poe-code 10.0.3 → 11.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "poe-code",
-  "version": "10.0.3",
+  "version": "11.0.0",
   "description": "CLI tool to configure Poe API for developer workflows.",
   "license": "MIT",
   "type": "module",

package/packages/agent-harness/dist/loader/run.js

@@ -138,7 +138,10 @@ export async function runHarnessPair(mdPath, options) {
             throw error;
         }
         await hostCallReplay.flush();
-        if (result.ok && options.preserveSnapshotOnSuccess !== true) {
+        if (result.ok && result.snapshot.migration !== undefined) {
+            await snapshotBackend.write(result.snapshot);
+        }
+        else if (result.ok && options.preserveSnapshotOnSuccess !== true) {
             await cleanupCompletedSnapshot(snapshotBackend, snapshotPath);
         }
         const usage = usageAccumulator.snapshot();

package/packages/safejs/dist/chunks/{chunk-MRH5YDMR.js → chunk-ARFGEQTM.js}

@@ -1,20 +1,179 @@
 import {
+  DUMP_FORMAT_VERSION,
+  EXECUTION_SEMANTICS,
   SandboxError,
   activateOtelSpan,
+  assertSnapshotInactive,
   bindOtelSpan,
   declareHostOperation,
   deepCopyToSandbox,
+  encodeReplayData,
   getActiveOtelSink,
   getOwnErrorCode,
   hasOwnErrorCode,
+  hashSource,
   hostErrorData,
   isSandboxClosure,
+  parseModule,
   runResources,
   safeAddEvent,
   safeEndSpan,
   safeRecordException,
-  safeStartSpan
-} from "./chunk-A2XBEN3H.js";
+  safeStartSpan,
+  serializeSafeJSSnapshot,
+  validateDumpEnvelope,
+  validateMigrationJournal,
+  validateMigrationReconciliation,
+  validateMigrationSemantics,
+  validateSnapshotData,
+  validateSnapshotMigration
+} from "./chunk-DKXGPEOM.js";
+
+// packages/safejs/src/migrate.ts
+import { createHash } from "node:crypto";
+function inspectSnapshotMigration(snapshot, options) {
+  assertSnapshotInactive(snapshot);
+  validateSnapshotData(snapshot);
+  validateDumpEnvelope(snapshot);
+  validateMigrationSemantics(snapshot.executionSemantics);
+  const sourceHash = hashSource(options.source);
+  if (snapshot.sourceHash !== sourceHash)
+    throw new TypeError(
+      `Migration requires the original executable source (checkpoint hash ${snapshot.sourceHash}, supplied ${sourceHash}). Preserve the checkpoint; do not replace its hash.`
+    );
+  validateSnapshotMigration(snapshot.migration, sourceHash);
+  const replay = validateMigrationJournal(sourceHash, snapshot.replay, snapshot.hostCalls);
+  return {
+    checkpointDigest: createHash("sha256").update(canonicalData(snapshot)).digest("hex"),
+    sourceHash,
+    executionSemantics: snapshot.executionSemantics,
+    calls: replay.calls,
+    unresolvedCalls: replay.calls.filter(
+      (call) => !["settled", "consumed"].includes(call.lifecycle)
+    )
+  };
+}
+function migrateSnapshot(snapshot, options) {
+  if (!Object.hasOwn(options, "state"))
+    throw new TypeError("Migration requires explicit application state.");
+  const inspection = inspectSnapshotMigration(snapshot, { source: options.source });
+  parseModule(options.targetSource);
+  const targetSourceHash = hashSource(options.targetSource);
+  validateMigrationReconciliation(
+    options.reconciliation,
+    inspection.checkpointDigest,
+    inspection.calls
+  );
+  const state = encodeReplayData(deepCopyToSandbox(options.state));
+  const previous = snapshot.migration;
+  const migration = {
+    version: 1,
+    state,
+    history: [
+      ...structuredClone(previous?.history ?? []),
+      {
+        sourceHash: inspection.sourceHash,
+        targetSourceHash,
+        executionSemantics: inspection.executionSemantics,
+        replay: { version: 1, calls: inspection.calls },
+        reconciliation: structuredClone(options.reconciliation)
+      }
+    ]
+  };
+  validateSnapshotMigration(migration, targetSourceHash);
+  return {
+    version: DUMP_FORMAT_VERSION,
+    executionSemantics: EXECUTION_SEMANTICS,
+    sourceHash: targetSourceHash,
+    bindings: {},
+    replay: { version: 1, calls: [] },
+    migration
+  };
+}
+function canonicalData(value) {
+  if (Array.isArray(value)) return `[${value.map(canonicalData).join(",")}]`;
+  if (value !== null && typeof value === "object")
+    return `{${Object.keys(value).sort().map(
+      (key2) => `${JSON.stringify(key2)}:${canonicalData(value[key2])}`
+    ).join(",")}}`;
+  return JSON.stringify(value);
+}
+
+// packages/safejs/src/migration-file.ts
+import { randomUUID } from "node:crypto";
+import { link, open, readFile, unlink } from "node:fs/promises";
+import path from "node:path";
+async function migrateSnapshotFile(options) {
+  const cwd = options.cwd ?? process.cwd();
+  const resolvePath = (value, label) => {
+    if (typeof value !== "string" || value.trim().length === 0)
+      throw new TypeError(`Migration requires ${label}.`);
+    return path.resolve(cwd, value);
+  };
+  const snapshotPath = resolvePath(options.snapshotPath, "a snapshot path");
+  const sourcePath = resolvePath(options.sourcePath, "--from <original.ajs>");
+  if (options.inspect && [options.targetSourcePath, options.planPath, options.outputPath].some(
+    (value) => value !== void 0
+  ))
+    throw new TypeError("Migration --inspect cannot be combined with --to, --plan, or --output.");
+  const outputPath = options.inspect ? void 0 : resolvePath(options.outputPath, "--output <new-checkpoint.json>");
+  const targetSourcePath = options.inspect ? void 0 : resolvePath(options.targetSourcePath, "--to <continuation.ajs>");
+  const planPath = options.inspect ? void 0 : resolvePath(options.planPath, "--plan <migration.json>");
+  for (const filepath of [sourcePath, targetSourcePath]) {
+    if (filepath !== void 0 && ![".ajs", ".safejs"].includes(path.extname(filepath)))
+      throw new TypeError(
+        "Migration source paths must name executable .ajs or .safejs files, not harness Markdown."
+      );
+  }
+  const snapshot = JSON.parse(await readFile(snapshotPath, "utf8"));
+  const source = await readFile(sourcePath, "utf8");
+  const inspection = inspectSnapshotMigration(snapshot, { source });
+  if (options.inspect) return { inspection };
+  const plan = JSON.parse(await readFile(planPath, "utf8"));
+  if (plan === null || typeof plan !== "object" || !Object.hasOwn(plan, "state") || !Object.hasOwn(plan, "reconciliation"))
+    throw new TypeError("Migration plan requires explicit state and reconciliation fields.");
+  const targetSource = await readFile(targetSourcePath, "utf8");
+  const migrated = migrateSnapshot(snapshot, {
+    source,
+    targetSource,
+    state: plan.state,
+    reconciliation: plan.reconciliation
+  });
+  const contents = serializeSafeJSSnapshot(migrated);
+  if (!options.dryRun) {
+    const temporaryPath = path.join(
+      path.dirname(outputPath),
+      `.safejs-migration-${randomUUID()}.tmp`
+    );
+    let created = false;
+    try {
+      const handle = await open(temporaryPath, "wx", 384);
+      created = true;
+      try {
+        await handle.writeFile(contents, "utf8");
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      try {
+        await link(temporaryPath, outputPath);
+      } catch (error) {
+        if (hasOwnErrorCode(error, "EEXIST"))
+          throw Object.assign(
+            new Error(
+              `Migration output already exists: ${JSON.stringify(outputPath)}. Choose a new output path; existing files are never overwritten.`,
+              { cause: error }
+            ),
+            { code: "EEXIST" }
+          );
+        throw error;
+      }
+    } finally {
+      if (created) await unlink(temporaryPath);
+    }
+  }
+  return { inspection, outputPath, dryRun: options.dryRun === true };
+}
 
 // packages/safejs/src/error/format.ts
 var DEFAULT_MAX_MESSAGE_LENGTH = 1e4;
@@ -2729,9 +2888,9 @@ import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path
 var MISSING_PATH_CODES = ["ENOENT", "ENOTDIR"];
 var NOT_A_SYMLINK_CODES = [...MISSING_PATH_CODES, "EINVAL"];
 var MAX_SYMLINK_FOLLOWS = 32;
-async function resolveCanonicalPath({ realpath, readlink }, path4) {
+async function resolveCanonicalPath({ realpath, readlink }, path5) {
   const missingSegments = [];
-  let current = path4;
+  let current = path5;
   let follows = 0;
   while (true) {
     try {
@@ -2744,23 +2903,23 @@ async function resolveCanonicalPath({ realpath, readlink }, path4) {
       const target = await readSymlinkTarget(readlink, current);
       if (target !== void 0) {
         if (++follows > MAX_SYMLINK_FOLLOWS) {
-          throw createLoopError(path4);
+          throw createLoopError(path5);
         }
         current = isAbsolute(target) ? resolve(target) : resolve(dirname(current), target);
         continue;
       }
       const parent = dirname(current);
       if (parent === current) {
-        return resolve(path4);
+        return resolve(path5);
       }
       missingSegments.push(basename(current));
       current = parent;
     }
   }
 }
-async function readSymlinkTarget(readlink, path4) {
+async function readSymlinkTarget(readlink, path5) {
   try {
-    return await readlink(path4);
+    return await readlink(path5);
   } catch (error) {
     if (NOT_A_SYMLINK_CODES.includes(getOwnErrorCode(error) ?? "")) {
       return void 0;
@@ -2768,9 +2927,9 @@ async function readSymlinkTarget(readlink, path4) {
     throw error;
   }
 }
-function createLoopError(path4) {
+function createLoopError(path5) {
   const error = new Error(
-    `ELOOP: too many symbolic links encountered, realpath '${path4}'`
+    `ELOOP: too many symbolic links encountered, realpath '${path5}'`
   );
   error.code = "ELOOP";
   return error;
@@ -2813,9 +2972,9 @@ async function descendsFromRoot(stat, canonicalRoot, canonicalPath) {
     current = parent;
   }
 }
-async function readIdentity(stat, path4) {
+async function readIdentity(stat, path5) {
   try {
-    const { dev, ino } = await stat(path4);
+    const { dev, ino } = await stat(path5);
     return { dev, ino };
   } catch (error) {
     if (MISSING_PATH_CODES.includes(getOwnErrorCode(error) ?? "")) {
@@ -3088,32 +3247,32 @@ async function resolvePathArguments(fs2, root, name, args) {
     return resolved;
   }
   const paths = FS_PATH_ARGUMENTS[name].map((_, index) => {
-    const path4 = readPath(canonicalRoot, args[index]);
-    resolved[index] = path4;
-    return path4;
+    const path5 = readPath(canonicalRoot, args[index]);
+    resolved[index] = path5;
+    return path5;
   });
   await assertInsideRoot(fs2, canonicalRoot, name, paths);
   return resolved;
 }
 async function assertInsideRoot(fs2, canonicalRoot, name, paths) {
-  for (const path4 of paths) {
-    if (await escapesRoot(fs2, canonicalRoot, path4)) {
+  for (const path5 of paths) {
+    if (await escapesRoot(fs2, canonicalRoot, path5)) {
       throw createAccessDeniedError(name, paths[0], paths[1]);
     }
   }
 }
-async function escapesRoot(fs2, canonicalRoot, path4) {
-  const canonicalPath = await resolveCanonicalPath(readCanonicalPathFs(fs2), path4);
+async function escapesRoot(fs2, canonicalRoot, path5) {
+  const canonicalPath = await resolveCanonicalPath(readCanonicalPathFs(fs2), path5);
   return !await containsPath(readStat(fs2), canonicalRoot, canonicalPath);
 }
 function readCanonicalPathFs(fs2) {
   return {
-    realpath: async (path4) => await invoke(fs2, "realpath", [path4]),
-    readlink: async (path4) => await invoke(fs2, "readlink", [path4])
+    realpath: async (path5) => await invoke(fs2, "realpath", [path5]),
+    readlink: async (path5) => await invoke(fs2, "readlink", [path5])
   };
 }
 function readStat(fs2) {
-  return async (path4) => await invoke(fs2, "stat", [path4]);
+  return async (path5) => await invoke(fs2, "stat", [path5]);
 }
 function assertSupportedPath(name, argument, value) {
   if (typeof value === "string") {
@@ -3164,19 +3323,19 @@ function describeReceivedValue(value) {
   return `type ${typeof value} (${inspect(value)})`;
 }
 function readPath(base, value) {
-  const path4 = value;
-  return isAbsolute2(path4) ? resolve2(path4) : resolve2(base, path4);
+  const path5 = value;
+  return isAbsolute2(path5) ? resolve2(path5) : resolve2(base, path5);
 }
-function createAccessDeniedError(name, path4, dest) {
+function createAccessDeniedError(name, path5, dest) {
   const syscall = FS_SYSCALLS[name];
-  const target = dest === void 0 ? `'${path4}'` : `'${path4}' -> '${dest}'`;
+  const target = dest === void 0 ? `'${path5}'` : `'${path5}' -> '${dest}'`;
   const error = new Error(
     `${ACCESS_DENIED_CODE}: ${ACCESS_DENIED_MESSAGE}, ${syscall} ${target}`
   );
   error.code = ACCESS_DENIED_CODE;
   error.errno = ACCESS_DENIED_ERRNO;
   error.syscall = syscall;
-  error.path = path4;
+  error.path = path5;
   if (dest !== void 0) {
     error.dest = dest;
   }
@@ -3521,7 +3680,7 @@ function readNonEmptyString4(value, label) {
 
 // packages/safejs/src/modules/mcp-transport.ts
 import { spawn as spawn3 } from "node:child_process";
-import path3 from "node:path";
+import path4 from "node:path";
 
 // packages/tiny-mcp-client/src/internal.ts
 import { spawn as spawn2 } from "node:child_process";
@@ -3529,13 +3688,13 @@ import { PassThrough } from "node:stream";
 
 // packages/mcp-oauth/src/client/auth-store-session-store.ts
 import crypto from "node:crypto";
-import path2 from "node:path";
+import path3 from "node:path";
 
 // packages/auth-store/src/encrypted-file-store.ts
-import { createCipheriv, createDecipheriv, randomBytes, randomUUID, scrypt } from "node:crypto";
+import { createCipheriv, createDecipheriv, randomBytes, randomUUID as randomUUID2, scrypt } from "node:crypto";
 import { promises as fs } from "node:fs";
 import { homedir, hostname, userInfo } from "node:os";
-import path from "node:path";
+import path2 from "node:path";
 
 // packages/auth-store/src/error-codes.ts
 function hasOwnErrorCode2(error, code) {
@@ -3567,7 +3726,7 @@ var EncryptedFileStore = class {
       const defaultFileName = input.defaultFileName ?? "credentials.enc";
       assertSafeDefaultDirectory(defaultDirectory);
       assertSafeDefaultFileName(defaultFileName);
-      this.filePath = path.join(
+      this.filePath = path2.join(
         homeDirectory,
         defaultDirectory,
         defaultFileName
@@ -3630,9 +3789,9 @@ var EncryptedFileStore = class {
       authTag: authTag.toString("base64"),
       ciphertext: ciphertext.toString("base64")
     };
-    await this.fs.mkdir(path.dirname(this.filePath), { recursive: true });
+    await this.fs.mkdir(path2.dirname(this.filePath), { recursive: true });
     await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
-    const temporaryPath = `${this.filePath}.${process.pid}.${randomUUID()}.tmp`;
+    const temporaryPath = `${this.filePath}.${process.pid}.${randomUUID2()}.tmp`;
     let temporaryCreated = false;
     try {
       await this.assertCredentialPathHasNoSymbolicLinks(temporaryPath);
@@ -3662,7 +3821,7 @@ var EncryptedFileStore = class {
     }
   }
   async assertCredentialPathHasNoSymbolicLinks(targetPath) {
-    const resolvedPath = path.resolve(targetPath);
+    const resolvedPath = path2.resolve(targetPath);
     const protectedPaths = getProtectedCredentialPaths(
       resolvedPath,
       this.symbolicLinkCheckStartPath
@@ -3696,26 +3855,26 @@ var EncryptedFileStore = class {
 };
 function resolveDefaultDirectoryCheckStart(homeDirectory, defaultDirectory) {
   const [firstSegment] = defaultDirectory.split(/[\\/]+/).filter(Boolean);
-  return path.resolve(homeDirectory, firstSegment ?? ".");
+  return path2.resolve(homeDirectory, firstSegment ?? ".");
 }
 function getProtectedCredentialPaths(resolvedPath, symbolicLinkCheckStartPath) {
   if (symbolicLinkCheckStartPath === null) {
     return getExplicitProtectedCredentialPaths(resolvedPath);
   }
-  const resolvedStartPath = path.resolve(symbolicLinkCheckStartPath);
+  const resolvedStartPath = path2.resolve(symbolicLinkCheckStartPath);
   if (!isPathInsideOrEqual(resolvedPath, resolvedStartPath)) {
-    return [path.dirname(resolvedPath), resolvedPath];
+    return [path2.dirname(resolvedPath), resolvedPath];
   }
   const protectedPaths = [resolvedStartPath];
   let currentPath = resolvedStartPath;
-  for (const segment of path.relative(resolvedStartPath, resolvedPath).split(path.sep).filter(Boolean)) {
-    currentPath = path.join(currentPath, segment);
+  for (const segment of path2.relative(resolvedStartPath, resolvedPath).split(path2.sep).filter(Boolean)) {
+    currentPath = path2.join(currentPath, segment);
     protectedPaths.push(currentPath);
   }
   return protectedPaths;
 }
 function assertSafeDefaultDirectory(defaultDirectory) {
-  if (path.isAbsolute(defaultDirectory) || path.win32.isAbsolute(defaultDirectory)) {
+  if (path2.isAbsolute(defaultDirectory) || path2.win32.isAbsolute(defaultDirectory)) {
     throw new Error("defaultDirectory must be a relative path inside the home directory");
   }
   for (const segment of splitPathSegments(defaultDirectory)) {
@@ -3733,15 +3892,15 @@ function splitPathSegments(value) {
   return value.split("/").flatMap((segment) => segment.split("\\")).filter((segment) => segment.length > 0);
 }
 function getExplicitProtectedCredentialPaths(resolvedPath) {
-  const parsed = path.parse(resolvedPath);
-  const segments = resolvedPath.slice(parsed.root.length).split(path.sep).filter((segment) => segment.length > 0);
+  const parsed = path2.parse(resolvedPath);
+  const segments = resolvedPath.slice(parsed.root.length).split(path2.sep).filter((segment) => segment.length > 0);
   if (segments.length <= 1) {
     return [resolvedPath];
   }
   const protectedPaths = [];
   let currentPath = parsed.root;
   for (const [index, segment] of segments.entries()) {
-    currentPath = path.join(currentPath, segment);
+    currentPath = path2.join(currentPath, segment);
     if (index === 0) {
       continue;
     }
@@ -3750,8 +3909,8 @@ function getExplicitProtectedCredentialPaths(resolvedPath) {
   return protectedPaths;
 }
 function isPathInsideOrEqual(childPath, parentPath) {
-  const relativePath = path.relative(parentPath, childPath);
-  return relativePath === "" || !relativePath.startsWith("..") && !path.isAbsolute(relativePath);
+  const relativePath = path2.relative(parentPath, childPath);
+  return relativePath === "" || !relativePath.startsWith("..") && !path2.isAbsolute(relativePath);
 }
 async function removeIfPresent(fileSystem, filePath) {
   try {
@@ -4113,10 +4272,10 @@ function createAuthStoreClientStore(options) {
 function createNamedSecretStore(key2, options, defaults) {
   const hash = crypto.createHash("sha256").update(key2).digest("hex");
   const configuredFilePath = options.fileStore?.filePath;
-  const parsedFilePath = configuredFilePath === void 0 ? null : path2.parse(configuredFilePath);
+  const parsedFilePath = configuredFilePath === void 0 ? null : path3.parse(configuredFilePath);
   const fileStore = {
     ...options.fileStore,
-    filePath: parsedFilePath === null ? void 0 : path2.join(
+    filePath: parsedFilePath === null ? void 0 : path3.join(
       parsedFilePath.dir,
       `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`
     ),
@@ -7240,9 +7399,9 @@ function parseMcpConfig(source, directory) {
   ]);
   for (const server of Object.values(options.servers)) {
     if ("command" in server) {
-      server.cwd = path3.resolve(directory, server.cwd ?? ".");
+      server.cwd = path4.resolve(directory, server.cwd ?? ".");
       if (server.command.includes("/") || server.command.includes("\\")) {
-        server.command = path3.resolve(directory, server.command);
+        server.command = path4.resolve(directory, server.command);
       }
     }
   }
@@ -7858,6 +8017,9 @@ function isPlainObjectRecord(value) {
 }
 
 export {
+  inspectSnapshotMigration,
+  migrateSnapshot,
+  migrateSnapshotFile,
   formatInterpreterError,
   SPAWN_MODES,
   supportsSpawnMode,
@@ -7886,4 +8048,4 @@ export {
   parseMcpConfig,
   makeMcpModule
 };
-//# sourceMappingURL=chunk-MRH5YDMR.js.map
+//# sourceMappingURL=chunk-ARFGEQTM.js.map