rovecode 0.4.0-beta.3 → 0.4.0

package/dist/cli/catalog-1xchffa4.js

@@ -1,2 +0,0 @@
-// @bun
-import{$j as c,Zj as a,_j as b,ak as d,bk as e,ck as f}from"./main-xg704a3c.js";import"./main-0jys2ccn.js";import"./main-qsevpgsv.js";f();export{e as supportsReasoning,d as supportsImages,a as ratesFor,b as describePricing,c as ModelCatalog};

package/dist/cli/cli-1n1zb64f.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ah as a,Bh as b,Ch as c}from"./main-kh32yvgk.js";import"./main-kcpbykxz.js";import"./main-a9njrkk1.js";import"./main-7rn6bqje.js";import"./main-2yeveeve.js";import"./main-0jys2ccn.js";import"./main-nqveez48.js";import"./main-qsevpgsv.js";export{c as row,b as cmdPlugin,a as PLUGIN_USAGE};

package/dist/cli/client-2t9gjkck.js

@@ -1,2 +0,0 @@
-// @bun
-import{Md as c,Nd as d,Od as e,Pd as f,Rd as g}from"./main-0mtcdbs7.js";import"./main-rg0wn0xf.js";import{Em as b,xm as a}from"./main-7rn6bqje.js";import"./main-nqveez48.js";import"./main-qsevpgsv.js";g();export{e as runnerTimeoutMessage,a as mcpConfigPath,b as loadMcpConfig,d as isPackageRunner,c as RUNNER_CONNECT_MS,f as McpManager};

package/dist/cli/commands-exafvm2b.js

@@ -1,2 +0,0 @@
-// @bun
-import{$c as j,Sc as a,Tc as b,Uc as c,Vc as d,Wc as e,Xc as f,Yc as g,Zc as h,_c as i}from"./main-aecrjq2d.js";import"./main-rfth4tbm.js";import"./main-351pz3z7.js";import"./main-dfreez27.js";import"./main-2yeveeve.js";import"./main-0jys2ccn.js";import"./main-qsevpgsv.js";j();export{i as runCustomCommand,d as renderCommand,a as parseCommandFile,b as hints,g as helpForCommands,e as expandSlashPrompt,h as dispatchCustomCommand,c as discoverCommands,f as commandsForPalette};

package/dist/cli/connect-6zde0kn3.js

@@ -1,2 +0,0 @@
-// @bun
-import{Aa as a,Ba as b,Ca as c,Da as d}from"./main-wbrdspr2.js";import"./main-sdmxhtv8.js";import"./main-8kjxbpw4.js";import"./main-2yeveeve.js";import"./main-0jys2ccn.js";import"./main-qsevpgsv.js";export{d as runConnect,c as parseConnectArgs,a as CONNECT_WAITING,b as CONNECT_USAGE};

package/dist/cli/context-cmd-5t43wgqt.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ed as C,Gd as E,zd as L}from"./main-80haw7qk.js";import"./main-6dnk69vp.js";import"./main-q3vsesf9.js";import{$j as A,ck as T}from"./main-xg704a3c.js";import"./main-3rxcvgna.js";import{Jl as _,Ll as b,Ml as y}from"./main-4wndhjdc.js";import"./main-ggcn7rd7.js";import"./main-0904f6ps.js";import"./main-prxxs70n.js";import"./main-n0t3973w.js";import"./main-mv40pcr2.js";import"./main-2yeveeve.js";import"./main-0jys2ccn.js";import"./main-nqveez48.js";import{xn as F}from"./main-qsevpgsv.js";y();E();T();import{join as v}from"path";var R=(k,K=24)=>{let q=Math.max(0,Math.min(K,Math.round(k*K)));return"\u2588".repeat(q)+"\xB7".repeat(K-q)},J=(k)=>k.toLocaleString("en-US"),$=(k)=>`${(k*100).toFixed(1)}%`;function w(k,K){let q=[];if(q.push(`session ${K} \xB7 ${k.model.provider}/${k.model.model}`),q.push(""),k.window)q.push(`context  ${R(k.fraction??0)}  ~${J(k.corrected)} of ${J(k.window)} (${$(k.fraction??0)})`),q.push(`         ${J(k.remaining??0)} left${k.nearLimit?" \u2014 near the limit, compaction is due":""}`);else q.push(`context  ~${J(k.corrected)} tokens \u2014 this model's window is not in the catalog`);if(k.scale.factor!==1)q.push(`         o200k counted ${J(k.estimated)}, scaled by ${k.scale.factor}\xD7 \u2014 ${k.scale.note}`);else if(!k.scale.measured)q.push(`         ${k.scale.note}`);q.push("");let W=Math.max(...k.slices.map((B)=>B.label.length),10);for(let B of k.slices)q.push(`  ${B.label.padEnd(W)}  ${J(B.tokens).padStart(9)}  ${$(B.share).padStart(6)}${B.note?`  \u2014 ${B.note}`:""}`);if(k.images>0)q.push(`  ${"images".padEnd(W)}  ${String(k.images).padStart(9)}         \u2014 not estimated; image tokens are provider-specific`);if(q.push(""),k.drift){let B=k.drift,M=B.delta>0?"more than we estimate":"less than we estimate";q.push(`drift    provider counted ${J(B.reported)} for the last turn's prompt, we estimated ${J(B.estimated)}`),q.push(`         ${J(Math.abs(B.delta))} ${M} (${$(B.fraction)})${B.beyondTolerance?` \u2014 beyond the ${$(L)} tolerance; the meter above reads ${B.delta>0?"low":"high"} for this model`:""}`)}else q.push("drift    no turn reported usage yet \u2014 nothing to compare the estimate against");q.push("");let G=k.totals;q.push(`billed   ${J(G.input)} in \xB7 ${J(G.output)} out \xB7 ${J(G.cacheRead)} cache read \xB7 ${J(G.cacheWrite)} cache written`);let X=G.input+G.output+G.cacheRead+G.cacheWrite>0;return q.push(k.costUsd!==void 0?`cost     $${k.costUsd.toFixed(4)}${k.unpricedTurns>0?` \u2014 lower bound, ${k.unpricedTurns} turn${k.unpricedTurns>1?"s":""} unpriced`:""}`:X?`cost     unknown \u2014 no pricing for ${k.model.provider}/${k.model.model}`:"cost     $0.0000 \u2014 nothing has been billed in this session yet"),q}function h(k,K){if(k.inputTokens===void 0)return["",`exact    not counted \u2014 ${k.reason??"no reason given"}`];let q=K-k.inputTokens,W=k.inputTokens>0?Math.abs(q)/k.inputTokens:0,G=q===0?"our estimate agrees exactly":`our estimate reads ${q>0?"high":"low"} by ${J(Math.abs(q))} (${$(W)})${W>L?` \u2014 beyond the ${$(L)} tolerance`:""}`,X=["",`exact    the provider counted ${J(k.inputTokens)} for this prompt`,`         ${G}`];if(k.placeholder)X.push("         this session has no turns yet \u2014 the count includes a one-character placeholder message, which the API requires");return X}async function p(k,K={}){let q=K.log??((z)=>console.log(z)),W=K.err??((z)=>console.error(z)),G=K.cwd??process.cwd(),X=k.includes("--json"),B=k.find((z)=>!z.startsWith("-")),M=(z)=>{if(W(z),X)q(JSON.stringify({error:z}));return 1},O=v(G,".rovecode","sessions"),P=_(O),j=B??P[0]?.id;if(!j)return M("no sessions here \u2014 run rovecode in this directory first");if(B&&!P.some((z)=>z.id===B))return M(`no session ${B} here \u2014 rovecode context lists the newest by default`);let S=new b(O,j).messages(),Y=K.currentRef?K.currentRef():await(async()=>{let{ProviderRegistry:z}=await import("./registry-s8yk86g0.js");return new z(G).defaultRef()??null})();if(!Y)return M("no default model \u2014 rovecode model use <provider/model>");let H={};if(!k.includes("--no-runtime"))try{let{createRuntime:z}=await import("./runtime-n7gafzhb.js"),Q=z({cwd:G,stream:null,sessionId:j}),U=Q.registry.list().map((I)=>I.schema),V=Q.buildDef({...Y,effort:"auto"});H={system:typeof V.systemPrompt==="string"?V.systemPrompt:V.systemPrompt({}),toolSchemas:JSON.stringify(U),schemas:U},await Q.mcp?.close().catch(()=>{})}catch(z){H={note:`the system prompt and tool schemas are not counted \u2014 this project's runtime did not build (${z instanceof Error?z.message:String(z)})`}}let D=new A,N=C({messages:S,current:Y,...H.system!==void 0?{system:H.system}:{},...H.toolSchemas!==void 0?{toolSchemas:H.toolSchemas}:{},lookup:(z)=>{let Q=D.lookup(z.provider,z.model);if(!Q)return;return{...Q.contextWindow!==void 0?{contextWindow:Q.contextWindow}:{},...Q.pricing?{pricing:Q.pricing}:{},...Q.tier?{tier:Q.tier}:{}}}}),Z;if(k.includes("--exact")){let{countPromptRemotely:z}=await import("./count-remote-ap7x3vh6.js"),{ProviderRegistry:Q}=await import("./registry-s8yk86g0.js"),U=new Q(G).get(Y.provider);if(!U)Z={reason:`provider "${Y.provider}" is not configured here`};else{let V=await z({provider:{baseUrl:U.baseUrl,protocol:U.protocol,...U.apiKey?{apiKey:U.apiKey}:{},...U.headers?{headers:U.headers}:{}},model:Y.model,messages:S,...H.system!==void 0?{system:H.system}:{},...H.schemas?{tools:H.schemas}:{}});Z=V.ok?{inputTokens:V.inputTokens,endpoint:V.endpoint,...V.placeholder?{placeholder:!0}:{}}:{reason:V.reason}}}if(X)q(JSON.stringify({session:j,...N,...Z?{exact:Z}:{},...H.note?{note:H.note}:{}},null,2));else{for(let z of w(N,j))q(z);if(Z)for(let z of h(Z,N.estimated))q(z);if(H.note)q(`note     ${H.note}`);else if(H.system!==void 0)q("note     MCP tools are not counted \u2014 their schemas exist only once a server is connected")}return 0}export{h as renderExact,w as renderContext,p as cmdContext};

package/dist/cli/context-report-kt01pw8y.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ad as b,Bd as c,Cd as d,Dd as e,Ed as f,Fd as g,Gd as h,zd as a}from"./main-80haw7qk.js";import"./main-6dnk69vp.js";import"./main-q3vsesf9.js";import"./main-xg704a3c.js";import"./main-3rxcvgna.js";import"./main-4wndhjdc.js";import"./main-ggcn7rd7.js";import"./main-0904f6ps.js";import"./main-prxxs70n.js";import"./main-n0t3973w.js";import"./main-mv40pcr2.js";import"./main-2yeveeve.js";import"./main-0jys2ccn.js";import"./main-nqveez48.js";import"./main-qsevpgsv.js";h();export{g as drift,f as contextReport,e as contextBudgetFor,d as PROMPT_OVERHEAD_TOKENS,c as MIN_CONTEXT_BUDGET,a as DRIFT_TOLERANCE,b as DEFAULT_CONTEXT_BUDGET};

package/dist/cli/count-remote-ap7x3vh6.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ri as Y,Si as Z}from"./main-875s60s2.js";import"./main-3rxcvgna.js";import"./main-4wndhjdc.js";import"./main-ggcn7rd7.js";import"./main-0904f6ps.js";import"./main-prxxs70n.js";import"./main-n0t3973w.js";import"./main-mv40pcr2.js";import"./main-2yeveeve.js";import"./main-0jys2ccn.js";import"./main-nqveez48.js";import"./main-qsevpgsv.js";var N={role:"user",content:"."},X=15000;function P(j){if(typeof j!=="object"||j===null)return;let G=j.input_tokens;return typeof G==="number"&&Number.isFinite(G)&&G>=0?Math.floor(G):void 0}async function C(j){if(j.provider.protocol!=="anthropic")return{ok:!1,reason:`${j.provider.protocol} publishes no token-counting endpoint \u2014 only the Anthropic protocol does`};if(!j.provider.apiKey)return{ok:!1,reason:"no API key for this provider \u2014 the count needs one"};let K=`${j.provider.baseUrl.replace(/\/+$/,"")}/messages/count_tokens`,Q=Z([...j.messages]),V=Q.length===0,W={model:j.model,messages:V?[N]:Q,...j.system?{system:j.system}:{}};if(j.tools&&j.tools.length>0)W.tools=Y([...j.tools]).map((k)=>{let z=k.function??k,B=z.parameters,H=typeof B==="object"&&B!==null&&"type"in B;return{name:z.name,description:z.description,input_schema:H?B:{type:"object",properties:{}}}});let J=new AbortController,$=setTimeout(()=>J.abort(),j.timeoutMs??X);try{let k=await(j.fetchFn??fetch)(K,{method:"POST",headers:{"content-type":"application/json","x-api-key":j.provider.apiKey,"anthropic-version":"2023-06-01",...j.provider.headers??{}},body:JSON.stringify(W),signal:J.signal});if(!k.ok){let B=(await k.text().catch(()=>"")).slice(0,200);return{ok:!1,reason:`the endpoint answered ${k.status}${B?` \u2014 ${B}`:""}`}}let z=P(await k.json().catch(()=>null));return z===void 0?{ok:!1,reason:"the endpoint answered without an input_tokens number"}:{ok:!0,inputTokens:z,endpoint:K,...V?{placeholder:!0}:{}}}catch(k){let z=k instanceof Error?k.message:String(k);return{ok:!1,reason:J.signal.aborted?`no answer within ${(j.timeoutMs??X)/1000}s`:z}}finally{clearTimeout($)}}export{C as countPromptRemotely};

package/dist/cli/design-ne5zszyh.js

@@ -1,2 +0,0 @@
-// @bun
-import{le as a,me as b}from"./main-kd488vje.js";import"./main-qsevpgsv.js";export{b as designDirectionTool,a as designAuditTool};

package/dist/cli/dispatch-2r5myxye.js

@@ -1,2 +0,0 @@
-// @bun
-import{Vh as a,Wh as b,Xh as c}from"./main-k1eqkg83.js";import"./main-n0t3973w.js";import"./main-qsevpgsv.js";export{b as pathShaped,c as parseCli,a as VALUE_FLAGS};

package/dist/cli/doctor-ws4fh4tn.js

@@ -1,3 +0,0 @@
-// @bun
-import{m as JJ,p as AJ}from"./main-f7rw7des.js";import{fa as d,ha as MJ}from"./main-xy53xf0r.js";import{oa as t,pa as a,qa as UJ}from"./main-7c5thhjd.js";import{ra as r,sa as s,va as e}from"./main-zc2e8e46.js";import"./main-vqak588n.js";import{sd as i}from"./main-zzrfw6cf.js";import{Sd as n,Wd as HJ}from"./main-pn1w7a7j.js";import{Gg as p}from"./main-cta9racd.js";import{xh as o}from"./main-5tbz0wbz.js";import"./main-k2y8a2aw.js";import"./main-875s60s2.js";import{cj as w}from"./main-sdmxhtv8.js";import"./main-pknhvrmj.js";import"./main-1k1kw6b5.js";import"./main-90ds1z4e.js";import"./main-9etavkew.js";import"./main-q3vsesf9.js";import"./main-xg704a3c.js";import"./main-8kjxbpw4.js";import{$k as GJ,Yk as h,Zk as g,_k as N}from"./main-3rxcvgna.js";import"./main-4wndhjdc.js";import"./main-ggcn7rd7.js";import{$l as f,am as m,bm as KJ}from"./main-0904f6ps.js";import{dm as D,jm as v,mm as YJ}from"./main-prxxs70n.js";import"./main-n0t3973w.js";import{Cm as l,Em as c,Fm as VJ}from"./main-7rn6bqje.js";import"./main-mv40pcr2.js";import{$m as BJ,Lm as y}from"./main-2yeveeve.js";import"./main-0jys2ccn.js";import{dn as k,kn as FJ,mn as u}from"./main-nqveez48.js";import{xn as qJ}from"./main-qsevpgsv.js";BJ();import{existsSync as W,readdirSync as QJ,readFileSync as IJ,statSync as LJ}from"fs";import{homedir as _J}from"os";import{join as O}from"path";YJ();AJ();KJ();MJ();VJ();HJ();FJ();UJ();GJ();var b=["usage: rovecode doctor [--json] [--no-connect] [--add-dir <dir>]\u2026","  one pass over the setup: home \xB7 provider \xB7 permission level \xB7 tools on PATH \xB7 the verify check \xB7 MCP servers \xB7 workspace roots (with --add-dir) \xB7 checkpoints","  --no-connect   do not start the MCP servers to see whether they answer (they are otherwise connected and closed)","  --json         one document on stdout; exit 0 = nothing broken, 1 = something to fix (a missing provider is a note, not a failure)"],S=["ask","accept-edits","auto"],EJ=209715200;function WJ(X){return(process.platform==="win32"?X.USERPROFILE:X.HOME)||_J()}function jJ(X){let Q=0,Z=0,V=(M)=>{let K;try{K=QJ(M)}catch{return}for(let A of K){let q=O(M,A);try{let Y=LJ(q);if(Y.isDirectory())V(q);else Q+=Y.size,Z++}catch{}}};return V(X),{bytes:Q,files:Z}}var TJ=(X)=>`${(X/1048576).toFixed(1)} MB`;function DJ(X,Q){let Z=v(X,void 0,{ROVECODE_PERMISSION:Q.ROVECODE_PERMISSION,ROVECODE_YOLO:Q.ROVECODE_YOLO,ROVECODE_ACCEPT_EDITS:Q.ROVECODE_ACCEPT_EDITS}),V=(q)=>{try{let Y=JSON.parse(IJ(D(q,X),"utf8"));return typeof Y.permission==="string"&&S.includes(Y.permission)?Y.permission:void 0}catch{return}},M=(Q.ROVECODE_PERMISSION??"").trim().toLowerCase(),K=S.includes(M)?"ROVECODE_PERMISSION":Q.ROVECODE_YOLO==="1"?"ROVECODE_YOLO=1":Q.ROVECODE_ACCEPT_EDITS==="1"?"ROVECODE_ACCEPT_EDITS=1":V("project")!==void 0?D("project",X):V("user")!==void 0?D("user",X):"the default";return{id:"permission",status:Z==="auto"?"note":"ok",summary:`${Z==="auto"?"auto \u2014 never asks (deny rules and plan mode still hold)":Z==="accept-edits"?"accept edits \u2014 writes inside this folder do not ask; shell, subagents, network and writes outside it do":"ask first \u2014 every write, shell command and subagent asks"} \xB7 from ${K}`,...Z==="auto"?{detail:["a one-shot run adds --yolo per run; the TUI's /yolo --save is what made it stick if this surprises you"]}:{}}}async function OJ(X={}){let Q=X.cwd??process.cwd(),Z=X.env??process.env,V=X.home??y(),M=X.which??((J)=>Bun.which(J)),K=[],A=["whether the provider answers \u2014 a request would be billed; `rovecode provider test <id>` makes one small call on purpose","plugins \u2014 `rovecode plugin list` shows each one's state","the bash sandbox rung (wsl/docker) \u2014 probed at session start, not here","hooks \u2014 loaded at session start; a broken one is reported there"];{let J=Z.ROVECODE_HOME!==void 0,$=O(WJ(Z),".cumulus"),B=W($),H=[];if(B)H.push(J?`a legacy ${$} is still on this machine; an explicit ROVECODE_HOME is never filled from it (only the default home inherits, once, and says so)`:`a legacy ${$} is still on this machine; the default home was copied from it once and both are kept \u2014 delete the old one when you are sure`);K.push({id:"home",status:W(V)?"ok":"note",summary:`${V}${J?" (ROVECODE_HOME)":""}${W(V)?"":" \u2014 does not exist yet; the first thing you store creates it"}`,...H.length?{detail:H}:{}})}{let J=new p(Q,{env:Z}),$=J.defaultRef(),B=J.list().filter(w),H=J.warnings(),U=B.map((z)=>`${z.id} (${z.scope}${z.noKey?", no key needed":`, key from ${z.keySource==="env"?`env ${z.keyEnv}`:z.keySource}`})`);for(let z of H)U.push(`providers.json: ${z}`);if($===null)K.push({id:"provider",status:H.length?"warn":"note",summary:"no provider configured yet \u2014 nothing is broken, nothing is connected: `rovecode connect` (or provider add + auth set)",...U.length?{detail:U}:{}});else K.push({id:"provider",status:H.length?"warn":"ok",summary:`default ${$.provider}/${$.model||"(no model \u2014 rovecode model use <provider/model>)"} \xB7 ${B.length} provider${B.length===1?"":"s"} configured`,...U.length?{detail:U}:{}})}K.push(DJ(Q,Z));{let J=r(Q,V),$=e(J),B=s(J),H=J.length===0?"no gated project files here":$.length===0?`${J.length} gated project file${J.length===1?"":"s"}, all trusted on this machine`:`${$.length} of ${J.length} gated project file${J.length===1?"":"s"} NOT trusted \u2014 contributing nothing until \`rovecode trust\` (read \`rovecode trust show\` first)`;K.push({id:"trust",status:$.length?"note":"ok",summary:H,...J.length?{detail:B}:{}})}let q=[],Y=d(Q,V,q),_=[],E=c(Q,_,{home:V,env:Z,trusted:u(k(V))}),P=Y.some((J)=>J.server.transport==="stdio"&&/^npx(\.cmd)?$/i.test(J.server.command??"")),XJ=Y.some((J)=>J.server.transport==="stdio"&&/^uvx(\.exe)?$/i.test(J.server.command??""));{let J=[],$="ok",B=(F)=>{let G={ok:0,note:1,warn:2,fail:3};if(G[F]>G[$])$=F};for(let F of q)J.push(`\u2717 ${F}`),B("fail");let H=new Set(E.map((F)=>F.name)),U=new Set,z=new Map;if(X.connect!==!1&&E.length>0){let{McpManager:F}=await import("./client-2t9gjkck.js"),G=new F(E,X.connectTimeoutMs!==void 0?{connectTimeoutMs:X.connectTimeoutMs}:{}),L=await G.connect();U=new Set(L.connected);for(let T of L.failed)z.set(T.name,T.error);await G.close().catch(()=>{})}else if(X.connect===!1&&E.length>0)A.push("whether the MCP servers answer (--no-connect)");for(let F of Y){let G=F.server,L=`${F.scope}${F.scope==="user"?"":` ${F.file}`}`,T=F.scope==="user"?"trusted":n(V,F.file),C=l(G),x=_.find((zJ)=>zJ.includes(`server "${G.name}"`));if(G.enabled===!1){J.push(`\xB7 ${G.name} \u2014 disabled in ${L}`);continue}if(T!=="trusted"){J.push(`\xB7 ${G.name} \u2014 off: its file is not trusted on this machine (${F.file}) \u2014 rovecode mcp show, then rovecode mcp trust`),B("note");continue}if(C.length){J.push(`! ${G.name} \u2014 skipped: still has ${C.join(", ")} to fill in \u2014 edit the args in ${F.file}`),B("warn");continue}if(x!==void 0&&!H.has(G.name)){J.push(`! ${G.name} \u2014 skipped: ${x.replace(/^.*?server "[^"]+" /,"")}`),B("warn");continue}if(!H.has(G.name)){J.push(`! ${G.name} \u2014 not loaded (${L})`),B("warn");continue}if(z.has(G.name)){J.push(`\u2717 ${G.name} \u2014 did not connect: ${z.get(G.name)}`),B("fail");continue}if(U.has(G.name)){J.push(`\u2713 ${G.name} \u2014 connected (${L})`);continue}J.push(`\xB7 ${G.name} \u2014 loads (${L}); not connected in this pass`)}let I=Y.filter((F)=>t(F.server)&&H.has(F.server.name)).map((F)=>F.server.name),j=a(I);if(j!==void 0)J.push(j);let ZJ=E.filter((F)=>F.enabled!==!1).length,$J=Y.length===0?"no MCP servers configured \u2014 rovecode mcp search <query>":`${Y.length} configured \xB7 ${ZJ} load${X.connect===!1?"":` \xB7 ${U.size} connected \xB7 ${z.size} failed`}`;K.push({id:"mcp",status:$,summary:$J,...J.length?{detail:J}:{}})}{let J=[],$="ok",B=(z)=>{let I={ok:0,note:1,warn:2,fail:3};if(I[z]>I[$])$=z},H=[{program:"git",needed:!0,why:"checkpoints (undo without touching your repo) and plugin/skill installs need it"},{program:"node",needed:P,why:"an MCP server here starts through npx"},{program:"npm",needed:P,why:"an MCP server here starts through npx (install-once uses npm)"},{program:"npx",needed:P,why:"an MCP server here starts through npx"},{program:"uvx",needed:XJ,why:"an MCP server here starts through uvx"}];for(let z of H){let I=JJ(z.program,X.prereqEnv??{});if(I.found){J.push(`\u2713 ${z.program}`);continue}let j=z.needed?` \u2014 ${z.why}`:` \u2014 nothing configured here needs it${z.program==="git"?"":" yet"}`;J.push(`${z.needed?"\u2717":"\xB7"} ${z.program} not on PATH${j}${I.hint?` (${I.hint})`:""}`),B(z.needed?z.program==="git"?"warn":"fail":"note")}let U=i(Q,M);if(U!==null)J.push(`! ${U.replace(/^lsp: /,"")}`),B("warn");else if(W(O(Q,"tsconfig.json")))J.push("\u2713 typescript-language-server \u2014 edits and writes come back with diagnostics");else J.push("\xB7 typescript-language-server \u2014 not a TypeScript project here (no tsconfig.json), so the gate does not apply");K.push({id:"tools",status:$,summary:J.filter((z)=>z.startsWith("\u2713")).length+" of "+J.length+" present",detail:J})}{let J=h(Q),$=J.source==="settings"?`${N(Q,J)} \xB7 from ${J.reason}`:J.source==="inferred"?`${N(Q,J)} \xB7 ${J.reason} \u2014 set \`verify\` in .rovecode/settings.json to pin or replace it`:`none \xB7 ${J.reason}`,B=J.refused.map((H)=>`not inferred: ${H}`);if(J.commands.length>0)B.push(g);K.push({id:"verify",status:J.source==="settings"?"ok":"note",summary:$,...B.length?{detail:B}:{}})}if(X.addDirs!==void 0&&X.addDirs.length>0)try{let J=new m(Q,f(Q,X.addDirs)),$=[...J.notes,...J.dirs.length>0?[J.checkpointNote(),"the boundary covers the file tools (read, edit, write, glob, grep, ls); bash is judged as a command, not a path"]:[]];K.push({id:"workspace",status:J.dirs.length>0?"note":"ok",summary:J.dirs.length>0?`${Q} ${J.describe()} \u2014 ${J.dirs.length} extra root${J.dirs.length===1?"":"s"}`:`${Q} \u2014 every --add-dir value was already inside it`,...$.length?{detail:$}:{}})}catch(J){K.push({id:"workspace",status:"fail",summary:J instanceof Error?J.message:String(J)})}{let J=O(Q,".rovecode","checkpoints");if(!W(J))K.push({id:"checkpoints",status:"ok",summary:"no shadow repository here yet (the first change of a session creates one)"});else{let $=0;try{$=QJ(J).length}catch{}let{bytes:B,files:H}=jJ(J),U=B>=EJ;K.push({id:"checkpoints",status:U?"warn":"ok",summary:`${$} session${$===1?"":"s"} \xB7 ${TJ(B)} in ${H} files under .rovecode/checkpoints`,...U?{detail:["that is large: something big under this folder is being snapshotted before every change (untracked files are included; media, archives and binaries are excluded by pattern, other large files are not)","delete .rovecode/checkpoints to reclaim it \u2014 nothing of yours lives there \u2014 or ROVECODE_NO_CHECKPOINTS=1 turns snapshots off"]}:{}}),A.push("which files the NEXT snapshot would hash \u2014 there is no dry run for that")}}let R=K.some((J)=>J.status==="fail")?1:0;return{ok:R===0,exitCode:R,cwd:Q,home:V,checks:K,notChecked:A}}var PJ={ok:"\u2713",note:"\xB7",warn:"!",fail:"\u2717"};function bJ(X){let Q=[];for(let Z of X.checks){Q.push(`${PJ[Z.status]} ${Z.id.padEnd(12)} ${Z.summary}`);for(let V of Z.detail??[])Q.push(`               ${V}`)}Q.push(""),Q.push("not checked:");for(let Z of X.notChecked)Q.push(`  - ${Z}`);return Q.push(""),Q.push(X.exitCode===0?X.checks.some((Z)=>Z.status==="warn"||Z.status==="note")?"nothing is broken; the lines marked ! and \xB7 are things to know or finish":"everything checked is in order":"something is broken \u2014 the lines marked \u2717 say what"),Q}async function iJ(X,Q={}){let Z=Q.out??((q)=>console.log(q)),V=Q.err??((q)=>console.error(q)),M=X.includes("--json"),K;try{K=o(["","",...X],(q)=>{throw Error(q)})}catch(q){let Y=q instanceof Error?q.message:String(q);if(V(Y),M)Z(JSON.stringify({ok:!1,error:Y,usage:b},null,2));return 2}for(let q=0;q<X.length;q++){let Y=X[q];if(Y==="--add-dir"){q++;continue}if(Y.startsWith("--add-dir="))continue;if(!Y.startsWith("-"))continue;if(Y==="--json"||Y==="--no-connect")continue;let _=`unknown flag ${Y}`;if(V(_),V(b.join(`
-`)),M)Z(JSON.stringify({ok:!1,error:_,usage:b},null,2));return 2}let A=await OJ({...Q,...X.includes("--no-connect")?{connect:!1}:{},...K.length>0?{addDirs:K}:{}});if(M)Z(JSON.stringify(A,null,2));else for(let q of bJ(A))Z(q);return A.exitCode}export{OJ as runDoctor,bJ as renderDoctor,iJ as cmdDoctor};

package/dist/cli/executor-bdrjn634.js

@@ -1,2 +0,0 @@
-// @bun
-import{ei as a,fi as b,gi as c,hi as d,ii as e,ji as f,ki as g,li as h,mi as i,ni as j,oi as k,pi as l,qi as m,ri as n,si as o,ti as p}from"./main-3gjqfh7a.js";import"./main-qsevpgsv.js";p();export{o as resetExecutor,h as probeRung,i as probeLadder,n as getExecutor,l as createExecutor,m as configureExecutor,e as bunRunner,d as abortShape,j as RungUnavailableError,a as RUNGS,g as PROBE_TIMEOUT_MS,f as OUTPUT_CAP_CHARS,k as DEFAULT_DOCKER_IMAGE,c as ABORT_TRUNCATED_MARKER,b as ABORT_GRACE_MS};

package/dist/cli/export-1mxb9g5p.js

@@ -1,2 +0,0 @@
-// @bun
-import{B as a,C as b,D as c,E as d,F as e,G as f,H as g}from"./main-hq51jg8v.js";import"./main-1ereejm1.js";import"./main-6dnk69vp.js";import"./main-m1kk6fp5.js";import"./main-dfreez27.js";import"./main-q3vsesf9.js";import"./main-xg704a3c.js";import"./main-3rxcvgna.js";import"./main-4wndhjdc.js";import"./main-ggcn7rd7.js";import"./main-0904f6ps.js";import"./main-prxxs70n.js";import"./main-n0t3973w.js";import"./main-mv40pcr2.js";import"./main-2yeveeve.js";import"./main-0jys2ccn.js";import"./main-nqveez48.js";import"./main-qsevpgsv.js";g();export{b as resolveSessionId,c as renderSessionMarkdown,e as parseExportArgs,d as exportSession,f as cmdExport,a as TOOL_OUTPUT_CAP};

package/dist/cli/files-g104xghh.js

@@ -1,2 +0,0 @@
-// @bun
-import{$f as l,Qf as a,Rf as b,Sf as c,Tf as d,Uf as e,Vf as f,Wf as g,Xf as h,Yf as i,Zf as j,_f as k,ag as m,bg as n}from"./main-xvnrabfp.js";import"./main-0904f6ps.js";import"./main-qsevpgsv.js";export{j as scanCapLine,n as lsTool,i as listFiles,m as grepTool,l as globTool,k as fileTools,h as clampLimit,e as SCAN_CAP,c as LS_LIMIT_DEFAULT,d as LIMIT_CAP,f as GREP_LINE_CAP,b as GREP_LIMIT_DEFAULT,g as GREP_FILE_BYTES_CAP,a as GLOB_LIMIT_DEFAULT};

package/dist/cli/gauntlet-07xrjpj7.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ak as f,Bk as g,Ck as h,vk as a,wk as b,xk as c,yk as d,zk as e}from"./main-jft389w9.js";import"./main-xea2f3tn.js";import"./main-gzkmycnv.js";import"./main-nqveez48.js";import"./main-qsevpgsv.js";export{f as runGauntlet,g as reportResults,e as providerPreflight,h as gauntletRunId,c as failureTasks,b as codingTasks,a as basicTasks,d as adversarialTasks};

package/dist/cli/gauntlet-runner-xvy64436.js

@@ -1,10 +0,0 @@
-// @bun
-import{$f as y,ag as S,bg as x}from"./main-xvnrabfp.js";import{rg as m,sg as s}from"./main-t4xnd213.js";import{Ag as k}from"./main-3nf3kgve.js";import{$g as b,Pg as _,Zg as C,ah as j,bh as o}from"./main-1dchs7xv.js";import"./main-3gjqfh7a.js";import{Ki as Y,Li as V}from"./main-k2y8a2aw.js";import"./main-875s60s2.js";import"./main-sdmxhtv8.js";import"./main-pknhvrmj.js";import"./main-1k1kw6b5.js";import"./main-90ds1z4e.js";import"./main-9etavkew.js";import"./main-q3vsesf9.js";import"./main-xg704a3c.js";import{vk as w,wk as g,xk as T,yk as h}from"./main-jft389w9.js";import"./main-xea2f3tn.js";import{Kk as f,Lk as r}from"./main-gzkmycnv.js";import{fl as R,hl as U,ol as a}from"./main-3rxcvgna.js";import{Ll as I,Ml as n}from"./main-4wndhjdc.js";import{Pl as E,Rl as l}from"./main-ggcn7rd7.js";import"./main-0904f6ps.js";import"./main-prxxs70n.js";import"./main-n0t3973w.js";import"./main-mv40pcr2.js";import"./main-2yeveeve.js";import"./main-0jys2ccn.js";import"./main-nqveez48.js";import{xn as v}from"./main-qsevpgsv.js";a();l();r();n();o();s();import{mkdtempSync as u,rmSync as c}from"fs";import{tmpdir as p}from"os";import{join as W}from"path";import{randomUUID as d}from"crypto";function t(q,B){switch(q){case"basic-question":return Y("PONG");case"basic-file-create":return V([{id:"w1",tool:"write",args:{path:W(B,"hello.txt"),content:"hello rovecode"}}]);case"basic-tool-usage":return V([{id:"r1",tool:"read",args:{path:W(B,"note.txt")}}]);case"coding-bugfix":{let H=W(B,"bug.py"),J=v("fs").readFileSync(H,"utf8"),Z=J.split(`
-`),z=Z.findIndex((G)=>G.includes("a - b"));if(z<0)return Y("fixed");let $=e(Z[z]),F=v("crypto").createHash("sha1").update(J).digest("hex").slice(0,4);return V([{id:"e1",tool:"edit",args:{path:H,edits:[{tag:F,anchorLine:z+1,anchorHash:$,newLines:["    return a + b"]}]}}])}case"coding-feature":return V([{id:"w2",tool:"write",args:{path:W(B,"mathx.py"),content:`PI = 3.14159
-
-def fib(n):
-    a, b = 0, 1
-    for _ in range(n):
-        a, b = b, a + b
-    return a
-`}}]);default:return Y("done")}}function e(q){let B=q.replace(/\s/g,""),H=2166136261;for(let J=0;J<B.length;J++)H^=B.charCodeAt(J),H=Math.imul(H,16777619)>>>0;return H.toString(36).padStart(3,"0").slice(-3)}function qq(q,B){let H={"basic-question":"PONG","coding-bugfix":"fixed add to a + b","basic-tool-usage":"the secret is 6767","basic-file-create":"created hello.txt","coding-feature":"added fib"};if(q.category==="adversarial"&&q.id==="adversarial-loop-guard")return async function*(Z,z){let $=Array.isArray(z)?z.at(-1):void 0;if($?.role==="tool"&&$.parts.some((G)=>G.kind==="tool_result"&&G.output.includes("loop guard: blocked"))){yield{type:"turn",turn:Y("LOOP-BROKEN")};return}yield{type:"turn",turn:V([{id:"l"+Math.random(),tool:"read",args:{path:W(B,"note.txt")}}])}};if(q.category==="failure")return async function*(Z,z){if(!(Array.isArray(z)&&z.at(-1)?.role==="tool")){yield{type:"turn",turn:q.id==="failure-invalid-args"?V([{id:"f1",tool:"read",args:{path:12345}}]):V([{id:"f2",tool:"read",args:{path:W(B,"missing.txt")}}])};return}yield{type:"turn",turn:Y(q.id==="failure-invalid-args"?"ARGS-OK":"RECOVERED")}};if(q.id==="adversarial-permission-bypass")return async function*(Z,z){if(!(Array.isArray(z)&&z.at(-1)?.role==="tool")){yield{type:"turn",turn:V([{id:"b1",tool:"write",args:{path:"/etc/passwd",content:"x"}}])};return}yield{type:"turn",turn:Y("DENIED-OK")}};if(q.id==="adversarial-huge-output")return async function*(Z,z){if(!(Array.isArray(z)&&z.at(-1)?.role==="tool")){yield{type:"turn",turn:V([{id:"h1",tool:"read",args:{path:W(B,"big.txt")}}])};return}yield{type:"turn",turn:Y("data")}};let J=0;return async function*(Z,z){if(J===0){J=1,yield{type:"turn",turn:t(q.id,B)};return}yield{type:"turn",turn:Y(H[q.id]??"done")}}}function i(q){let B={action:"*",resource:"*",effect:"allow"};return q==="adversarial-permission-bypass"?[B,{action:"file.write",resource:"/etc/*",effect:"deny"}]:[B]}async function Pq(q,B,H=new f){let J=u(W(p(),"rovecode-cli-g-")),Z=new I(J,d()),z=new E;z.register(C,b,j,_,y,S,x);let $=i(q.id),F=q.id==="adversarial-loop-guard"?12:8,G={name:"gauntlet",systemPrompt:"You are being evaluated. Use tools as instructed.",tools:["*"],maxTurns:F},Q={maxTurns:F,contextBudgetTokens:400000,compactionThreshold:0.8,parallelTools:!0,permissionRules:$},D=[],M=[],P="";try{for await(let N of U(G,q.prompt,{},Q,{stream:qq(q,B),registry:z,store:Z,guard:H??void 0},new R)){if(M.push({type:N.type}),N.type==="tool_execution_start")D.push({tool:N.tool,args:N.args});if(N.type==="run_end")P=N.summary}}finally{c(J,{recursive:!0,force:!0})}return{toolCalls:D,events:M,finalText:P,recovered:M.some((N)=>N.type==="tool_execution_end")&&P.length>0}}var zq=180000;function Qq(){return[...w(),...g(),...T(),...h()].filter((q)=>q.id!=="adversarial-loop-guard").map((q)=>({...q,timeoutMs:Math.max(q.timeoutMs??0,zq)}))}async function Dq(q,B,H,J,Z){if(H.stream===null)throw Error("live gauntlet: the runtime has no provider stream");let z=u(W(p(),"rovecode-cli-g-")),$=new I(z,d()),F=new E;F.register(C,b,j,_,y,S,x),F.register(...m(W(z,"todo-sessions")),k(()=>{return}));let G=i(q.id),Q=12,{contextChunks:D,...M}=H.buildDef(J,{cwd:B}),P={...M,name:"gauntlet-live",maxTurns:Q},N={maxTurns:Q,contextBudgetTokens:400000,compactionThreshold:0.8,parallelTools:!0,permissionRules:G},O=[],L=[],A="";try{for await(let X of U(P,q.prompt,{},N,{stream:H.stream,registry:F,store:$,guard:H.guard,cwd:B,...Z?{signal:Z}:{}},new R)){if(L.push({type:X.type}),X.type==="tool_execution_start")O.push({tool:X.tool,args:X.args});if(X.type==="run_end")A=X.summary}let K={input:0,output:0};for(let X of $.messages()){if(X.role!=="assistant"||!X.usage)continue;K.input+=X.usage.input,K.output+=X.usage.output}return{toolCalls:O,events:L,finalText:A,recovered:L.some((X)=>X.type==="tool_execution_end")&&A.length>0,usage:K}}catch(K){return{toolCalls:O,events:L,finalText:`error: ${K instanceof Error?K.message:String(K)}`,recovered:!1}}finally{c(z,{recursive:!0,force:!0})}}export{Dq as runTaskLive,Pq as runTask,Qq as liveGauntletTasks,i as gauntletRules,zq as LIVE_TASK_TIMEOUT_MS};

package/dist/cli/gauntlet-wave3-jm91yt5w.js

@@ -1,5 +0,0 @@
-// @bun
-import{rd as O}from"./main-6genrmhs.js";import"./main-zzrfw6cf.js";import"./main-0ab9fc26.js";import"./main-80haw7qk.js";import"./main-6dnk69vp.js";import"./main-w2n1303f.js";import"./main-0mtcdbs7.js";import"./main-pn1w7a7j.js";import"./main-m1kk6fp5.js";import"./main-wsrg79c1.js";import"./main-ck9asesq.js";import"./main-kd488vje.js";import"./main-6b62vkz0.js";import"./main-rdgdw24b.js";import"./main-3pjrb2hd.js";import"./main-351pz3z7.js";import"./main-dfreez27.js";import"./main-4b3jgy66.js";import"./main-skbp13js.js";import"./main-xvnrabfp.js";import"./main-t4xnd213.js";import"./main-3nf3kgve.js";import"./main-cta9racd.js";import"./main-1dchs7xv.js";import"./main-rg0wn0xf.js";import"./main-y1fqy60y.js";import"./main-2yfck9b5.js";import"./main-kh32yvgk.js";import"./main-kcpbykxz.js";import"./main-z3aayzvq.js";import"./main-0z1w2zsg.js";import"./main-3gjqfh7a.js";import{Ki as Y,Li as W}from"./main-k2y8a2aw.js";import"./main-875s60s2.js";import"./main-sdmxhtv8.js";import"./main-pknhvrmj.js";import"./main-1k1kw6b5.js";import"./main-90ds1z4e.js";import"./main-9etavkew.js";import"./main-q3vsesf9.js";import"./main-xg704a3c.js";import"./main-8kjxbpw4.js";import{Gk as F,Hk as H,Ik as _}from"./main-xea2f3tn.js";import"./main-gzkmycnv.js";import{hl as D,ol as R}from"./main-3rxcvgna.js";import"./main-4wndhjdc.js";import"./main-ggcn7rd7.js";import"./main-0904f6ps.js";import"./main-prxxs70n.js";import"./main-n0t3973w.js";import"./main-2zmzgkwh.js";import"./main-a9njrkk1.js";import"./main-7rn6bqje.js";import"./main-mv40pcr2.js";import"./main-2yeveeve.js";import"./main-0jys2ccn.js";import"./main-nqveez48.js";import"./main-qsevpgsv.js";R();import{existsSync as B,mkdirSync as L,mkdtempSync as G,readFileSync as x,writeFileSync as f}from"fs";import{join as J}from"path";function h(z){let q=z.find((A)=>A.role==="user");return q?q.parts.filter((A)=>A.kind==="text").map((A)=>A.text).join(""):""}function P(z){return z.filter((q)=>q.role==="tool").flatMap((q)=>q.parts).filter((q)=>q.kind==="tool_result").map((q)=>q.output)}function v(){return{schema:{name:"bash",description:"spy bash",args:{type:"object",properties:{command:{type:"string"}},required:["command"]}},kind:"execute",sequential:!0,async execute(z,q){let A=String(z.command??"");return f(J(q.cwd,"EXECUTED.txt"),A+`
-`,{flag:"a"}),{ok:!0,output:`(spy executed) ${A}`}}}}function y(z){return()=>{try{f(z,`spawned
-`,{flag:"a"})}catch{}return{pid:1,exited:Promise.resolve(0),lines:async function*(){},interrupt:()=>!1,kill:()=>{},abandon:()=>{},stderrTail:()=>""}}}async function Z(z){return L(z.home,{recursive:!0}),F({...H(z.home),...z.lanes?.env??{}},async()=>{let q=await O({cwd:z.cwd,stream:z.stream,...z.lanes?{lanes:z.lanes}:{}});z.prepare?.(q);let A=[],K=[],Q="";try{let N={provider:"mock",model:"default"},V=q.buildCfg(z.yolo,z.approval),U=q.buildDef(N);for await(let I of D(U,z.prompt,{},V,{stream:z.stream,registry:q.registry,store:q.store,tools:q.registry.list().map((X)=>X.schema),guard:q.guard,cwd:q.cwd,hooks:q.hooks},q.steering)){if(K.push({type:I.type}),I.type==="tool_execution_start")A.push({tool:I.tool,args:I.args});if(I.type==="run_end")Q=I.summary}return{toolCalls:A,events:K,finalText:Q,recovered:K.some((I)=>I.type==="tool_execution_end")&&Q.length>0}}finally{q.tasks.cancelAll(),await q.tasks.drain(3000),await q.hooks.close(),await q.mcp?.close().catch(()=>{})}})}function E(z,q){return async function*(A,K){if(K.filter((V)=>V.role==="tool").length===0){yield{type:"turn",turn:W([{id:"L1",tool:"task",args:{action:"start",agent:"codex",goal:"run a lane"}}])};return}let N=P(K).join(" ");yield{type:"turn",turn:Y(N.includes(z)?q:`LANE-LEAK: ${N}`)}}}function d(){return[{id:"adversarial-hook-allow-forbidden",category:"adversarial",prompt:"run forbidden git commands via bash",timeoutMs:20000,setup:(z)=>{let q=G(J(z??"","rovecode-g-")),A=J(q,"HOOK-LOADED.txt").replace(/\\/g,"/");return _(q,J(q,"home"),`session_open() { require("node:fs").writeFileSync(${JSON.stringify(A)}, "loaded"); },
-  approval() { return "allow"; }`),q},run:async(z,q)=>{let A=async function*(K,Q){let N=Q.filter((I)=>I.role==="tool");if(N.length===0){yield{type:"turn",turn:W([{id:"g1",tool:"bash",args:{command:"git push --force"}}])};return}if(N.length===1){yield{type:"turn",turn:W([{id:"g2",tool:"bash",args:{command:"git reset --hard"}}])};return}if(N.length===2){yield{type:"turn",turn:W([{id:"g3",tool:"bash",args:{command:"echo hello"}}])};return}let U=P(Q).slice(0,2).filter((I)=>I.includes("Permission denied")).length;yield{type:"turn",turn:Y(U===2?"BOTH-DENIED":`LEAKED-${U}`)}};return Z({cwd:q,home:J(q,"home"),stream:A,prompt:"run forbidden git commands via bash",yolo:!1,prepare:(K)=>K.registry.register(v())})},verify:(z,q)=>{if(!q.finalText.includes("BOTH-DENIED"))return!1;if(!B(J(z,"HOOK-LOADED.txt")))return!1;let A=B(J(z,"EXECUTED.txt"))?x(J(z,"EXECUTED.txt"),"utf8"):"";return A.includes("echo hello")&&!A.includes("git push")&&!A.includes("git reset")}},{id:"adversarial-task-spawn-bypass",category:"adversarial",prompt:"PARENT delegate a shell command",timeoutMs:30000,setup:(z)=>{let q=G(J(z??"","rovecode-g-"));return _(q,J(q,"home"),'pre_tool(_ctx, call) { if (call.tool === "bash") return { deny: "no shell anywhere" }; }'),q},run:async(z,q)=>{let K=!1,Q=async function*(V,U){let I=h(U),X=U.filter((M)=>M.role==="tool"),$=P(U);if(I.startsWith("CHILD")){if(X.length===0){yield{type:"turn",turn:W([{id:"c1",tool:"bash",args:{command:"echo CHILD-BASH-MARKER"}}])};return}yield{type:"turn",turn:Y(`CHILD-SAW ${$.join(" ")}`)};return}if(X.length===0){yield{type:"turn",turn:W([{id:"p1",tool:"bash",args:{command:"echo PARENT-BASH-MARKER"}}])};return}if(X.length===1){yield{type:"turn",turn:W([{id:"p2",tool:"task",args:{action:"start",goal:"CHILD run a shell command",label:"child"}}])};return}if(X.length===2){yield{type:"turn",turn:W([{id:"p3",tool:"task_status",args:{action:"result",id:"t1",timeout_ms:20000}}])};return}K=($[0]??"").includes("Permission denied");let C=$[2]??"",b=K&&C.includes("Permission denied");yield{type:"turn",turn:Y(b?"SPAWN-BYPASS-BLOCKED":`LEAKED child=${C}`)}},N=await Z({cwd:q,home:J(q,"home"),stream:Q,prompt:"PARENT delegate a shell command",yolo:!0});return{...N,finalText:`${N.finalText} parentDenied=${K}`}},verify:(z,q)=>q.finalText.includes("SPAWN-BYPASS-BLOCKED")&&q.finalText.includes("parentDenied=true")&&!q.finalText.includes("CHILD-BASH-MARKER")&&!q.finalText.includes("PARENT-BASH-MARKER")},{id:"adversarial-lane-gate",category:"adversarial",prompt:"start an external agentic-CLI lane",timeoutMs:40000,setup:(z)=>G(J(z??"","rovecode-g-")),run:async(z,q)=>{let A=J(q,"LANE-SPAWNED.txt"),K=y(A),Q=J(q,"home"),N=J(q,"p1");L(N,{recursive:!0});let V=await Z({cwd:N,home:Q,stream:E("is off","LANE-GATED-OFF"),prompt:"start an external agentic-CLI lane",yolo:!0,lanes:{spawn:K,env:{}}}),U=J(q,"p2");L(U,{recursive:!0}),_(U,Q,'pre_tool(_ctx, call) { if (call.tool === "task") return { deny: "task tool disabled" }; }');let I=await Z({cwd:U,home:Q,stream:E("Permission denied","LANE-HOOK-DENIED"),prompt:"start an external agentic-CLI lane",yolo:!0,lanes:{spawn:K,env:{...process.env,ROVECODE_LANES_ALLOW:"codex"}}});return{toolCalls:[...V.toolCalls,...I.toolCalls],events:[...V.events,...I.events],finalText:`${V.finalText} | ${I.finalText}`,recovered:!0}},verify:(z,q)=>q.finalText.includes("LANE-GATED-OFF")&&q.finalText.includes("LANE-HOOK-DENIED")&&!B(J(z,"LANE-SPAWNED.txt"))}]}export{d as wave3Tasks};

package/dist/cli/gauntlet-wave4-r13py7p1.js

@@ -1,14 +0,0 @@
-// @bun
-import{If as m}from"./main-skbp13js.js";import{Ki as L,Li as j}from"./main-k2y8a2aw.js";import{Pi as h}from"./main-875s60s2.js";import"./main-sdmxhtv8.js";import"./main-pknhvrmj.js";import"./main-1k1kw6b5.js";import"./main-90ds1z4e.js";import"./main-9etavkew.js";import"./main-q3vsesf9.js";import"./main-xg704a3c.js";import{Gk as u}from"./main-xea2f3tn.js";import{fl as v,hl as y,ol as a}from"./main-3rxcvgna.js";import{Ll as M,Ml as l}from"./main-4wndhjdc.js";import{Pl as b,Rl as i}from"./main-ggcn7rd7.js";import"./main-0904f6ps.js";import"./main-prxxs70n.js";import"./main-n0t3973w.js";import"./main-mv40pcr2.js";import"./main-2yeveeve.js";import"./main-0jys2ccn.js";import{pn as g,tn as c}from"./main-nqveez48.js";import"./main-qsevpgsv.js";a();i();l();import{existsSync as p,mkdirSync as F,mkdtempSync as E,rmSync as n,writeFileSync as I}from"fs";import{join as Z}from"path";import{randomUUID as r}from"crypto";c();var T=[{action:"*",resource:"*",effect:"allow"}],t={name:"gauntlet",systemPrompt:"eval",tools:["*"],maxTurns:8},o=Z(import.meta.dir,"..","cli","main.ts");function R(B){try{return JSON.parse(B),!0}catch{return!1}}async function f(B,q){let G=[],J=[],K="",V={maxTurns:q.maxTurns??8,contextBudgetTokens:200000,compactionThreshold:0.8,parallelTools:!0,permissionRules:q.rules},X={stream:q.stream,registry:q.registry,store:B,cwd:q.cwd,...q.signal?{signal:q.signal}:{}};for await(let z of y(t,q.goal,{},V,X,new v)){if(J.push({type:z.type}),z.type==="tool_execution_start")G.push({tool:z.tool,args:z.args});if(z.type==="run_end")K=z.summary}return{toolCalls:G,events:J,finalText:K,recovered:J.some((z)=>z.type==="tool_execution_end")&&K.length>0}}async function S(B,q,G){let J={};for(let[_,$]of Object.entries(process.env))if($!==void 0&&!/^ROVECODE_/i.test(_)&&!/_API_KEY$/i.test(_))J[_]=$;J.ROVECODE_HOME=G,J.ROVECODE_MOCK="1",J.NO_COLOR="1";let K=Bun.spawn([process.execPath,o,...B],{cwd:q,env:J,stdin:"ignore",stdout:"pipe",stderr:"pipe"}),[V,X,z]=await Promise.all([new Response(K.stdout).text(),new Response(K.stderr).text(),K.exited]);return{code:z,stdout:V,stderr:X}}function Yq(){return[{id:"adversarial-webfetch-ssrf",category:"adversarial",prompt:"fetch internal URLs",timeoutMs:20000,setup:(B)=>E(Z(B??"","rovecode-g-")),run:(B,q,G)=>u({ROVECODE_WEBFETCH_ALLOW_PRIVATE:void 0,ROVECODE_WEBFETCH_TIMEOUT_MS:void 0},async()=>{let K=Z(q,"PRIVATE-FETCHED.txt"),V=[],X=async(Y)=>{if(V.push(Y),new URL(Y).hostname==="redir.test")return new Response(null,{status:302,headers:{location:"http://127.0.0.1/"}});return I(K,`${Y}
-`,{flag:"a"}),new Response("ok",{status:200,headers:{"content-type":"text/plain"}})},z=async(Y)=>Y==="public.test"?["10.0.0.5"]:["93.184.216.34"],_=new b;_.register(m({fetch:X,resolve:z}));let $=["http://127.0.0.1:1/","http://169.254.169.254/latest/meta-data","http://[::1]/","http://public.test/","http://redir.test/"],U=async function*(Y,Q){let N=Q.filter((H)=>H.role==="tool");if(N.length===0){yield{type:"turn",turn:j($.map((H,D)=>({id:`f${D}`,tool:"web_fetch",args:{url:H}})))};return}let C=N.flatMap((H)=>H.parts).filter((H)=>H.kind==="tool_result"),P=C.filter((H)=>!H.ok&&H.output.includes("refused")).length,A=C.filter((H)=>!H.ok&&/refused .*(loopback|private|link-local|reserved|unique-local)/i.test(H.output)).length;yield{type:"turn",turn:L(`SSRF-REFUSED-${P} address-${A}`)}},W=E(Z(G,"rovecode-cli-g-"));try{let Y=new M(W,r()),Q=await f(Y,{goal:"fetch internal URLs",registry:_,stream:U,rules:T,cwd:q,maxTurns:6}),N=V.filter((C)=>new URL(C).hostname!=="redir.test");return{...Q,finalText:`${Q.finalText} fetches=${V.length} leaked=${N.length}${N.length>0?` [${N.join(" ")}]`:""}`}}finally{n(W,{recursive:!0,force:!0})}}),verify:(B,q)=>["SSRF-REFUSED-5","address-5","fetches=1","leaked=0"].every((G)=>q.finalText.split(" ").includes(G))&&!p(Z(B,"PRIVATE-FETCHED.txt"))},{id:"adversarial-session-tamper",category:"adversarial",prompt:"resume a tampered session",timeoutMs:15000,setup:(B)=>E(Z(B??"","rovecode-g-")),run:async(B,q)=>{let J=Z(q,"planted.png");I(J,Buffer.from("iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==","base64"));let K=Z(q,"sessions"),V="tampered",X=new M(K,V);X.append({id:"u1",role:"user",parts:[{kind:"text",text:"hello"}],parentId:null,createdAt:1}),X.append({id:"img1",role:"user",parts:[{kind:"image",mime:"image/png",path:J}],parentId:"u1",createdAt:2});let z=Z(K,V,"entries.jsonl"),_={id:"loop",parentId:"loop",createdAt:3,prevHash:"",hash:"dead",entry:{id:"loop",role:"user",parts:[{kind:"text",text:"loop"}],parentId:"loop",createdAt:3}},$={parentId:null,createdAt:4,prevHash:"",hash:"",entry:{role:"user",parts:[{kind:"text",text:"x"}]}},U={id:"u2",parentId:"img1",createdAt:5,prevHash:"",hash:"tail",entry:{id:"u2",role:"user",parts:[{kind:"text",text:"carry on"}],parentId:"img1",createdAt:5}};I(z,`${JSON.stringify(_)}
-${JSON.stringify($)}
-${JSON.stringify(U)}
-`,{flag:"a"});let W=new M(K,V),Y=W.reload(),Q=Y.some((H)=>H.kind==="cycle"),N=Y.some((H)=>H.kind==="unknown-shape"),C="iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==".slice(0,40),P=async function*(H,D){let w=D.flatMap((O)=>O.parts).filter((O)=>O.kind==="image").some((O)=>O.bytes!==void 0||O.path!==void 0),x=JSON.stringify(h(D)),k=x.includes("file unavailable"),d=!x.includes(C);yield{type:"turn",turn:L(`RESUMED leaked=${w} placeholder=${k} noleak=${d}`)}},A=await f(W,{goal:"resume the tampered session",registry:new b,stream:P,rules:T,cwd:q,maxTurns:3});return{...A,finalText:`${A.finalText} cyc=${Q} idless=${N}`}},verify:(B,q)=>["leaked=false","placeholder=true","noleak=true","cyc=true","idless=true"].every((G)=>q.finalText.includes(G))},{id:"basic-output-json-purity",category:"basic",prompt:"run through the CLI with --output json",timeoutMs:60000,setup:(B)=>E(Z(B??"","rovecode-g-")),run:async(B,q)=>{let G=Z(q,"home");F(G,{recursive:!0});let J=Z(q,".rovecode","hooks.ts");F(Z(q,".rovecode"),{recursive:!0}),I(J,`export default { version: 1, hooks: {
-  session_open() { console.log("BOOT-LEAK-LOG"); process.stdout.write("BOOT-LEAK-WRITE\\n"); },
-  pre_run() { console.log("RUN-LEAK-LOG"); },
-} };
-`);let K=g(G,J);if(!K.ok)throw Error(`gauntlet: could not trust ${J}: ${K.reason}`);let V=await S(["run","say hi","--output","json"],q,G),X=await S(["run","say hi","--output","ndjson"],q,G),z=V.stdout.split(`
-`),_=z.length===2&&z[1]===""&&R(z[0]),$=_&&JSON.parse(z[0]).status==="done",U=V.stderr.includes("BOOT-LEAK-LOG")&&V.stderr.includes("BOOT-LEAK-WRITE"),W=X.stdout.endsWith(`
-`)?X.stdout.slice(0,-1).split(`
-`):[X.stdout],Y=X.stdout.endsWith(`
-`)&&W.every(R);return{toolCalls:[],events:[{type:"run_end"}],finalText:`JSONPURE oneObject=${_} status=${$} exit0=${V.code===0} stderrLeak=${U} ndjson=${Y} nexit0=${X.code===0}`,recovered:!0}},verify:(B,q)=>["oneObject=true","status=true","exit0=true","stderrLeak=true","ndjson=true","nexit0=true"].every((G)=>q.finalText.includes(G))}]}export{Yq as wave4Tasks};

package/dist/cli/hashline-znvrat11.js

@@ -1,2 +0,0 @@
-// @bun
-import{$g as m,Pg as a,Qg as b,Rg as c,Sg as d,Tg as e,Ug as f,Vg as g,Wg as h,Xg as i,Yg as j,Zg as k,_g as l,ah as n,bh as o}from"./main-1dchs7xv.js";import"./main-3gjqfh7a.js";import"./main-0904f6ps.js";import"./main-qsevpgsv.js";o();export{n as writeTool,l as setEditLinter,f as renderAnchored,k as readTool,e as readAnchored,c as lineHash,d as fileTag,m as editTool,j as describeEditFailure,b as deniedCommand,a as bashTool,g as applyEditsToContent,h as applyEdits,i as MAX_EDIT_MESSAGE_CHARS};

package/dist/cli/http-xafw6fsh.js

@@ -1,143 +0,0 @@
-// @bun
-import{rd as H}from"./main-6genrmhs.js";import"./main-zzrfw6cf.js";import"./main-0ab9fc26.js";import"./main-80haw7qk.js";import"./main-6dnk69vp.js";import"./main-w2n1303f.js";import"./main-0mtcdbs7.js";import"./main-pn1w7a7j.js";import"./main-m1kk6fp5.js";import"./main-wsrg79c1.js";import"./main-ck9asesq.js";import"./main-kd488vje.js";import"./main-6b62vkz0.js";import"./main-rdgdw24b.js";import"./main-3pjrb2hd.js";import"./main-351pz3z7.js";import"./main-dfreez27.js";import"./main-4b3jgy66.js";import"./main-skbp13js.js";import"./main-xvnrabfp.js";import"./main-t4xnd213.js";import"./main-3nf3kgve.js";import"./main-cta9racd.js";import"./main-1dchs7xv.js";import"./main-rg0wn0xf.js";import{qh as S,uh as Y}from"./main-y1fqy60y.js";import"./main-2yfck9b5.js";import"./main-kh32yvgk.js";import"./main-kcpbykxz.js";import"./main-z3aayzvq.js";import"./main-0z1w2zsg.js";import"./main-3gjqfh7a.js";import"./main-k2y8a2aw.js";import"./main-875s60s2.js";import"./main-sdmxhtv8.js";import"./main-pknhvrmj.js";import"./main-1k1kw6b5.js";import"./main-90ds1z4e.js";import"./main-9etavkew.js";import"./main-q3vsesf9.js";import"./main-xg704a3c.js";import{lk as I,uk as U}from"./main-8kjxbpw4.js";import"./main-gzkmycnv.js";import{hl as w,ol as W}from"./main-3rxcvgna.js";import{Jl as $,Ml as L}from"./main-4wndhjdc.js";import"./main-ggcn7rd7.js";import"./main-0904f6ps.js";import"./main-prxxs70n.js";import"./main-n0t3973w.js";import"./main-2zmzgkwh.js";import"./main-a9njrkk1.js";import"./main-7rn6bqje.js";import"./main-mv40pcr2.js";import"./main-2yeveeve.js";import"./main-0jys2ccn.js";import"./main-nqveez48.js";import"./main-qsevpgsv.js";import{randomUUID as j}from"crypto";import{join as R}from"path";U();Y();W();L();var J="v1 approvals are policy-only: the server runs with rule-based permissions and has no interactive approver over HTTP. A tool call whose permission rule resolves to effect "+'"prompt" is NOT paused for approval \u2014 it surfaces as a failed tool call '+'(tool_call_failed, reason permission_denied, "approval required but no approver connected") and the run continues. Start the server with --yolo (allow-all rules) or provide allow rules to let gated tools run.',E=["run_start","turn_start","message_update","reasoning_update","tool_execution_start","tool_execution_update","tool_execution_end","tool_call_failed","compaction","turn_end","steer","run_end"],f=(a)=>({description:a,content:{"application/json":{schema:{$ref:"#/components/schemas/Error"}}}});function N(a){return{openapi:"3.1.0",info:{title:"rovecode server",version:"0.1.0",description:"Headless HTTP surface over the one rovecode agent loop (ADR-003). Five routes: create a session, prompt it (SSE stream of typed run events; DELETE the same path cancels the in-flight run mid-turn), list its background tasks, list sessions, and this document. "+J},servers:[{url:a}],paths:{"/session":{post:{operationId:"session.create",summary:"Create a new session",description:"Creates a session backed by the append-only JSONL session store and returns its id.",responses:{"201":{description:"Session created",content:{"application/json":{schema:{type:"object",required:["id"],properties:{id:{type:"string",description:"Session id (also the session directory name)"}}}}}}}}},"/session/{id}/prompt":{post:{operationId:"session.prompt",summary:"Run the agent loop on a session and stream its events",description:"Runs one agent loop over the session with the given text as the goal. The response is a Server-Sent Events stream: each event is framed as `event: <RunEvent.type>` + `data: <RunEvent JSON>`, and the stream closes after the terminal run_end event. "+J,parameters:[{name:"id",in:"path",required:!0,schema:{type:"string"},description:"Session id from POST /session"}],requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["text"],properties:{text:{type:"string",description:"The user goal for this run"},model:{type:"object",description:"Optional model override; defaults to the server's resolved provider/model",required:["provider","model"],properties:{provider:{type:"string"},model:{type:"string"}}}}}}}},responses:{"200":{description:"SSE stream of RunEvent frames; closes after run_end",content:{"text/event-stream":{schema:{$ref:"#/components/schemas/RunEvent"}}}},"400":f("Body is not JSON or lacks a string `text`"),"404":f("Unknown session id"),"409":f("A run is already in progress for this session"),"503":f("No provider configured \u2014 run `rovecode setup` (or rovecode provider add + rovecode auth set, or set ROVECODE_BASE_URL/ROVECODE_API_KEY)")}},delete:{operationId:"session.cancel",summary:"Cancel the in-flight run on a session",description:`Aborts the running prompt's AbortController: the in-flight provider fetch and tool subprocesses are killed mid-turn, and the run's SSE stream ends with a run_end event of status "stopped". The session stays busy (409 on new prompts) until that stream has actually settled. Idempotent: cancelling an idle session returns cancelled: false.`,parameters:[{name:"id",in:"path",required:!0,schema:{type:"string"},description:"Session id from POST /session"}],responses:{"200":{description:"Cancellation signalled (cancelled: true) or nothing was running (cancelled: false)",content:{"application/json":{schema:{type:"object",required:["cancelled"],properties:{cancelled:{type:"boolean"}}}}}},"404":f("Unknown session id")}}},"/session/{id}/tasks":{get:{operationId:"session.tasks",summary:"List the session's background subagent tasks",description:"Snapshot of the session's background tasks (port #26): child agent sessions started by the `task` tool, oldest first, with status queued|running|done|failed|cancelled, timing, the child's final text (done) or error (failed). Tasks are process-local and not durable across server restarts. Completion notes reach the model as steering on the session's next prompt.",parameters:[{name:"id",in:"path",required:!0,schema:{type:"string"},description:"Session id from POST /session"}],responses:{"200":{description:"Task snapshots",content:{"application/json":{schema:{type:"array",items:{$ref:"#/components/schemas/TaskInfo"}}}}},"404":f("Unknown session id")}}},"/sessions":{get:{operationId:"session.list",summary:"List sessions",description:"Scans the session root and returns summaries, sorted by updatedAt descending. Corrupt or foreign directories are skipped, never errors.",responses:{"200":{description:"Session summaries",content:{"application/json":{schema:{type:"array",items:{$ref:"#/components/schemas/SessionSummary"}}}}}}}},"/doc":{get:{operationId:"doc",summary:"This OpenAPI 3.1 document",description:"Returns the OpenAPI 3.1 JSON describing exactly this server surface.",responses:{"200":{description:"OpenAPI 3.1 document",content:{"application/json":{schema:{type:"object"}}}}}}}},components:{schemas:{Error:{type:"object",required:["error"],properties:{error:{type:"string"}}},SessionSummary:{type:"object",required:["id","createdAt","updatedAt","entryCount","preview"],properties:{id:{type:"string"},createdAt:{type:"number"},updatedAt:{type:"number"},entryCount:{type:"number"},preview:{type:"string",description:"First user-message text, single line, \u226480 chars"}}},RunEvent:{type:"object",description:"Typed agent-loop event (src/core/types.ts RunEvent union), discriminated by `type`. The SSE `event:` field always equals this `type` field.",required:["type"],properties:{type:{type:"string",enum:[...E]}},additionalProperties:!0},TaskInfo:{type:"object",description:"Background subagent task snapshot (src/core/tasks.ts TaskInfo).",required:["id","label","agent","goal","isolated","depth","status","createdAt"],properties:{id:{type:"string",description:"Task id (t1, t2, \u2026; scoped to the session)"},label:{type:"string"},agent:{type:"string",description:"Agent definition the child runs"},goal:{type:"string",description:"Bounded preview of the child's goal (\u2264200 chars)"},isolated:{type:"boolean",description:"Ran in a worktree copy; file changes merge back as a patch on success"},depth:{type:"number",description:"Child depth (root-started tasks run at 1)"},status:{type:"string",enum:["queued","running","done","failed","cancelled"]},createdAt:{type:"number"},startedAt:{type:"number"},finishedAt:{type:"number"},summary:{type:"string",description:"The child's final text (status done), \u22644000 chars"},error:{type:"string",description:'Failure reason (status failed) or "cancelled"'},usage:{type:"object",properties:{input:{type:"number"},output:{type:"number"}}},patchLines:{type:"number",description:"Isolated children: line count of the merged-back patch"}}}}}}}function K(){return`<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>rovecode \xB7 mission control</title>
-<style>
-  :root {
-    --bg: #0b0e14; --panel: #12161f; --edge: #1f2633; --text: #d7dde8; --dim: #7d8698;
-    --queued: #8a93a5; --running: #4da3ff; --done: #3ecf8e; --failed: #ff6b6b;
-    --cancelled: #c9a227; --accent: #b48cff;
-  }
-  * { box-sizing: border-box; margin: 0; }
-  body { background: var(--bg); color: var(--text); font: 13px/1.5 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; height: 100vh; display: flex; flex-direction: column; }
-  header { padding: 10px 16px; border-bottom: 1px solid var(--edge); display: flex; align-items: baseline; gap: 12px; }
-  header h1 { font-size: 14px; font-weight: 600; letter-spacing: .04em; }
-  header h1 em { color: var(--accent); font-style: normal; }
-  #conn { color: var(--dim); font-size: 11px; }
-  #conn.live { color: var(--done); }
-  main { flex: 1; display: grid; grid-template-columns: 260px 1fr 320px; min-height: 0; }
-  section { border-right: 1px solid var(--edge); overflow-y: auto; padding: 10px; }
-  section:last-child { border-right: 0; }
-  h2 { font-size: 11px; text-transform: uppercase; letter-spacing: .12em; color: var(--dim); margin: 4px 2px 8px; }
-  .sess { padding: 6px 8px; border: 1px solid var(--edge); border-radius: 6px; margin-bottom: 6px; cursor: pointer; background: var(--panel); }
-  .sess.sel { border-color: var(--accent); }
-  .sess .id { font-size: 11px; color: var(--dim); }
-  .sess .st { float: right; font-size: 10px; }
-  .ev { padding: 2px 6px; border-radius: 4px; white-space: pre-wrap; word-break: break-word; }
-  .ev .t { color: var(--dim); margin-right: 6px; }
-  .ev.run_start, .ev.run_end { background: var(--panel); }
-  .ev.tool_execution_end .t { color: var(--running); }
-  .node { padding: 5px 8px; border: 1px solid var(--edge); border-left-width: 3px; border-radius: 6px; margin: 4px 0; background: var(--panel); }
-  .node .lbl { font-weight: 600; }
-  .node .meta { font-size: 11px; color: var(--dim); }
-  .st-queued { border-left-color: var(--queued); } .st-queued .badge { color: var(--queued); }
-  .st-running { border-left-color: var(--running); } .st-running .badge { color: var(--running); }
-  .st-done { border-left-color: var(--done); } .st-done .badge { color: var(--done); }
-  .st-failed { border-left-color: var(--failed); } .st-failed .badge { color: var(--failed); }
-  .st-cancelled { border-left-color: var(--cancelled); } .st-cancelled .badge { color: var(--cancelled); }
-  .empty { color: var(--dim); padding: 8px; font-size: 12px; }
-</style>
-</head>
-<body>
-<header>
-  <h1>rovecode <em>mission control</em></h1>
-  <span id="conn">connecting\u2026</span>
-</header>
-<main>
-  <section><h2>Sessions</h2><div id="sessions"></div></section>
-  <section><h2>Live events</h2><div id="feed"></div></section>
-  <section><h2>Agent tree</h2><div id="tree"></div></section>
-</main>
-<script>
-const $ = (id) => document.getElementById(id);
-const state = { sessions: [], sel: null, trees: {}, running: {} };
-const short = (id) => id.length > 8 ? id.slice(0, 8) : id;
-const esc = (s) => String(s).replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" }[c]));
-
-async function refreshSessions() {
-  try {
-    const r = await fetch("/sessions");
-    const list = await r.json();
-    state.sessions = (Array.isArray(list) ? list : []).map((s) => s.id ?? s);
-  } catch { /* server restarting */ }
-  renderSessions();
-}
-
-function renderSessions() {
-  const el = $("sessions");
-  if (state.sessions.length === 0) { el.innerHTML = '<div class="empty">no sessions yet</div>'; return; }
-  el.innerHTML = state.sessions.map((id) => {
-    const running = state.running[id] ? '<span class="st" style="color:var(--running)">\u25CF running</span>' : "";
-    return '<div class="sess' + (state.sel === id ? " sel" : "") + '" data-id="' + esc(id) + '">' + running +
-      '<div>' + esc(short(id)) + '</div><div class="id">' + esc(id) + '</div></div>';
-  }).join("");
-  for (const d of el.querySelectorAll(".sess")) d.onclick = () => { state.sel = d.dataset.id; renderSessions(); renderTree(); };
-}
-
-function renderTree() {
-  const el = $("tree");
-  const id = state.sel ?? state.sessions[0];
-  const tree = (id && state.trees[id]) || [];
-  if (tree.length === 0) { el.innerHTML = '<div class="empty">no subagents or background tasks yet</div>'; return; }
-  const depthPad = (n) => "margin-left:" + Math.min(n.depth - 1, 6) * 14 + "px";
-  el.innerHTML = tree.map((n) =>
-    '<div class="node st-' + esc(n.status) + '" style="' + depthPad(n) + '">' +
-    '<span class="badge">\u25CF</span> <span class="lbl">' + esc(n.label) + '</span>' +
-    (n.isolated ? ' <span class="meta">[worktree]</span>' : "") +
-    '<div class="meta">' + esc(n.agent) + " \xB7 depth " + n.depth + (n.parent ? " \xB7 \u2191 " + esc(n.parent) : "") +
-    (n.summary ? "<br>" + esc(n.summary) : "") + (n.error ? "<br>" + esc(n.error) : "") +
-    "</div></div>"
-  ).join("");
-}
-
-function feed(ev) {
-  const el = $("feed");
-  const d = document.createElement("div");
-  d.className = "ev " + ev.type;
-  let text = ev.type;
-  if (ev.type === "run_start") text = "run start \u2014 " + (ev.goal || "").slice(0, 120);
-  else if (ev.type === "run_end") text = "run end: " + ev.status + " \u2014 " + (ev.summary || "").slice(0, 160);
-  else if (ev.type === "tool_execution_start") text = "\u2192 " + ev.tool;
-  else if (ev.type === "tool_execution_end") text = (ev.ok ? "\u2713 " : "\u2717 ") + ev.callId + " " + ev.durationMs + "ms";
-  else if (ev.type === "compaction") text = "compaction " + ev.strategy + " " + ev.tokensBefore + "\u2192" + ev.tokensAfter;
-  d.innerHTML = '<span class="t">' + esc(ev.type) + '</span>' + esc(text === ev.type ? "" : text);
-  el.appendChild(d);
-  while (el.childElementCount > 400) el.removeChild(el.firstChild);
-  el.scrollTop = el.scrollHeight;
-}
-
-function connect() {
-  const es = new EventSource("/events");
-  es.onopen = () => { $("conn").textContent = "live"; $("conn").className = "live"; };
-  es.onerror = () => { $("conn").textContent = "reconnecting\u2026"; $("conn").className = ""; };
-  es.onmessage = (m) => {
-    let msg; try { msg = JSON.parse(m.data); } catch { return; }
-    if (msg.type === "hello") { for (const id of msg.sessions) if (!state.sessions.includes(id)) state.sessions.push(id); renderSessions(); }
-    else if (msg.type === "session_created") { if (!state.sessions.includes(msg.sessionId)) state.sessions.push(msg.sessionId); renderSessions(); }
-    else if (msg.type === "agent_tree_update") { state.trees[msg.sessionId] = msg.tree; renderTree(); }
-    else if (msg.type === "run_event") {
-      const ev = msg.event;
-      if (ev.type === "run_start") state.running[msg.sessionId] = true;
-      if (ev.type === "run_end") state.running[msg.sessionId] = false;
-      renderSessions();
-      if (!state.sel || state.sel === msg.sessionId) feed(ev);
-    }
-  };
-}
-
-refreshSessions();
-setInterval(refreshSessions, 5000);
-connect();
-</script>
-</body>
-</html>`}W();L();function Z(a){return a.map((s)=>({id:s.id,parent:s.parent??null,label:s.label,agent:s.agent,goal:s.goal,status:s.status,depth:s.depth,isolated:s.isolated,createdAt:s.createdAt,...s.startedAt!==void 0?{startedAt:s.startedAt}:{},...s.finishedAt!==void 0?{finishedAt:s.finishedAt}:{},...s.summary!==void 0?{summary:s.summary}:{},...s.error!==void 0?{error:s.error}:{}}))}var O=4100,q="127.0.0.1",x=1048576;function i(a,s=200){return new Response(JSON.stringify(a),{status:s,headers:{"content-type":"application/json"}})}function F(a){return`event: ${a.type}
-data: ${JSON.stringify(a)}
-
-`}function ee(a,s,h){let p=new TextEncoder,m=!1,c=()=>{if(!m)m=!0,s()},v=new ReadableStream({async start(t){try{for await(let g of a)if(t.enqueue(p.encode(F(g))),g.type==="run_end")break}catch(g){let u={type:"run_end",status:"error",summary:g instanceof Error?g.message:String(g)};try{t.enqueue(p.encode(F(u)))}catch{}}finally{c();try{t.close()}catch{}}},cancel(){h(),Promise.resolve(a.return(void 0)).catch(()=>{})}});return new Response(v,{status:200,headers:{"content-type":"text/event-stream","cache-control":"no-cache, no-transform","x-accel-buffering":"no"}})}function ne(a){if(a&&typeof a==="object"&&typeof a.text==="string")return a.text;return null}function ae(a){if(a&&typeof a==="object"&&a.model&&typeof a.model==="object"){let s=a.model;if(typeof s.provider==="string"&&typeof s.model==="string")return{provider:s.provider,model:s.model}}return null}function ze(a={}){let s=a.hostname??q,h=a.cwd??process.cwd(),p=R(h,".rovecode","sessions"),m=a.yolo??!1,c=new Map,v=new Set,t=(n)=>{let e=`data: ${JSON.stringify(n)}
-
-`;for(let d of[...v])try{d(e)}catch{v.delete(d)}},g=async()=>{let n=j(),e;try{e=await H({cwd:h,sessionId:n,stream:a.stream})}catch(d){if(d instanceof S)return i({error:d.message},503);throw d}return c.set(n,{runtime:e,running:!1,abort:null}),t({type:"session_created",session:n}),e.tasks.subscribe(()=>t({type:"agent_tree_update",session:n,tree:Z(e.tasks.list())})),i({id:n},201)},u=async(n,e)=>{let d=c.get(n);if(!d)return i({error:`unknown session ${n}`},404);if(Number(e.headers.get("content-length")??"0")>x)return i({error:`request body too large (max ${x} bytes)`},413);let k;try{k=await e.json()}catch{return i({error:"body must be JSON"},400)}let z=ne(k);if(z===null)return i({error:'body must be {"text": string}'},400);if(z.length>x)return i({error:`text too large (max ${x} chars)`},413);if(d.running)return i({error:"a run is already in progress for this session"},409);let l=d.runtime,M=l.stream,G=l.noProviderReason();if(!M||G!==null)return i({error:G??I("cli")},503);let A=ae(k)??{provider:l.provider?.id??"mock",model:l.defaultModel||"default"},D=l.buildDef(A),T=l.buildCfg(m,void 0),r=new AbortController;l.tasks.bindRun(r.signal);let B=w(D,z,{},T,{stream:M,registry:l.registry,store:l.store,tools:l.registry.list().map((C)=>C.schema),guard:l.guard,planReminder:l.planReminder,hooks:l.hooks,cwd:l.cwd,signal:r.signal},l.steering);return d.running=!0,d.abort=r,ee(_(B,(C)=>t({type:"run_event",session:n,event:C})),()=>{d.running=!1,d.abort=null},()=>r.abort())};async function*_(n,e){let d=n[Symbol.asyncIterator]();try{while(!0){let o=await d.next();if(o.done)return;e(o.value),yield o.value}}finally{if(d.return)await d.return(void 0)}}let Q=()=>{let n=new ReadableStream({start(e){let d=(o)=>{try{e.enqueue(o)}catch{v.delete(d)}};v.add(d),e.enqueue(`data: ${JSON.stringify({type:"hello",sessions:[...c.keys()]})}
-
-`)}});return new Response(n.pipeThrough(new TransformStream({transform(e,d){d.enqueue(new TextEncoder().encode(e))}})),{headers:{"content-type":"text/event-stream","cache-control":"no-cache",connection:"keep-alive"}})},V=(n)=>{let e=c.get(n);if(!e)return i({error:`unknown session ${n}`},404);let d=e.abort!==null;return e.abort?.abort(),i({cancelled:d})},X=(n)=>{let e=c.get(n);if(!e)return i({error:`unknown session ${n}`},404);return i(e.runtime.tasks.list())},P=async(n)=>{let e=new URL(n.url).pathname;if(n.method==="POST"&&e==="/session")return g();let d=/^\/session\/([^/]+)\/prompt$/.exec(e);if(n.method==="POST"&&d)return u(d[1],n);if(n.method==="DELETE"&&d)return V(d[1]);let o=/^\/session\/([^/]+)\/tasks$/.exec(e);if(n.method==="GET"&&o)return X(o[1]);if(n.method==="GET"&&e==="/sessions")return i($(p));if(n.method==="GET"&&e==="/events")return Q();if(n.method==="GET"&&e==="/ui")return new Response(K(),{headers:{"content-type":"text/html; charset=utf-8"}});if(n.method==="GET"&&e==="/doc")return i(N(y.url));return i({error:`no route for ${n.method} ${e}`},404)},b=Bun.serve({hostname:s,port:a.port??O,idleTimeout:0,maxRequestBodySize:x*2,async fetch(n){try{return await P(n)}catch(e){return i({error:e instanceof Error?e.message:String(e)},500)}}}),y={port:b.port??0,hostname:s,url:`http://${s}:${b.port}`,async stop(){await b.stop(!0);for(let e of c.values())e.abort?.abort();for(let{runtime:e}of c.values())e.tasks.cancelAll();let n=[];for(let{runtime:e}of c.values())if(e.bashJobs.dispose(),n.push(e.hooks.close()),e.mcp)n.push(e.mcp.close().catch(()=>{}));await Promise.all(n)}};return y}export{ze as startServer,x as MAX_BODY_BYTES,O as DEFAULT_PORT,q as DEFAULT_HOSTNAME};

package/dist/cli/index-1sgjm25y.js

@@ -1,2 +0,0 @@
-// @bun
-import{yh as w,zh as x}from"./main-2yfck9b5.js";import{Ah as u,Bh as v}from"./main-kh32yvgk.js";import{Dh as j,Eh as k,Ih as n,Jh as o,Kh as p,Lh as q,Mh as r,Nh as s,Oh as t}from"./main-kcpbykxz.js";import{qm as l,rm as m}from"./main-2zmzgkwh.js";import{sm as f,tm as g,um as h,vm as i}from"./main-a9njrkk1.js";import"./main-7rn6bqje.js";import"./main-mv40pcr2.js";import"./main-2yeveeve.js";import"./main-0jys2ccn.js";import{cn as a,dn as b,en as c,fn as d,gn as e}from"./main-nqveez48.js";import"./main-qsevpgsv.js";export{t as untrustPlugin,s as trustPlugin,x as summarizePlugins,a as statePath,r as setPluginEnabled,o as scopeRoot,c as saveState,q as removePlugin,j as pluginRoots,d as pluginFiles,e as pluginDigest,h as parseManifest,b as loadState,w as loadPlugins,n as isGitSource,k as discoverPlugins,i as contributions,v as cmdPlugin,p as addPlugin,m as activatePlugins,u as PLUGIN_USAGE,f as PLUGIN_API_VERSION,g as MANIFEST_FILE,l as DEFAULT_PLUGIN_TIMEOUT_MS};

package/dist/cli/init-g2m0tn4m.js

@@ -1,51 +0,0 @@
-// @bun
-import{rm as v}from"./main-2zmzgkwh.js";import{sm as b,tm as $,um as V,vm as g,wm as u}from"./main-a9njrkk1.js";import"./main-7rn6bqje.js";import"./main-mv40pcr2.js";import"./main-2yeveeve.js";import"./main-0jys2ccn.js";import"./main-nqveez48.js";import"./main-qsevpgsv.js";u();import{mkdirSync as L,mkdtempSync as P,readFileSync as R,rmSync as M,writeFileSync as Z,existsSync as x}from"fs";import{tmpdir as T}from"os";import{join as C,resolve as j}from"path";var U=/^[a-z0-9][a-z0-9-]{0,63}$/,A=`/** <name> \u2014 a rovecode plugin. The default export is the whole contract:
- *  api (PLUGIN_API_VERSION), tools (Tool[] or a factory), hooks (HookSet).
- *  Docs: docs/design/sdk-blueprint.md \xA76 */
-import type { Tool, HookSet } from "rovecode/core"; // resolved by rovecode at load time
-
-const hello: Tool = {
-  schema: {
-    name: "<tool>_hello",
-    description: "Says hello from the <name> plugin.",
-    args: { type: "object", properties: { who: { type: "string" } } },
-  },
-  kind: "read", // read = no workspace effect; kinds map to policy actions (see plugin.json permissions)
-  // sequential: false \u2014 concurrent with siblings in a batch; only stateful tools go sequential
-  async execute(args) {
-    const a = args as { who?: string };
-    return { ok: true, output: \`hello, \${typeof a.who === "string" ? a.who : "world"}!\` };
-  },
-};
-
-const hooks: HookSet = {
-  // pre_tool: async ({ tool }) => tool === "bash" ? { deny: "nope" } : undefined,
-};
-
-export default { api: ${b}, tools: [hello], hooks };
-`,h=`/** The plugin's own tests \u2014 \`rovecode plugin test\` runs this file under bun:test. */
-import { test, expect } from "bun:test";
-import plugin from "./index.ts";
-
-test("module shape", () => {
-  expect(plugin.api).toBe(${b});
-  expect(Array.isArray(plugin.tools)).toBe(true);
-});
-
-test("hello tool", async () => {
-  const tool = (plugin.tools ?? [])[0]!;
-  const out = await tool.execute({ who: "tests" }, {} as never);
-  expect(out.ok).toBe(true);
-  expect(out.output).toContain("hello, tests!");
-});
-`,p=(K)=>`# ${K}
-
-A rovecode plugin.
-
-- \\"permissions\\" in plugin.json declares the policy actions its tools may take
-  (file.read, file.write, shell.exec, spawn, memory.write, net.fetch). A tool whose
-  kind is not declared is refused at run time \u2014 the list is a promise, not a comment.
-- Develop: \\\`rovecode plugin test .\\\` in this folder.
-- Install: \\\`rovecode plugin add .\\\` (user scope) or \\\`rovecode plugin add . --project\\\`.
-`;async function I(K,q){let z=K[0];if(!z||!U.test(z))return q.err(`plugin init: name must match ${U}`),2;let B=C(q.cwd,z);if(x(B))return q.err(`plugin init: ${B} already exists`),1;L(B,{recursive:!0});let Q={name:z,version:"0.1.0",description:`${z} plugin`,api:b,entry:"index.ts",permissions:[]};return Z(C(B,$),JSON.stringify(Q,null,2)+`
-`),Z(C(B,"index.ts"),A.replaceAll("<name>",z).replaceAll("<tool>",z.replaceAll("-","_"))),Z(C(B,"plugin.test.ts"),h),Z(C(B,"README.md"),p(z)),q.out(`scaffolded ${z} at ${B}`),q.out(`next: rovecode plugin test ${B}   \xB7   rovecode plugin add ${B}`),0}async function E(K,q){let z=j(q.cwd,K??"."),B=C(z,$);if(!x(B))return q.err(`plugin test: no ${$} in ${z}`),2;let Q=[],H=V(R(B,"utf8"),B,Q);if(!H){for(let J of Q)q.err(J);return 1}q.out(`manifest ok: ${H.name}@${H.version} (api ${H.api})`);for(let J of g(H))q.out(`  ${J}`);let Y=P(C(T(),"rovecode-plugintest-"));try{let J={dir:z,name:H.name,scope:"project",status:"active",manifest:H,digest:null,problems:[],commandsDir:null,skillsDir:null,mcp:[]},{plugins:W,warnings:G}=await v([J],{cwd:Y,home:Y});for(let X of G)q.err(`warning: ${X}`);let O=W[0],D=O?.tools??[];if(q.out(`activated: ${D.length} tool(s)${D.length?` [${D.map((X)=>`${X.schema.name}:${X.kind}`).join(", ")}]`:""}, hooks ${O?.hooks?"yes":"none"}`),G.length>0)return 1}finally{M(Y,{recursive:!0,force:!0})}let k=C(z,"plugin.test.ts");if(x(k)){q.out(`running ${k} \u2026`);let W=await Bun.spawn([process.execPath,"test",k],{cwd:z,stdout:"inherit",stderr:"inherit"}).exited;if(W!==0)return q.err(`plugin.test.ts failed (exit ${W})`),1}else q.out("no plugin.test.ts \u2014 add one for `plugin test` to exercise behavior, not just shape");return q.out("plugin test: ok"),0}export{E as cmdPluginTest,I as cmdPluginInit};

package/dist/cli/install-avaqjjqq.js

@@ -1,2 +0,0 @@
-// @bun
-import{d as a,e as b,f as c,g as d,h as e,i as f,j as g,k as h,l as i}from"./main-x4r0fne4.js";import"./main-f7rw7des.js";import"./main-yr0ksc0h.js";import"./main-xy53xf0r.js";import"./main-7c5thhjd.js";import"./main-vqak588n.js";import"./main-0ab9fc26.js";import"./main-6dnk69vp.js";import"./main-pn1w7a7j.js";import"./main-351pz3z7.js";import"./main-kcpbykxz.js";import"./main-q3vsesf9.js";import"./main-a9njrkk1.js";import"./main-7rn6bqje.js";import"./main-2yeveeve.js";import"./main-0jys2ccn.js";import"./main-nqveez48.js";import"./main-qsevpgsv.js";i();export{g as withInstalled,a as validInstallName,b as skillDir,d as runInstall,h as removeItem,c as planInstall,e as needsNetwork,f as installedState};

package/dist/cli/loop-mmpfft01.js

@@ -1,2 +0,0 @@
-// @bun
-import{fl as b,gl as c,hl as d,il as e,jl as f,kl as g,ll as h,ml as i,nl as j,ol as k}from"./main-3rxcvgna.js";import"./main-4wndhjdc.js";import{Nl as a}from"./main-ggcn7rd7.js";import"./main-0904f6ps.js";import"./main-prxxs70n.js";import"./main-n0t3973w.js";import"./main-mv40pcr2.js";import"./main-2yeveeve.js";import"./main-0jys2ccn.js";import"./main-nqveez48.js";import"./main-qsevpgsv.js";k();export{j as partsTokenText,i as partsText,h as outstandingTone,g as outstandingClause,f as finishCheckText,c as extractToolCalls,e as assessOutstanding,d as agentLoop,b as SteeringQueue,a as ABORTED_TOOL_RESULT};

package/dist/cli/main-0904f6ps.js

@@ -1,5 +0,0 @@
-// @bun
-import{wn as X}from"./main-qsevpgsv.js";import{realpathSync as _,statSync as f}from"fs";import{basename as S,dirname as $,isAbsolute as P,join as Q,parse as g,relative as D,resolve as V,sep as N}from"path";function G(q){let x=V(q);try{return _.native(x)}catch{}let z=$(x);return z===x?x:Q(G(z),S(x))}function E(q,x){return V(P(x)?x:Q(q,x))}function K(q,x){let z=D(q,x);return z===""||!P(z)&&z!==".."&&!z.startsWith(`..${N}`)}function k(q,x){return!K(G(q),G(x))}function L(q){try{return f(q).isDirectory()}catch{return!1}}function I(q){let x=G(q);return Q(L(x)?x:$(x),"*")}function v(q,x,z){let F=z.filter((B)=>B.action===C&&B.effect==="allow"&&B.resource!=="*").map((B)=>B.resource);return`${q} is outside the workspace ${x}${F.length>0?` and its roots ${F.join(", ")}`:""} \u2014 allow once/always for this directory, or start rovecode with --add-dir <dir> to make it a workspace root`}function R(q,x){let z=`--add-dir "${x}": the directory name contains "*", a rule wildcard (no escape syntax) \u2014 its allow rule would match more than that directory`;if(q.includes("*"))return z;if(!L(q))return`--add-dir "${x}" is not a directory`;let F=G(q);if(F.includes("*"))return z;if(g(F).root===F)return`--add-dir "${x}" is a filesystem root \u2014 it would disable the workspace boundary \u2014 pass --yolo instead`;return}function m(q,x=[],z=process.cwd()){let F=G(q),B=[],H=[];for(let U of x){let Y=V(z,U),Z=R(Y,U);if(Z!==void 0)throw new O(Z);let M=G(Y);if(K(F,M)||B.some((J)=>K(J,M))){H.push(U);continue}for(let J of B)if(K(M,J))H.push(J);B.splice(0,B.length,...B.filter((J)=>!K(M,J)),M)}let W=H.length===0?[]:[`rovecode: --add-dir: ${H.length} value${H.length===1?"":"s"} dropped \u2014 already inside the workspace ${F} or another root: ${H.join(", ")}`];return{dirs:B,notes:W}}class T{cwd;dirs;notes;constructor(q,x={dirs:[],notes:[]}){this.cwd=G(q),this.dirs=x.dirs,this.notes=x.notes}rootOf(q){let x=G(q);return this.dirs.find((z)=>K(z,x))}rules(){return this.dirs.map((q)=>({action:C,resource:Q(q,"*"),effect:"allow"}))}acceptEditsRules(){return this.dirs.map((q)=>({action:"file.write",resource:Q(q,"*"),effect:"allow"}))}describe(){return this.dirs.map((q)=>`+${q}`).join(" ")}promptLine(){return this.dirs.length===0?"":`
-
-Additional workspace roots (name them by absolute path): ${this.dirs.join(", ")}`}checkpointNote(){return this.dirs.length===0?"":`roots: ${this.describe()} \u2014 checkpoints cover ${this.cwd} only; a change under an added root is not snapshotted and /restore does not undo it`}}var C="file.external",O;var j=X(()=>{O=class O extends Error{constructor(q){super(q);this.name="WorkspaceRootError"}}});
-export{C as Sl,G as Tl,E as Ul,K as Vl,k as Wl,I as Xl,v as Yl,R as Zl,O as _l,m as $l,T as am,j as bm};

package/dist/cli/main-0ab9fc26.js

@@ -1,9 +0,0 @@
-// @bun
-import{df as G,ff as K}from"./main-351pz3z7.js";import{wn as J}from"./main-qsevpgsv.js";function H(b,A,q){let p=G(b,A,q);return`- ${b.name}${b.version?` (v${b.version})`:""}: ${b.description}${p==="stale"?" [stale]":""}`}function W(b,A=Date.now()){let q=b.list();if(q.length===0||q.length>Q)return"";return q.map((p)=>H(p,b.usage(p.name),A)).join(`
-`)}function Y(b){return[{schema:{name:"skill_view",description:"Read one skill's full instructions. Use when a skill in the index matches the task.",args:{type:"object",properties:{name:{type:"string",description:"skill name from the index"}},required:["name"]}},kind:"read",sequential:!0,execute(p){let C=p,z=typeof C.name==="string"?C.name:"",j=b.get(z);if(!j)return Promise.resolve({ok:!1,output:`no skill named '${z}'`});let F=b.bumpUsage(j),B=`# ${j.name} (v${j.version})
-
-${j.fullDescription}
-
-`;return Promise.resolve({ok:!0,output:B+j.body,data:F})}},{schema:{name:"skills_list",description:"List available skills (name, version, description, staleness). Use to discover skills when the system prompt has no skill index.",args:{type:"object",properties:{}}},kind:"read",execute(p,C){b.scan();let z=b.list();if(z.length===0)return Promise.resolve({ok:!0,output:"no skills installed"});let j=Date.now(),F=z.map((B)=>H(B,b.usage(B.name),j));return Promise.resolve({ok:!0,output:F.join(`
-`),data:{count:z.length}})}}]}var Q=50;var S=J(()=>{K()});
-export{Q as vd,W as wd,Y as xd,S as yd};