\t\t\t\tevidenceExecutor: binding.evidenceExecutor,\n\t\t\t\toperations: inner,\n\t\t\t\tgoalId: binding.goalId,\n\t\t\t\t...(binding.laneId !== undefined ? { laneId: binding.laneId } : {}),\n\t\t\t\tclaim,\n\t\t\t\tshell: binding.shell,\n\t\t\t\tscript: command,\n\t\t\t\tcwd,\n\t\t\t\ttimeoutMs: options.timeout !== undefined && options.timeout > 0 ? options.timeout * 1000 : null,\n\t\t\t\tworkspaceScope: binding.workspaceScope ?? { root: cwd, artifactPaths: [] },\n\t\t\t\texecutor: \"bash-tool\",\n\t\t\t\t...(options.signal !== undefined ? { signal: options.signal } : {}),\n\t\t\t\t...(options.env !== undefined ? { env: options.env } : {}),\n\t\t\t\tonData: options.onData,\n\t\t\t});\n\t\t\tconst status = execution.receipt.core.status;\n\t\t\tif (status === \"aborted\") throw new Error(\"aborted\");\n\t\t\tif (status === \"timeout\") {\n\t\t\t\tthrow new Error(`timeout:${options.timeout ?? 0}`);\n\t\t\t}\n\t\t\treturn { exitCode: execution.receipt.core.exitCode };\n\t\t},\n\t};\n}\n"]}

package/dist/core/verified-bash-runtime.d.ts

@@ -0,0 +1,13 @@
+import type { WorkspaceScope } from "../types/evidence.ts";
+export declare function isVerifiedBashEnabled(env?: Record<string, string | undefined>): boolean;
+/**
+ * Workspace scope for session bash receipts. Inside a git worktree the scope
+ * root is the toplevel and `artifactPaths` is the current dirty set (staged,
+ * modified, untracked; capped and sorted), which lets `captureWorkspaceFingerprint`
+ * bind HEAD plus a scope-limited dirty digest. Outside git, falls back to an
+ * empty artifact set under `cwd`. Never throws.
+ */
+export declare function resolveSessionWorkspaceScope(cwd: string, options?: {
+    maxPaths?: number;
+}): WorkspaceScope;
+//# sourceMappingURL=verified-bash-runtime.d.ts.map

package/dist/core/verified-bash-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verified-bash-runtime.d.ts","sourceRoot":"","sources":["../../src/core/verified-bash-runtime.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,wBAAgB,qBAAqB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAGvF;AAaD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAUzG","sourcesContent":["/**\n * Default-on gate for the verified bash adapter (opt-out via OMK_VERIFIED_BASH=0).\n *\n * Mirrors ADR-OMP-009: the receipt-bound path is the default experience; the\n * exact legacy unverified path remains available as a byte-identical rollback.\n */\nimport { spawnSync } from \"node:child_process\";\nimport type { WorkspaceScope } from \"../types/evidence.ts\";\n\nexport function isVerifiedBashEnabled(env?: Record<string, string | undefined>): boolean {\n\tconst source: Record<string, string | undefined> = env ?? process.env;\n\treturn source.OMK_VERIFIED_BASH !== \"0\";\n}\n\n// ---------------------------------------------------------------------------\n// Git-aware session workspace scope (bounded, TTL-cached)\n// ---------------------------------------------------------------------------\n\nconst SCOPE_TTL_MS = 1_000;\nconst SCOPE_CACHE_MAX = 8;\nconst SCOPE_MAX_PATHS = 32;\nconst GIT_TIMEOUT_MS = 1_500;\n\nconst scopeCache = new Map<string, { at: number; scope: WorkspaceScope }>();\n\n/**\n * Workspace scope for session bash receipts. Inside a git worktree the scope\n * root is the toplevel and `artifactPaths` is the current dirty set (staged,\n * modified, untracked; capped and sorted), which lets `captureWorkspaceFingerprint`\n * bind HEAD plus a scope-limited dirty digest. Outside git, falls back to an\n * empty artifact set under `cwd`. Never throws.\n */\nexport function resolveSessionWorkspaceScope(cwd: string, options?: { maxPaths?: number }): WorkspaceScope {\n\tconst cached = scopeCache.get(cwd);\n\tif (cached && Date.now() - cached.at < SCOPE_TTL_MS) return cached.scope;\n\tconst scope = computeSessionWorkspaceScope(cwd, options?.maxPaths ?? SCOPE_MAX_PATHS);\n\tif (scopeCache.size >= SCOPE_CACHE_MAX) {\n\t\tconst oldest = scopeCache.keys().next().value;\n\t\tif (oldest !== undefined) scopeCache.delete(oldest);\n\t}\n\tscopeCache.set(cwd, { at: Date.now(), scope });\n\treturn scope;\n}\n\nfunction computeSessionWorkspaceScope(cwd: string, maxPaths: number): WorkspaceScope {\n\ttry {\n\t\tconst top = spawnSync(\"git\", [\"-C\", cwd, \"rev-parse\", \"--show-toplevel\"], {\n\t\t\tencoding: \"utf8\",\n\t\t\ttimeout: GIT_TIMEOUT_MS,\n\t\t\tstdio: [\"ignore\", \"pipe\", \"ignore\"],\n\t\t});\n\t\tif (top.status !== 0 || typeof top.stdout !== \"string\") return { root: cwd, artifactPaths: [] };\n\t\tconst root = top.stdout.trim();\n\t\tif (root.length === 0) return { root: cwd, artifactPaths: [] };\n\t\tconst status = spawnSync(\"git\", [\"-C\", cwd, \"status\", \"--porcelain=v1\", \"-z\", \"--untracked-files=normal\"], {\n\t\t\ttimeout: GIT_TIMEOUT_MS,\n\t\t\tmaxBuffer: 4 * 1024 * 1024,\n\t\t\tstdio: [\"ignore\", \"pipe\", \"ignore\"],\n\t\t});\n\t\tif (status.status !== 0 || !status.stdout) return { root, artifactPaths: [] };\n\t\tconst fields = status.stdout.toString(\"utf8\").split(\"\\0\");\n\t\tconst paths: string[] = [];\n\t\tfor (let index = 0; index < fields.length; index++) {\n\t\t\tconst field = fields[index];\n\t\t\tif (field.length < 4) continue;\n\t\t\tconst xy = field.slice(0, 2);\n\t\t\tif (xy === \"!!\") continue;\n\t\t\tif (xy.includes(\"R\")) index++; // rename: consume the source path field too\n\t\t\tconst artifact = field.slice(3);\n\t\t\tif (artifact.length > 0) paths.push(artifact);\n\t\t}\n\t\tconst artifactPaths = [...new Set(paths)].sort().slice(0, maxPaths);\n\t\treturn { root, artifactPaths };\n\t} catch {\n\t\treturn { root: cwd, artifactPaths: [] };\n\t}\n}\n"]}

package/dist/core/verified-bash-runtime.js

@@ -0,0 +1,81 @@
+/**
+ * Default-on gate for the verified bash adapter (opt-out via OMK_VERIFIED_BASH=0).
+ *
+ * Mirrors ADR-OMP-009: the receipt-bound path is the default experience; the
+ * exact legacy unverified path remains available as a byte-identical rollback.
+ */
+import { spawnSync } from "node:child_process";
+export function isVerifiedBashEnabled(env) {
+    const source = env ?? process.env;
+    return source.OMK_VERIFIED_BASH !== "0";
+}
+// ---------------------------------------------------------------------------
+// Git-aware session workspace scope (bounded, TTL-cached)
+// ---------------------------------------------------------------------------
+const SCOPE_TTL_MS = 1_000;
+const SCOPE_CACHE_MAX = 8;
+const SCOPE_MAX_PATHS = 32;
+const GIT_TIMEOUT_MS = 1_500;
+const scopeCache = new Map();
+/**
+ * Workspace scope for session bash receipts. Inside a git worktree the scope
+ * root is the toplevel and `artifactPaths` is the current dirty set (staged,
+ * modified, untracked; capped and sorted), which lets `captureWorkspaceFingerprint`
+ * bind HEAD plus a scope-limited dirty digest. Outside git, falls back to an
+ * empty artifact set under `cwd`. Never throws.
+ */
+export function resolveSessionWorkspaceScope(cwd, options) {
+    const cached = scopeCache.get(cwd);
+    if (cached && Date.now() - cached.at < SCOPE_TTL_MS)
+        return cached.scope;
+    const scope = computeSessionWorkspaceScope(cwd, options?.maxPaths ?? SCOPE_MAX_PATHS);
+    if (scopeCache.size >= SCOPE_CACHE_MAX) {
+        const oldest = scopeCache.keys().next().value;
+        if (oldest !== undefined)
+            scopeCache.delete(oldest);
+    }
+    scopeCache.set(cwd, { at: Date.now(), scope });
+    return scope;
+}
+function computeSessionWorkspaceScope(cwd, maxPaths) {
+    try {
+        const top = spawnSync("git", ["-C", cwd, "rev-parse", "--show-toplevel"], {
+            encoding: "utf8",
+            timeout: GIT_TIMEOUT_MS,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        if (top.status !== 0 || typeof top.stdout !== "string")
+            return { root: cwd, artifactPaths: [] };
+        const root = top.stdout.trim();
+        if (root.length === 0)
+            return { root: cwd, artifactPaths: [] };
+        const status = spawnSync("git", ["-C", cwd, "status", "--porcelain=v1", "-z", "--untracked-files=normal"], {
+            timeout: GIT_TIMEOUT_MS,
+            maxBuffer: 4 * 1024 * 1024,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        if (status.status !== 0 || !status.stdout)
+            return { root, artifactPaths: [] };
+        const fields = status.stdout.toString("utf8").split("\0");
+        const paths = [];
+        for (let index = 0; index < fields.length; index++) {
+            const field = fields[index];
+            if (field.length < 4)
+                continue;
+            const xy = field.slice(0, 2);
+            if (xy === "!!")
+                continue;
+            if (xy.includes("R"))
+                index++; // rename: consume the source path field too
+            const artifact = field.slice(3);
+            if (artifact.length > 0)
+                paths.push(artifact);
+        }
+        const artifactPaths = [...new Set(paths)].sort().slice(0, maxPaths);
+        return { root, artifactPaths };
+    }
+    catch {
+        return { root: cwd, artifactPaths: [] };
+    }
+}
+//# sourceMappingURL=verified-bash-runtime.js.map

package/dist/core/verified-bash-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verified-bash-runtime.js","sourceRoot":"","sources":["../../src/core/verified-bash-runtime.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,MAAM,UAAU,qBAAqB,CAAC,GAAwC,EAAW;IACxF,MAAM,MAAM,GAAuC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACtE,OAAO,MAAM,CAAC,iBAAiB,KAAK,GAAG,CAAC;AAAA,CACxC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,cAAc,GAAG,KAAK,CAAC;AAE7B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW,EAAE,OAA+B,EAAkB;IAC1G,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,YAAY;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IACzE,MAAM,KAAK,GAAG,4BAA4B,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,IAAI,eAAe,CAAC,CAAC;IACtF,IAAI,UAAU,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS;YAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,4BAA4B,CAAC,GAAW,EAAE,QAAgB,EAAkB;IACpF,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,iBAAiB,CAAC,EAAE;YACzE,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,cAAc;YACvB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAChG,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,0BAA0B,CAAC,EAAE;YAC1G,OAAO,EAAE,cAAc;YACvB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;YAC1B,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS;YAC/B,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7B,IAAI,EAAE,KAAK,IAAI;gBAAE,SAAS;YAC1B,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,KAAK,EAAE,CAAC,CAAC,4CAA4C;YAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;AAAA,CACD","sourcesContent":["/**\n * Default-on gate for the verified bash adapter (opt-out via OMK_VERIFIED_BASH=0).\n *\n * Mirrors ADR-OMP-009: the receipt-bound path is the default experience; the\n * exact legacy unverified path remains available as a byte-identical rollback.\n */\nimport { spawnSync } from \"node:child_process\";\nimport type { WorkspaceScope } from \"../types/evidence.ts\";\n\nexport function isVerifiedBashEnabled(env?: Record<string, string | undefined>): boolean {\n\tconst source: Record<string, string | undefined> = env ?? process.env;\n\treturn source.OMK_VERIFIED_BASH !== \"0\";\n}\n\n// ---------------------------------------------------------------------------\n// Git-aware session workspace scope (bounded, TTL-cached)\n// ---------------------------------------------------------------------------\n\nconst SCOPE_TTL_MS = 1_000;\nconst SCOPE_CACHE_MAX = 8;\nconst SCOPE_MAX_PATHS = 32;\nconst GIT_TIMEOUT_MS = 1_500;\n\nconst scopeCache = new Map<string, { at: number; scope: WorkspaceScope }>();\n\n/**\n * Workspace scope for session bash receipts. Inside a git worktree the scope\n * root is the toplevel and `artifactPaths` is the current dirty set (staged,\n * modified, untracked; capped and sorted), which lets `captureWorkspaceFingerprint`\n * bind HEAD plus a scope-limited dirty digest. Outside git, falls back to an\n * empty artifact set under `cwd`. Never throws.\n */\nexport function resolveSessionWorkspaceScope(cwd: string, options?: { maxPaths?: number }): WorkspaceScope {\n\tconst cached = scopeCache.get(cwd);\n\tif (cached && Date.now() - cached.at < SCOPE_TTL_MS) return cached.scope;\n\tconst scope = computeSessionWorkspaceScope(cwd, options?.maxPaths ?? SCOPE_MAX_PATHS);\n\tif (scopeCache.size >= SCOPE_CACHE_MAX) {\n\t\tconst oldest = scopeCache.keys().next().value;\n\t\tif (oldest !== undefined) scopeCache.delete(oldest);\n\t}\n\tscopeCache.set(cwd, { at: Date.now(), scope });\n\treturn scope;\n}\n\nfunction computeSessionWorkspaceScope(cwd: string, maxPaths: number): WorkspaceScope {\n\ttry {\n\t\tconst top = spawnSync(\"git\", [\"-C\", cwd, \"rev-parse\", \"--show-toplevel\"], {\n\t\t\tencoding: \"utf8\",\n\t\t\ttimeout: GIT_TIMEOUT_MS,\n\t\t\tstdio: [\"ignore\", \"pipe\", \"ignore\"],\n\t\t});\n\t\tif (top.status !== 0 || typeof top.stdout !== \"string\") return { root: cwd, artifactPaths: [] };\n\t\tconst root = top.stdout.trim();\n\t\tif (root.length === 0) return { root: cwd, artifactPaths: [] };\n\t\tconst status = spawnSync(\"git\", [\"-C\", cwd, \"status\", \"--porcelain=v1\", \"-z\", \"--untracked-files=normal\"], {\n\t\t\ttimeout: GIT_TIMEOUT_MS,\n\t\t\tmaxBuffer: 4 * 1024 * 1024,\n\t\t\tstdio: [\"ignore\", \"pipe\", \"ignore\"],\n\t\t});\n\t\tif (status.status !== 0 || !status.stdout) return { root, artifactPaths: [] };\n\t\tconst fields = status.stdout.toString(\"utf8\").split(\"\\0\");\n\t\tconst paths: string[] = [];\n\t\tfor (let index = 0; index < fields.length; index++) {\n\t\t\tconst field = fields[index];\n\t\t\tif (field.length < 4) continue;\n\t\t\tconst xy = field.slice(0, 2);\n\t\t\tif (xy === \"!!\") continue;\n\t\t\tif (xy.includes(\"R\")) index++; // rename: consume the source path field too\n\t\t\tconst artifact = field.slice(3);\n\t\t\tif (artifact.length > 0) paths.push(artifact);\n\t\t}\n\t\tconst artifactPaths = [...new Set(paths)].sort().slice(0, maxPaths);\n\t\treturn { root, artifactPaths };\n\t} catch {\n\t\treturn { root: cwd, artifactPaths: [] };\n\t}\n}\n"]}

package/dist/index.d.ts

@@ -18,14 +18,16 @@ export type { ResourceCollision, ResourceDiagnostic, ResourceLoader } from "./co
 export { DefaultResourceLoader, loadProjectContextFiles } from "./core/resource-loader.ts";
 export { extractReverseSkillFactsFromMarkdown, formatReverseSkillFromSource, formatReverseSkillMarkdown, formatReverseSkillRouteDecision, getReverseSkillToolAliases, normalizeReverseSkillName, normalizeReverseSkillText, planReverseSkillToolChecks, REVERSE_SKILL_ROUTES, type ReverseSkillPlatform, type ReverseSkillRisk, type ReverseSkillRoute, type ReverseSkillRouteDecision, type ReverseSkillRouteInput, type ReverseSkillRouteScore, type ReverseSkillSourceFacts, type ReverseSkillSourceInput, type ReverseSkillSpecInput, routeReverseSkill, } from "./core/reverse-skill.ts";
 export { appendRunJournalRecordDurably, type OpenRunJournalStoreOptions, type RunJournalQuarantineReport, RunJournalStore, RunJournalStoreCorruptionError, writeQuarantineBytesDurably, } from "./core/run-journal-store.ts";
+export { type BashSandboxMode, createWorkspaceSandboxPolicy, resolveBashSandboxMode, } from "./core/sandbox/default-policy.ts";
 export { AgentSessionRuntime, type AgentSessionRuntimeDiagnostic, type AgentSessionServices, type CreateAgentSessionFromServicesOptions, type CreateAgentSessionOptions, type CreateAgentSessionResult, type CreateAgentSessionRuntimeFactory, type CreateAgentSessionRuntimeResult, type CreateAgentSessionServicesOptions, createAgentSession, createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, createBashTool, createCodingTools, createEditTool, createFindTool, createGrepTool, createLsTool, createReadOnlyTools, createReadTool, createWriteTool, type PromptTemplate, } from "./core/sdk.ts";
 export { type BranchSummaryEntry, buildSessionContext, type CompactionEntry, type CompactionProvenanceDetails, CURRENT_SESSION_VERSION, type CustomEntry, type CustomMessageEntry, type FileEntry, getLatestCompactionEntry, type ModelChangeEntry, migrateSessionEntries, type NewSessionOptions, parseSessionEntries, type SessionContext, type SessionEntry, type SessionEntryBase, type SessionHeader, type SessionInfo, type SessionInfoEntry, SessionManager, type SessionMessageEntry, type SessionQuarantineReport, type ThinkingLevelChangeEntry, } from "./core/session-manager.ts";
 export { classifySessionTermination, formatSessionTermination, type SessionTermination, type SessionTerminationCause, SessionTerminationError, type SessionTerminationKind, } from "./core/session-termination.ts";
 export { type AgentRuntimeSettings, type CompactionSettings, type ImageSettings, type PackageSource, type RetrySettings, SettingsManager, type ToolSchedulerSetting, } from "./core/settings-manager.ts";
 export { formatSkillsForPrompt, type LoadSkillsFromDirOptions, type LoadSkillsResult, loadSkills, loadSkillsFromDir, type Skill, type SkillFrontmatter, } from "./core/skills.ts";
 export { createSyntheticSourceInfo } from "./core/source-info.ts";
-export { type BashOperations, type BashSpawnContext, type BashSpawnHook, type BashToolDetails, type BashToolInput, type BashToolOptions, createBashToolDefinition, createEditToolDefinition, createFindToolDefinition, createGrepToolDefinition, createLocalBashOperations, createLsToolDefinition, createReadToolDefinition, createWriteToolDefinition, DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, type EditOperations, type EditToolDetails, type EditToolInput, type EditToolOptions, type FindOperations, type FindToolDetails, type FindToolInput, type FindToolOptions, formatSize, type GrepOperations, type GrepToolDetails, type GrepToolInput, type GrepToolOptions, type LsOperations, type LsToolDetails, type LsToolInput, type LsToolOptions, type ReadOperations, type ReadToolDetails, type ReadToolInput, type ReadToolOptions, type ToolsOptions, type TruncationOptions, type TruncationResult, truncateHead, truncateLine, truncateTail, type WriteOperations, type WriteToolInput, type WriteToolOptions, withFileMutationQueue, } from "./core/tools/index.ts";
-export { executeVerifiedBash, executeVerifiedLocalBash, VERIFIED_BASH_REDACTION_POLICY_ID, VerifiedBashAdapterError, type VerifiedBashExecutionRequest, type VerifiedLocalBashExecutionRequest, } from "./core/verified-bash-adapter.ts";
+export { type BashOperations, type BashSpawnContext, type BashSpawnHook, type BashToolDetails, type BashToolInput, type BashToolOptions, createBashToolDefinition, createDiagnosticsTool, createDiagnosticsToolDefinition, createEditToolDefinition, createFindToolDefinition, createGrepToolDefinition, createLocalBashOperations, createLsToolDefinition, createReadToolDefinition, createWriteToolDefinition, DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, type DiagnosticLine, type DiagnosticsToolDetails, type DiagnosticsToolInput, type EditOperations, type EditToolDetails, type EditToolInput, type EditToolOptions, type FindOperations, type FindToolDetails, type FindToolInput, type FindToolOptions, formatSize, type GrepOperations, type GrepToolDetails, type GrepToolInput, type GrepToolOptions, type LsOperations, type LsToolDetails, type LsToolInput, type LsToolOptions, type ReadOperations, type ReadToolDetails, type ReadToolInput, type ReadToolOptions, type ToolsOptions, type TruncationOptions, type TruncationResult, truncateHead, truncateLine, truncateTail, type WriteOperations, type WriteToolInput, type WriteToolOptions, withFileMutationQueue, } from "./core/tools/index.ts";
+export { createVerifiedBashOperations, executeVerifiedBash, executeVerifiedLocalBash, VERIFIED_BASH_REDACTION_POLICY_ID, VerifiedBashAdapterError, type VerifiedBashExecutionRequest, type VerifiedBashOperationsBinding, type VerifiedLocalBashExecutionRequest, } from "./core/verified-bash-adapter.ts";
+export { isVerifiedBashEnabled, resolveSessionWorkspaceScope } from "./core/verified-bash-runtime.ts";
 export { type CommandHmacBinder, CommandRedactionError, createCommandHmacBinder, EVIDENCE_COMMAND_REDACTION_POLICY_ID, MAX_COMMAND_REDACTION_PLACEHOLDERS, parseCommandHmacBinding, parseCommandRedactionSummary, type RedactedCommandDescriptor, redactCommandDescriptor, } from "./guardrails/command-redaction.ts";
 export { computeEvidenceCommandSha256, computeEvidenceReceiptCoreSha256, constantTimeSha256Equal, createEvidenceReceipt, evidenceReceiptReplayPayload, isSafeEvidenceReceiptId, isSha256Hex, parseEvidenceReceipt, parseSha256Hex, validateEvidenceReceipt, withEvidenceReceiptEnvelope, } from "./guardrails/evidence-receipt.ts";
 export { EvidenceReceiptStore, type EvidenceReceiptStoreFaultStage, type EvidenceReceiptStoreOptions, } from "./guardrails/evidence-receipt-store.ts";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,IAAI,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACN,YAAY,EACZ,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,eAAe,EACf,KAAK,YAAY,GACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,WAAW,EACX,KAAK,kBAAkB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,eAAe,GACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,KAAK,SAAS,EACd,SAAS,EACT,KAAK,SAAS,EACd,KAAK,UAAU,EACf,aAAa,EACb,KAAK,2BAA2B,EAChC,uBAAuB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,aAAa,EACb,cAAc,EACd,6BAA6B,EAC7B,SAAS,EACT,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,SAAS,EACd,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,qBAAqB,EACrB,KAAK,SAAS,EACd,cAAc,EACd,KAAK,WAAW,EAChB,eAAe,EACf,mBAAmB,EACnB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACvB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,sBAAsB,EACtB,8BAA8B,EAC9B,OAAO,EACP,wBAAwB,EACxB,gCAAgC,EAChC,+BAA+B,EAC/B,8BAA8B,EAC9B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,sBAAsB,EACtB,cAAc,EACd,yBAAyB,EACzB,KAAK,cAAc,EACnB,YAAY,EACZ,kBAAkB,EAClB,KAAK,4BAA4B,EACjC,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,EACb,wBAAwB,EACxB,0BAA0B,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACN,6BAA6B,EAC7B,sDAAsD,EACtD,gCAAgC,EAChC,gCAAgC,EAChC,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,EAClC,KAAK,gCAAgC,EACrC,iCAAiC,EACjC,sCAAsC,EACtC,wCAAwC,EACxC,yBAAyB,EACzB,6BAA6B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACN,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,GAC7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE7F,YAAY,EACX,aAAa,EACb,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,2BAA2B,EAC3B,iBAAiB,EACjB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,EAC1B,gCAAgC,EAChC,wBAAwB,EACxB,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,YAAY,EACZ,uBAAuB,EACvB,8BAA8B,EAC9B,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,UAAU,EACV,oBAAoB,EACpB,aAAa,EACb,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,QAAQ,EACR,uBAAuB,EACvB,eAAe,EACf,YAAY,EACZ,cAAc,EACd,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,uBAAuB,EACvB,kBAAkB,GAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACN,sBAAsB,EACtB,UAAU,EACV,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,GACnB,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,YAAY,EACX,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,gBAAgB,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AACvG,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,EACN,oCAAoC,EACpC,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,iBAAiB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,6BAA6B,EAC7B,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAC/B,eAAe,EACf,8BAA8B,EAC9B,2BAA2B,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACN,mBAAmB,EACnB,KAAK,6BAA6B,EAClC,KAAK,oBAAoB,EACzB,KAAK,qCAAqC,EAC1C,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,gCAAgC,EACrC,KAAK,+BAA+B,EACpC,KAAK,iCAAiC,EAEtC,kBAAkB,EAClB,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC1B,cAAc,EAEd,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,KAAK,cAAc,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EACN,KAAK,kBAAkB,EACvB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,2BAA2B,EAChC,uBAAuB,EACvB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,qBAAqB,EACrB,KAAK,iBAAiB,EACtB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,cAAc,EACd,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC7B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACN,0BAA0B,EAC1B,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,uBAAuB,EACvB,KAAK,sBAAsB,GAC3B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACN,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,eAAe,EACf,KAAK,oBAAoB,GACzB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACN,qBAAqB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,UAAU,EACV,iBAAiB,EACjB,KAAK,KAAK,EACV,KAAK,gBAAgB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAElE,OAAO,EACN,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,qBAAqB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACN,mBAAmB,EACnB,wBAAwB,EACxB,iCAAiC,EACjC,wBAAwB,EACxB,KAAK,4BAA4B,EACjC,KAAK,iCAAiC,GACtC,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACN,KAAK,iBAAiB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,oCAAoC,EACpC,kCAAkC,EAClC,uBAAuB,EACvB,4BAA4B,EAC5B,KAAK,yBAAyB,EAC9B,uBAAuB,GACvB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,4BAA4B,EAC5B,gCAAgC,EAChC,uBAAuB,EACvB,qBAAqB,EACrB,4BAA4B,EAC5B,uBAAuB,EACvB,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,uBAAuB,EACvB,2BAA2B,GAC3B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACN,oBAAoB,EACpB,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,GAChC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACN,YAAY,EACZ,KAAK,mBAAmB,EACxB,mBAAmB,EACnB,kCAAkC,EAClC,mBAAmB,EACnB,mBAAmB,GACnB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACN,KAAK,gCAAgC,EACrC,KAAK,gCAAgC,EACrC,KAAK,+BAA+B,EACpC,wBAAwB,EACxB,6BAA6B,EAC7B,KAAK,+BAA+B,EACpC,KAAK,wBAAwB,GAC7B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,2BAA2B,EAC3B,8BAA8B,EAC9B,iCAAiC,EACjC,8BAA8B,EAC9B,yBAAyB,GACzB,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,KAAK,WAAW,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EACN,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,YAAY,EACZ,UAAU,GACV,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACN,cAAc,EACd,yBAAyB,EACzB,sBAAsB,EACtB,cAAc,EACd,6BAA6B,EAC7B,iCAAiC,EACjC,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,0BAA0B,EAC1B,eAAe,EACf,OAAO,EACP,OAAO,EACP,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,UAAU,EACV,UAAU,EACV,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,yBAAyB,EACzB,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,oBAAoB,GACzB,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,SAAS,EACT,KAAK,EACL,KAAK,UAAU,GACf,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EACX,+BAA+B,EAC/B,aAAa,EACb,kBAAkB,EAClB,2BAA2B,EAC3B,+BAA+B,EAC/B,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,0BAA0B,EAC1B,4BAA4B,EAC5B,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,SAAS,EACT,YAAY,EACZ,oBAAoB,EACpB,8BAA8B,EAC9B,cAAc,GACd,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,KAAK,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE9F,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC","sourcesContent":["// Core session management\n\nexport { type Args, parseArgs } from \"./cli/args.ts\";\n// Config paths\nexport { getAgentDir, VERSION } from \"./config.ts\";\nexport {\n\tAgentSession,\n\ttype AgentSessionConfig,\n\ttype AgentSessionEvent,\n\ttype AgentSessionEventListener,\n\ttype ModelCycleResult,\n\ttype ParsedSkillBlock,\n\ttype PromptOptions,\n\tparseSkillBlock,\n\ttype SessionStats,\n} from \"./core/agent-session.ts\";\n// Auth and model registry\nexport {\n\ttype ApiKeyCredential,\n\ttype AuthCredential,\n\ttype AuthStatus,\n\tAuthStorage,\n\ttype AuthStorageBackend,\n\tFileAuthStorageBackend,\n\tInMemoryAuthStorageBackend,\n\ttype OAuthCredential,\n} from \"./core/auth-storage.ts\";\nexport {\n\ttype ApiAction,\n\tApiBroker,\n\ttype ApiMethod,\n\ttype ApiOutcome,\n\tAUTOPILOT_MAX,\n\ttype AutomationHarnessScoreInput,\n\tAutomationHarnessScorer,\n\ttype AutomationScoreBreakdown,\n\ttype AutomationTrace,\n\ttype AutomationTraceAction,\n\ttype AutomationTraceContextPlan,\n\ttype AutomationTraceEnvApiUse,\n\ttype AutonomyProfile,\n\ttype BrokerFetcher,\n\ttype BrokerFetchRequest,\n\ttype BrokerFetchResponse,\n\ttype Capability,\n\tcanonicalHash,\n\tclassifyEnvKey,\n\tDynamicToolPortfolioOptimizer,\n\tEnvBroker,\n\ttype EnvBrokerLedger,\n\ttype EnvMode,\n\ttype EnvRecord,\n\ttype EnvResolutionRequest,\n\ttype EnvUseEvent,\n\ttype EvidenceActor,\n\ttype EvidenceEvent,\n\ttype EvidenceEventInput,\n\tEvidenceLedger,\n\ttype EvidenceOutcome,\n\ttype EvidencePointer,\n\ttype ExecutionStrategy,\n\ttype Postcondition,\n\tPostconditionVerifier,\n\ttype RiskLevel,\n\tredactForModel,\n\ttype Sensitivity,\n\tstrategyForRisk,\n\tToolExecutionBroker,\n\ttype ToolExecutionCandidate,\n\ttype ToolExecutionChoice,\n\ttype ToolExecutionNeed,\n\ttype VerificationContext,\n\ttype VerificationResult,\n} from \"./core/automation/index.ts\";\n// Compaction\nexport {\n\ttype BranchPreparation,\n\ttype BranchSummaryResult,\n\ttype CollectEntriesResult,\n\ttype CompactionBarrierResult,\n\ttype CompactionCommitDecision,\n\ttype CompactionEnvelope,\n\ttype CompactionHysteresisConfig,\n\ttype CompactionHysteresisState,\n\ttype CompactionResult,\n\ttype CompactionTransaction,\n\ttype CutPointResult,\n\tcalculateContextTokens,\n\tcollectEntriesForBranchSummary,\n\tcompact,\n\tcreateCompactionEnvelope,\n\tcreateCompactionHysteresisConfig,\n\tcreateCompactionHysteresisState,\n\tcreateCompactionSourceIdentity,\n\tcreateCompactionTransaction,\n\tcreateSessionRevisionToken,\n\tDEFAULT_COMPACTION_SETTINGS,\n\tdecideCompactionCommit,\n\testimateTokens,\n\tevaluateCompactionBarrier,\n\ttype FileOperations,\n\tfindCutPoint,\n\tfindTurnStartIndex,\n\ttype GenerateBranchSummaryOptions,\n\tgenerateBranchSummary,\n\tgenerateSummary,\n\tgetLastAssistantUsage,\n\tprepareBranchEntries,\n\tserializeConversation,\n\tshouldCompact,\n\tstepCompactionHysteresis,\n\tvalidateCompactionEnvelope,\n} from \"./core/compaction/index.ts\";\nexport {\n\tapplyContextCacheInvalidation,\n\tbuildContextBudgetMaterializedRepresentationCacheKeyV2,\n\tbuildContextBudgetPlanCacheKeyV2,\n\tCONTEXT_BUDGET_POLICY_VERSION_V2,\n\ttype ContextBudgetCacheProviderV2,\n\ttype ContextCacheInvalidationEvent,\n\ttype ContextCacheInvalidationSnapshot,\n\tcreateContextBudgetCacheKeyBaseV2,\n\tcreateContextCacheInvalidationSnapshot,\n\tcreateMemoryContextBudgetCacheProviderV2,\n\tplanPromptContextBudgetV2,\n\tserializeContextCacheSnapshot,\n} from \"./core/context-budget-governor-v2.ts\";\nexport {\n\tcomputeReservedTokenBudget,\n\testimateToolResultReserve,\n\tReservedTokenBudgetError,\n\ttype ReservedTokenBudgetInput,\n\ttype ReservedTokenBudgetResult,\n\ttype ToolResultReserveRequest,\n} from \"./core/context-budget-reserved-tokens.ts\";\nexport { createEventBus, type EventBus, type EventBusController } from \"./core/event-bus.ts\";\n// Extension system\nexport type {\n\tAgentEndEvent,\n\tAgentStartEvent,\n\tAgentToolResult,\n\tAgentToolUpdateCallback,\n\tAppKeybinding,\n\tAutocompleteProviderFactory,\n\tBashToolCallEvent,\n\tBeforeAgentStartEvent,\n\tBeforeAgentStartEventResult,\n\tBeforeProviderRequestEvent,\n\tBeforeProviderRequestEventResult,\n\tBuildSystemPromptOptions,\n\tCompactOptions,\n\tContextEvent,\n\tContextUsage,\n\tCustomToolCallEvent,\n\tEditToolCallEvent,\n\tExecOptions,\n\tExecResult,\n\tExtension,\n\tExtensionActions,\n\tExtensionAPI,\n\tExtensionCommandContext,\n\tExtensionCommandContextActions,\n\tExtensionContext,\n\tExtensionContextActions,\n\tExtensionError,\n\tExtensionEvent,\n\tExtensionFactory,\n\tExtensionFlag,\n\tExtensionHandler,\n\tExtensionRuntime,\n\tExtensionShortcut,\n\tExtensionUIContext,\n\tExtensionUIDialogOptions,\n\tExtensionWidgetOptions,\n\tFindToolCallEvent,\n\tGrepToolCallEvent,\n\tInputEvent,\n\tInputEventResult,\n\tInputSource,\n\tKeybindingsManager,\n\tLoadExtensionsResult,\n\tLsToolCallEvent,\n\tMessageRenderer,\n\tMessageRenderOptions,\n\tProviderConfig,\n\tProviderModelConfig,\n\tReadToolCallEvent,\n\tRegisteredCommand,\n\tRegisteredTool,\n\tResolvedCommand,\n\tSessionBeforeCompactEvent,\n\tSessionBeforeForkEvent,\n\tSessionBeforeSwitchEvent,\n\tSessionBeforeTreeEvent,\n\tSessionCompactEvent,\n\tSessionShutdownEvent,\n\tSessionStartEvent,\n\tSessionTreeEvent,\n\tSlashCommandInfo,\n\tSlashCommandSource,\n\tSourceInfo,\n\tTerminalInputHandler,\n\tToolCallEvent,\n\tToolCallEventResult,\n\tToolDefinition,\n\tToolExecutionMode,\n\tToolInfo,\n\tToolRenderResultOptions,\n\tToolResultEvent,\n\tTurnEndEvent,\n\tTurnStartEvent,\n\tUserBashEvent,\n\tUserBashEventResult,\n\tWidgetPlacement,\n\tWorkingIndicatorOptions,\n\tWriteToolCallEvent,\n} from \"./core/extensions/index.ts\";\nexport {\n\tcreateExtensionRuntime,\n\tdefineTool,\n\tdiscoverAndLoadExtensions,\n\tExtensionRunner,\n\tisBashToolResult,\n\tisEditToolResult,\n\tisFindToolResult,\n\tisGrepToolResult,\n\tisLsToolResult,\n\tisReadToolResult,\n\tisToolCallEventType,\n\tisWriteToolResult,\n\twrapRegisteredTool,\n\twrapRegisteredTools,\n} from \"./core/extensions/index.ts\";\n// Footer data provider (git branch + extension statuses - data not otherwise available to extensions)\nexport type { ReadonlyFooterDataProvider } from \"./core/footer-data-provider.ts\";\nexport { convertToLlm } from \"./core/messages.ts\";\nexport { ModelRegistry } from \"./core/model-registry.ts\";\nexport type {\n\tPackageManager,\n\tPathMetadata,\n\tProgressCallback,\n\tProgressEvent,\n\tResolvedPaths,\n\tResolvedResource,\n} from \"./core/package-manager.ts\";\nexport { DefaultPackageManager } from \"./core/package-manager.ts\";\nexport type { ResourceCollision, ResourceDiagnostic, ResourceLoader } from \"./core/resource-loader.ts\";\nexport { DefaultResourceLoader, loadProjectContextFiles } from \"./core/resource-loader.ts\";\nexport {\n\textractReverseSkillFactsFromMarkdown,\n\tformatReverseSkillFromSource,\n\tformatReverseSkillMarkdown,\n\tformatReverseSkillRouteDecision,\n\tgetReverseSkillToolAliases,\n\tnormalizeReverseSkillName,\n\tnormalizeReverseSkillText,\n\tplanReverseSkillToolChecks,\n\tREVERSE_SKILL_ROUTES,\n\ttype ReverseSkillPlatform,\n\ttype ReverseSkillRisk,\n\ttype ReverseSkillRoute,\n\ttype ReverseSkillRouteDecision,\n\ttype ReverseSkillRouteInput,\n\ttype ReverseSkillRouteScore,\n\ttype ReverseSkillSourceFacts,\n\ttype ReverseSkillSourceInput,\n\ttype ReverseSkillSpecInput,\n\trouteReverseSkill,\n} from \"./core/reverse-skill.ts\";\nexport {\n\tappendRunJournalRecordDurably,\n\ttype OpenRunJournalStoreOptions,\n\ttype RunJournalQuarantineReport,\n\tRunJournalStore,\n\tRunJournalStoreCorruptionError,\n\twriteQuarantineBytesDurably,\n} from \"./core/run-journal-store.ts\";\n// SDK for programmatic usage\nexport {\n\tAgentSessionRuntime,\n\ttype AgentSessionRuntimeDiagnostic,\n\ttype AgentSessionServices,\n\ttype CreateAgentSessionFromServicesOptions,\n\ttype CreateAgentSessionOptions,\n\ttype CreateAgentSessionResult,\n\ttype CreateAgentSessionRuntimeFactory,\n\ttype CreateAgentSessionRuntimeResult,\n\ttype CreateAgentSessionServicesOptions,\n\t// Factory\n\tcreateAgentSession,\n\tcreateAgentSessionFromServices,\n\tcreateAgentSessionRuntime,\n\tcreateAgentSessionServices,\n\tcreateBashTool,\n\t// Tool factories (for custom cwd)\n\tcreateCodingTools,\n\tcreateEditTool,\n\tcreateFindTool,\n\tcreateGrepTool,\n\tcreateLsTool,\n\tcreateReadOnlyTools,\n\tcreateReadTool,\n\tcreateWriteTool,\n\ttype PromptTemplate,\n} from \"./core/sdk.ts\";\nexport {\n\ttype BranchSummaryEntry,\n\tbuildSessionContext,\n\ttype CompactionEntry,\n\ttype CompactionProvenanceDetails,\n\tCURRENT_SESSION_VERSION,\n\ttype CustomEntry,\n\ttype CustomMessageEntry,\n\ttype FileEntry,\n\tgetLatestCompactionEntry,\n\ttype ModelChangeEntry,\n\tmigrateSessionEntries,\n\ttype NewSessionOptions,\n\tparseSessionEntries,\n\ttype SessionContext,\n\ttype SessionEntry,\n\ttype SessionEntryBase,\n\ttype SessionHeader,\n\ttype SessionInfo,\n\ttype SessionInfoEntry,\n\tSessionManager,\n\ttype SessionMessageEntry,\n\ttype SessionQuarantineReport,\n\ttype ThinkingLevelChangeEntry,\n} from \"./core/session-manager.ts\";\nexport {\n\tclassifySessionTermination,\n\tformatSessionTermination,\n\ttype SessionTermination,\n\ttype SessionTerminationCause,\n\tSessionTerminationError,\n\ttype SessionTerminationKind,\n} from \"./core/session-termination.ts\";\nexport {\n\ttype AgentRuntimeSettings,\n\ttype CompactionSettings,\n\ttype ImageSettings,\n\ttype PackageSource,\n\ttype RetrySettings,\n\tSettingsManager,\n\ttype ToolSchedulerSetting,\n} from \"./core/settings-manager.ts\";\n// Skills\nexport {\n\tformatSkillsForPrompt,\n\ttype LoadSkillsFromDirOptions,\n\ttype LoadSkillsResult,\n\tloadSkills,\n\tloadSkillsFromDir,\n\ttype Skill,\n\ttype SkillFrontmatter,\n} from \"./core/skills.ts\";\nexport { createSyntheticSourceInfo } from \"./core/source-info.ts\";\n// Tools\nexport {\n\ttype BashOperations,\n\ttype BashSpawnContext,\n\ttype BashSpawnHook,\n\ttype BashToolDetails,\n\ttype BashToolInput,\n\ttype BashToolOptions,\n\tcreateBashToolDefinition,\n\tcreateEditToolDefinition,\n\tcreateFindToolDefinition,\n\tcreateGrepToolDefinition,\n\tcreateLocalBashOperations,\n\tcreateLsToolDefinition,\n\tcreateReadToolDefinition,\n\tcreateWriteToolDefinition,\n\tDEFAULT_MAX_BYTES,\n\tDEFAULT_MAX_LINES,\n\ttype EditOperations,\n\ttype EditToolDetails,\n\ttype EditToolInput,\n\ttype EditToolOptions,\n\ttype FindOperations,\n\ttype FindToolDetails,\n\ttype FindToolInput,\n\ttype FindToolOptions,\n\tformatSize,\n\ttype GrepOperations,\n\ttype GrepToolDetails,\n\ttype GrepToolInput,\n\ttype GrepToolOptions,\n\ttype LsOperations,\n\ttype LsToolDetails,\n\ttype LsToolInput,\n\ttype LsToolOptions,\n\ttype ReadOperations,\n\ttype ReadToolDetails,\n\ttype ReadToolInput,\n\ttype ReadToolOptions,\n\ttype ToolsOptions,\n\ttype TruncationOptions,\n\ttype TruncationResult,\n\ttruncateHead,\n\ttruncateLine,\n\ttruncateTail,\n\ttype WriteOperations,\n\ttype WriteToolInput,\n\ttype WriteToolOptions,\n\twithFileMutationQueue,\n} from \"./core/tools/index.ts\";\nexport {\n\texecuteVerifiedBash,\n\texecuteVerifiedLocalBash,\n\tVERIFIED_BASH_REDACTION_POLICY_ID,\n\tVerifiedBashAdapterError,\n\ttype VerifiedBashExecutionRequest,\n\ttype VerifiedLocalBashExecutionRequest,\n} from \"./core/verified-bash-adapter.ts\";\n// Execution-bound evidence\nexport {\n\ttype CommandHmacBinder,\n\tCommandRedactionError,\n\tcreateCommandHmacBinder,\n\tEVIDENCE_COMMAND_REDACTION_POLICY_ID,\n\tMAX_COMMAND_REDACTION_PLACEHOLDERS,\n\tparseCommandHmacBinding,\n\tparseCommandRedactionSummary,\n\ttype RedactedCommandDescriptor,\n\tredactCommandDescriptor,\n} from \"./guardrails/command-redaction.ts\";\nexport {\n\tcomputeEvidenceCommandSha256,\n\tcomputeEvidenceReceiptCoreSha256,\n\tconstantTimeSha256Equal,\n\tcreateEvidenceReceipt,\n\tevidenceReceiptReplayPayload,\n\tisSafeEvidenceReceiptId,\n\tisSha256Hex,\n\tparseEvidenceReceipt,\n\tparseSha256Hex,\n\tvalidateEvidenceReceipt,\n\twithEvidenceReceiptEnvelope,\n} from \"./guardrails/evidence-receipt.ts\";\nexport {\n\tEvidenceReceiptStore,\n\ttype EvidenceReceiptStoreFaultStage,\n\ttype EvidenceReceiptStoreOptions,\n} from \"./guardrails/evidence-receipt-store.ts\";\nexport {\n\tEvidenceGate,\n\ttype EvidenceGateOptions,\n\tFailClosedMergeGate,\n\tlatestRelevantWorkspaceMutationSeq,\n\tReplayLedgerManager,\n\tTaskContractBuilder,\n} from \"./guardrails/evidence-system.ts\";\nexport {\n\ttype VerifiedEvidenceExecutionOutcome,\n\ttype VerifiedEvidenceExecutionRequest,\n\ttype VerifiedEvidenceExecutionResult,\n\tVerifiedEvidenceExecutor,\n\tVerifiedEvidenceExecutorError,\n\ttype VerifiedEvidenceExecutorOptions,\n\ttype VerifiedEvidenceMetadata,\n} from \"./guardrails/verified-executor.ts\";\nexport {\n\tcaptureWorkspaceFingerprint,\n\tcomputeGitWorkspaceDirtySha256,\n\tcomputeGitWorkspaceManifestSha256,\n\tcomputeWorkspaceManifestSha256,\n\tparseWorkspaceFingerprint,\n} from \"./guardrails/workspace-fingerprint.ts\";\n// Main entry point\nexport { type MainOptions, main } from \"./main.ts\";\n// Run modes for programmatic SDK usage\nexport {\n\tInteractiveMode,\n\ttype InteractiveModeOptions,\n\ttype ModelInfo,\n\ttype PrintModeOptions,\n\tRpcClient,\n\ttype RpcClientOptions,\n\ttype RpcCommand,\n\ttype RpcEventListener,\n\ttype RpcResponse,\n\ttype RpcSessionState,\n\trunPrintMode,\n\trunRpcMode,\n} from \"./modes/index.ts\";\n// UI components for extensions\nexport {\n\tArminComponent,\n\tAssistantMessageComponent,\n\tBashExecutionComponent,\n\tBorderedLoader,\n\tBranchSummaryMessageComponent,\n\tCompactionSummaryMessageComponent,\n\tCustomEditor,\n\tCustomMessageComponent,\n\tDynamicBorder,\n\tExtensionEditorComponent,\n\tExtensionInputComponent,\n\tExtensionSelectorComponent,\n\tFooterComponent,\n\tkeyHint,\n\tkeyText,\n\tLoginDialogComponent,\n\tModelSelectorComponent,\n\tOAuthSelectorComponent,\n\ttype RenderDiffOptions,\n\trawKeyHint,\n\trenderDiff,\n\tSessionSelectorComponent,\n\ttype SettingsCallbacks,\n\ttype SettingsConfig,\n\tSettingsSelectorComponent,\n\tShowImagesSelectorComponent,\n\tSkillInvocationMessageComponent,\n\tThemeSelectorComponent,\n\tThinkingSelectorComponent,\n\tToolExecutionComponent,\n\ttype ToolExecutionOptions,\n\tTreeSelectorComponent,\n\ttruncateToVisualLines,\n\tUserMessageComponent,\n\tUserMessageSelectorComponent,\n\ttype VisualTruncateResult,\n} from \"./modes/interactive/components/index.ts\";\n// Theme utilities for custom tools and extensions\nexport {\n\tgetLanguageFromPath,\n\tgetMarkdownTheme,\n\tgetSelectListTheme,\n\tgetSettingsListTheme,\n\thighlightCode,\n\tinitTheme,\n\tTheme,\n\ttype ThemeColor,\n} from \"./modes/interactive/theme/theme.ts\";\nexport type {\n\tArtifactSetWorkspaceFingerprint,\n\tArtifactState,\n\tCommandHmacBinding,\n\tCommandRedactionPlaceholder,\n\tCommandRedactionPlaceholderType,\n\tCommandRedactionSummary,\n\tEvidenceCommandDescriptor,\n\tEvidenceExecutor,\n\tEvidenceItem,\n\tEvidenceReceipt,\n\tEvidenceReceiptDisposition,\n\tEvidenceReceiptLedgerBinding,\n\tEvidenceReceiptMode,\n\tFileArtifactState,\n\tGitWorkspaceFingerprint,\n\tGitWorkspaceState,\n\tMissingArtifactState,\n\tReplayEvent,\n\tReplayEventType,\n\tSha256Hex,\n\tTaskContract,\n\tWorkspaceFingerprint,\n\tWorkspaceMutationReplayPayload,\n\tWorkspaceScope,\n} from \"./types/evidence.ts\";\n// Clipboard utilities\nexport { copyToClipboard } from \"./utils/clipboard.ts\";\nexport { parseFrontmatter, stripFrontmatter } from \"./utils/frontmatter.ts\";\nexport { convertToPng } from \"./utils/image-convert.ts\";\nexport { formatDimensionNote, type ResizedImage, resizeImage } from \"./utils/image-resize.ts\";\n// Shell utilities\nexport { getShellConfig } from \"./utils/shell.ts\";\n"]}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,IAAI,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACN,YAAY,EACZ,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,eAAe,EACf,KAAK,YAAY,GACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,WAAW,EACX,KAAK,kBAAkB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,eAAe,GACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,KAAK,SAAS,EACd,SAAS,EACT,KAAK,SAAS,EACd,KAAK,UAAU,EACf,aAAa,EACb,KAAK,2BAA2B,EAChC,uBAAuB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,aAAa,EACb,cAAc,EACd,6BAA6B,EAC7B,SAAS,EACT,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,SAAS,EACd,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,qBAAqB,EACrB,KAAK,SAAS,EACd,cAAc,EACd,KAAK,WAAW,EAChB,eAAe,EACf,mBAAmB,EACnB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACvB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,sBAAsB,EACtB,8BAA8B,EAC9B,OAAO,EACP,wBAAwB,EACxB,gCAAgC,EAChC,+BAA+B,EAC/B,8BAA8B,EAC9B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,sBAAsB,EACtB,cAAc,EACd,yBAAyB,EACzB,KAAK,cAAc,EACnB,YAAY,EACZ,kBAAkB,EAClB,KAAK,4BAA4B,EACjC,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,EACb,wBAAwB,EACxB,0BAA0B,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACN,6BAA6B,EAC7B,sDAAsD,EACtD,gCAAgC,EAChC,gCAAgC,EAChC,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,EAClC,KAAK,gCAAgC,EACrC,iCAAiC,EACjC,sCAAsC,EACtC,wCAAwC,EACxC,yBAAyB,EACzB,6BAA6B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACN,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,GAC7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE7F,YAAY,EACX,aAAa,EACb,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,2BAA2B,EAC3B,iBAAiB,EACjB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,EAC1B,gCAAgC,EAChC,wBAAwB,EACxB,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,YAAY,EACZ,uBAAuB,EACvB,8BAA8B,EAC9B,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,UAAU,EACV,oBAAoB,EACpB,aAAa,EACb,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,QAAQ,EACR,uBAAuB,EACvB,eAAe,EACf,YAAY,EACZ,cAAc,EACd,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,uBAAuB,EACvB,kBAAkB,GAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACN,sBAAsB,EACtB,UAAU,EACV,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,GACnB,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,YAAY,EACX,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,gBAAgB,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AACvG,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,EACN,oCAAoC,EACpC,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,iBAAiB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,6BAA6B,EAC7B,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAC/B,eAAe,EACf,8BAA8B,EAC9B,2BAA2B,GAC3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACN,KAAK,eAAe,EACpB,4BAA4B,EAC5B,sBAAsB,GACtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACN,mBAAmB,EACnB,KAAK,6BAA6B,EAClC,KAAK,oBAAoB,EACzB,KAAK,qCAAqC,EAC1C,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,gCAAgC,EACrC,KAAK,+BAA+B,EACpC,KAAK,iCAAiC,EAEtC,kBAAkB,EAClB,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC1B,cAAc,EAEd,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,KAAK,cAAc,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EACN,KAAK,kBAAkB,EACvB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,2BAA2B,EAChC,uBAAuB,EACvB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,qBAAqB,EACrB,KAAK,iBAAiB,EACtB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,cAAc,EACd,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC7B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACN,0BAA0B,EAC1B,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,uBAAuB,EACvB,KAAK,sBAAsB,GAC3B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACN,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,eAAe,EACf,KAAK,oBAAoB,GACzB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACN,qBAAqB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,UAAU,EACV,iBAAiB,EACjB,KAAK,KAAK,EACV,KAAK,gBAAgB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAElE,OAAO,EACN,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,+BAA+B,EAC/B,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,qBAAqB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACN,4BAA4B,EAC5B,mBAAmB,EACnB,wBAAwB,EACxB,iCAAiC,EACjC,wBAAwB,EACxB,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,EAClC,KAAK,iCAAiC,GACtC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAEtG,OAAO,EACN,KAAK,iBAAiB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,oCAAoC,EACpC,kCAAkC,EAClC,uBAAuB,EACvB,4BAA4B,EAC5B,KAAK,yBAAyB,EAC9B,uBAAuB,GACvB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,4BAA4B,EAC5B,gCAAgC,EAChC,uBAAuB,EACvB,qBAAqB,EACrB,4BAA4B,EAC5B,uBAAuB,EACvB,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,uBAAuB,EACvB,2BAA2B,GAC3B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACN,oBAAoB,EACpB,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,GAChC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACN,YAAY,EACZ,KAAK,mBAAmB,EACxB,mBAAmB,EACnB,kCAAkC,EAClC,mBAAmB,EACnB,mBAAmB,GACnB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACN,KAAK,gCAAgC,EACrC,KAAK,gCAAgC,EACrC,KAAK,+BAA+B,EACpC,wBAAwB,EACxB,6BAA6B,EAC7B,KAAK,+BAA+B,EACpC,KAAK,wBAAwB,GAC7B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,2BAA2B,EAC3B,8BAA8B,EAC9B,iCAAiC,EACjC,8BAA8B,EAC9B,yBAAyB,GACzB,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,KAAK,WAAW,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EACN,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,YAAY,EACZ,UAAU,GACV,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACN,cAAc,EACd,yBAAyB,EACzB,sBAAsB,EACtB,cAAc,EACd,6BAA6B,EAC7B,iCAAiC,EACjC,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,0BAA0B,EAC1B,eAAe,EACf,OAAO,EACP,OAAO,EACP,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,UAAU,EACV,UAAU,EACV,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,yBAAyB,EACzB,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,oBAAoB,GACzB,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,SAAS,EACT,KAAK,EACL,KAAK,UAAU,GACf,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EACX,+BAA+B,EAC/B,aAAa,EACb,kBAAkB,EAClB,2BAA2B,EAC3B,+BAA+B,EAC/B,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,0BAA0B,EAC1B,4BAA4B,EAC5B,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,SAAS,EACT,YAAY,EACZ,oBAAoB,EACpB,8BAA8B,EAC9B,cAAc,GACd,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,KAAK,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE9F,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC","sourcesContent":["// Core session management\n\nexport { type Args, parseArgs } from \"./cli/args.ts\";\n// Config paths\nexport { getAgentDir, VERSION } from \"./config.ts\";\nexport {\n\tAgentSession,\n\ttype AgentSessionConfig,\n\ttype AgentSessionEvent,\n\ttype AgentSessionEventListener,\n\ttype ModelCycleResult,\n\ttype ParsedSkillBlock,\n\ttype PromptOptions,\n\tparseSkillBlock,\n\ttype SessionStats,\n} from \"./core/agent-session.ts\";\n// Auth and model registry\nexport {\n\ttype ApiKeyCredential,\n\ttype AuthCredential,\n\ttype AuthStatus,\n\tAuthStorage,\n\ttype AuthStorageBackend,\n\tFileAuthStorageBackend,\n\tInMemoryAuthStorageBackend,\n\ttype OAuthCredential,\n} from \"./core/auth-storage.ts\";\nexport {\n\ttype ApiAction,\n\tApiBroker,\n\ttype ApiMethod,\n\ttype ApiOutcome,\n\tAUTOPILOT_MAX,\n\ttype AutomationHarnessScoreInput,\n\tAutomationHarnessScorer,\n\ttype AutomationScoreBreakdown,\n\ttype AutomationTrace,\n\ttype AutomationTraceAction,\n\ttype AutomationTraceContextPlan,\n\ttype AutomationTraceEnvApiUse,\n\ttype AutonomyProfile,\n\ttype BrokerFetcher,\n\ttype BrokerFetchRequest,\n\ttype BrokerFetchResponse,\n\ttype Capability,\n\tcanonicalHash,\n\tclassifyEnvKey,\n\tDynamicToolPortfolioOptimizer,\n\tEnvBroker,\n\ttype EnvBrokerLedger,\n\ttype EnvMode,\n\ttype EnvRecord,\n\ttype EnvResolutionRequest,\n\ttype EnvUseEvent,\n\ttype EvidenceActor,\n\ttype EvidenceEvent,\n\ttype EvidenceEventInput,\n\tEvidenceLedger,\n\ttype EvidenceOutcome,\n\ttype EvidencePointer,\n\ttype ExecutionStrategy,\n\ttype Postcondition,\n\tPostconditionVerifier,\n\ttype RiskLevel,\n\tredactForModel,\n\ttype Sensitivity,\n\tstrategyForRisk,\n\tToolExecutionBroker,\n\ttype ToolExecutionCandidate,\n\ttype ToolExecutionChoice,\n\ttype ToolExecutionNeed,\n\ttype VerificationContext,\n\ttype VerificationResult,\n} from \"./core/automation/index.ts\";\n// Compaction\nexport {\n\ttype BranchPreparation,\n\ttype BranchSummaryResult,\n\ttype CollectEntriesResult,\n\ttype CompactionBarrierResult,\n\ttype CompactionCommitDecision,\n\ttype CompactionEnvelope,\n\ttype CompactionHysteresisConfig,\n\ttype CompactionHysteresisState,\n\ttype CompactionResult,\n\ttype CompactionTransaction,\n\ttype CutPointResult,\n\tcalculateContextTokens,\n\tcollectEntriesForBranchSummary,\n\tcompact,\n\tcreateCompactionEnvelope,\n\tcreateCompactionHysteresisConfig,\n\tcreateCompactionHysteresisState,\n\tcreateCompactionSourceIdentity,\n\tcreateCompactionTransaction,\n\tcreateSessionRevisionToken,\n\tDEFAULT_COMPACTION_SETTINGS,\n\tdecideCompactionCommit,\n\testimateTokens,\n\tevaluateCompactionBarrier,\n\ttype FileOperations,\n\tfindCutPoint,\n\tfindTurnStartIndex,\n\ttype GenerateBranchSummaryOptions,\n\tgenerateBranchSummary,\n\tgenerateSummary,\n\tgetLastAssistantUsage,\n\tprepareBranchEntries,\n\tserializeConversation,\n\tshouldCompact,\n\tstepCompactionHysteresis,\n\tvalidateCompactionEnvelope,\n} from \"./core/compaction/index.ts\";\nexport {\n\tapplyContextCacheInvalidation,\n\tbuildContextBudgetMaterializedRepresentationCacheKeyV2,\n\tbuildContextBudgetPlanCacheKeyV2,\n\tCONTEXT_BUDGET_POLICY_VERSION_V2,\n\ttype ContextBudgetCacheProviderV2,\n\ttype ContextCacheInvalidationEvent,\n\ttype ContextCacheInvalidationSnapshot,\n\tcreateContextBudgetCacheKeyBaseV2,\n\tcreateContextCacheInvalidationSnapshot,\n\tcreateMemoryContextBudgetCacheProviderV2,\n\tplanPromptContextBudgetV2,\n\tserializeContextCacheSnapshot,\n} from \"./core/context-budget-governor-v2.ts\";\nexport {\n\tcomputeReservedTokenBudget,\n\testimateToolResultReserve,\n\tReservedTokenBudgetError,\n\ttype ReservedTokenBudgetInput,\n\ttype ReservedTokenBudgetResult,\n\ttype ToolResultReserveRequest,\n} from \"./core/context-budget-reserved-tokens.ts\";\nexport { createEventBus, type EventBus, type EventBusController } from \"./core/event-bus.ts\";\n// Extension system\nexport type {\n\tAgentEndEvent,\n\tAgentStartEvent,\n\tAgentToolResult,\n\tAgentToolUpdateCallback,\n\tAppKeybinding,\n\tAutocompleteProviderFactory,\n\tBashToolCallEvent,\n\tBeforeAgentStartEvent,\n\tBeforeAgentStartEventResult,\n\tBeforeProviderRequestEvent,\n\tBeforeProviderRequestEventResult,\n\tBuildSystemPromptOptions,\n\tCompactOptions,\n\tContextEvent,\n\tContextUsage,\n\tCustomToolCallEvent,\n\tEditToolCallEvent,\n\tExecOptions,\n\tExecResult,\n\tExtension,\n\tExtensionActions,\n\tExtensionAPI,\n\tExtensionCommandContext,\n\tExtensionCommandContextActions,\n\tExtensionContext,\n\tExtensionContextActions,\n\tExtensionError,\n\tExtensionEvent,\n\tExtensionFactory,\n\tExtensionFlag,\n\tExtensionHandler,\n\tExtensionRuntime,\n\tExtensionShortcut,\n\tExtensionUIContext,\n\tExtensionUIDialogOptions,\n\tExtensionWidgetOptions,\n\tFindToolCallEvent,\n\tGrepToolCallEvent,\n\tInputEvent,\n\tInputEventResult,\n\tInputSource,\n\tKeybindingsManager,\n\tLoadExtensionsResult,\n\tLsToolCallEvent,\n\tMessageRenderer,\n\tMessageRenderOptions,\n\tProviderConfig,\n\tProviderModelConfig,\n\tReadToolCallEvent,\n\tRegisteredCommand,\n\tRegisteredTool,\n\tResolvedCommand,\n\tSessionBeforeCompactEvent,\n\tSessionBeforeForkEvent,\n\tSessionBeforeSwitchEvent,\n\tSessionBeforeTreeEvent,\n\tSessionCompactEvent,\n\tSessionShutdownEvent,\n\tSessionStartEvent,\n\tSessionTreeEvent,\n\tSlashCommandInfo,\n\tSlashCommandSource,\n\tSourceInfo,\n\tTerminalInputHandler,\n\tToolCallEvent,\n\tToolCallEventResult,\n\tToolDefinition,\n\tToolExecutionMode,\n\tToolInfo,\n\tToolRenderResultOptions,\n\tToolResultEvent,\n\tTurnEndEvent,\n\tTurnStartEvent,\n\tUserBashEvent,\n\tUserBashEventResult,\n\tWidgetPlacement,\n\tWorkingIndicatorOptions,\n\tWriteToolCallEvent,\n} from \"./core/extensions/index.ts\";\nexport {\n\tcreateExtensionRuntime,\n\tdefineTool,\n\tdiscoverAndLoadExtensions,\n\tExtensionRunner,\n\tisBashToolResult,\n\tisEditToolResult,\n\tisFindToolResult,\n\tisGrepToolResult,\n\tisLsToolResult,\n\tisReadToolResult,\n\tisToolCallEventType,\n\tisWriteToolResult,\n\twrapRegisteredTool,\n\twrapRegisteredTools,\n} from \"./core/extensions/index.ts\";\n// Footer data provider (git branch + extension statuses - data not otherwise available to extensions)\nexport type { ReadonlyFooterDataProvider } from \"./core/footer-data-provider.ts\";\nexport { convertToLlm } from \"./core/messages.ts\";\nexport { ModelRegistry } from \"./core/model-registry.ts\";\nexport type {\n\tPackageManager,\n\tPathMetadata,\n\tProgressCallback,\n\tProgressEvent,\n\tResolvedPaths,\n\tResolvedResource,\n} from \"./core/package-manager.ts\";\nexport { DefaultPackageManager } from \"./core/package-manager.ts\";\nexport type { ResourceCollision, ResourceDiagnostic, ResourceLoader } from \"./core/resource-loader.ts\";\nexport { DefaultResourceLoader, loadProjectContextFiles } from \"./core/resource-loader.ts\";\nexport {\n\textractReverseSkillFactsFromMarkdown,\n\tformatReverseSkillFromSource,\n\tformatReverseSkillMarkdown,\n\tformatReverseSkillRouteDecision,\n\tgetReverseSkillToolAliases,\n\tnormalizeReverseSkillName,\n\tnormalizeReverseSkillText,\n\tplanReverseSkillToolChecks,\n\tREVERSE_SKILL_ROUTES,\n\ttype ReverseSkillPlatform,\n\ttype ReverseSkillRisk,\n\ttype ReverseSkillRoute,\n\ttype ReverseSkillRouteDecision,\n\ttype ReverseSkillRouteInput,\n\ttype ReverseSkillRouteScore,\n\ttype ReverseSkillSourceFacts,\n\ttype ReverseSkillSourceInput,\n\ttype ReverseSkillSpecInput,\n\trouteReverseSkill,\n} from \"./core/reverse-skill.ts\";\nexport {\n\tappendRunJournalRecordDurably,\n\ttype OpenRunJournalStoreOptions,\n\ttype RunJournalQuarantineReport,\n\tRunJournalStore,\n\tRunJournalStoreCorruptionError,\n\twriteQuarantineBytesDurably,\n} from \"./core/run-journal-store.ts\";\nexport {\n\ttype BashSandboxMode,\n\tcreateWorkspaceSandboxPolicy,\n\tresolveBashSandboxMode,\n} from \"./core/sandbox/default-policy.ts\";\n// SDK for programmatic usage\nexport {\n\tAgentSessionRuntime,\n\ttype AgentSessionRuntimeDiagnostic,\n\ttype AgentSessionServices,\n\ttype CreateAgentSessionFromServicesOptions,\n\ttype CreateAgentSessionOptions,\n\ttype CreateAgentSessionResult,\n\ttype CreateAgentSessionRuntimeFactory,\n\ttype CreateAgentSessionRuntimeResult,\n\ttype CreateAgentSessionServicesOptions,\n\t// Factory\n\tcreateAgentSession,\n\tcreateAgentSessionFromServices,\n\tcreateAgentSessionRuntime,\n\tcreateAgentSessionServices,\n\tcreateBashTool,\n\t// Tool factories (for custom cwd)\n\tcreateCodingTools,\n\tcreateEditTool,\n\tcreateFindTool,\n\tcreateGrepTool,\n\tcreateLsTool,\n\tcreateReadOnlyTools,\n\tcreateReadTool,\n\tcreateWriteTool,\n\ttype PromptTemplate,\n} from \"./core/sdk.ts\";\nexport {\n\ttype BranchSummaryEntry,\n\tbuildSessionContext,\n\ttype CompactionEntry,\n\ttype CompactionProvenanceDetails,\n\tCURRENT_SESSION_VERSION,\n\ttype CustomEntry,\n\ttype CustomMessageEntry,\n\ttype FileEntry,\n\tgetLatestCompactionEntry,\n\ttype ModelChangeEntry,\n\tmigrateSessionEntries,\n\ttype NewSessionOptions,\n\tparseSessionEntries,\n\ttype SessionContext,\n\ttype SessionEntry,\n\ttype SessionEntryBase,\n\ttype SessionHeader,\n\ttype SessionInfo,\n\ttype SessionInfoEntry,\n\tSessionManager,\n\ttype SessionMessageEntry,\n\ttype SessionQuarantineReport,\n\ttype ThinkingLevelChangeEntry,\n} from \"./core/session-manager.ts\";\nexport {\n\tclassifySessionTermination,\n\tformatSessionTermination,\n\ttype SessionTermination,\n\ttype SessionTerminationCause,\n\tSessionTerminationError,\n\ttype SessionTerminationKind,\n} from \"./core/session-termination.ts\";\nexport {\n\ttype AgentRuntimeSettings,\n\ttype CompactionSettings,\n\ttype ImageSettings,\n\ttype PackageSource,\n\ttype RetrySettings,\n\tSettingsManager,\n\ttype ToolSchedulerSetting,\n} from \"./core/settings-manager.ts\";\n// Skills\nexport {\n\tformatSkillsForPrompt,\n\ttype LoadSkillsFromDirOptions,\n\ttype LoadSkillsResult,\n\tloadSkills,\n\tloadSkillsFromDir,\n\ttype Skill,\n\ttype SkillFrontmatter,\n} from \"./core/skills.ts\";\nexport { createSyntheticSourceInfo } from \"./core/source-info.ts\";\n// Tools\nexport {\n\ttype BashOperations,\n\ttype BashSpawnContext,\n\ttype BashSpawnHook,\n\ttype BashToolDetails,\n\ttype BashToolInput,\n\ttype BashToolOptions,\n\tcreateBashToolDefinition,\n\tcreateDiagnosticsTool,\n\tcreateDiagnosticsToolDefinition,\n\tcreateEditToolDefinition,\n\tcreateFindToolDefinition,\n\tcreateGrepToolDefinition,\n\tcreateLocalBashOperations,\n\tcreateLsToolDefinition,\n\tcreateReadToolDefinition,\n\tcreateWriteToolDefinition,\n\tDEFAULT_MAX_BYTES,\n\tDEFAULT_MAX_LINES,\n\ttype DiagnosticLine,\n\ttype DiagnosticsToolDetails,\n\ttype DiagnosticsToolInput,\n\ttype EditOperations,\n\ttype EditToolDetails,\n\ttype EditToolInput,\n\ttype EditToolOptions,\n\ttype FindOperations,\n\ttype FindToolDetails,\n\ttype FindToolInput,\n\ttype FindToolOptions,\n\tformatSize,\n\ttype GrepOperations,\n\ttype GrepToolDetails,\n\ttype GrepToolInput,\n\ttype GrepToolOptions,\n\ttype LsOperations,\n\ttype LsToolDetails,\n\ttype LsToolInput,\n\ttype LsToolOptions,\n\ttype ReadOperations,\n\ttype ReadToolDetails,\n\ttype ReadToolInput,\n\ttype ReadToolOptions,\n\ttype ToolsOptions,\n\ttype TruncationOptions,\n\ttype TruncationResult,\n\ttruncateHead,\n\ttruncateLine,\n\ttruncateTail,\n\ttype WriteOperations,\n\ttype WriteToolInput,\n\ttype WriteToolOptions,\n\twithFileMutationQueue,\n} from \"./core/tools/index.ts\";\nexport {\n\tcreateVerifiedBashOperations,\n\texecuteVerifiedBash,\n\texecuteVerifiedLocalBash,\n\tVERIFIED_BASH_REDACTION_POLICY_ID,\n\tVerifiedBashAdapterError,\n\ttype VerifiedBashExecutionRequest,\n\ttype VerifiedBashOperationsBinding,\n\ttype VerifiedLocalBashExecutionRequest,\n} from \"./core/verified-bash-adapter.ts\";\nexport { isVerifiedBashEnabled, resolveSessionWorkspaceScope } from \"./core/verified-bash-runtime.ts\";\n// Execution-bound evidence\nexport {\n\ttype CommandHmacBinder,\n\tCommandRedactionError,\n\tcreateCommandHmacBinder,\n\tEVIDENCE_COMMAND_REDACTION_POLICY_ID,\n\tMAX_COMMAND_REDACTION_PLACEHOLDERS,\n\tparseCommandHmacBinding,\n\tparseCommandRedactionSummary,\n\ttype RedactedCommandDescriptor,\n\tredactCommandDescriptor,\n} from \"./guardrails/command-redaction.ts\";\nexport {\n\tcomputeEvidenceCommandSha256,\n\tcomputeEvidenceReceiptCoreSha256,\n\tconstantTimeSha256Equal,\n\tcreateEvidenceReceipt,\n\tevidenceReceiptReplayPayload,\n\tisSafeEvidenceReceiptId,\n\tisSha256Hex,\n\tparseEvidenceReceipt,\n\tparseSha256Hex,\n\tvalidateEvidenceReceipt,\n\twithEvidenceReceiptEnvelope,\n} from \"./guardrails/evidence-receipt.ts\";\nexport {\n\tEvidenceReceiptStore,\n\ttype EvidenceReceiptStoreFaultStage,\n\ttype EvidenceReceiptStoreOptions,\n} from \"./guardrails/evidence-receipt-store.ts\";\nexport {\n\tEvidenceGate,\n\ttype EvidenceGateOptions,\n\tFailClosedMergeGate,\n\tlatestRelevantWorkspaceMutationSeq,\n\tReplayLedgerManager,\n\tTaskContractBuilder,\n} from \"./guardrails/evidence-system.ts\";\nexport {\n\ttype VerifiedEvidenceExecutionOutcome,\n\ttype VerifiedEvidenceExecutionRequest,\n\ttype VerifiedEvidenceExecutionResult,\n\tVerifiedEvidenceExecutor,\n\tVerifiedEvidenceExecutorError,\n\ttype VerifiedEvidenceExecutorOptions,\n\ttype VerifiedEvidenceMetadata,\n} from \"./guardrails/verified-executor.ts\";\nexport {\n\tcaptureWorkspaceFingerprint,\n\tcomputeGitWorkspaceDirtySha256,\n\tcomputeGitWorkspaceManifestSha256,\n\tcomputeWorkspaceManifestSha256,\n\tparseWorkspaceFingerprint,\n} from \"./guardrails/workspace-fingerprint.ts\";\n// Main entry point\nexport { type MainOptions, main } from \"./main.ts\";\n// Run modes for programmatic SDK usage\nexport {\n\tInteractiveMode,\n\ttype InteractiveModeOptions,\n\ttype ModelInfo,\n\ttype PrintModeOptions,\n\tRpcClient,\n\ttype RpcClientOptions,\n\ttype RpcCommand,\n\ttype RpcEventListener,\n\ttype RpcResponse,\n\ttype RpcSessionState,\n\trunPrintMode,\n\trunRpcMode,\n} from \"./modes/index.ts\";\n// UI components for extensions\nexport {\n\tArminComponent,\n\tAssistantMessageComponent,\n\tBashExecutionComponent,\n\tBorderedLoader,\n\tBranchSummaryMessageComponent,\n\tCompactionSummaryMessageComponent,\n\tCustomEditor,\n\tCustomMessageComponent,\n\tDynamicBorder,\n\tExtensionEditorComponent,\n\tExtensionInputComponent,\n\tExtensionSelectorComponent,\n\tFooterComponent,\n\tkeyHint,\n\tkeyText,\n\tLoginDialogComponent,\n\tModelSelectorComponent,\n\tOAuthSelectorComponent,\n\ttype RenderDiffOptions,\n\trawKeyHint,\n\trenderDiff,\n\tSessionSelectorComponent,\n\ttype SettingsCallbacks,\n\ttype SettingsConfig,\n\tSettingsSelectorComponent,\n\tShowImagesSelectorComponent,\n\tSkillInvocationMessageComponent,\n\tThemeSelectorComponent,\n\tThinkingSelectorComponent,\n\tToolExecutionComponent,\n\ttype ToolExecutionOptions,\n\tTreeSelectorComponent,\n\ttruncateToVisualLines,\n\tUserMessageComponent,\n\tUserMessageSelectorComponent,\n\ttype VisualTruncateResult,\n} from \"./modes/interactive/components/index.ts\";\n// Theme utilities for custom tools and extensions\nexport {\n\tgetLanguageFromPath,\n\tgetMarkdownTheme,\n\tgetSelectListTheme,\n\tgetSettingsListTheme,\n\thighlightCode,\n\tinitTheme,\n\tTheme,\n\ttype ThemeColor,\n} from \"./modes/interactive/theme/theme.ts\";\nexport type {\n\tArtifactSetWorkspaceFingerprint,\n\tArtifactState,\n\tCommandHmacBinding,\n\tCommandRedactionPlaceholder,\n\tCommandRedactionPlaceholderType,\n\tCommandRedactionSummary,\n\tEvidenceCommandDescriptor,\n\tEvidenceExecutor,\n\tEvidenceItem,\n\tEvidenceReceipt,\n\tEvidenceReceiptDisposition,\n\tEvidenceReceiptLedgerBinding,\n\tEvidenceReceiptMode,\n\tFileArtifactState,\n\tGitWorkspaceFingerprint,\n\tGitWorkspaceState,\n\tMissingArtifactState,\n\tReplayEvent,\n\tReplayEventType,\n\tSha256Hex,\n\tTaskContract,\n\tWorkspaceFingerprint,\n\tWorkspaceMutationReplayPayload,\n\tWorkspaceScope,\n} from \"./types/evidence.ts\";\n// Clipboard utilities\nexport { copyToClipboard } from \"./utils/clipboard.ts\";\nexport { parseFrontmatter, stripFrontmatter } from \"./utils/frontmatter.ts\";\nexport { convertToPng } from \"./utils/image-convert.ts\";\nexport { formatDimensionNote, type ResizedImage, resizeImage } from \"./utils/image-resize.ts\";\n// Shell utilities\nexport { getShellConfig } from \"./utils/shell.ts\";\n"]}

package/dist/index.js

@@ -18,6 +18,7 @@ export { DefaultPackageManager } from "./core/package-manager.js";
 export { DefaultResourceLoader, loadProjectContextFiles } from "./core/resource-loader.js";
 export { extractReverseSkillFactsFromMarkdown, formatReverseSkillFromSource, formatReverseSkillMarkdown, formatReverseSkillRouteDecision, getReverseSkillToolAliases, normalizeReverseSkillName, normalizeReverseSkillText, planReverseSkillToolChecks, REVERSE_SKILL_ROUTES, routeReverseSkill, } from "./core/reverse-skill.js";
 export { appendRunJournalRecordDurably, RunJournalStore, RunJournalStoreCorruptionError, writeQuarantineBytesDurably, } from "./core/run-journal-store.js";
+export { createWorkspaceSandboxPolicy, resolveBashSandboxMode, } from "./core/sandbox/default-policy.js";
 // SDK for programmatic usage
 export { AgentSessionRuntime, 
 // Factory
@@ -31,8 +32,9 @@ export { SettingsManager, } from "./core/settings-manager.js";
 export { formatSkillsForPrompt, loadSkills, loadSkillsFromDir, } from "./core/skills.js";
 export { createSyntheticSourceInfo } from "./core/source-info.js";
 // Tools
-export { createBashToolDefinition, createEditToolDefinition, createFindToolDefinition, createGrepToolDefinition, createLocalBashOperations, createLsToolDefinition, createReadToolDefinition, createWriteToolDefinition, DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, formatSize, truncateHead, truncateLine, truncateTail, withFileMutationQueue, } from "./core/tools/index.js";
-export { executeVerifiedBash, executeVerifiedLocalBash, VERIFIED_BASH_REDACTION_POLICY_ID, VerifiedBashAdapterError, } from "./core/verified-bash-adapter.js";
+export { createBashToolDefinition, createDiagnosticsTool, createDiagnosticsToolDefinition, createEditToolDefinition, createFindToolDefinition, createGrepToolDefinition, createLocalBashOperations, createLsToolDefinition, createReadToolDefinition, createWriteToolDefinition, DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, formatSize, truncateHead, truncateLine, truncateTail, withFileMutationQueue, } from "./core/tools/index.js";
+export { createVerifiedBashOperations, executeVerifiedBash, executeVerifiedLocalBash, VERIFIED_BASH_REDACTION_POLICY_ID, VerifiedBashAdapterError, } from "./core/verified-bash-adapter.js";
+export { isVerifiedBashEnabled, resolveSessionWorkspaceScope } from "./core/verified-bash-runtime.js";
 // Execution-bound evidence
 export { CommandRedactionError, createCommandHmacBinder, EVIDENCE_COMMAND_REDACTION_POLICY_ID, MAX_COMMAND_REDACTION_PLACEHOLDERS, parseCommandHmacBinding, parseCommandRedactionSummary, redactCommandDescriptor, } from "./guardrails/command-redaction.js";
 export { computeEvidenceCommandSha256, computeEvidenceReceiptCoreSha256, constantTimeSha256Equal, createEvidenceReceipt, evidenceReceiptReplayPayload, isSafeEvidenceReceiptId, isSha256Hex, parseEvidenceReceipt, parseSha256Hex, validateEvidenceReceipt, withEvidenceReceiptEnvelope, } from "./guardrails/evidence-receipt.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAE1B,OAAO,EAAa,SAAS,EAAE,MAAM,eAAe,CAAC;AACrD,eAAe;AACf,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACN,YAAY,EAOZ,eAAe,GAEf,MAAM,yBAAyB,CAAC;AACjC,0BAA0B;AAC1B,OAAO,EAIN,WAAW,EAEX,sBAAsB,EACtB,0BAA0B,GAE1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAEN,SAAS,EAGT,aAAa,EAEb,uBAAuB,EAWvB,aAAa,EACb,cAAc,EACd,6BAA6B,EAC7B,SAAS,EAST,cAAc,EAKd,qBAAqB,EAErB,cAAc,EAEd,eAAe,EACf,mBAAmB,GAMnB,MAAM,4BAA4B,CAAC;AACpC,aAAa;AACb,OAAO,EAYN,sBAAsB,EACtB,8BAA8B,EAC9B,OAAO,EACP,wBAAwB,EACxB,gCAAgC,EAChC,+BAA+B,EAC/B,8BAA8B,EAC9B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,sBAAsB,EACtB,cAAc,EACd,yBAAyB,EAEzB,YAAY,EACZ,kBAAkB,EAElB,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,EACb,wBAAwB,EACxB,0BAA0B,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACN,6BAA6B,EAC7B,sDAAsD,EACtD,gCAAgC,EAChC,gCAAgC,EAIhC,iCAAiC,EACjC,sCAAsC,EACtC,wCAAwC,EACxC,yBAAyB,EACzB,6BAA6B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACN,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,GAIxB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,cAAc,EAA0C,MAAM,qBAAqB,CAAC;AAkF7F,OAAO,EACN,sBAAsB,EACtB,UAAU,EACV,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,GACnB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AASzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,EACN,oCAAoC,EACpC,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,oBAAoB,EAUpB,iBAAiB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,6BAA6B,EAG7B,eAAe,EACf,8BAA8B,EAC9B,2BAA2B,GAC3B,MAAM,6BAA6B,CAAC;AACrC,6BAA6B;AAC7B,OAAO,EACN,mBAAmB;AASnB,UAAU;AACV,kBAAkB,EAClB,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC1B,cAAc;AACd,kCAAkC;AAClC,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,eAAe,GAEf,MAAM,eAAe,CAAC;AACvB,OAAO,EAEN,mBAAmB,EAGnB,uBAAuB,EAIvB,wBAAwB,EAExB,qBAAqB,EAErB,mBAAmB,EAOnB,cAAc,GAId,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACN,0BAA0B,EAC1B,wBAAwB,EAGxB,uBAAuB,GAEvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAMN,eAAe,GAEf,MAAM,4BAA4B,CAAC;AACpC,SAAS;AACT,OAAO,EACN,qBAAqB,EAGrB,UAAU,EACV,iBAAiB,GAGjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,QAAQ;AACR,OAAO,EAON,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EASjB,UAAU,EAgBV,YAAY,EACZ,YAAY,EACZ,YAAY,EAIZ,qBAAqB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACN,mBAAmB,EACnB,wBAAwB,EACxB,iCAAiC,EACjC,wBAAwB,GAGxB,MAAM,iCAAiC,CAAC;AACzC,2BAA2B;AAC3B,OAAO,EAEN,qBAAqB,EACrB,uBAAuB,EACvB,oCAAoC,EACpC,kCAAkC,EAClC,uBAAuB,EACvB,4BAA4B,EAE5B,uBAAuB,GACvB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,4BAA4B,EAC5B,gCAAgC,EAChC,uBAAuB,EACvB,qBAAqB,EACrB,4BAA4B,EAC5B,uBAAuB,EACvB,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,uBAAuB,EACvB,2BAA2B,GAC3B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACN,oBAAoB,GAGpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACN,YAAY,EAEZ,mBAAmB,EACnB,kCAAkC,EAClC,mBAAmB,EACnB,mBAAmB,GACnB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAIN,wBAAwB,EACxB,6BAA6B,GAG7B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,2BAA2B,EAC3B,8BAA8B,EAC9B,iCAAiC,EACjC,8BAA8B,EAC9B,yBAAyB,GACzB,MAAM,uCAAuC,CAAC;AAC/C,mBAAmB;AACnB,OAAO,EAAoB,IAAI,EAAE,MAAM,WAAW,CAAC;AACnD,uCAAuC;AACvC,OAAO,EACN,eAAe,EAIf,SAAS,EAMT,YAAY,EACZ,UAAU,GACV,MAAM,kBAAkB,CAAC;AAC1B,+BAA+B;AAC/B,OAAO,EACN,cAAc,EACd,yBAAyB,EACzB,sBAAsB,EACtB,cAAc,EACd,6BAA6B,EAC7B,iCAAiC,EACjC,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,0BAA0B,EAC1B,eAAe,EACf,OAAO,EACP,OAAO,EACP,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EAEtB,UAAU,EACV,UAAU,EACV,wBAAwB,EAGxB,yBAAyB,EACzB,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EAEtB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,4BAA4B,GAE5B,MAAM,yCAAyC,CAAC;AACjD,kDAAkD;AAClD,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,SAAS,EACT,KAAK,GAEL,MAAM,oCAAoC,CAAC;AA2B5C,sBAAsB;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAqB,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9F,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC","sourcesContent":["// Core session management\n\nexport { type Args, parseArgs } from \"./cli/args.ts\";\n// Config paths\nexport { getAgentDir, VERSION } from \"./config.ts\";\nexport {\n\tAgentSession,\n\ttype AgentSessionConfig,\n\ttype AgentSessionEvent,\n\ttype AgentSessionEventListener,\n\ttype ModelCycleResult,\n\ttype ParsedSkillBlock,\n\ttype PromptOptions,\n\tparseSkillBlock,\n\ttype SessionStats,\n} from \"./core/agent-session.ts\";\n// Auth and model registry\nexport {\n\ttype ApiKeyCredential,\n\ttype AuthCredential,\n\ttype AuthStatus,\n\tAuthStorage,\n\ttype AuthStorageBackend,\n\tFileAuthStorageBackend,\n\tInMemoryAuthStorageBackend,\n\ttype OAuthCredential,\n} from \"./core/auth-storage.ts\";\nexport {\n\ttype ApiAction,\n\tApiBroker,\n\ttype ApiMethod,\n\ttype ApiOutcome,\n\tAUTOPILOT_MAX,\n\ttype AutomationHarnessScoreInput,\n\tAutomationHarnessScorer,\n\ttype AutomationScoreBreakdown,\n\ttype AutomationTrace,\n\ttype AutomationTraceAction,\n\ttype AutomationTraceContextPlan,\n\ttype AutomationTraceEnvApiUse,\n\ttype AutonomyProfile,\n\ttype BrokerFetcher,\n\ttype BrokerFetchRequest,\n\ttype BrokerFetchResponse,\n\ttype Capability,\n\tcanonicalHash,\n\tclassifyEnvKey,\n\tDynamicToolPortfolioOptimizer,\n\tEnvBroker,\n\ttype EnvBrokerLedger,\n\ttype EnvMode,\n\ttype EnvRecord,\n\ttype EnvResolutionRequest,\n\ttype EnvUseEvent,\n\ttype EvidenceActor,\n\ttype EvidenceEvent,\n\ttype EvidenceEventInput,\n\tEvidenceLedger,\n\ttype EvidenceOutcome,\n\ttype EvidencePointer,\n\ttype ExecutionStrategy,\n\ttype Postcondition,\n\tPostconditionVerifier,\n\ttype RiskLevel,\n\tredactForModel,\n\ttype Sensitivity,\n\tstrategyForRisk,\n\tToolExecutionBroker,\n\ttype ToolExecutionCandidate,\n\ttype ToolExecutionChoice,\n\ttype ToolExecutionNeed,\n\ttype VerificationContext,\n\ttype VerificationResult,\n} from \"./core/automation/index.ts\";\n// Compaction\nexport {\n\ttype BranchPreparation,\n\ttype BranchSummaryResult,\n\ttype CollectEntriesResult,\n\ttype CompactionBarrierResult,\n\ttype CompactionCommitDecision,\n\ttype CompactionEnvelope,\n\ttype CompactionHysteresisConfig,\n\ttype CompactionHysteresisState,\n\ttype CompactionResult,\n\ttype CompactionTransaction,\n\ttype CutPointResult,\n\tcalculateContextTokens,\n\tcollectEntriesForBranchSummary,\n\tcompact,\n\tcreateCompactionEnvelope,\n\tcreateCompactionHysteresisConfig,\n\tcreateCompactionHysteresisState,\n\tcreateCompactionSourceIdentity,\n\tcreateCompactionTransaction,\n\tcreateSessionRevisionToken,\n\tDEFAULT_COMPACTION_SETTINGS,\n\tdecideCompactionCommit,\n\testimateTokens,\n\tevaluateCompactionBarrier,\n\ttype FileOperations,\n\tfindCutPoint,\n\tfindTurnStartIndex,\n\ttype GenerateBranchSummaryOptions,\n\tgenerateBranchSummary,\n\tgenerateSummary,\n\tgetLastAssistantUsage,\n\tprepareBranchEntries,\n\tserializeConversation,\n\tshouldCompact,\n\tstepCompactionHysteresis,\n\tvalidateCompactionEnvelope,\n} from \"./core/compaction/index.ts\";\nexport {\n\tapplyContextCacheInvalidation,\n\tbuildContextBudgetMaterializedRepresentationCacheKeyV2,\n\tbuildContextBudgetPlanCacheKeyV2,\n\tCONTEXT_BUDGET_POLICY_VERSION_V2,\n\ttype ContextBudgetCacheProviderV2,\n\ttype ContextCacheInvalidationEvent,\n\ttype ContextCacheInvalidationSnapshot,\n\tcreateContextBudgetCacheKeyBaseV2,\n\tcreateContextCacheInvalidationSnapshot,\n\tcreateMemoryContextBudgetCacheProviderV2,\n\tplanPromptContextBudgetV2,\n\tserializeContextCacheSnapshot,\n} from \"./core/context-budget-governor-v2.ts\";\nexport {\n\tcomputeReservedTokenBudget,\n\testimateToolResultReserve,\n\tReservedTokenBudgetError,\n\ttype ReservedTokenBudgetInput,\n\ttype ReservedTokenBudgetResult,\n\ttype ToolResultReserveRequest,\n} from \"./core/context-budget-reserved-tokens.ts\";\nexport { createEventBus, type EventBus, type EventBusController } from \"./core/event-bus.ts\";\n// Extension system\nexport type {\n\tAgentEndEvent,\n\tAgentStartEvent,\n\tAgentToolResult,\n\tAgentToolUpdateCallback,\n\tAppKeybinding,\n\tAutocompleteProviderFactory,\n\tBashToolCallEvent,\n\tBeforeAgentStartEvent,\n\tBeforeAgentStartEventResult,\n\tBeforeProviderRequestEvent,\n\tBeforeProviderRequestEventResult,\n\tBuildSystemPromptOptions,\n\tCompactOptions,\n\tContextEvent,\n\tContextUsage,\n\tCustomToolCallEvent,\n\tEditToolCallEvent,\n\tExecOptions,\n\tExecResult,\n\tExtension,\n\tExtensionActions,\n\tExtensionAPI,\n\tExtensionCommandContext,\n\tExtensionCommandContextActions,\n\tExtensionContext,\n\tExtensionContextActions,\n\tExtensionError,\n\tExtensionEvent,\n\tExtensionFactory,\n\tExtensionFlag,\n\tExtensionHandler,\n\tExtensionRuntime,\n\tExtensionShortcut,\n\tExtensionUIContext,\n\tExtensionUIDialogOptions,\n\tExtensionWidgetOptions,\n\tFindToolCallEvent,\n\tGrepToolCallEvent,\n\tInputEvent,\n\tInputEventResult,\n\tInputSource,\n\tKeybindingsManager,\n\tLoadExtensionsResult,\n\tLsToolCallEvent,\n\tMessageRenderer,\n\tMessageRenderOptions,\n\tProviderConfig,\n\tProviderModelConfig,\n\tReadToolCallEvent,\n\tRegisteredCommand,\n\tRegisteredTool,\n\tResolvedCommand,\n\tSessionBeforeCompactEvent,\n\tSessionBeforeForkEvent,\n\tSessionBeforeSwitchEvent,\n\tSessionBeforeTreeEvent,\n\tSessionCompactEvent,\n\tSessionShutdownEvent,\n\tSessionStartEvent,\n\tSessionTreeEvent,\n\tSlashCommandInfo,\n\tSlashCommandSource,\n\tSourceInfo,\n\tTerminalInputHandler,\n\tToolCallEvent,\n\tToolCallEventResult,\n\tToolDefinition,\n\tToolExecutionMode,\n\tToolInfo,\n\tToolRenderResultOptions,\n\tToolResultEvent,\n\tTurnEndEvent,\n\tTurnStartEvent,\n\tUserBashEvent,\n\tUserBashEventResult,\n\tWidgetPlacement,\n\tWorkingIndicatorOptions,\n\tWriteToolCallEvent,\n} from \"./core/extensions/index.ts\";\nexport {\n\tcreateExtensionRuntime,\n\tdefineTool,\n\tdiscoverAndLoadExtensions,\n\tExtensionRunner,\n\tisBashToolResult,\n\tisEditToolResult,\n\tisFindToolResult,\n\tisGrepToolResult,\n\tisLsToolResult,\n\tisReadToolResult,\n\tisToolCallEventType,\n\tisWriteToolResult,\n\twrapRegisteredTool,\n\twrapRegisteredTools,\n} from \"./core/extensions/index.ts\";\n// Footer data provider (git branch + extension statuses - data not otherwise available to extensions)\nexport type { ReadonlyFooterDataProvider } from \"./core/footer-data-provider.ts\";\nexport { convertToLlm } from \"./core/messages.ts\";\nexport { ModelRegistry } from \"./core/model-registry.ts\";\nexport type {\n\tPackageManager,\n\tPathMetadata,\n\tProgressCallback,\n\tProgressEvent,\n\tResolvedPaths,\n\tResolvedResource,\n} from \"./core/package-manager.ts\";\nexport { DefaultPackageManager } from \"./core/package-manager.ts\";\nexport type { ResourceCollision, ResourceDiagnostic, ResourceLoader } from \"./core/resource-loader.ts\";\nexport { DefaultResourceLoader, loadProjectContextFiles } from \"./core/resource-loader.ts\";\nexport {\n\textractReverseSkillFactsFromMarkdown,\n\tformatReverseSkillFromSource,\n\tformatReverseSkillMarkdown,\n\tformatReverseSkillRouteDecision,\n\tgetReverseSkillToolAliases,\n\tnormalizeReverseSkillName,\n\tnormalizeReverseSkillText,\n\tplanReverseSkillToolChecks,\n\tREVERSE_SKILL_ROUTES,\n\ttype ReverseSkillPlatform,\n\ttype ReverseSkillRisk,\n\ttype ReverseSkillRoute,\n\ttype ReverseSkillRouteDecision,\n\ttype ReverseSkillRouteInput,\n\ttype ReverseSkillRouteScore,\n\ttype ReverseSkillSourceFacts,\n\ttype ReverseSkillSourceInput,\n\ttype ReverseSkillSpecInput,\n\trouteReverseSkill,\n} from \"./core/reverse-skill.ts\";\nexport {\n\tappendRunJournalRecordDurably,\n\ttype OpenRunJournalStoreOptions,\n\ttype RunJournalQuarantineReport,\n\tRunJournalStore,\n\tRunJournalStoreCorruptionError,\n\twriteQuarantineBytesDurably,\n} from \"./core/run-journal-store.ts\";\n// SDK for programmatic usage\nexport {\n\tAgentSessionRuntime,\n\ttype AgentSessionRuntimeDiagnostic,\n\ttype AgentSessionServices,\n\ttype CreateAgentSessionFromServicesOptions,\n\ttype CreateAgentSessionOptions,\n\ttype CreateAgentSessionResult,\n\ttype CreateAgentSessionRuntimeFactory,\n\ttype CreateAgentSessionRuntimeResult,\n\ttype CreateAgentSessionServicesOptions,\n\t// Factory\n\tcreateAgentSession,\n\tcreateAgentSessionFromServices,\n\tcreateAgentSessionRuntime,\n\tcreateAgentSessionServices,\n\tcreateBashTool,\n\t// Tool factories (for custom cwd)\n\tcreateCodingTools,\n\tcreateEditTool,\n\tcreateFindTool,\n\tcreateGrepTool,\n\tcreateLsTool,\n\tcreateReadOnlyTools,\n\tcreateReadTool,\n\tcreateWriteTool,\n\ttype PromptTemplate,\n} from \"./core/sdk.ts\";\nexport {\n\ttype BranchSummaryEntry,\n\tbuildSessionContext,\n\ttype CompactionEntry,\n\ttype CompactionProvenanceDetails,\n\tCURRENT_SESSION_VERSION,\n\ttype CustomEntry,\n\ttype CustomMessageEntry,\n\ttype FileEntry,\n\tgetLatestCompactionEntry,\n\ttype ModelChangeEntry,\n\tmigrateSessionEntries,\n\ttype NewSessionOptions,\n\tparseSessionEntries,\n\ttype SessionContext,\n\ttype SessionEntry,\n\ttype SessionEntryBase,\n\ttype SessionHeader,\n\ttype SessionInfo,\n\ttype SessionInfoEntry,\n\tSessionManager,\n\ttype SessionMessageEntry,\n\ttype SessionQuarantineReport,\n\ttype ThinkingLevelChangeEntry,\n} from \"./core/session-manager.ts\";\nexport {\n\tclassifySessionTermination,\n\tformatSessionTermination,\n\ttype SessionTermination,\n\ttype SessionTerminationCause,\n\tSessionTerminationError,\n\ttype SessionTerminationKind,\n} from \"./core/session-termination.ts\";\nexport {\n\ttype AgentRuntimeSettings,\n\ttype CompactionSettings,\n\ttype ImageSettings,\n\ttype PackageSource,\n\ttype RetrySettings,\n\tSettingsManager,\n\ttype ToolSchedulerSetting,\n} from \"./core/settings-manager.ts\";\n// Skills\nexport {\n\tformatSkillsForPrompt,\n\ttype LoadSkillsFromDirOptions,\n\ttype LoadSkillsResult,\n\tloadSkills,\n\tloadSkillsFromDir,\n\ttype Skill,\n\ttype SkillFrontmatter,\n} from \"./core/skills.ts\";\nexport { createSyntheticSourceInfo } from \"./core/source-info.ts\";\n// Tools\nexport {\n\ttype BashOperations,\n\ttype BashSpawnContext,\n\ttype BashSpawnHook,\n\ttype BashToolDetails,\n\ttype BashToolInput,\n\ttype BashToolOptions,\n\tcreateBashToolDefinition,\n\tcreateEditToolDefinition,\n\tcreateFindToolDefinition,\n\tcreateGrepToolDefinition,\n\tcreateLocalBashOperations,\n\tcreateLsToolDefinition,\n\tcreateReadToolDefinition,\n\tcreateWriteToolDefinition,\n\tDEFAULT_MAX_BYTES,\n\tDEFAULT_MAX_LINES,\n\ttype EditOperations,\n\ttype EditToolDetails,\n\ttype EditToolInput,\n\ttype EditToolOptions,\n\ttype FindOperations,\n\ttype FindToolDetails,\n\ttype FindToolInput,\n\ttype FindToolOptions,\n\tformatSize,\n\ttype GrepOperations,\n\ttype GrepToolDetails,\n\ttype GrepToolInput,\n\ttype GrepToolOptions,\n\ttype LsOperations,\n\ttype LsToolDetails,\n\ttype LsToolInput,\n\ttype LsToolOptions,\n\ttype ReadOperations,\n\ttype ReadToolDetails,\n\ttype ReadToolInput,\n\ttype ReadToolOptions,\n\ttype ToolsOptions,\n\ttype TruncationOptions,\n\ttype TruncationResult,\n\ttruncateHead,\n\ttruncateLine,\n\ttruncateTail,\n\ttype WriteOperations,\n\ttype WriteToolInput,\n\ttype WriteToolOptions,\n\twithFileMutationQueue,\n} from \"./core/tools/index.ts\";\nexport {\n\texecuteVerifiedBash,\n\texecuteVerifiedLocalBash,\n\tVERIFIED_BASH_REDACTION_POLICY_ID,\n\tVerifiedBashAdapterError,\n\ttype VerifiedBashExecutionRequest,\n\ttype VerifiedLocalBashExecutionRequest,\n} from \"./core/verified-bash-adapter.ts\";\n// Execution-bound evidence\nexport {\n\ttype CommandHmacBinder,\n\tCommandRedactionError,\n\tcreateCommandHmacBinder,\n\tEVIDENCE_COMMAND_REDACTION_POLICY_ID,\n\tMAX_COMMAND_REDACTION_PLACEHOLDERS,\n\tparseCommandHmacBinding,\n\tparseCommandRedactionSummary,\n\ttype RedactedCommandDescriptor,\n\tredactCommandDescriptor,\n} from \"./guardrails/command-redaction.ts\";\nexport {\n\tcomputeEvidenceCommandSha256,\n\tcomputeEvidenceReceiptCoreSha256,\n\tconstantTimeSha256Equal,\n\tcreateEvidenceReceipt,\n\tevidenceReceiptReplayPayload,\n\tisSafeEvidenceReceiptId,\n\tisSha256Hex,\n\tparseEvidenceReceipt,\n\tparseSha256Hex,\n\tvalidateEvidenceReceipt,\n\twithEvidenceReceiptEnvelope,\n} from \"./guardrails/evidence-receipt.ts\";\nexport {\n\tEvidenceReceiptStore,\n\ttype EvidenceReceiptStoreFaultStage,\n\ttype EvidenceReceiptStoreOptions,\n} from \"./guardrails/evidence-receipt-store.ts\";\nexport {\n\tEvidenceGate,\n\ttype EvidenceGateOptions,\n\tFailClosedMergeGate,\n\tlatestRelevantWorkspaceMutationSeq,\n\tReplayLedgerManager,\n\tTaskContractBuilder,\n} from \"./guardrails/evidence-system.ts\";\nexport {\n\ttype VerifiedEvidenceExecutionOutcome,\n\ttype VerifiedEvidenceExecutionRequest,\n\ttype VerifiedEvidenceExecutionResult,\n\tVerifiedEvidenceExecutor,\n\tVerifiedEvidenceExecutorError,\n\ttype VerifiedEvidenceExecutorOptions,\n\ttype VerifiedEvidenceMetadata,\n} from \"./guardrails/verified-executor.ts\";\nexport {\n\tcaptureWorkspaceFingerprint,\n\tcomputeGitWorkspaceDirtySha256,\n\tcomputeGitWorkspaceManifestSha256,\n\tcomputeWorkspaceManifestSha256,\n\tparseWorkspaceFingerprint,\n} from \"./guardrails/workspace-fingerprint.ts\";\n// Main entry point\nexport { type MainOptions, main } from \"./main.ts\";\n// Run modes for programmatic SDK usage\nexport {\n\tInteractiveMode,\n\ttype InteractiveModeOptions,\n\ttype ModelInfo,\n\ttype PrintModeOptions,\n\tRpcClient,\n\ttype RpcClientOptions,\n\ttype RpcCommand,\n\ttype RpcEventListener,\n\ttype RpcResponse,\n\ttype RpcSessionState,\n\trunPrintMode,\n\trunRpcMode,\n} from \"./modes/index.ts\";\n// UI components for extensions\nexport {\n\tArminComponent,\n\tAssistantMessageComponent,\n\tBashExecutionComponent,\n\tBorderedLoader,\n\tBranchSummaryMessageComponent,\n\tCompactionSummaryMessageComponent,\n\tCustomEditor,\n\tCustomMessageComponent,\n\tDynamicBorder,\n\tExtensionEditorComponent,\n\tExtensionInputComponent,\n\tExtensionSelectorComponent,\n\tFooterComponent,\n\tkeyHint,\n\tkeyText,\n\tLoginDialogComponent,\n\tModelSelectorComponent,\n\tOAuthSelectorComponent,\n\ttype RenderDiffOptions,\n\trawKeyHint,\n\trenderDiff,\n\tSessionSelectorComponent,\n\ttype SettingsCallbacks,\n\ttype SettingsConfig,\n\tSettingsSelectorComponent,\n\tShowImagesSelectorComponent,\n\tSkillInvocationMessageComponent,\n\tThemeSelectorComponent,\n\tThinkingSelectorComponent,\n\tToolExecutionComponent,\n\ttype ToolExecutionOptions,\n\tTreeSelectorComponent,\n\ttruncateToVisualLines,\n\tUserMessageComponent,\n\tUserMessageSelectorComponent,\n\ttype VisualTruncateResult,\n} from \"./modes/interactive/components/index.ts\";\n// Theme utilities for custom tools and extensions\nexport {\n\tgetLanguageFromPath,\n\tgetMarkdownTheme,\n\tgetSelectListTheme,\n\tgetSettingsListTheme,\n\thighlightCode,\n\tinitTheme,\n\tTheme,\n\ttype ThemeColor,\n} from \"./modes/interactive/theme/theme.ts\";\nexport type {\n\tArtifactSetWorkspaceFingerprint,\n\tArtifactState,\n\tCommandHmacBinding,\n\tCommandRedactionPlaceholder,\n\tCommandRedactionPlaceholderType,\n\tCommandRedactionSummary,\n\tEvidenceCommandDescriptor,\n\tEvidenceExecutor,\n\tEvidenceItem,\n\tEvidenceReceipt,\n\tEvidenceReceiptDisposition,\n\tEvidenceReceiptLedgerBinding,\n\tEvidenceReceiptMode,\n\tFileArtifactState,\n\tGitWorkspaceFingerprint,\n\tGitWorkspaceState,\n\tMissingArtifactState,\n\tReplayEvent,\n\tReplayEventType,\n\tSha256Hex,\n\tTaskContract,\n\tWorkspaceFingerprint,\n\tWorkspaceMutationReplayPayload,\n\tWorkspaceScope,\n} from \"./types/evidence.ts\";\n// Clipboard utilities\nexport { copyToClipboard } from \"./utils/clipboard.ts\";\nexport { parseFrontmatter, stripFrontmatter } from \"./utils/frontmatter.ts\";\nexport { convertToPng } from \"./utils/image-convert.ts\";\nexport { formatDimensionNote, type ResizedImage, resizeImage } from \"./utils/image-resize.ts\";\n// Shell utilities\nexport { getShellConfig } from \"./utils/shell.ts\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAE1B,OAAO,EAAa,SAAS,EAAE,MAAM,eAAe,CAAC;AACrD,eAAe;AACf,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACN,YAAY,EAOZ,eAAe,GAEf,MAAM,yBAAyB,CAAC;AACjC,0BAA0B;AAC1B,OAAO,EAIN,WAAW,EAEX,sBAAsB,EACtB,0BAA0B,GAE1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAEN,SAAS,EAGT,aAAa,EAEb,uBAAuB,EAWvB,aAAa,EACb,cAAc,EACd,6BAA6B,EAC7B,SAAS,EAST,cAAc,EAKd,qBAAqB,EAErB,cAAc,EAEd,eAAe,EACf,mBAAmB,GAMnB,MAAM,4BAA4B,CAAC;AACpC,aAAa;AACb,OAAO,EAYN,sBAAsB,EACtB,8BAA8B,EAC9B,OAAO,EACP,wBAAwB,EACxB,gCAAgC,EAChC,+BAA+B,EAC/B,8BAA8B,EAC9B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,sBAAsB,EACtB,cAAc,EACd,yBAAyB,EAEzB,YAAY,EACZ,kBAAkB,EAElB,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,EACb,wBAAwB,EACxB,0BAA0B,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACN,6BAA6B,EAC7B,sDAAsD,EACtD,gCAAgC,EAChC,gCAAgC,EAIhC,iCAAiC,EACjC,sCAAsC,EACtC,wCAAwC,EACxC,yBAAyB,EACzB,6BAA6B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACN,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,GAIxB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,cAAc,EAA0C,MAAM,qBAAqB,CAAC;AAkF7F,OAAO,EACN,sBAAsB,EACtB,UAAU,EACV,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,GACnB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AASzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,EACN,oCAAoC,EACpC,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,oBAAoB,EAUpB,iBAAiB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,6BAA6B,EAG7B,eAAe,EACf,8BAA8B,EAC9B,2BAA2B,GAC3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEN,4BAA4B,EAC5B,sBAAsB,GACtB,MAAM,kCAAkC,CAAC;AAC1C,6BAA6B;AAC7B,OAAO,EACN,mBAAmB;AASnB,UAAU;AACV,kBAAkB,EAClB,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC1B,cAAc;AACd,kCAAkC;AAClC,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,eAAe,GAEf,MAAM,eAAe,CAAC;AACvB,OAAO,EAEN,mBAAmB,EAGnB,uBAAuB,EAIvB,wBAAwB,EAExB,qBAAqB,EAErB,mBAAmB,EAOnB,cAAc,GAId,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACN,0BAA0B,EAC1B,wBAAwB,EAGxB,uBAAuB,GAEvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAMN,eAAe,GAEf,MAAM,4BAA4B,CAAC;AACpC,SAAS;AACT,OAAO,EACN,qBAAqB,EAGrB,UAAU,EACV,iBAAiB,GAGjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,QAAQ;AACR,OAAO,EAON,wBAAwB,EACxB,qBAAqB,EACrB,+BAA+B,EAC/B,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EAYjB,UAAU,EAgBV,YAAY,EACZ,YAAY,EACZ,YAAY,EAIZ,qBAAqB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACN,4BAA4B,EAC5B,mBAAmB,EACnB,wBAAwB,EACxB,iCAAiC,EACjC,wBAAwB,GAIxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AACtG,2BAA2B;AAC3B,OAAO,EAEN,qBAAqB,EACrB,uBAAuB,EACvB,oCAAoC,EACpC,kCAAkC,EAClC,uBAAuB,EACvB,4BAA4B,EAE5B,uBAAuB,GACvB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,4BAA4B,EAC5B,gCAAgC,EAChC,uBAAuB,EACvB,qBAAqB,EACrB,4BAA4B,EAC5B,uBAAuB,EACvB,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,uBAAuB,EACvB,2BAA2B,GAC3B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACN,oBAAoB,GAGpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACN,YAAY,EAEZ,mBAAmB,EACnB,kCAAkC,EAClC,mBAAmB,EACnB,mBAAmB,GACnB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAIN,wBAAwB,EACxB,6BAA6B,GAG7B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,2BAA2B,EAC3B,8BAA8B,EAC9B,iCAAiC,EACjC,8BAA8B,EAC9B,yBAAyB,GACzB,MAAM,uCAAuC,CAAC;AAC/C,mBAAmB;AACnB,OAAO,EAAoB,IAAI,EAAE,MAAM,WAAW,CAAC;AACnD,uCAAuC;AACvC,OAAO,EACN,eAAe,EAIf,SAAS,EAMT,YAAY,EACZ,UAAU,GACV,MAAM,kBAAkB,CAAC;AAC1B,+BAA+B;AAC/B,OAAO,EACN,cAAc,EACd,yBAAyB,EACzB,sBAAsB,EACtB,cAAc,EACd,6BAA6B,EAC7B,iCAAiC,EACjC,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,0BAA0B,EAC1B,eAAe,EACf,OAAO,EACP,OAAO,EACP,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EAEtB,UAAU,EACV,UAAU,EACV,wBAAwB,EAGxB,yBAAyB,EACzB,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EAEtB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,4BAA4B,GAE5B,MAAM,yCAAyC,CAAC;AACjD,kDAAkD;AAClD,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,SAAS,EACT,KAAK,GAEL,MAAM,oCAAoC,CAAC;AA2B5C,sBAAsB;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAqB,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9F,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC","sourcesContent":["// Core session management\n\nexport { type Args, parseArgs } from \"./cli/args.ts\";\n// Config paths\nexport { getAgentDir, VERSION } from \"./config.ts\";\nexport {\n\tAgentSession,\n\ttype AgentSessionConfig,\n\ttype AgentSessionEvent,\n\ttype AgentSessionEventListener,\n\ttype ModelCycleResult,\n\ttype ParsedSkillBlock,\n\ttype PromptOptions,\n\tparseSkillBlock,\n\ttype SessionStats,\n} from \"./core/agent-session.ts\";\n// Auth and model registry\nexport {\n\ttype ApiKeyCredential,\n\ttype AuthCredential,\n\ttype AuthStatus,\n\tAuthStorage,\n\ttype AuthStorageBackend,\n\tFileAuthStorageBackend,\n\tInMemoryAuthStorageBackend,\n\ttype OAuthCredential,\n} from \"./core/auth-storage.ts\";\nexport {\n\ttype ApiAction,\n\tApiBroker,\n\ttype ApiMethod,\n\ttype ApiOutcome,\n\tAUTOPILOT_MAX,\n\ttype AutomationHarnessScoreInput,\n\tAutomationHarnessScorer,\n\ttype AutomationScoreBreakdown,\n\ttype AutomationTrace,\n\ttype AutomationTraceAction,\n\ttype AutomationTraceContextPlan,\n\ttype AutomationTraceEnvApiUse,\n\ttype AutonomyProfile,\n\ttype BrokerFetcher,\n\ttype BrokerFetchRequest,\n\ttype BrokerFetchResponse,\n\ttype Capability,\n\tcanonicalHash,\n\tclassifyEnvKey,\n\tDynamicToolPortfolioOptimizer,\n\tEnvBroker,\n\ttype EnvBrokerLedger,\n\ttype EnvMode,\n\ttype EnvRecord,\n\ttype EnvResolutionRequest,\n\ttype EnvUseEvent,\n\ttype EvidenceActor,\n\ttype EvidenceEvent,\n\ttype EvidenceEventInput,\n\tEvidenceLedger,\n\ttype EvidenceOutcome,\n\ttype EvidencePointer,\n\ttype ExecutionStrategy,\n\ttype Postcondition,\n\tPostconditionVerifier,\n\ttype RiskLevel,\n\tredactForModel,\n\ttype Sensitivity,\n\tstrategyForRisk,\n\tToolExecutionBroker,\n\ttype ToolExecutionCandidate,\n\ttype ToolExecutionChoice,\n\ttype ToolExecutionNeed,\n\ttype VerificationContext,\n\ttype VerificationResult,\n} from \"./core/automation/index.ts\";\n// Compaction\nexport {\n\ttype BranchPreparation,\n\ttype BranchSummaryResult,\n\ttype CollectEntriesResult,\n\ttype CompactionBarrierResult,\n\ttype CompactionCommitDecision,\n\ttype CompactionEnvelope,\n\ttype CompactionHysteresisConfig,\n\ttype CompactionHysteresisState,\n\ttype CompactionResult,\n\ttype CompactionTransaction,\n\ttype CutPointResult,\n\tcalculateContextTokens,\n\tcollectEntriesForBranchSummary,\n\tcompact,\n\tcreateCompactionEnvelope,\n\tcreateCompactionHysteresisConfig,\n\tcreateCompactionHysteresisState,\n\tcreateCompactionSourceIdentity,\n\tcreateCompactionTransaction,\n\tcreateSessionRevisionToken,\n\tDEFAULT_COMPACTION_SETTINGS,\n\tdecideCompactionCommit,\n\testimateTokens,\n\tevaluateCompactionBarrier,\n\ttype FileOperations,\n\tfindCutPoint,\n\tfindTurnStartIndex,\n\ttype GenerateBranchSummaryOptions,\n\tgenerateBranchSummary,\n\tgenerateSummary,\n\tgetLastAssistantUsage,\n\tprepareBranchEntries,\n\tserializeConversation,\n\tshouldCompact,\n\tstepCompactionHysteresis,\n\tvalidateCompactionEnvelope,\n} from \"./core/compaction/index.ts\";\nexport {\n\tapplyContextCacheInvalidation,\n\tbuildContextBudgetMaterializedRepresentationCacheKeyV2,\n\tbuildContextBudgetPlanCacheKeyV2,\n\tCONTEXT_BUDGET_POLICY_VERSION_V2,\n\ttype ContextBudgetCacheProviderV2,\n\ttype ContextCacheInvalidationEvent,\n\ttype ContextCacheInvalidationSnapshot,\n\tcreateContextBudgetCacheKeyBaseV2,\n\tcreateContextCacheInvalidationSnapshot,\n\tcreateMemoryContextBudgetCacheProviderV2,\n\tplanPromptContextBudgetV2,\n\tserializeContextCacheSnapshot,\n} from \"./core/context-budget-governor-v2.ts\";\nexport {\n\tcomputeReservedTokenBudget,\n\testimateToolResultReserve,\n\tReservedTokenBudgetError,\n\ttype ReservedTokenBudgetInput,\n\ttype ReservedTokenBudgetResult,\n\ttype ToolResultReserveRequest,\n} from \"./core/context-budget-reserved-tokens.ts\";\nexport { createEventBus, type EventBus, type EventBusController } from \"./core/event-bus.ts\";\n// Extension system\nexport type {\n\tAgentEndEvent,\n\tAgentStartEvent,\n\tAgentToolResult,\n\tAgentToolUpdateCallback,\n\tAppKeybinding,\n\tAutocompleteProviderFactory,\n\tBashToolCallEvent,\n\tBeforeAgentStartEvent,\n\tBeforeAgentStartEventResult,\n\tBeforeProviderRequestEvent,\n\tBeforeProviderRequestEventResult,\n\tBuildSystemPromptOptions,\n\tCompactOptions,\n\tContextEvent,\n\tContextUsage,\n\tCustomToolCallEvent,\n\tEditToolCallEvent,\n\tExecOptions,\n\tExecResult,\n\tExtension,\n\tExtensionActions,\n\tExtensionAPI,\n\tExtensionCommandContext,\n\tExtensionCommandContextActions,\n\tExtensionContext,\n\tExtensionContextActions,\n\tExtensionError,\n\tExtensionEvent,\n\tExtensionFactory,\n\tExtensionFlag,\n\tExtensionHandler,\n\tExtensionRuntime,\n\tExtensionShortcut,\n\tExtensionUIContext,\n\tExtensionUIDialogOptions,\n\tExtensionWidgetOptions,\n\tFindToolCallEvent,\n\tGrepToolCallEvent,\n\tInputEvent,\n\tInputEventResult,\n\tInputSource,\n\tKeybindingsManager,\n\tLoadExtensionsResult,\n\tLsToolCallEvent,\n\tMessageRenderer,\n\tMessageRenderOptions,\n\tProviderConfig,\n\tProviderModelConfig,\n\tReadToolCallEvent,\n\tRegisteredCommand,\n\tRegisteredTool,\n\tResolvedCommand,\n\tSessionBeforeCompactEvent,\n\tSessionBeforeForkEvent,\n\tSessionBeforeSwitchEvent,\n\tSessionBeforeTreeEvent,\n\tSessionCompactEvent,\n\tSessionShutdownEvent,\n\tSessionStartEvent,\n\tSessionTreeEvent,\n\tSlashCommandInfo,\n\tSlashCommandSource,\n\tSourceInfo,\n\tTerminalInputHandler,\n\tToolCallEvent,\n\tToolCallEventResult,\n\tToolDefinition,\n\tToolExecutionMode,\n\tToolInfo,\n\tToolRenderResultOptions,\n\tToolResultEvent,\n\tTurnEndEvent,\n\tTurnStartEvent,\n\tUserBashEvent,\n\tUserBashEventResult,\n\tWidgetPlacement,\n\tWorkingIndicatorOptions,\n\tWriteToolCallEvent,\n} from \"./core/extensions/index.ts\";\nexport {\n\tcreateExtensionRuntime,\n\tdefineTool,\n\tdiscoverAndLoadExtensions,\n\tExtensionRunner,\n\tisBashToolResult,\n\tisEditToolResult,\n\tisFindToolResult,\n\tisGrepToolResult,\n\tisLsToolResult,\n\tisReadToolResult,\n\tisToolCallEventType,\n\tisWriteToolResult,\n\twrapRegisteredTool,\n\twrapRegisteredTools,\n} from \"./core/extensions/index.ts\";\n// Footer data provider (git branch + extension statuses - data not otherwise available to extensions)\nexport type { ReadonlyFooterDataProvider } from \"./core/footer-data-provider.ts\";\nexport { convertToLlm } from \"./core/messages.ts\";\nexport { ModelRegistry } from \"./core/model-registry.ts\";\nexport type {\n\tPackageManager,\n\tPathMetadata,\n\tProgressCallback,\n\tProgressEvent,\n\tResolvedPaths,\n\tResolvedResource,\n} from \"./core/package-manager.ts\";\nexport { DefaultPackageManager } from \"./core/package-manager.ts\";\nexport type { ResourceCollision, ResourceDiagnostic, ResourceLoader } from \"./core/resource-loader.ts\";\nexport { DefaultResourceLoader, loadProjectContextFiles } from \"./core/resource-loader.ts\";\nexport {\n\textractReverseSkillFactsFromMarkdown,\n\tformatReverseSkillFromSource,\n\tformatReverseSkillMarkdown,\n\tformatReverseSkillRouteDecision,\n\tgetReverseSkillToolAliases,\n\tnormalizeReverseSkillName,\n\tnormalizeReverseSkillText,\n\tplanReverseSkillToolChecks,\n\tREVERSE_SKILL_ROUTES,\n\ttype ReverseSkillPlatform,\n\ttype ReverseSkillRisk,\n\ttype ReverseSkillRoute,\n\ttype ReverseSkillRouteDecision,\n\ttype ReverseSkillRouteInput,\n\ttype ReverseSkillRouteScore,\n\ttype ReverseSkillSourceFacts,\n\ttype ReverseSkillSourceInput,\n\ttype ReverseSkillSpecInput,\n\trouteReverseSkill,\n} from \"./core/reverse-skill.ts\";\nexport {\n\tappendRunJournalRecordDurably,\n\ttype OpenRunJournalStoreOptions,\n\ttype RunJournalQuarantineReport,\n\tRunJournalStore,\n\tRunJournalStoreCorruptionError,\n\twriteQuarantineBytesDurably,\n} from \"./core/run-journal-store.ts\";\nexport {\n\ttype BashSandboxMode,\n\tcreateWorkspaceSandboxPolicy,\n\tresolveBashSandboxMode,\n} from \"./core/sandbox/default-policy.ts\";\n// SDK for programmatic usage\nexport {\n\tAgentSessionRuntime,\n\ttype AgentSessionRuntimeDiagnostic,\n\ttype AgentSessionServices,\n\ttype CreateAgentSessionFromServicesOptions,\n\ttype CreateAgentSessionOptions,\n\ttype CreateAgentSessionResult,\n\ttype CreateAgentSessionRuntimeFactory,\n\ttype CreateAgentSessionRuntimeResult,\n\ttype CreateAgentSessionServicesOptions,\n\t// Factory\n\tcreateAgentSession,\n\tcreateAgentSessionFromServices,\n\tcreateAgentSessionRuntime,\n\tcreateAgentSessionServices,\n\tcreateBashTool,\n\t// Tool factories (for custom cwd)\n\tcreateCodingTools,\n\tcreateEditTool,\n\tcreateFindTool,\n\tcreateGrepTool,\n\tcreateLsTool,\n\tcreateReadOnlyTools,\n\tcreateReadTool,\n\tcreateWriteTool,\n\ttype PromptTemplate,\n} from \"./core/sdk.ts\";\nexport {\n\ttype BranchSummaryEntry,\n\tbuildSessionContext,\n\ttype CompactionEntry,\n\ttype CompactionProvenanceDetails,\n\tCURRENT_SESSION_VERSION,\n\ttype CustomEntry,\n\ttype CustomMessageEntry,\n\ttype FileEntry,\n\tgetLatestCompactionEntry,\n\ttype ModelChangeEntry,\n\tmigrateSessionEntries,\n\ttype NewSessionOptions,\n\tparseSessionEntries,\n\ttype SessionContext,\n\ttype SessionEntry,\n\ttype SessionEntryBase,\n\ttype SessionHeader,\n\ttype SessionInfo,\n\ttype SessionInfoEntry,\n\tSessionManager,\n\ttype SessionMessageEntry,\n\ttype SessionQuarantineReport,\n\ttype ThinkingLevelChangeEntry,\n} from \"./core/session-manager.ts\";\nexport {\n\tclassifySessionTermination,\n\tformatSessionTermination,\n\ttype SessionTermination,\n\ttype SessionTerminationCause,\n\tSessionTerminationError,\n\ttype SessionTerminationKind,\n} from \"./core/session-termination.ts\";\nexport {\n\ttype AgentRuntimeSettings,\n\ttype CompactionSettings,\n\ttype ImageSettings,\n\ttype PackageSource,\n\ttype RetrySettings,\n\tSettingsManager,\n\ttype ToolSchedulerSetting,\n} from \"./core/settings-manager.ts\";\n// Skills\nexport {\n\tformatSkillsForPrompt,\n\ttype LoadSkillsFromDirOptions,\n\ttype LoadSkillsResult,\n\tloadSkills,\n\tloadSkillsFromDir,\n\ttype Skill,\n\ttype SkillFrontmatter,\n} from \"./core/skills.ts\";\nexport { createSyntheticSourceInfo } from \"./core/source-info.ts\";\n// Tools\nexport {\n\ttype BashOperations,\n\ttype BashSpawnContext,\n\ttype BashSpawnHook,\n\ttype BashToolDetails,\n\ttype BashToolInput,\n\ttype BashToolOptions,\n\tcreateBashToolDefinition,\n\tcreateDiagnosticsTool,\n\tcreateDiagnosticsToolDefinition,\n\tcreateEditToolDefinition,\n\tcreateFindToolDefinition,\n\tcreateGrepToolDefinition,\n\tcreateLocalBashOperations,\n\tcreateLsToolDefinition,\n\tcreateReadToolDefinition,\n\tcreateWriteToolDefinition,\n\tDEFAULT_MAX_BYTES,\n\tDEFAULT_MAX_LINES,\n\ttype DiagnosticLine,\n\ttype DiagnosticsToolDetails,\n\ttype DiagnosticsToolInput,\n\ttype EditOperations,\n\ttype EditToolDetails,\n\ttype EditToolInput,\n\ttype EditToolOptions,\n\ttype FindOperations,\n\ttype FindToolDetails,\n\ttype FindToolInput,\n\ttype FindToolOptions,\n\tformatSize,\n\ttype GrepOperations,\n\ttype GrepToolDetails,\n\ttype GrepToolInput,\n\ttype GrepToolOptions,\n\ttype LsOperations,\n\ttype LsToolDetails,\n\ttype LsToolInput,\n\ttype LsToolOptions,\n\ttype ReadOperations,\n\ttype ReadToolDetails,\n\ttype ReadToolInput,\n\ttype ReadToolOptions,\n\ttype ToolsOptions,\n\ttype TruncationOptions,\n\ttype TruncationResult,\n\ttruncateHead,\n\ttruncateLine,\n\ttruncateTail,\n\ttype WriteOperations,\n\ttype WriteToolInput,\n\ttype WriteToolOptions,\n\twithFileMutationQueue,\n} from \"./core/tools/index.ts\";\nexport {\n\tcreateVerifiedBashOperations,\n\texecuteVerifiedBash,\n\texecuteVerifiedLocalBash,\n\tVERIFIED_BASH_REDACTION_POLICY_ID,\n\tVerifiedBashAdapterError,\n\ttype VerifiedBashExecutionRequest,\n\ttype VerifiedBashOperationsBinding,\n\ttype VerifiedLocalBashExecutionRequest,\n} from \"./core/verified-bash-adapter.ts\";\nexport { isVerifiedBashEnabled, resolveSessionWorkspaceScope } from \"./core/verified-bash-runtime.ts\";\n// Execution-bound evidence\nexport {\n\ttype CommandHmacBinder,\n\tCommandRedactionError,\n\tcreateCommandHmacBinder,\n\tEVIDENCE_COMMAND_REDACTION_POLICY_ID,\n\tMAX_COMMAND_REDACTION_PLACEHOLDERS,\n\tparseCommandHmacBinding,\n\tparseCommandRedactionSummary,\n\ttype RedactedCommandDescriptor,\n\tredactCommandDescriptor,\n} from \"./guardrails/command-redaction.ts\";\nexport {\n\tcomputeEvidenceCommandSha256,\n\tcomputeEvidenceReceiptCoreSha256,\n\tconstantTimeSha256Equal,\n\tcreateEvidenceReceipt,\n\tevidenceReceiptReplayPayload,\n\tisSafeEvidenceReceiptId,\n\tisSha256Hex,\n\tparseEvidenceReceipt,\n\tparseSha256Hex,\n\tvalidateEvidenceReceipt,\n\twithEvidenceReceiptEnvelope,\n} from \"./guardrails/evidence-receipt.ts\";\nexport {\n\tEvidenceReceiptStore,\n\ttype EvidenceReceiptStoreFaultStage,\n\ttype EvidenceReceiptStoreOptions,\n} from \"./guardrails/evidence-receipt-store.ts\";\nexport {\n\tEvidenceGate,\n\ttype EvidenceGateOptions,\n\tFailClosedMergeGate,\n\tlatestRelevantWorkspaceMutationSeq,\n\tReplayLedgerManager,\n\tTaskContractBuilder,\n} from \"./guardrails/evidence-system.ts\";\nexport {\n\ttype VerifiedEvidenceExecutionOutcome,\n\ttype VerifiedEvidenceExecutionRequest,\n\ttype VerifiedEvidenceExecutionResult,\n\tVerifiedEvidenceExecutor,\n\tVerifiedEvidenceExecutorError,\n\ttype VerifiedEvidenceExecutorOptions,\n\ttype VerifiedEvidenceMetadata,\n} from \"./guardrails/verified-executor.ts\";\nexport {\n\tcaptureWorkspaceFingerprint,\n\tcomputeGitWorkspaceDirtySha256,\n\tcomputeGitWorkspaceManifestSha256,\n\tcomputeWorkspaceManifestSha256,\n\tparseWorkspaceFingerprint,\n} from \"./guardrails/workspace-fingerprint.ts\";\n// Main entry point\nexport { type MainOptions, main } from \"./main.ts\";\n// Run modes for programmatic SDK usage\nexport {\n\tInteractiveMode,\n\ttype InteractiveModeOptions,\n\ttype ModelInfo,\n\ttype PrintModeOptions,\n\tRpcClient,\n\ttype RpcClientOptions,\n\ttype RpcCommand,\n\ttype RpcEventListener,\n\ttype RpcResponse,\n\ttype RpcSessionState,\n\trunPrintMode,\n\trunRpcMode,\n} from \"./modes/index.ts\";\n// UI components for extensions\nexport {\n\tArminComponent,\n\tAssistantMessageComponent,\n\tBashExecutionComponent,\n\tBorderedLoader,\n\tBranchSummaryMessageComponent,\n\tCompactionSummaryMessageComponent,\n\tCustomEditor,\n\tCustomMessageComponent,\n\tDynamicBorder,\n\tExtensionEditorComponent,\n\tExtensionInputComponent,\n\tExtensionSelectorComponent,\n\tFooterComponent,\n\tkeyHint,\n\tkeyText,\n\tLoginDialogComponent,\n\tModelSelectorComponent,\n\tOAuthSelectorComponent,\n\ttype RenderDiffOptions,\n\trawKeyHint,\n\trenderDiff,\n\tSessionSelectorComponent,\n\ttype SettingsCallbacks,\n\ttype SettingsConfig,\n\tSettingsSelectorComponent,\n\tShowImagesSelectorComponent,\n\tSkillInvocationMessageComponent,\n\tThemeSelectorComponent,\n\tThinkingSelectorComponent,\n\tToolExecutionComponent,\n\ttype ToolExecutionOptions,\n\tTreeSelectorComponent,\n\ttruncateToVisualLines,\n\tUserMessageComponent,\n\tUserMessageSelectorComponent,\n\ttype VisualTruncateResult,\n} from \"./modes/interactive/components/index.ts\";\n// Theme utilities for custom tools and extensions\nexport {\n\tgetLanguageFromPath,\n\tgetMarkdownTheme,\n\tgetSelectListTheme,\n\tgetSettingsListTheme,\n\thighlightCode,\n\tinitTheme,\n\tTheme,\n\ttype ThemeColor,\n} from \"./modes/interactive/theme/theme.ts\";\nexport type {\n\tArtifactSetWorkspaceFingerprint,\n\tArtifactState,\n\tCommandHmacBinding,\n\tCommandRedactionPlaceholder,\n\tCommandRedactionPlaceholderType,\n\tCommandRedactionSummary,\n\tEvidenceCommandDescriptor,\n\tEvidenceExecutor,\n\tEvidenceItem,\n\tEvidenceReceipt,\n\tEvidenceReceiptDisposition,\n\tEvidenceReceiptLedgerBinding,\n\tEvidenceReceiptMode,\n\tFileArtifactState,\n\tGitWorkspaceFingerprint,\n\tGitWorkspaceState,\n\tMissingArtifactState,\n\tReplayEvent,\n\tReplayEventType,\n\tSha256Hex,\n\tTaskContract,\n\tWorkspaceFingerprint,\n\tWorkspaceMutationReplayPayload,\n\tWorkspaceScope,\n} from \"./types/evidence.ts\";\n// Clipboard utilities\nexport { copyToClipboard } from \"./utils/clipboard.ts\";\nexport { parseFrontmatter, stripFrontmatter } from \"./utils/frontmatter.ts\";\nexport { convertToPng } from \"./utils/image-convert.ts\";\nexport { formatDimensionNote, type ResizedImage, resizeImage } from \"./utils/image-resize.ts\";\n// Shell utilities\nexport { getShellConfig } from \"./utils/shell.ts\";\n"]}