sept-agent 0.1.2 → 0.1.4

package/CONTRIBUTING.md

@@ -29,20 +29,24 @@ After each coherent module: `npm run check`, directly affected tests, structural
 
 ## Ownership and change expectations
 
-[Architecture](docs/architecture.md) names the mechanism boundaries. Cross-mechanism imports use intentional indexes. Pi alone owns providers/authentication, generation/tool tasks, native scheduling/replay and context accounting. SEPT owns durable task/lifecycle/evidence, bounded authenticated transport and explicitly supplied execution authority. Do not add another provider SDK, model loop, tokenizer, compactor, scheduler, extension ABI or provisioner.
+Cross-mechanism imports use intentional indexes. Pi alone owns providers/authentication, generation/tool tasks, native scheduling/replay and context accounting. SEPT owns durable task/lifecycle/evidence, bounded authenticated transport and explicitly supplied execution authority. Do not add another provider SDK, model loop, tokenizer, compactor, scheduler, extension ABI or provisioner.
 
 Keep functions/files cohesive and documented; validate hostile input once at its owning boundary, use typed domain errors, preserve first-cause cancellation and independent cleanup, bound resources before buffering, and preserve fsync-before-transition ordering. Credentials never enter prompts, durable/public state, telemetry, logs or images. Trusted extensions are full-authority brain code; workspace instructions/skills and mounts never grant executable authority. Hands checks live policy beside effects and fails closed.
 
 A focused PR should explain the concrete trigger and resulting behavior, exact owner/callers and relevant validation. Update public contracts/docs/examples together. Add meaningful focused regression coverage for behavior, important errors and both race orderings; avoid tests that merely mirror trivial implementation. Preserve exact dependency/security/limit/meta gates.
 
-Only root, client and hands are public npm entries. Public API changes need strict external NodeNext compilation with normal Node types and `skipLibCheck=false`, a real production-only cold install outside repository module lookup, and actual behavioral callers. Native Pi extension authoring is a separate declaration/tooling concern; describe any upstream limits honestly. The [two copied external integrations](docs/index.md#developer-reading-order) must compile/copy/run explicitly because root tsconfig does not include them.
+Only root, client and hands are public npm entries. Public API changes need strict external NodeNext compilation with normal Node types and `skipLibCheck=false`, a real production-only cold install outside repository module lookup, and actual behavioral callers. Native Pi extension authoring is a separate declaration/tooling concern; describe any upstream limits honestly. The copied [Node application](examples/node-app/README.md) and [incident investigator](examples/incident-investigator/README.md) must compile/copy/run explicitly because root tsconfig does not include them.
 
 ## Installed evidence and cleanup
 
 Compilation and isolated tests support delivery; the actual installed runtime path is the completion criterion. Exercise the changed installed CLI/public import through production Pi and supplied hands. Container input changes require a fresh no-cache image and affected installed proof. The npm tarball excludes the Docker build context; build from full source and inspect final package inventory, source maps, legal/provenance files and allowed imports.
 
-Record exact source/tar/image/dependency identity, cwd/commands, actual child exit/signal/join, original failures and separately observed finalizers. Do not turn wrapper exit0 into a product verdict. Export needed tmpfs data before stopping the exact owned generation; independently close worker, provider/listener, attachments/leases and namespace even if one cleanup fails. Preserve stopped-generation proof, mutex inodes, evidence, recovery and unrelated resources. Never prune/delete them as incidental cleanup. See [operator finalization](docs/pi-contract.md#export-and-finalize-the-owned-generation).
+Record exact source/tar/image/dependency identity, cwd/commands, actual child exit/signal/join, original failures and separately observed finalizers. Do not turn wrapper exit0 into a product verdict. Export needed tmpfs data before stopping the exact owned generation; independently close worker, provider/listener, attachments/leases and namespace even if one cleanup fails. Preserve stopped-generation proof, mutex inodes, evidence, recovery and unrelated resources. Never prune/delete them as incidental cleanup. For helper-created instances, join the worker before `sept hands finish --root <instance>` exports and stops the owned generation.
 
 ## Automated package releases
 
-[Release setup and retry policy](https://github.com/DB-Conneely/sept/blob/main/docs/releasing.md) describes the GitHub-hosted Linux/amd64 gate and main-push npm/GHCR/GitHub release workflow. It uses no live provider or local model. The publish job consumes the exact tested tarball and saved image; deployment remains manual.
+Branch pushes and pull requests run `SEPT checks`. An authorized push to `main` runs `SEPT publish`: select the next patch version, run the Linux AMD64/ARM64 package and image gates and macOS installed-package lifecycle checks, then publish the exact tested artifacts to npm, GHCR and a GitHub release. There is no service deployment job and no live-provider/local-model prerequisite.
+
+Keep the source version baseline unchanged; CI allocates the next patch from completed publications. Monitor the exact pushed SHA until **Publish verified artifacts** succeeds, then verify npm, the versioned multi-architecture GHCR image and GitHub release. A green check alone is not completed publication. Preserve artifact hashes and publication receipts.
+
+On partial publication or npm scanning delay, inspect and retry the original run's failed jobs with its retained artifacts. Never submit an accepted or uncertain npm version again, overwrite immutable images, or use a new push to bypass an incomplete publication. An incomplete release blocks allocating another version. Main publications queue without cancelling older runs. Repository/npm trusted-publisher access remains an operator prerequisite.

package/README.md

@@ -4,9 +4,9 @@ SEPT is a durable, single-slot task worker for Node.js, built on the native Pi D
 
 ## Install and prepare
 
-Requires Node.js **22.19.0 or newer**, ESM, Pi credentials or a suitable configured model, persistent local state, and an operator-supplied Docker Linux hands namespace. Valid hands are required even for text-only tasks. The package does not install Docker, serve models or provision hands.
+Requires Node.js **22.19.0 or newer**, ESM, Pi credentials or a suitable configured model, persistent local state, and an operator-supplied Docker Linux hands namespace. Valid hands are required even for text-only tasks. The package does not install Docker or serve models. Optional local setup commands prepare the supported hands profile.
 
-The npm worker runs natively on Linux and macOS; task effects use Linux Docker containers. Apple Silicon uses the ARM64 image through Docker Desktop. Published image tags select AMD64 or ARM64 automatically. Native Windows and Intel Mac task execution remain unqualified. See [release verification](https://github.com/DB-Conneely/sept/blob/main/docs/releasing.md) for exact proof boundaries.
+The npm worker runs natively on Linux and macOS; task effects use Linux Docker containers. Apple Silicon uses the ARM64 image through Docker Desktop. Published image tags select AMD64 or ARM64 automatically. Native Windows and Intel Mac task execution remain unqualified. Hosted Mac release checks cover installed package lifecycle; Docker task execution is qualified separately.
 
 Add SEPT to your application with `npm install --save-exact sept-agent`. The command is `sept` and the import name is `sept-agent`.
 
@@ -16,7 +16,19 @@ To install a retained exact package artifact for a qualified source revision:
 npm install --save-exact /absolute/path/sept-agent-0.1.0.tgz
 ```
 
-This works without assuming a registry publication. For development from a complete checkout, use `npm ci` then `npm run build`. Configure [models and Pi authentication](docs/models.md), then follow the [supplied-hands setup](docs/pi-contract.md#executable-supplied-hands-setup), including the explicit first-boot policy **before starting a worker or direct run**.
+This works without assuming a registry publication. For development from a complete checkout, use `npm ci` then `npm run build`. Prepare hands and its explicit first-boot policy **before starting a worker or direct run**, then configure Pi authentication in the private agent directory.
+
+For a fresh empty workspace, the optional helper replaces the manual Docker flags, identity capture and initial permission setup. Have Docker CLI/Engine running and a compatible matching SEPT image already available locally:
+
+```sh
+sept hands init --root /absolute/new/sept-instance \
+  --engine-socket /run/docker.sock \
+  --image ghcr.io/db-conneely/sept:0.1.3 --access files > worker-paths.json
+```
+
+Use the four path fields in `worker-paths.json` with `createWorker`, supply your own token, and configure model credentials in its returned `agentDir`. `files` grants workspace read/write; `none` grants neither. Both disable shell and networking. The helper never pulls images or imports an existing project. After awaiting `worker.stop()`, run `sept hands finish --root /absolute/new/sept-instance` to retain a private workspace tar archive and stop the exact owned container. Containers and receipts are preserved.
+
+Choose the actual canonical local Unix socket explicitly; Docker Desktop commonly uses `$HOME/.docker/run/docker.sock`. The instance root must be new, absolute and have trusted ancestors. This fixed profile provides a 128 MiB/32768-inode tmpfs workspace, 16 MiB scratch, 1 GiB memory, 128 PIDs and 2 CPUs. Finish refuses a live worker or replacement generation and reports export and stop outcomes separately in `evidence/finish.json`. Failed initialization retains recovery receipts. The helper does not orchestrate recovery, seed imports, custom mounts, network or shell access. Cancellation/backend loss may destroy workspace bytes before export.
 
 The supplied brain image runs as UID10001 and stores durable evidence at `/state/runs`. Container operation requires persistent storage, for example `-v sept-state:/state`, plus explicit private Pi credential storage and assigned workspaces. Supply hands as a separate namespace using the linked setup.
 
@@ -46,7 +58,7 @@ for (const signal of ["SIGINT", "SIGTERM"]) {
 console.log(worker.address);
 ```
 
-Required roots/token must be nonempty; use canonical absolute paths and a persistent external state root. Readiness covers the listener/router and synchronous durable adoption; asynchronous Pi/backend execution is observed through task state. `stop()` joins the existing durable boundary. See [SDK lifecycle and ownership](docs/sdk.md#worker-lifecycle).
+Required roots/token must be nonempty; use canonical absolute paths and a persistent external state root. Readiness covers the listener/router and synchronous durable adoption; asynchronous Pi/backend execution is observed through task state. `stop()` joins the existing durable boundary. Reopening durable state requires a fresh compatible hands generation and current-revision permission activation; the helper only prepares fresh instances.
 
 ## Submit from TypeScript
 
@@ -72,7 +84,20 @@ const current = await client.getTask(admission.runId);
 console.log(current.state.status);
 ```
 
-Keep `source`/`eventId` stable across retries. Admission receipts retain their original `active` status; `getTask` reports current state. A timeout or abort can occur after durable acceptance. The [SDK guide](docs/sdk.md) covers all five client methods, finite cursor-gap recovery, limits and error classifications.
+Keep `source`/`eventId` stable across retries. Admission receipts retain their original `active` status; `getTask` reports current state. A timeout or abort can occur after durable acceptance. The package ships public client types and contracts for messages, cancellation and conversation retrieval.
+
+## Model authentication
+
+Use the same private agent directory returned by setup for every model command and worker. For Claude through Anthropic:
+
+```sh
+sept auth login --provider anthropic --method api-key --agent-dir "$PI_CODING_AGENT_DIR"
+sept models list --provider anthropic --agent-dir "$PI_CODING_AGENT_DIR"
+sept models select --provider anthropic --model YOUR_MODEL_ID --agent-dir "$PI_CODING_AGENT_DIR"
+sept models validate --agent-dir "$PI_CODING_AGENT_DIR"
+```
+
+Choose an available model ID from the list. Login reads hidden TTY input or stdin; never put credentials in arguments, task text or evidence. Pi owns provider credentials and requests, including compatible local/custom providers configured in that agent directory's `models.json`. Model selection can also be supplied as a complete `provider`/`model` pair in a task. Keep agent storage outside hands and out of Git/images.
 
 ## CLI and integrations
 
@@ -87,10 +112,10 @@ sept worker --state-dir "$SEPT_STATE_DIR" --agent-dir "$PI_CODING_AGENT_DIR" \
 
 The bearer comes from `SEPT_TOKEN`, never a CLI token option. Every HTTP route requires it. One state root has one owner and one resident slot, including while waiting. The [Node application](examples/node-app/README.md) and [incident investigator](examples/incident-investigator/README.md) show the two integration patterns; each owns its finite work and cleanup.
 
-[Formal documentation and AI navigation](docs/index.md) · [HTTP/SSE API](docs/worker-api.md) · [Pi, hands and security contract](docs/pi-contract.md) · [Architecture](docs/architecture.md) · [Observability](docs/observability.md) · [Contributing](CONTRIBUTING.md)
+[Contributing and release procedure](CONTRIBUTING.md) · [Node application](examples/node-app/README.md) · [Incident investigator](examples/incident-investigator/README.md)
 
-Support is scoped to qualified source/image/host combinations; see [version and support](docs/index.md#version-and-support). The npm artifact is a consumer package; build the Docker image from a pinned complete repository checkout. Host npm Pi stays stock; the [four native-search image assets](image/pi-native-search/README.md) describe the image-only overlay. No publication or deployment is performed by these instructions.
+Support is scoped to qualified source/image/host combinations. The npm artifact is a consumer package; build the Docker image from a pinned complete repository checkout. Host npm Pi stays stock; the [four native-search image assets](image/pi-native-search/README.md) describe the image-only overlay. No publication or deployment is performed by these instructions.
 
 SEPT is [MIT licensed](LICENSE). [NOTICE](NOTICE) retains the known upstream attribution and image-overlay provenance.
 
-Maintainers: [automatic checks and publishing setup](https://github.com/DB-Conneely/sept/blob/main/docs/releasing.md) describes main-push releases, npm trusted publishing and GHCR configuration. Publishing does not deploy a service.
+Maintainers: [Contributing](CONTRIBUTING.md#automated-package-releases) describes main-push checks and publication. Publishing does not deploy a service. The local `docs/` directory is private working material, excluded from Git and the npm package.

package/dist/src/cli/commands.js

@@ -12,6 +12,7 @@ import { assertCompatibleStateRoot, getAgentDir, inspectPi } from "../pi-integra
 import { CycleController } from "../runtime/index.js";
 import { createTerminalAuthInteraction } from "./auth-interaction.js";
 import { initializeCapabilities, assertCapabilityAdmission, capabilityHostFactory, createWorker, } from "../worker/index.js";
+import { runHands } from "./hands.js";
 import { runPermissions } from "./permissions.js";
 import { resumePermissionRun, assertLocalRunSlot } from "./permission-decisions.js";
 import { CliError } from "./errors.js";
@@ -215,6 +216,9 @@ async function runHealth(context) {
 /** Execute one parsed command through public mechanism boundaries without retaining credentials. */
 export async function executeCommand(context) {
     switch (context.command) {
+        case "hands":
+            writeJson(await runHands(context));
+            return;
         case "permissions":
             writeJson(await runPermissions(context, stateRoot(context.options), context.agentDir));
             return;

package/dist/src/cli/commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../../src/cli/commands.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAA6B,MAAM,0BAA0B,CAAC;AACzF,OAAO,EAAE,aAAa,EAAsB,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,YAAY,GAEb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAUvC,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,OAAO,CAAC,KAAyB;IACxC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,MAA0B,EAC1B,OAA+B;IAE/B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,QAAQ,CAAC,+CAA+C,CAAC,CAAC;IACtE,CAAC;IACD,SAAS,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAuB;IAC9C,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAClC,SAAS,CAAC,MAAM,CAAC,2BAA2B,EAAE,CAAC,CAAC;IAClD,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACrC,SAAS,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3F,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC3C,SAAS,CACP,MAAM,MAAM,CAAC,kBAAkB,CAC7B,QAAQ,CAAC,QAAQ,EACjB,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,MAAM,EACf,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAC5B,CACF,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,QAAQ,CAChB,kFAAkF,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB;IACrD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,KAAK,CAClB,MAA0B,EAC1B,QAAgB,EAChB,YAAgC;IAEhC,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAAC,yDAAyD,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,WAAW,GAAG,6BAA6B,EAAE,CAAC;IACpD,IAAI,CAAC;QACH,SAAS,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,WAAW,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,OAAuB;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,QAAQ,CAAC,kCAAkC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChC,SAAS,CAAC,MAAM,MAAM,CAAC,oBAAoB,CAAC,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvC,SAAS,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QACtC,MAAM,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,QAAQ,CAChB,sFAAsF,CACvF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,OAA+B;IAChD,OAAO,OAAO,CACZ,OAAO,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAE,SAAwB;IACnE,IAAI,QAAmC,CAAC;IACxC,MAAM,IAAI,GAAG,GAAS,EAAE;QACtB,QAAQ,KAAK,CAAC,KAAK,IAAI,EAAE;YACvB,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACvB,CAAC;oBAAS,CAAC;gBACT,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC;YAC7B,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC5B,SAAS,CAAC,GAAG,CACX,gBAAgB,EAChB,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,EACjE,OAAO,CACR,CAAC;YACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC3B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAuB;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IAC7F,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC;QACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,aAAa,EAAE,OAAO,CACpB,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,CACtF;QACD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE;QACnC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC;QAC3E,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sCAAsC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAC/E,CAAC;IACF,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,aAAa,CAAC,OAA+B;IACpD,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACnD,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACzC,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAuB,EAAE,IAAY;IAClE,MAAM,SAAS,GAAG,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,QAAQ,GACZ,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS;QAC3E,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE;QAC1D,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAC/C,QAAQ,CAAC,QAAQ,EACjB,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,MAAM,EACf,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAC5B,CAAC;IACF,OAAO,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAE,EAAE,EAAE,GAAG,EAAE,CAC7D,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;QACpB,GAAG,SAAS;QACZ,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ;QACrC,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK;KAChC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAAuB,EAAE,KAAe;IACtE,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/C,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAClC,OAAO,CAAC,SAAS,CAAC,WAAW,CAC3B,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,WAAW,EACpB,KAAK,CAAC,eAAe,EAAE,CAAC,MAAM,CAC/B,CAAC;IACF,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,EAAE;QAC5F,aAAa,EAAE,KAAK,CAAC,KAAK;QAC1B,gBAAgB,EAAE,QAAQ;QAC1B,cAAc,EAAE,UAAU;KAC3B,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IACzC,MAAM,IAAI,eAAe,CACvB,KAAK,EACL,OAAO,CAAC,QAAQ,EAChB,qBAAqB,CACnB,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAC1B,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAC9D,EACD,OAAO,CAAC,SAAS,CAClB,CAAC,GAAG,EAAE,CAAC;IACR,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACjF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAuB;IAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC,IAAI,EACJ,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAC9D,CAAC;IACF,MAAM,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjD,yBAAyB,CACvB,MAAM,EACN,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAC9D,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3E,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,IAAI,CAAC,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,WAAW,EAAE,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAuB;IAC9C,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC,CAAC;IACjG,SAAS,CAAC;QACR,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,IAAI,EAAE,OAAO,CAAC,WAAW;QACzB,KAAK,EAAE,OAAO,CAAC,SAAS;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,GAAG,UAAU;KACd,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAuB;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,QAAQ,CAAC,2DAA2D,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,8BAA8B,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAAC,oCAAoC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AAChD,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAuB;IAC1D,QAAQ,OAAO,CAAC,OAAO,EAAE,CAAC;QACxB,KAAK,aAAa;YAChB,SAAS,CAAC,MAAM,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YACvF,OAAO;QACT,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5B,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1B,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5B,KAAK,KAAK;YACR,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5B,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5B,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACnE,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,WAAW,EAAE,CAAC,CAAC;AAC3F,CAAC"}
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../../src/cli/commands.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAA6B,MAAM,0BAA0B,CAAC;AACzF,OAAO,EAAE,aAAa,EAAsB,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,YAAY,GAEb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAUvC,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,OAAO,CAAC,KAAyB;IACxC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,MAA0B,EAC1B,OAA+B;IAE/B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,QAAQ,CAAC,+CAA+C,CAAC,CAAC;IACtE,CAAC;IACD,SAAS,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAuB;IAC9C,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAClC,SAAS,CAAC,MAAM,CAAC,2BAA2B,EAAE,CAAC,CAAC;IAClD,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACrC,SAAS,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3F,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC3C,SAAS,CACP,MAAM,MAAM,CAAC,kBAAkB,CAC7B,QAAQ,CAAC,QAAQ,EACjB,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,MAAM,EACf,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAC5B,CACF,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,QAAQ,CAChB,kFAAkF,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB;IACrD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,KAAK,CAClB,MAA0B,EAC1B,QAAgB,EAChB,YAAgC;IAEhC,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAAC,yDAAyD,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,WAAW,GAAG,6BAA6B,EAAE,CAAC;IACpD,IAAI,CAAC;QACH,SAAS,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,WAAW,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,OAAuB;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,QAAQ,CAAC,kCAAkC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChC,SAAS,CAAC,MAAM,MAAM,CAAC,oBAAoB,CAAC,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvC,SAAS,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QACtC,MAAM,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,QAAQ,CAChB,sFAAsF,CACvF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,OAA+B;IAChD,OAAO,OAAO,CACZ,OAAO,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAE,SAAwB;IACnE,IAAI,QAAmC,CAAC;IACxC,MAAM,IAAI,GAAG,GAAS,EAAE;QACtB,QAAQ,KAAK,CAAC,KAAK,IAAI,EAAE;YACvB,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACvB,CAAC;oBAAS,CAAC;gBACT,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC;YAC7B,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC5B,SAAS,CAAC,GAAG,CACX,gBAAgB,EAChB,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,EACjE,OAAO,CACR,CAAC;YACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC3B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAuB;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IAC7F,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC;QACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,aAAa,EAAE,OAAO,CACpB,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,CACtF;QACD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE;QACnC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC;QAC3E,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sCAAsC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAC/E,CAAC;IACF,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,aAAa,CAAC,OAA+B;IACpD,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACnD,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACzC,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAuB,EAAE,IAAY;IAClE,MAAM,SAAS,GAAG,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,QAAQ,GACZ,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS;QAC3E,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE;QAC1D,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAC/C,QAAQ,CAAC,QAAQ,EACjB,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,MAAM,EACf,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAC5B,CAAC;IACF,OAAO,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAE,EAAE,EAAE,GAAG,EAAE,CAC7D,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;QACpB,GAAG,SAAS;QACZ,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ;QACrC,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK;KAChC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAAuB,EAAE,KAAe;IACtE,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/C,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAClC,OAAO,CAAC,SAAS,CAAC,WAAW,CAC3B,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,WAAW,EACpB,KAAK,CAAC,eAAe,EAAE,CAAC,MAAM,CAC/B,CAAC;IACF,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,EAAE;QAC5F,aAAa,EAAE,KAAK,CAAC,KAAK;QAC1B,gBAAgB,EAAE,QAAQ;QAC1B,cAAc,EAAE,UAAU;KAC3B,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IACzC,MAAM,IAAI,eAAe,CACvB,KAAK,EACL,OAAO,CAAC,QAAQ,EAChB,qBAAqB,CACnB,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAC1B,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAC9D,EACD,OAAO,CAAC,SAAS,CAClB,CAAC,GAAG,EAAE,CAAC;IACR,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACjF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAuB;IAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC,IAAI,EACJ,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAC9D,CAAC;IACF,MAAM,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjD,yBAAyB,CACvB,MAAM,EACN,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAC9D,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3E,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,IAAI,CAAC,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,WAAW,EAAE,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAuB;IAC9C,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC,CAAC;IACjG,SAAS,CAAC;QACR,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,IAAI,EAAE,OAAO,CAAC,WAAW;QACzB,KAAK,EAAE,OAAO,CAAC,SAAS;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,GAAG,UAAU;KACd,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAuB;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,QAAQ,CAAC,2DAA2D,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,8BAA8B,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAAC,oCAAoC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AAChD,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAuB;IAC1D,QAAQ,OAAO,CAAC,OAAO,EAAE,CAAC;QACxB,KAAK,OAAO;YACV,SAAS,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACnC,OAAO;QACT,KAAK,aAAa;YAChB,SAAS,CAAC,MAAM,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YACvF,OAAO;QACT,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5B,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1B,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5B,KAAK,KAAK;YACR,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5B,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5B,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACnE,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,WAAW,EAAE,CAAC,CAAC;AAC3F,CAAC"}

package/dist/src/cli/hands-docker.d.ts

@@ -0,0 +1,7 @@
+import { type HandsReceipt } from "./hands-record.js";
+/** Bounded setup controls never invoke a shell, pull an image, or read the user's Docker config. */
+export declare function handsDocker(root: string, receipt: HandsReceipt, arguments_: string[]): string;
+/** The sole supported offline, file-only profile uses existing finite kernel limits. */
+export declare function createHandsArguments(root: string, receipt: HandsReceipt): string[];
+/** Stream a bounded tar archive to a new private file; hostile archive paths are never extracted. */
+export declare function exportHandsWorkspace(root: string, receipt: HandsReceipt, path: string): Promise<void>;

package/dist/src/cli/hands-docker.js

@@ -0,0 +1,182 @@
+/** Setup-only Docker CLI calls use one explicit socket and no ambient Docker context or credentials. */
+import { spawn, spawnSync } from "node:child_process";
+import { createWriteStream, fsyncSync, closeSync, openSync } from "node:fs";
+import { join } from "node:path";
+import { Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { SeptError } from "../durable/index.js";
+import { guardedCommand, parseNamespaceLifetime } from "../execution/index.js";
+import { readHandsMetadata } from "./hands-record.js";
+// Lifetime is checked inside the exec: a replacement namespace can never emit an archive.
+const ARCHIVE_ENTRY = `const fs = require('node:fs');
+const { spawnSync } = require('node:child_process');
+const stat = fs.readFileSync('/proc/1/stat', 'utf8');
+if (stat.length > 16384) process.exit(126);
+const start = stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19];
+if (fs.readlinkSync('/proc/self/ns/pid') !== process.argv[1] || start !== process.argv[2]) process.exit(126);
+const result = spawnSync('/bin/tar', ['-C', '/workspace', '-cf', '-', '.'], { stdio: 'inherit', env: { PATH: '/usr/bin:/bin' }, timeout: 25000 });
+process.exit(result.status === 0 && result.signal === null ? 0 : 126);`;
+const MAX_ARCHIVE_BYTES = 134217728 + 32768 * 2048;
+function commandArguments(root, receipt, arguments_) {
+    return [
+        "--config",
+        join(root, "docker-cli"),
+        "--host",
+        `unix://${receipt.engineSocket}`,
+        ...arguments_,
+    ];
+}
+/** Bounded setup controls never invoke a shell, pull an image, or read the user's Docker config. */
+export function handsDocker(root, receipt, arguments_) {
+    const result = spawnSync("docker", commandArguments(root, receipt, arguments_), {
+        env: { PATH: process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin" },
+        encoding: "utf8",
+        timeout: 30_000,
+        maxBuffer: 16 * 1024,
+    });
+    if (result.status !== 0 || result.signal !== null || result.error !== undefined) {
+        throw new SeptError("Hands setup Docker command failed; retained receipt requires inspection", {
+            cause: result.error,
+        });
+    }
+    return result.stdout.trim();
+}
+/** The sole supported offline, file-only profile uses existing finite kernel limits. */
+export function createHandsArguments(root, receipt) {
+    return [
+        "create",
+        "--pull",
+        "never",
+        "--name",
+        `sept-hands-${receipt.owner}`,
+        "--label",
+        `sept.setup.owner=${receipt.owner}`,
+        "--init",
+        "--no-healthcheck",
+        "--entrypoint",
+        "",
+        "--user",
+        "10002:10002",
+        "--read-only",
+        "--cap-drop",
+        "ALL",
+        "--security-opt",
+        "no-new-privileges",
+        "--pids-limit",
+        "128",
+        "--memory",
+        "1g",
+        "--cpus",
+        "2",
+        "--network",
+        "none",
+        "--tmpfs",
+        "/tmp:rw,nosuid,nodev,noexec,size=16777216,mode=1777",
+        "--tmpfs",
+        "/workspace:rw,nosuid,nodev,noexec,size=134217728,nr_inodes=32768,mode=2770,uid=10002,gid=10002",
+        "--mount",
+        `type=bind,src=${join(root, "resources")},dst=/resources,readonly`,
+        receipt.image,
+        "sleep",
+        "infinity",
+    ];
+}
+/** Stream a bounded tar archive to a new private file; hostile archive paths are never extracted. */
+export async function exportHandsWorkspace(root, receipt, path) {
+    if (receipt.containerId === undefined) {
+        throw new SeptError("Hands export requires captured container ownership");
+    }
+    const child = archiveChild(root, receipt);
+    const completion = childCompletion(child);
+    const timer = setTimeout(() => {
+        child.kill("SIGKILL");
+    }, 30_000);
+    try {
+        await archivePipeline(child.stdout, path);
+        await completion;
+        syncArchive(path);
+    }
+    catch (error) {
+        child.kill("SIGKILL");
+        await completion.catch(() => undefined);
+        throw new SeptError("Hands workspace export failed; partial archive retained", {
+            cause: error,
+        });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function archiveChild(root, receipt) {
+    if (receipt.containerId === undefined) {
+        throw new SeptError("Hands export requires captured container ownership");
+    }
+    const child = spawn("docker", commandArguments(root, receipt, [
+        "exec",
+        "--user",
+        "10002:10002",
+        receipt.containerId,
+        ...archiveCommand(root),
+    ]), {
+        env: { PATH: process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin" },
+        stdio: ["pipe", "pipe", "pipe"],
+    });
+    child.stdin.end();
+    let stderrBytes = 0;
+    child.stderr.on("data", (chunk) => {
+        stderrBytes += chunk.byteLength;
+        if (stderrBytes > 16 * 1024) {
+            child.kill("SIGKILL");
+        }
+    });
+    return child;
+}
+function archiveCommand(root) {
+    const path = join(root, "evidence", "lifetime.json");
+    const raw = readHandsMetadata(path, 1024);
+    const lifetime = parseNamespaceLifetime(raw);
+    return guardedCommand(["--eval", ARCHIVE_ENTRY, lifetime.pidNamespace, lifetime.initStart]);
+}
+function childCompletion(child) {
+    const completed = new Promise((resolve, reject) => {
+        child.once("error", () => {
+            reject(new SeptError("Hands archive process could not start"));
+        });
+        child.once("close", (code, signal) => {
+            if (code === 0 && signal === null) {
+                resolve();
+            }
+            else {
+                reject(new SeptError("Hands archive process failed"));
+            }
+        });
+    });
+    // Attach a rejection owner immediately: an Engine failure may arrive before stream finalization.
+    void completed.catch(() => undefined);
+    return completed;
+}
+async function archivePipeline(source, path) {
+    let bytes = 0;
+    const bound = new Transform({
+        transform(chunk, _encoding, callback) {
+            bytes += chunk.byteLength;
+            if (bytes > MAX_ARCHIVE_BYTES) {
+                callback(new SeptError("Hands workspace archive exceeds its fixed capacity"));
+            }
+            else {
+                callback(null, chunk);
+            }
+        },
+    });
+    await pipeline(source, bound, createWriteStream(path, { flags: "wx", mode: 0o600 }));
+}
+function syncArchive(path) {
+    const descriptor = openSync(path, "r");
+    try {
+        fsyncSync(descriptor);
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}
+//# sourceMappingURL=hands-docker.js.map

package/dist/src/cli/hands-docker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hands-docker.js","sourceRoot":"","sources":["../../../src/cli/hands-docker.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAqB,MAAM,mBAAmB,CAAC;AAEzE,0FAA0F;AAC1F,MAAM,aAAa,GAAG;;;;;;;uEAOiD,CAAC;AAExE,MAAM,iBAAiB,GAAG,SAAS,GAAG,KAAK,GAAG,IAAI,CAAC;AAEnD,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAqB,EAAE,UAAoB;IACjF,OAAO;QACL,UAAU;QACV,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;QACxB,QAAQ;QACR,UAAU,OAAO,CAAC,YAAY,EAAE;QAChC,GAAG,UAAU;KACd,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,OAAqB,EAAE,UAAoB;IACnF,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE;QAC9E,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,8BAA8B,EAAE;QACjE,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,MAAM;QACf,SAAS,EAAE,EAAE,GAAG,IAAI;KACrB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChF,MAAM,IAAI,SAAS,CAAC,yEAAyE,EAAE;YAC7F,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,OAAqB;IACtE,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,cAAc,OAAO,CAAC,KAAK,EAAE;QAC7B,SAAS;QACT,oBAAoB,OAAO,CAAC,KAAK,EAAE;QACnC,QAAQ;QACR,kBAAkB;QAClB,cAAc;QACd,EAAE;QACF,QAAQ;QACR,aAAa;QACb,aAAa;QACb,YAAY;QACZ,KAAK;QACL,gBAAgB;QAChB,mBAAmB;QACnB,cAAc;QACd,KAAK;QACL,UAAU;QACV,IAAI;QACJ,QAAQ;QACR,GAAG;QACH,WAAW;QACX,MAAM;QACN,SAAS;QACT,qDAAqD;QACrD,SAAS;QACT,gGAAgG;QAChG,SAAS;QACT,iBAAiB,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,0BAA0B;QAClE,OAAO,CAAC,KAAK;QACb,OAAO;QACP,UAAU;KACX,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,OAAqB,EACrB,IAAY;IAEZ,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC,EAAE,MAAM,CAAC,CAAC;IACX,IAAI,CAAC;QACH,MAAM,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,UAAU,CAAC;QACjB,WAAW,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,IAAI,SAAS,CAAC,yDAAyD,EAAE;YAC7E,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,IAAY,EACZ,OAAqB;IAErB,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CACjB,QAAQ,EACR,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE;QAC9B,MAAM;QACN,QAAQ;QACR,aAAa;QACb,OAAO,CAAC,WAAW;QACnB,GAAG,cAAc,CAAC,IAAI,CAAC;KACxB,CAAC,EACF;QACE,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,8BAA8B,EAAE;QACjE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KAChC,CACF,CAAC;IACF,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAClB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC;QAChC,IAAI,WAAW,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,cAAc,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,eAAe,CAAC,KAAgD;IACvE,MAAM,SAAS,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,MAAM,CAAC,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBAClC,OAAO,EAAE,CAAC;YACZ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,iGAAiG;IACjG,KAAK,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAA6B,EAAE,IAAY;IACxE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC;QAC1B,SAAS,CAAC,KAAa,EAAE,SAAS,EAAE,QAAQ;YAC1C,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,iBAAiB,EAAE,CAAC;gBAC9B,QAAQ,CAAC,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC,CAAC;YAChF,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,iBAAiB,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,SAAS,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;AACH,CAAC"}

package/dist/src/cli/hands-finish.d.ts

@@ -0,0 +1,2 @@
+/** Refuse a live worker, serialize setup ownership, then independently finalize export and stop. */
+export declare function finishHands(options: Record<string, string>): Promise<unknown>;

package/dist/src/cli/hands-finish.js

@@ -0,0 +1,164 @@
+/** Export before stopping one exclusively owned hands generation; never extract archive bytes on host. */
+import { existsSync, lstatSync } from "node:fs";
+import { join, dirname, basename } from "node:path";
+import { randomUUID } from "node:crypto";
+import { acquireStateRootLease, atomicWrite, SeptError } from "../durable/index.js";
+import { handsPaths, readHandsReceipt, readHandsMetadata, trustedHandsRoot, writeHandsReceipt, } from "./hands-record.js";
+import { exportHandsWorkspace } from "./hands-docker.js";
+import { inspectHandsOwner, openHandsEngine, stopHandsOwner } from "./hands-owner.js";
+/** Refuse a live worker, serialize setup ownership, then independently finalize export and stop. */
+export async function finishHands(options) {
+    if (Object.keys(options).some((key) => key !== "root")) {
+        throw new SeptError("hands finish accepts only --root");
+    }
+    const root = trustedHandsRoot(options.root);
+    assertSetupLayout(root);
+    // Preflight schema grants no authority; the owner is re-read after serialized lease acquisition.
+    readHandsReceipt(root);
+    const releaseSetup = acquireStateRootLease(join(root, "evidence"));
+    try {
+        const releaseWorker = acquireStateRootLease(handsPaths(root).stateRoot);
+        try {
+            return await finishOwned(root, readHandsReceipt(root));
+        }
+        finally {
+            releaseWorker();
+        }
+    }
+    finally {
+        releaseSetup();
+    }
+}
+function assertSetupLayout(root) {
+    try {
+        // Lease acquisition creates lock files: prove a setup-owned layout before any such mutation.
+        for (const name of ["state", "evidence"]) {
+            const directory = lstatSync(join(root, name));
+            if (!directory.isDirectory() ||
+                directory.uid !== process.getuid?.() ||
+                (directory.mode & 0o077) !== 0) {
+                throw new SeptError("Hands setup directories must be private and owned");
+            }
+        }
+        assertSetupReceipt(root);
+    }
+    catch (error) {
+        throw new SeptError("Hands finish requires an existing private owned setup layout", {
+            cause: error,
+        });
+    }
+}
+function assertSetupReceipt(root) {
+    const receipt = lstatSync(join(root, "evidence", "setup.json"));
+    if (!receipt.isFile() ||
+        receipt.nlink !== 1 ||
+        receipt.uid !== process.getuid?.() ||
+        (receipt.mode & 0o077) !== 0 ||
+        receipt.size > 16 * 1024) {
+        throw new SeptError("Hands setup receipt must be private and owned");
+    }
+}
+async function finishOwned(root, receipt) {
+    const previous = reusableExport(root);
+    const engine = await openHandsEngine(receipt);
+    const archive = join(root, "evidence", `workspace-${randomUUID()}.tar`);
+    let exported = previous !== undefined;
+    let stopped = false;
+    try {
+        const state = await inspectHandsOwner(root, receipt, engine);
+        if (receipt.phase === "finished") {
+            return verifiedFinalization(root, state, previous);
+        }
+        exported ||= await tryExport(root, receipt, archive, state.Running === true);
+        await stopHandsOwner(root, receipt, engine);
+        stopped = true;
+    }
+    finally {
+        await engine.close();
+        if (receipt.phase !== "finished") {
+            atomicWrite(join(root, "evidence", "finish.json"), {
+                exported,
+                stopped,
+                archive: previous ?? (existsSync(archive) ? archive : null),
+            });
+        }
+    }
+    if (!exported) {
+        throw new SeptError("Hands workspace export failed or unavailable; stop verified; inspect evidence/finish.json");
+    }
+    receipt.phase = "finished";
+    writeHandsReceipt(root, receipt);
+    return readFinalization(root);
+}
+function verifiedFinalization(root, state, previous) {
+    if (state.Running !== false || state.Pid !== 0 || previous === undefined) {
+        throw new SeptError("Previously finished hands has no verified stopped namespace and retained archive");
+    }
+    const result = readFinalization(root);
+    if (!result.exported || !result.stopped) {
+        throw new SeptError("Hands finished receipt has no verified successful outcomes");
+    }
+    return result;
+}
+function readFinalization(root) {
+    const result = readHandsMetadata(join(root, "evidence", "finish.json"), 1024);
+    if (typeof result !== "object" ||
+        result === null ||
+        !("exported" in result) ||
+        !("stopped" in result) ||
+        !("archive" in result)) {
+        throw new SeptError("Hands finalization receipt is malformed");
+    }
+    if (typeof result.exported !== "boolean" ||
+        typeof result.stopped !== "boolean" ||
+        (typeof result.archive !== "string" && result.archive !== null)) {
+        throw new SeptError("Hands finalization outcomes are malformed");
+    }
+    return { exported: result.exported, stopped: result.stopped, archive: result.archive };
+}
+function reusableExport(root) {
+    try {
+        return previousExport(root);
+    }
+    catch {
+        // Invalid export evidence grants no reuse, but cannot skip independently owned namespace shutdown.
+        return undefined;
+    }
+}
+function previousExport(root) {
+    if (!existsSync(join(root, "evidence", "finish.json"))) {
+        return undefined;
+    }
+    const previous = readFinalization(root);
+    if (!previous.exported || previous.archive === null) {
+        return undefined;
+    }
+    if (dirname(previous.archive) !== join(root, "evidence") ||
+        !/^workspace-[a-f0-9-]{36}\.tar$/.test(basename(previous.archive))) {
+        throw new SeptError("Hands archive receipt escapes the owned evidence directory");
+    }
+    assertArchive(previous.archive);
+    return previous.archive;
+}
+function assertArchive(path) {
+    const file = lstatSync(path);
+    if (!file.isFile() ||
+        file.nlink !== 1 ||
+        file.uid !== process.getuid?.() ||
+        (file.mode & 0o077) !== 0) {
+        throw new SeptError("Hands retained archive ownership is malformed");
+    }
+}
+async function tryExport(root, receipt, archive, running) {
+    if (!running || receipt.generation === undefined) {
+        return false;
+    }
+    try {
+        await exportHandsWorkspace(root, receipt, archive);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=hands-finish.js.map

package/dist/src/cli/hands-finish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hands-finish.js","sourceRoot":"","sources":["../../../src/cli/hands-finish.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACtF,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA+B;IAC/D,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxB,iGAAiG;IACjG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,YAAY,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,qBAAqB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC;QACxE,IAAI,CAAC;YACH,OAAO,MAAM,WAAW,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,CAAC;gBAAS,CAAC;YACT,aAAa,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,YAAY,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,6FAA6F;QAC7F,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9C,IACE,CAAC,SAAS,CAAC,WAAW,EAAE;gBACxB,SAAS,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;gBACpC,CAAC,SAAS,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAC9B,CAAC;gBACD,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QACD,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,SAAS,CAAC,8DAA8D,EAAE;YAClF,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;IAChE,IACE,CAAC,OAAO,CAAC,MAAM,EAAE;QACjB,OAAO,CAAC,KAAK,KAAK,CAAC;QACnB,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;QAClC,CAAC,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAC5B,OAAO,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,EACxB,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,OAAqB;IAC5D,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,aAAa,UAAU,EAAE,MAAM,CAAC,CAAC;IACxE,IAAI,QAAQ,GAAG,QAAQ,KAAK,SAAS,CAAC;IACtC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACjC,OAAO,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrD,CAAC;QACD,QAAQ,KAAK,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;QAC7E,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACjC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE;gBACjD,QAAQ;gBACR,OAAO;gBACP,OAAO,EAAE,QAAQ,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;aAC5D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,SAAS,CACjB,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC;IAC3B,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,oBAAoB,CAC3B,IAAY,EACZ,KAA8B,EAC9B,QAA4B;IAE5B,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzE,MAAM,IAAI,SAAS,CACjB,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxC,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAQD,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9E,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACf,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC;QACvB,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC;QACtB,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,EACtB,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACjE,CAAC;IACD,IACE,OAAO,MAAM,CAAC,QAAQ,KAAK,SAAS;QACpC,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS;QACnC,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,EAC/D,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,mGAAmG;QACnG,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC;QACpD,CAAC,gCAAgC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAClE,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACpF,CAAC;IACD,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IACE,CAAC,IAAI,CAAC,MAAM,EAAE;QACd,IAAI,CAAC,KAAK,KAAK,CAAC;QAChB,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;QAC/B,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EACzB,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,IAAY,EACZ,OAAqB,EACrB,OAAe,EACf,OAAgB;IAEhB,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/src/cli/hands-owner.d.ts

@@ -0,0 +1,10 @@
+import { DockerEngineControl, type DockerHandsConfiguration } from "../execution/index.js";
+import { type HandsReceipt } from "./hands-record.js";
+/** Open the originally captured socket/daemon only; ambient context and replacement daemons refuse. */
+export declare function openHandsEngine(receipt: HandsReceipt): Promise<DockerEngineControl>;
+/** A pre-create receipt can recover only its unique setup-labelled container, never a foreign name. */
+export declare function inspectHandsOwner(root: string, receipt: HandsReceipt, engine: DockerEngineControl): Promise<Record<string, unknown>>;
+/** Capture the native pinned stop receipt before granting the first permission revision. */
+export declare function captureHandsOwner(root: string, receipt: HandsReceipt, configuration: DockerHandsConfiguration, engine: DockerEngineControl): Promise<void>;
+/** Stop only the captured namespace lifetime, independently verifying stopped/PID0 after helper teardown. */
+export declare function stopHandsOwner(root: string, receipt: HandsReceipt, engine: DockerEngineControl): Promise<void>;