priiisk 0.1.4 → 0.1.6

package/dist/{chunk-62BTCFUO.js → chunk-32R4IEGS.js}

@@ -1152,7 +1152,7 @@ var numberArgument = (parameters, name) => {
   const value = parameters[name];
   return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 };
-var campUiExploredReadPath = (parameters) => stringArgument(parameters, "path") ?? stringArgument(parameters, "file_path");
+var campUiExploredReadPath = (parameters) => stringArgument(parameters, "path");
 var campUiExploredReadRange = (parameters) => {
   const offset = numberArgument(parameters, "offset");
   const limit = numberArgument(parameters, "limit");
@@ -1196,7 +1196,14 @@ var collectNodes = (reads) => {
       node.errorMessage = read.errorMessage;
     }
   }
-  return [...byPath.values()];
+  const directoryOrder = /* @__PURE__ */ new Map();
+  for (const node of byPath.values()) {
+    if (!directoryOrder.has(node.directory))
+      directoryOrder.set(node.directory, directoryOrder.size);
+  }
+  return [...byPath.values()].sort(
+    (left, right) => (directoryOrder.get(left.directory) ?? 0) - (directoryOrder.get(right.directory) ?? 0)
+  );
 };
 var toneByStatus = {
   completed: CampUiTone.success,

package/dist/{chunk-QX5EESCS.js → chunk-3NSS6BZD.js}

@@ -10643,16 +10643,42 @@ var currentDirectToolSandbox = () => {
   cached2 ??= detectDirectToolSandbox();
   return cached2;
 };
+var DIRECT_TOOL_SANDBOX_STATUS_FD = 3;
 var directToolSandboxCommand = (sandbox2, executablePath, args, options4) => sandbox2.kind === DirectToolSandboxKind.bubblewrap && sandbox2.command !== void 0 ? {
   command: sandbox2.command,
-  args: [...sandboxArguments(options4.cwd, true), executablePath, ...args]
+  args: [
+    "--json-status-fd",
+    String(DIRECT_TOOL_SANDBOX_STATUS_FD),
+    ...sandboxArguments(options4.cwd, true),
+    executablePath,
+    ...args
+  ],
+  statusFd: DIRECT_TOOL_SANDBOX_STATUS_FD
 } : { command: executablePath, args };
-var isDirectToolSandboxFailure = (stderr3) => stderr3.startsWith("bwrap:");
+var parseDirectToolSandboxStatus = (status) => {
+  let started = false;
+  let exitCode3;
+  for (const line of status.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed === "") continue;
+    let document;
+    try {
+      document = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    if (typeof document !== "object" || document === null) continue;
+    if ("child-pid" in document) started = true;
+    const reported = document["exit-code"];
+    if (typeof reported === "number") exitCode3 = reported;
+  }
+  return { started, ...exitCode3 === void 0 ? {} : { exitCode: exitCode3 } };
+};
 var describeDirectToolSandbox = (sandbox2) => sandbox2.kind === DirectToolSandboxKind.bubblewrap ? "External binaries run in a bubblewrap sandbox: read-only filesystem, writable worker directory, no network" : sandbox2.absence === DirectToolSandboxAbsence.disabled ? `External binaries run without an OS sandbox: disabled by ${DIRECT_TOOL_SANDBOX_ENV}` : sandbox2.absence === DirectToolSandboxAbsence.unsupportedPlatform ? `External binaries run without an OS sandbox: no supported mechanism on ${sandbox2.detail ?? "this platform"}` : sandbox2.absence === DirectToolSandboxAbsence.binaryMissing ? "External binaries run without an OS sandbox: bubblewrap (bwrap) is not installed" : "External binaries run without an OS sandbox: bubblewrap is present but cannot start";
 
 // packages/protocol/src/domain/protocolVersion.ts
 var PRIIISK_PROTOCOL_VERSION = "11";
-var PRIIISK_PROTOCOL_PACKAGE_VERSION = "0.1.4";
+var PRIIISK_PROTOCOL_PACKAGE_VERSION = "0.1.6";
 var ProtocolVersionSchema = Schema_exports.String.pipe(Schema_exports.minLength(1));
 
 // packages/protocol/src/domain/protocolIdentifiers.ts
@@ -13527,7 +13553,7 @@ var CampProtocol = class extends RpcGroup_exports.make(
 };
 
 // packages/camp-state/src/bootstrap/campHostVersion.ts
-var PRIIISK_HOST_VERSION = "0.1.4";
+var PRIIISK_HOST_VERSION = "0.1.6";
 
 // packages/surface/src/domain/surfaceModel.ts
 var NonEmptyString7 = Schema_exports.String.pipe(Schema_exports.minLength(1));
@@ -14909,7 +14935,7 @@ export {
   resolveExecutablePath,
   currentDirectToolSandbox,
   directToolSandboxCommand,
-  isDirectToolSandboxFailure,
+  parseDirectToolSandboxStatus,
   describeDirectToolSandbox,
   NetSocket,
   fromDuplex,

package/dist/{chunk-GLWKYPVL.js → chunk-JWVO4S72.js}

@@ -28,7 +28,7 @@ import {
   makePlatform,
   makeRunMain,
   stdin
-} from "./chunk-QX5EESCS.js";
+} from "./chunk-3NSS6BZD.js";
 import {
   BaseProto,
   __export,

package/dist/{chunk-JFAW425C.js → chunk-TOVFB7H6.js}

@@ -84,7 +84,7 @@ import {
   selectCampRun,
   styleCampUiTone,
   uniqueCampUiNames
-} from "./chunk-62BTCFUO.js";
+} from "./chunk-32R4IEGS.js";
 import "./chunk-KFSFN6L5.js";
 export {
   CAMP_UI_BASH_PREVIEW_LINES,

package/dist/{chunk-XI3HWC7Q.js → chunk-UDDSOI3H.js}

@@ -20,7 +20,7 @@ import {
   layerNet,
   makeCampSurfaceName,
   resolveProjectScopeSync
-} from "./chunk-QX5EESCS.js";
+} from "./chunk-3NSS6BZD.js";
 import {
   Clock_exports,
   Config_exports,
@@ -111,7 +111,7 @@ var CliSurfaceSelectionError = class extends Data_exports.TaggedError("CliSurfac
 import { randomUUID } from "node:crypto";
 
 // packages/cli/src/domain/cliVersion.ts
-var PRIIISK_CLI_VERSION = "0.1.4";
+var PRIIISK_CLI_VERSION = "0.1.6";
 
 // packages/cli/src/client/campRpcConnection.ts
 var PRIIISK_CONTROLLER_ID_ENV = "PRIIISK_CONTROLLER_ID";

package/dist/{chunk-GZTHKLSX.js → chunk-X4GVQOCR.js}

@@ -8,13 +8,13 @@ import {
   makeDoctorReport,
   resolveCampSurface,
   withCampRpc
-} from "./chunk-XI3HWC7Q.js";
+} from "./chunk-UDDSOI3H.js";
 import {
   PI_RUNTIME_VERSION,
   PiModelCatalogIssueCode,
   inspectPiModelCatalog,
   makePiOperatorResources
-} from "./chunk-44I2RCT5.js";
+} from "./chunk-ZNRMKVX3.js";
 import {
   CampHealthComponentStatus,
   CampHealthOverallStatus,
@@ -48,7 +48,7 @@ import {
   resolveCredentialsPath,
   resolveProjectScope,
   resolveWorkerConfigPath
-} from "./chunk-QX5EESCS.js";
+} from "./chunk-3NSS6BZD.js";
 import {
   Clock_exports,
   Effect_exports,

package/dist/{chunk-44I2RCT5.js → chunk-ZNRMKVX3.js}

@@ -3,7 +3,7 @@ const require = __priiiskCreateRequire(import.meta.url);
 import {
   FileSystem_exports,
   PRIIISK_PI_AGENT_DIR_ENV
-} from "./chunk-QX5EESCS.js";
+} from "./chunk-3NSS6BZD.js";
 import {
   CampDeliveryPort,
   CampFailureCode,

package/dist/priiisk-host.js

@@ -4,14 +4,14 @@ const require = __priiiskCreateRequire(import.meta.url);
 import {
   NodeContext_exports,
   NodeRuntime_exports
-} from "./chunk-GLWKYPVL.js";
+} from "./chunk-JWVO4S72.js";
 import {
   CampUiBackendError,
   CampUiHealthStatus,
   CampUiPlacement,
   CampUiRuntimeStatus,
   mountPiCampUi
-} from "./chunk-62BTCFUO.js";
+} from "./chunk-32R4IEGS.js";
 import {
   PiTransport,
   makePiOperatorResources,
@@ -19,7 +19,7 @@ import {
   makePiTransportLayer,
   requirePiModelCatalog,
   require_undici
-} from "./chunk-44I2RCT5.js";
+} from "./chunk-ZNRMKVX3.js";
 import {
   AgentRole,
   AgentRoleSchema,
@@ -73,11 +73,11 @@ import {
   fromDuplex,
   fromWebSocket,
   hostStoppedCampManifest,
-  isDirectToolSandboxFailure,
   listWorkerModelCatalogEntries,
   loadCampManifest,
   loadReferencedMcpCredentials,
   loadWorkerConfig,
+  parseDirectToolSandboxStatus,
   prepareCampRunStorage,
   prepareCampStorage,
   projectScopeFromCwd,
@@ -100,7 +100,7 @@ import {
   runningCampManifest,
   saveCampHealth,
   saveCampManifest
-} from "./chunk-QX5EESCS.js";
+} from "./chunk-3NSS6BZD.js";
 import {
   CampAskRouter,
   CampCancellationCode,
@@ -11198,7 +11198,7 @@ var require_cross_spawn = __commonJS({
     var cp = __require("child_process");
     var parse3 = require_parse();
     var enoent = require_enoent();
-    function spawn2(command, args, options) {
+    function spawn3(command, args, options) {
       const parsed = parse3(command, args, options);
       const spawned = cp.spawn(parsed.command, parsed.args, parsed.options);
       enoent.hookChildProcess(spawned, parsed);
@@ -11210,8 +11210,8 @@ var require_cross_spawn = __commonJS({
       result.error = result.error || enoent.verifyENOENTSync(result.status, parsed);
       return result;
     }
-    module.exports = spawn2;
-    module.exports.spawn = spawn2;
+    module.exports = spawn3;
+    module.exports.spawn = spawn3;
     module.exports.sync = spawnSync;
     module.exports._parse = parse3;
     module.exports._enoent = enoent;
@@ -22416,7 +22416,7 @@ var Client = class extends Protocol {
 };
 
 // packages/mcp-backend/src/connections/clientIdentity.ts
-var backendVersion = "0.1.4";
+var backendVersion = "0.1.6";
 
 // packages/mcp-backend/src/connections/mcpFailure.ts
 var McpFailure = class extends Data_exports.TaggedError("McpFailure") {
@@ -26376,7 +26376,7 @@ var makeCampRpcServerLayer = (socketPath) => {
 };
 
 // packages/host/src/tools/directTools.ts
-import { execFile } from "node:child_process";
+import { spawn as spawn2 } from "node:child_process";
 
 // packages/host/src/tools/directToolPolicy.ts
 var flagName = (argument) => {
@@ -26391,7 +26391,19 @@ var violatesFlag = (argument, denied) => {
   const letter = denied.charAt(1);
   return !name.startsWith("--") && name.slice(1).includes(letter);
 };
-var findSubcommand = (args) => args.find((argument) => !argument.startsWith("-"));
+var findSubcommand = (args, allowed) => {
+  let previousWasFlag = false;
+  for (const argument of args) {
+    if (argument.startsWith("-")) {
+      previousWasFlag = !argument.includes("=");
+      continue;
+    }
+    if (allowed.includes(argument)) return argument;
+    if (!previousWasFlag) return argument;
+    previousWasFlag = false;
+  }
+  return void 0;
+};
 var checkDirectToolArguments = (policy, args) => {
   const invalid = args.find((argument) => argument.includes("\0"));
   if (invalid !== void 0) return { reason: "invalid_argument", argument: invalid };
@@ -26400,7 +26412,7 @@ var checkDirectToolArguments = (policy, args) => {
     if (denied !== void 0) return { reason: "denied_flag", argument: denied };
   }
   if (policy.allowedSubcommands === void 0) return void 0;
-  const subcommand = findSubcommand(args);
+  const subcommand = findSubcommand(args, policy.allowedSubcommands);
   if (subcommand === void 0) return { reason: "missing_subcommand" };
   return policy.allowedSubcommands.includes(subcommand) ? void 0 : { reason: "unknown_subcommand", argument: subcommand };
 };
@@ -26423,34 +26435,70 @@ var truncate = (value, limit) => {
   return encoded.byteLength <= limit ? { text: value, truncated: false } : { text: encoded.subarray(0, limit).toString("utf8"), truncated: true };
 };
 var binaryCandidates = (bin) => bin === "fd" ? ["fd", "fdfind"] : [bin];
+var collect = (stream, onOverflow) => {
+  const chunks = [];
+  let size = 0;
+  let overflowed = false;
+  stream?.on("data", (chunk) => {
+    if (overflowed) return;
+    size += chunk.byteLength;
+    if (size > MAX_BUFFER_BYTES) {
+      overflowed = true;
+      onOverflow();
+      return;
+    }
+    chunks.push(chunk);
+  });
+  return { text: () => Buffer.concat(chunks).toString("utf8") };
+};
 var runBinary = (executablePath, args, options, environment, signal) => {
   const sandbox = options.sandbox ?? currentDirectToolSandbox();
   const launch = directToolSandboxCommand(sandbox, executablePath, args, { cwd: options.cwd });
+  const sandboxed = launch.statusFd !== void 0;
   return new Promise((resolve) => {
-    const child = execFile(
-      launch.command,
-      [...launch.args],
-      {
-        cwd: options.cwd,
-        env: environment,
-        timeout: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
-        maxBuffer: MAX_BUFFER_BYTES,
-        ...signal === void 0 ? {} : { signal }
-      },
-      (error2, stdout, stderr) => {
-        const failure = error2;
-        const sandboxed = launch.command !== executablePath;
-        resolve({
-          stdout,
-          stderr,
-          exitCode: typeof failure?.code === "number" ? failure.code : failure === null ? 0 : 1,
-          signal: child.signalCode ?? void 0,
-          timedOut: failure?.killed === true,
-          ...sandboxed && isDirectToolSandboxFailure(stderr) ? { sandboxFailed: true } : {},
-          ...typeof failure?.code === "string" && failure.code !== "" ? { launchError: `${failure.code}: ${failure.message}` } : {}
-        });
-      }
+    const child = spawn2(launch.command, [...launch.args], {
+      cwd: options.cwd,
+      env: environment,
+      stdio: sandboxed ? ["ignore", "pipe", "pipe", "pipe"] : ["ignore", "pipe", "pipe"],
+      ...signal === void 0 ? {} : { signal }
+    });
+    let timedOut = false;
+    let launchError;
+    const stop = () => {
+      child.kill("SIGTERM");
+    };
+    const stdout = collect(child.stdout, stop);
+    const stderr = collect(child.stderr, stop);
+    const status = collect(
+      sandboxed ? child.stdio[launch.statusFd ?? 3] ?? null : null,
+      stop
     );
+    const timer = setTimeout(() => {
+      timedOut = true;
+      stop();
+    }, options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    child.on("error", (cause) => {
+      if (signal?.aborted === true || cause.name === "AbortError") return;
+      launchError = `${cause.code ?? cause.name}: ${cause.message}`;
+    });
+    child.on("close", (code, terminatedBy) => {
+      clearTimeout(timer);
+      const sandboxStatus = sandboxed ? parseDirectToolSandboxStatus(status.text()) : void 0;
+      resolve({
+        stdout: stdout.text(),
+        stderr: stderr.text(),
+        exitCode: sandboxStatus?.exitCode ?? code ?? void 0,
+        signal: terminatedBy ?? void 0,
+        timedOut,
+        /*
+         * A sandbox that never reached the command is only a refusal when the
+         * command was not stopped from the outside: a killed sandbox reports no
+         * child either, and that is the timeout, not the boundary.
+         */
+        ...sandboxStatus !== void 0 && !sandboxStatus.started && !timedOut && launchError === void 0 ? { sandboxFailed: true } : {},
+        ...launchError === void 0 ? {} : { launchError }
+      });
+    });
   });
 };
 var runWithFallback = async (policy, args, options, signal) => {

package/dist/priiisk.js

@@ -5,7 +5,7 @@ import {
   fromReadable,
   layer,
   runMain
-} from "./chunk-GLWKYPVL.js";
+} from "./chunk-JWVO4S72.js";
 import {
   CliCampLifecycleError,
   CliEquipmentConflict,
@@ -23,7 +23,7 @@ import {
   resolveCampSurface,
   withCampRpc,
   withCampRpcSession
-} from "./chunk-XI3HWC7Q.js";
+} from "./chunk-UDDSOI3H.js";
 import {
   CampCommandFailure,
   CampHostReadiness,
@@ -58,7 +58,7 @@ import {
   resolveProjectScopeSync,
   saveCampManifest,
   startingCampManifest
-} from "./chunk-QX5EESCS.js";
+} from "./chunk-3NSS6BZD.js";
 import {
   Cause_exports,
   CommitPrototype,
@@ -19903,7 +19903,7 @@ var campResumeListCommand = Command_exports.make(
   )
 ).pipe(Command_exports.withDescription("Lists saved runs of this project that resume can restore."));
 var runIdArgument = Args_exports.text({ name: "runId" }).pipe(Args_exports.optional);
-var selectCampRunOnDemand = (items) => Effect_exports.promise(() => import("./chunk-JFAW425C.js")).pipe(
+var selectCampRunOnDemand = (items) => Effect_exports.promise(() => import("./chunk-TOVFB7H6.js")).pipe(
   Effect_exports.flatMap((ui) => ui.selectCampRun({ items }))
 );
 var selectAndResume = (json) => {
@@ -19976,7 +19976,7 @@ var rootCommand = Command_exports.make(
 ).pipe(Command_exports.withDescription("Runs and observes a camp of collaborating workers."));
 
 // packages/cli/src/commands/doctorCommand.ts
-var runDoctorOnDemand = Effect_exports.promise(() => import("./chunk-GZTHKLSX.js")).pipe(
+var runDoctorOnDemand = Effect_exports.promise(() => import("./chunk-X4GVQOCR.js")).pipe(
   Effect_exports.flatMap((doctor) => doctor.runDoctor)
 );
 var statusLabel = {
@@ -20672,7 +20672,7 @@ var command = rootCommand.pipe(
 );
 var cli = Command_exports.run(command, {
   name: "priiisk camp control",
-  version: "0.1.4"
+  version: "0.1.6"
 });
 var runCliCommand = (argumentsList) => cli(argumentsList).pipe(
   Effect_exports.matchEffect({

package/package.json

@@ -1,22 +1,22 @@
 {
   "name": "priiisk",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "CLI for running and observing a camp of collaborating agents",
   "type": "module",
   "bin": {
     "priiisk": "./dist/priiisk.js"
   },
   "files": [
-    "dist/chunk-44I2RCT5.js",
-    "dist/chunk-44I2RCT5.js.LEGAL.txt",
-    "dist/chunk-62BTCFUO.js",
-    "dist/chunk-GLWKYPVL.js",
-    "dist/chunk-GZTHKLSX.js",
-    "dist/chunk-JFAW425C.js",
+    "dist/chunk-32R4IEGS.js",
+    "dist/chunk-3NSS6BZD.js",
+    "dist/chunk-3NSS6BZD.js.LEGAL.txt",
+    "dist/chunk-JWVO4S72.js",
     "dist/chunk-KFSFN6L5.js",
-    "dist/chunk-QX5EESCS.js",
-    "dist/chunk-QX5EESCS.js.LEGAL.txt",
-    "dist/chunk-XI3HWC7Q.js",
+    "dist/chunk-TOVFB7H6.js",
+    "dist/chunk-UDDSOI3H.js",
+    "dist/chunk-X4GVQOCR.js",
+    "dist/chunk-ZNRMKVX3.js",
+    "dist/chunk-ZNRMKVX3.js.LEGAL.txt",
     "dist/priiisk-host.js",
     "dist/priiisk.js",
     "profiles",