smol-symphony 0.2.0 → 0.3.0

package/dist/src/shell/main-adapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main-adapters.js","sourceRoot":"","sources":["../../../src/shell/main-adapters.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,gFAAgF;AAChF,6EAA6E;AAC7E,qDAAqD;AACrD,EAAE;AACF,yEAAyE;AACzE,qEAAqE;AACrE,8EAA8E;AAC9E,kFAAkF;AAClF,kFAAkF;AAClF,4EAA4E;AAC5E,kFAAkF;AAClF,iFAAiF;AACjF,+EAA+E;AAC/E,gFAAgF;AAEhF,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAmBzF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAExG,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAuB,MAAM,qBAAqB,CAAC;AAEhF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AASnD,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAAC,UAA8B,EAAE,GAAkB;IAC/E,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC9E,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CACzB,UAA8B,EAC9B,GAAkB;IAElB,IAAI,OAAO,GAAG,cAAc,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC9C,UAAU,CAAC,OAAO,CAAC,CAAC;IACpB,OAAO,CAAC,IAAmB,EAAQ,EAAE;QACnC,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,QAAQ,KAAK,OAAO;YAAE,OAAO;QACjC,OAAO,GAAG,QAAQ,CAAC;QACnB,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,QAAQ,IAAI,CAAC,CAAC;IAChF,CAAC,CAAC;AACJ,CAAC;AAsBD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA2B,EAC3B,GAAY,EACZ,iBAAoC,EACpC,IAAqB;IAErB,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,OAAO;QACL,KAAK,EAAE,WAAW,EAAE;QACpB,MAAM,EAAE,iBAAiB,EAAE;QAC3B,MAAM,EAAE,aAAa,EAAE;QACvB,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC;QAC5C,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,uBAAuB,EAAE;QACjC,KAAK,EAAE,eAAe,EAAE;QACxB,GAAG,EAAE,gBAAgB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACxC,EAAE,EAAE,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QAC3E,EAAE,EAAE,IAAI,gBAAgB,EAAE;QAC1B,OAAO,EAAE,oBAAoB,CAAC;YAC5B,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,OAAO;YAC9B,GAAG;YACH,YAAY,EAAE,iBAAiB;YAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;SAC1D,CAAC;QACF,SAAS,EAAE,sBAAsB,CAAC;YAChC,8EAA8E;YAC9E,2EAA2E;YAC3E,oEAAoE;YACpE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI;YACnC,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,MAAM,EAAE,CAAC,YAAY;YAC3E,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC;QACF,MAAM,EAAE,IAAI,aAAa,CAAC,GAAG,CAAC;QAC9B,KAAK,EAAE,IAAI,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAqBC;IAED,MAAM,WAAW,GAAoB;QACnC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QACnD,SAAS,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC;KAC1E,CAAC;IACF,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW;QACX,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,2EAA2E;QAC3E,+CAA+C;QAC/C,WAAW,EAAE,GAAG,EAAE,CAAC,SAAS;QAC5B,6EAA6E;QAC7E,+EAA+E;QAC/E,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,EAAE,EAAE,WAAW,EAAE;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,wEAAwE;QACxE,aAAa,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,UAAU,QAAQ,CAAC;QAC1F,4EAA4E;QAC5E,8EAA8E;QAC9E,8EAA8E;QAC9E,+EAA+E;QAC/E,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC,CAAC;QACvH,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;QACpI,6EAA6E;QAC7E,yEAAyE;QACzE,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,iFAAiF;QACjF,kFAAkF;QAClF,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACrE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YAChC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACvD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;QACD,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACvB,MAAM,KAAK,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1B,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAChB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACjD,CAAC;QACD,SAAS,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC;QAC9D,QAAQ,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC;QAChD,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACxE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CACZ,MAAM,CAAC,CAAC,CAAC;aACN,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aAChB,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;KACxB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAkB,EAAE,MAAkB;IAC1E,MAAM,KAAK,GAAU,IAAI,CAAC,KAAK,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,EAAE;QAClB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK;QACL,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,IAAI;QACjB,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,IAAI;QACnB,YAAY,EAAE,IAAI;QAClB,YAAY,EAAE,CAAC;QACf,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC;QACf,0BAA0B,EAAE,CAAC;QAC7B,2BAA2B,EAAE,CAAC;QAC9B,0BAA0B,EAAE,CAAC;QAC7B,UAAU,EAAE,CAAC;QACb,aAAa,EAAE,IAAI,CAAC,OAAO;QAC3B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,cAAc,EAAE,EAAE;QAClB,MAAM;QACN,aAAa,EAAE,EAAE;QACjB,UAAU,EAAE,IAAI;QAChB,yBAAyB,EAAE,KAAK;QAChC,SAAS,EAAE,IAAI;QACf,wBAAwB,EAAE,IAAI,CAAC,WAAW;QAC1C,uBAAuB,EAAE,IAAI;QAC7B,uBAAuB,EAAE,EAAE;QAC3B,cAAc,EAAE,EAAE;QAClB,YAAY,EAAE,KAAK;QACnB,kBAAkB,EAAE,KAAK;QACzB,iBAAiB,EAAE,IAAI;QACvB,gBAAgB,EAAE,IAAI;QACtB,iBAAiB,EAAE,IAAI,GAAG,EAAU;QACpC,eAAe,EAAE,IAAI;KACtB,CAAC;AACJ,CAAC"}

package/dist/src/shell/main-credential.js

@@ -0,0 +1,122 @@
+// FCIS rewrite — credential-substrate construction for the composition root (kind:
+// shell). Replaces the placeholderCredential() stub with the REAL host-only
+// credential slice + the per-VM egress substrate the runner consumes.
+//
+// Builds:
+//   • the host-only CredentialPort  → GondolinCredentialAdapter over the injected
+//     PURE core extractors (probe / read_identity / refresh / exchange / lock).
+//   • the live per-VM SecretManager registry (CredentialSecretRegistry) whose
+//     readToken / refresh close over the port — the runner's `SecretRegistry`.
+//   • the periodic host-side refresh ticker (CredentialTicker).
+//   • the per-VM `createHttpHooks` builder (buildVmHttpHooks) wrapped in the
+//     request-hook CHAIN: egress audit ∘ codex chatgpt-backend route swap (PR#119).
+//     REQUEST-side hooks ONLY — never an onResponse hook (issue-135 streaming
+//     regression).
+//
+// INVARIANTS preserved here (load-bearing — see project memory):
+//   • HOST-ONLY REFRESH / PLACEHOLDER-ONLY GUEST: the guest is staged a token-SHAPED
+//     PLACEHOLDER (buildAdapterCredentialSpecWithPlaceholder / buildGondolinFakeCreds);
+//     the REAL token is registered for EGRESS SUBSTITUTION only (secrets[].hosts via
+//     buildVmHttpHooks). The real/refresh token never enters the guest.
+//   • NO onResponse HOOK: buildVmHttpHooks wires onRequest only (chained below); we
+//     never pass onResponse. Re-buffering responses starves the in-VM streaming SDK
+//     → the ECONNRESET loop.
+//   • CODEX UPSTREAM ROUTE (PR#119): the request-hook chain keeps the codex
+//     chatgpt-backend route swap (host→chatgpt.com, /v1→/backend-api/codex,
+//     chatgpt-account-id) or a ChatGPT-OAuth codex token 401s the platform API.
+//
+// Core-free: imports src/types + sibling shell only — every pure decider arrives
+// injected via `input.core` (only the composition root imports core).
+import process from 'node:process';
+import { GondolinCredentialAdapter } from './interp/credential.js';
+import { CredentialSecretRegistry, CredentialTicker } from './interp/credential-registry.js';
+import { buildVmHttpHooks, makeCodexUpstreamRouteHook, makeLazyRefreshHook, chainOnRequest, } from './interp/credential-hooks.js';
+/** The universe of host-refreshable adapters. The ticker only fans out to the
+ *  SUBSET the live workflow declares (input.requiredAdapters) — an unused adapter
+ *  is never probed, so a claude-only workflow doesn't warn on a missing
+ *  ~/.codex/auth.json. */
+const ALL_ADAPTERS = ['claude', 'codex'];
+/**
+ * Construct the credential substrate. The returned `port` is the host-only
+ * CredentialPort wired into the EffectAdapters bundle; `registry` is the runner's
+ * per-VM `SecretRegistry`; `buildPerVmHooks` builds one dispatch's egress hooks.
+ */
+export function buildCredentialSubstrate(input) {
+    const env = input.env ?? process.env;
+    // ── host-only CredentialPort (the IO + injected pure extractors) ──────────────
+    const port = new GondolinCredentialAdapter({
+        pure: input.core.pure,
+        log: input.log,
+        env,
+    });
+    // ── live per-VM SecretManager registry: readToken / refresh close over the port ─
+    // register() seeds the latest cached token BEFORE returning + schedules the
+    // proactive pre-expiry tick (the §4.3 fan-out). The runner uses this as its
+    // `SecretRegistry`. The REAL token only ever lands in a SecretManager value (the
+    // egress-substitution slot) — never in the guest's staged files / launch env.
+    const registry = new CredentialSecretRegistry({
+        readToken: (adapter) => port.probe(adapter),
+        refresh: (adapter) => port.refresh(adapter),
+        log: input.log,
+        refreshMarginMs: input.refreshMarginMs(),
+    });
+    // ── periodic host-side refresh ticker (idle-window backstop) ──────────────────
+    const ticker = new CredentialTicker({
+        intervalMs: input.tickerIntervalMs(),
+        refreshAll: async () => {
+            const required = input.requiredAdapters();
+            for (const adapter of ALL_ADAPTERS) {
+                if (!required.has(adapter))
+                    continue;
+                await registry.refreshAdapter(adapter).catch(() => undefined);
+            }
+        },
+        log: input.log,
+    });
+    // ── per-VM egress hooks (REQUEST-side chain; NEVER onResponse) ─────────────────
+    const buildPerVmHooks = (hooksInput) => {
+        // Egress request-side lazy refresh (issue 214): ensure the token is fresh on the
+        // credential's substitution hosts BEFORE Gondolin substitutes the secret value. Runs
+        // FIRST in the chain (a pure pass-through that only awaits a host refresh when within
+        // margin); never an onResponse hook → no issue-135 streaming regression.
+        const lazyRefresh = makeLazyRefreshHook(hooksInput.substitutionHosts, () => registry.ensureFreshForRequest(hooksInput.adapterId), input.log);
+        const requestChain = chainOnRequest(lazyRefresh, buildPerVmRequestChain(hooksInput.token, hooksInput.onRequest, input.core.codexUpstreamRoute));
+        // buildVmHttpHooks wraps the request chain in the standing egress-audit hook and
+        // wires the secret substitution (secrets[<secretName>].hosts = substitutionHosts,
+        // placeholder = token-shaped placeholder). It registers ONLY `onRequest`.
+        return buildVmHttpHooks({ ...hooksInput, onRequest: requestChain }, input.log);
+    };
+    return {
+        port,
+        registry,
+        ticker,
+        // Host refresh + fan-out for the in-session 401 recovery (issue 214); the boolean
+        // reports whether a fresh token landed (false ⇒ genuine auth failure → end attempt).
+        refreshCredential: (adapter) => registry.refreshAdapter(adapter),
+        buildPerVmHooks,
+        buildAdapterSpec: (adapter, accountId = null) => input.core.buildAdapterCredentialSpecWithPlaceholder(adapter, input.random, accountId),
+        buildHooksConfig: (specs, egressAllowlist) => input.core.buildAdapterHooksConfig(specs, egressAllowlist),
+        buildFakeCreds: (fakeInput) => input.core.buildGondolinFakeCreds(fakeInput),
+    };
+}
+/**
+ * Assemble the per-VM REQUEST-side onRequest chain for one dispatch:
+ *
+ *   adapter-supplied guard  (e.g. a codex pre-hook)
+ *   ∘ codex chatgpt-backend route swap (PR#119; only for a ChatGPT-OAuth codex token)
+ *
+ * The codex route hook is wired for EVERY dispatch but only RE-WRITES when
+ * `codexUpstreamRoute(token)` returns a non-null route (a ChatGPT-OAuth token); an
+ * API-key / non-codex credential → null route → the request passes through
+ * unchanged.
+ *
+ * NO onResponse hook is ever assembled — request hooks only.
+ */
+function buildPerVmRequestChain(token, adapterGuard, codexUpstreamRoute) {
+    // codex chatgpt-backend route swap — keyed on the LIVE credential so an OAuth
+    // subscription token routes off the metered platform API (else it 401s).
+    const resolveRoute = () => (token !== null ? codexUpstreamRoute(token) : null);
+    const codexRouteHook = makeCodexUpstreamRouteHook(resolveRoute);
+    return chainOnRequest(adapterGuard, codexRouteHook);
+}
+//# sourceMappingURL=main-credential.js.map

package/dist/src/shell/main-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main-credential.js","sourceRoot":"","sources":["../../../src/shell/main-credential.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,4EAA4E;AAC5E,sEAAsE;AACtE,EAAE;AACF,UAAU;AACV,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,gEAAgE;AAChE,6EAA6E;AAC7E,oFAAoF;AACpF,8EAA8E;AAC9E,mBAAmB;AACnB,EAAE;AACF,iEAAiE;AACjE,qFAAqF;AACrF,wFAAwF;AACxF,qFAAqF;AACrF,wEAAwE;AACxE,oFAAoF;AACpF,oFAAoF;AACpF,6BAA6B;AAC7B,4EAA4E;AAC5E,4EAA4E;AAC5E,gFAAgF;AAChF,EAAE;AACF,iFAAiF;AACjF,sEAAsE;AAEtE,OAAO,OAAO,MAAM,cAAc,CAAC;AAUnC,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAC7F,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,mBAAmB,EACnB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAEtC;;;0BAG0B;AAC1B,MAAM,YAAY,GAA4B,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAElE;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAA+B;IACtE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAErC,iFAAiF;IACjF,MAAM,IAAI,GAAmB,IAAI,yBAAyB,CAAC;QACzD,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG;KACJ,CAAC,CAAC;IAEH,mFAAmF;IACnF,4EAA4E;IAC5E,4EAA4E;IAC5E,iFAAiF;IACjF,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,IAAI,wBAAwB,CAAC;QAC5C,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAC3C,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;KACzC,CAAC,CAAC;IAEH,iFAAiF;IACjF,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC;QAClC,UAAU,EAAE,KAAK,CAAC,gBAAgB,EAAE;QACpC,UAAU,EAAE,KAAK,IAAI,EAAE;YACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC1C,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;gBACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;oBAAE,SAAS;gBACrC,MAAM,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QACD,GAAG,EAAE,KAAK,CAAC,GAAG;KACf,CAAC,CAAC;IAEH,kFAAkF;IAClF,MAAM,eAAe,GAAG,CAAC,UAA2B,EAAE,EAAE;QACtD,iFAAiF;QACjF,qFAAqF;QACrF,sFAAsF;QACtF,yEAAyE;QACzE,MAAM,WAAW,GAAG,mBAAmB,CACrC,UAAU,CAAC,iBAAiB,EAC5B,GAAG,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,UAAU,CAAC,SAAS,CAAC,EAC1D,KAAK,CAAC,GAAG,CACV,CAAC;QACF,MAAM,YAAY,GAAG,cAAc,CACjC,WAAW,EACX,sBAAsB,CACpB,UAAU,CAAC,KAAK,EAChB,UAAU,CAAC,SAAS,EACpB,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAC9B,CACF,CAAC;QACF,iFAAiF;QACjF,kFAAkF;QAClF,0EAA0E;QAC1E,OAAO,gBAAgB,CAAC,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACjF,CAAC,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,MAAM;QACN,kFAAkF;QAClF,qFAAqF;QACrF,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC;QAChE,eAAe;QACf,gBAAgB,EAAE,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI,EAAE,EAAE,CAC9C,KAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC;QACxF,gBAAgB,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,CAC3C,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,eAAe,CAAC;QAC5D,cAAc,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,sBAAsB,CAC7B,KAAuB,EACvB,YAA0C,EAC1C,kBAA6C;IAE7C,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,YAAY,GAAG,GAA8B,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1G,MAAM,cAAc,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;IAEhE,OAAO,cAAc,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AACtD,CAAC"}

package/dist/src/shell/main-doctor.js

@@ -0,0 +1,22 @@
+// FCIS rewrite — the `doctor` preflight closure (kind: shell helper). Sliced out of
+// src/shell/main.ts so the composition root stays under the max-lines budget. Runs
+// every doctor probe non-fatally and renders the report; the pure core checks +
+// credential classifiers + the workflow parser arrive INJECTED from the root (the
+// shell doctor may not import core). Imports src/types + sibling shell ONLY.
+/** Build the `runDoctor(workflowPath, port)` closure the preflight branch calls. The
+ *  managed-image wiring (issue 224) is built by the root (the only core importer) and
+ *  injected so the doctor can preflight the managed source for this host arch. */
+export function buildRunDoctor(checks, classifiers, loadConfig, managedWiring) {
+    return async (workflowPath, port) => {
+        // Imported lazily so the bare `serve` path doesn't pull the doctor's heavy IO.
+        const { runDoctorCli, defaultDoctorDeps } = await import('./cli/doctor.js');
+        return runDoctorCli({ workflowPath, port }, checks, {
+            // The core decisions the shell doctor can't import: the credential
+            // availability classifiers + the required-adapter union (collapses the
+            // doctor's inline re-implementations onto the single core source of truth).
+            ...defaultDoctorDeps(classifiers, managedWiring),
+            loadConfig,
+        });
+    };
+}
+//# sourceMappingURL=main-doctor.js.map

package/dist/src/shell/main-doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main-doctor.js","sourceRoot":"","sources":["../../../src/shell/main-doctor.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,mFAAmF;AACnF,gFAAgF;AAChF,kFAAkF;AAClF,6EAA6E;AAK7E;;kFAEkF;AAClF,MAAM,UAAU,cAAc,CAC5B,MAAwB,EACxB,WAAiC,EACjC,UAA4B,EAC5B,aAAwC;IAExC,OAAO,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE;QAClC,+EAA+E;QAC/E,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC5E,OAAO,YAAY,CACjB,EAAE,YAAY,EAAE,IAAI,EAAE,EACtB,MAAM,EACN;YACE,mEAAmE;YACnE,uEAAuE;YACvE,4EAA4E;YAC5E,GAAG,iBAAiB,CAAC,WAAW,EAAE,aAAa,CAAC;YAChD,UAAU;SACX,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/shell/main-entry.js

@@ -0,0 +1,46 @@
+// FCIS rewrite — process-entry helpers (kind: shell helper).
+//
+// Sliced out of the composition root (src/shell/main.ts) so the root stays under
+// the max-lines budget. This module owns NO decisions and imports NO core — it is
+// pure node/runtime plumbing: read the package version off package.json, and
+// detect whether this module is the process entry point (so tests can import the
+// root's pure helpers without kicking off main()).
+//
+// Shell rule: imports from node builtins ONLY (no src/core, no src/types needed).
+import path from 'node:path';
+import process from 'node:process';
+import { realpathSync, readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+/**
+ * The symphony version, read off package.json (works from src/ and dist/ since the
+ * URL is resolved relative to this module). Falls back to '0.0.0' on any read/parse
+ * failure so the banner never crashes startup.
+ */
+export function readSymphonyVersion(metaUrl) {
+    try {
+        const pkgPath = fileURLToPath(new URL('../../package.json', metaUrl));
+        const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
+        return typeof pkg.version === 'string' ? pkg.version : '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+/**
+ * True when the given module is the process entry point, false when imported —
+ * tests import the pure helpers and must not kick off main() (which parses argv,
+ * binds listeners, and would exit the test runner). realpathSync resolves bin
+ * symlinks (REF isMainEntry).
+ */
+export function isMainEntry(metaUrl) {
+    const entry = process.argv[1];
+    if (!entry)
+        return false;
+    try {
+        return realpathSync(entry) === realpathSync(fileURLToPath(metaUrl));
+    }
+    catch {
+        return path.resolve(entry) === fileURLToPath(metaUrl);
+    }
+}
+//# sourceMappingURL=main-entry.js.map

package/dist/src/shell/main-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main-entry.js","sourceRoot":"","sources":["../../../src/shell/main-entry.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,iFAAiF;AACjF,kFAAkF;AAClF,6EAA6E;AAC7E,iFAAiF;AACjF,mDAAmD;AACnD,EAAE;AACF,kFAAkF;AAElF,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAyB,CAAC;QAC9E,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;AACH,CAAC"}

package/dist/src/shell/main-http-csrf.js

@@ -0,0 +1,45 @@
+// FCIS rewrite — the CSRF / HTMX same-origin gate helpers (kind: shell).
+//
+// Header-derived request facts shared by the two shell HTTP route modules
+// (main-http-handler.ts for the dashboard/REST POSTs, main-http-mcp.ts for the
+// agent-facing steering-reply POST). Previously copied verbatim into both; folded
+// here so the security-relevant same-origin gate is defined ONCE — a fix lands in
+// a single place instead of drifting between two copies.
+//
+// These are pure header→fact functions (no IO, no core import); they feed the
+// injected core CSRF deciders (`checkTriageCsrf` / `checkSteeringCsrf`) the
+// boolean facts those deciders gate on. Shell-imports-shell is allowed, so both
+// route modules import from here.
+//
+// Shell rule: imports from src/types/** ONLY.
+/** True when the request carries htmx's `HX-Request: true` header. */
+export function isHtmxRequest(headers) {
+    return (headers['hx-request'] ?? '').toLowerCase() === 'true';
+}
+/**
+ * Same-origin check for the CSRF gates. A cross-site "simple" form POST carries an
+ * `Origin` header whose host differs from the request `Host`; a same-origin POST
+ * either omits `Origin` (older browsers / same-page htmx swaps) or matches the
+ * Host. We compare hosts (the `Origin` is `scheme://host[:port]`). Absent Origin
+ * AND Referer is treated as same-origin (a top-level same-site navigation).
+ */
+export function isSameOrigin(headers) {
+    const host = headers['host'];
+    const origin = headers['origin'];
+    if (origin)
+        return originHost(origin) === host;
+    const referer = headers['referer'];
+    if (referer)
+        return originHost(referer) === host;
+    return true;
+}
+/** Extract the `host[:port]` authority from an Origin/Referer URL, or '' on parse failure. */
+export function originHost(url) {
+    try {
+        return new URL(url).host;
+    }
+    catch {
+        return '';
+    }
+}
+//# sourceMappingURL=main-http-csrf.js.map

package/dist/src/shell/main-http-csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main-http-csrf.js","sourceRoot":"","sources":["../../../src/shell/main-http-csrf.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,kFAAkF;AAClF,kFAAkF;AAClF,yDAAyD;AACzD,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;AAChF,kCAAkC;AAClC,EAAE;AACF,8CAA8C;AAE9C,sEAAsE;AACtE,MAAM,UAAU,aAAa,CAAC,OAA2C;IACvE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,OAA2C;IACtE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,MAAM;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,OAAO;QAAE,OAAO,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}