smol-symphony 0.2.0 → 0.3.0

package/dist/acp-bridge.js

@@ -1,324 +0,0 @@
-// ACP TCP bridge — host-side transport for the in-VM ACP adapter.
-//
-// Before this module, symphony spoke ACP to the in-VM adapter over the earlier
-// in-VM-exec stdio channel directly. Two problems with that:
-//
-//   1. The in-VM-exec stdin pump does not reliably wake the in-VM reader for new
-//      event-loop iterations unless host-side stdin keeps writing — so once symphony
-//      stopped writing (after `session/prompt`), the adapter would freeze waiting for
-//      events that the kernel had already delivered. The previous workaround was a
-//      1.5 s `\n` keepalive on the in-VM-exec stdin.
-//
-//   2. The in-VM-exec stdio path tightly coupled symphony to the exec channel. If we
-//      ever swap the sandbox out for another (firecracker, gvisor, Kubernetes job, …)
-//      we'd have to relearn the same per-sandbox-stdio quirks.
-//
-// This bridge replaces that path: symphony binds a TCP listener; the in-VM `vm-agent`
-// dials back, authenticates with a per-dispatch bearer token, and from then on ACP
-// JSON-RPC frames flow over a regular TCP socket. The in-VM exec is reduced to a process
-// launcher — its stdio is used only for diagnostic stderr from the in-VM agent. Any
-// sandbox that can (a) exec a process with env vars and (b) reach the host loopback
-// can now run our agent stack.
-//
-// Lifecycle:
-//   1. Orchestrator calls `bridge.register(issueId)` BEFORE launching the VM.
-//      Returns a `{ token, accepted }` pair; `token` goes into the launch env as
-//      SYMPHONY_ACP_TOKEN.
-//   2. Launch command exec's `node /opt/symphony/vm-agent.mjs`, which dials
-//      `tcp://<bridge.host>:<bridge.port>` and writes `Bearer <token>\n` as its first
-//      line.
-//   3. Bridge accepts the socket, parses the bearer line, looks up the registration,
-//      validates the token (constant time), and resolves the registration's
-//      `accepted` promise with the now-authenticated socket.
-//   4. Caller hands the socket to AcpClient as its stdin/stdout.
-//   5. On attempt teardown the caller closes the socket; vm-agent reacts by killing
-//      the adapter and exiting; the in-VM exec sees the in-VM agent exit; the orchestrator
-//      destroys the VM (per current lifecycle).
-import { createServer } from 'node:net';
-import { randomBytes, timingSafeEqual } from 'node:crypto';
-import { log } from './logging.js';
-/**
- * Loopback host literals `start()` accepts under `loopbackOnly`. We match the exact
- * IPv4 loopback `127.0.0.1`, the whole `127.0.0.0/8` range textually, the IPv6
- * loopback `::1`, and the `localhost` name. A `0.0.0.0`/`::`/LAN-IP/hostname bind is
- * rejected — those are wider than loopback.
- */
-function isLoopbackHost(host) {
-    if (host === '::1' || host === 'localhost')
-        return true;
-    return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
-}
-export class AcpBridge {
-    server = null;
-    boundPort = null;
-    // Pending registrations keyed by token. Lookups are constant time because we walk and
-    // compare with `timingSafeEqual`; the map is just for fast membership filtering of
-    // expired entries during teardown.
-    pending = new Map();
-    // Live, post-auth sockets we've handed to callers. We track them so `stop()` can force
-    // them closed instead of waiting on `server.close()` to drain — without that, SIGTERM
-    // during an active attempt would block indefinitely while the adapter side fails to
-    // unwind. Added in response to a review finding that pointed out the shutdown hang.
-    liveSockets = new Set();
-    // Pre-auth sockets: connected but not yet authenticated (or failing auth). Tracked so
-    // stop() can destroy them too; otherwise `server.close()` waits for the 10s auth
-    // deadline to expire on each idle connection before SIGTERM completes.
-    preAuthSockets = new Set();
-    stopped = false;
-    authTimeoutMs;
-    loopbackOnly;
-    constructor(opts = {}) {
-        this.authTimeoutMs = opts.authTimeoutMs ?? 10_000;
-        this.loopbackOnly = opts.loopbackOnly ?? false;
-    }
-    /**
-     * Start listening on (host, port). Pass 0 for an ephemeral port; the actually-bound
-     * port is available via `port()` and is what the in-VM agent must dial. Throws on
-     * bind failure so the symphony bootstrap can surface the error early.
-     */
-    async start(host, port) {
-        if (this.server)
-            return;
-        if (this.loopbackOnly && !isLoopbackHost(host)) {
-            throw new Error(`acp bridge: loopbackOnly is set but host ${JSON.stringify(host)} is not a ` +
-                `loopback address; refusing to bind a bearer-gated control channel wider than loopback`);
-        }
-        this.server = createServer((socket) => this.handleConnection(socket));
-        await new Promise((resolve, reject) => {
-            const onError = (err) => {
-                this.server?.removeListener('listening', onListening);
-                reject(err);
-            };
-            const onListening = () => {
-                this.server?.removeListener('error', onError);
-                resolve();
-            };
-            this.server.once('error', onError);
-            this.server.once('listening', onListening);
-            this.server.listen(port, host);
-        });
-        const addr = this.server.address();
-        if (typeof addr === 'object' && addr !== null) {
-            this.boundPort = addr.port;
-        }
-        // Re-attach a permanent error handler so post-bind runtime errors don't crash the
-        // process — they land in the log and the listener stays up.
-        this.server.on('error', (err) => log.warn('acp bridge runtime error', { error: err.message }));
-        log.info('acp bridge listening', { host, port: this.boundPort });
-    }
-    /**
-     * Actually-bound port (differs from the requested port when 0 was passed). Returns
-     * `null` before `start()` has bound the listener.
-     */
-    port() {
-        return this.boundPort;
-    }
-    /**
-     * Register a pending dispatch. Returns a token to inject into the in-VM agent's env
-     * and a promise that resolves when the agent connects + authenticates. The promise
-     * rejects if `cancel()` is called or if `stop()` runs before the agent connects.
-     */
-    register(issueId, identifier) {
-        if (this.stopped) {
-            throw new Error('acp bridge is stopped');
-        }
-        if (!this.server) {
-            throw new Error('acp bridge is not listening; call start() first');
-        }
-        const token = randomBytes(24).toString('base64url');
-        let resolveFn;
-        let rejectFn;
-        const accepted = new Promise((res, rej) => {
-            resolveFn = res;
-            rejectFn = rej;
-        });
-        // Defensive: attach an internal noop catch so a `cancel()` that lands before the
-        // caller has wired up its own handler can't escalate into an unhandled-rejection
-        // crash. The caller's eventual `await accepted` / `.then()` still sees the rejection
-        // via its own handler chain — this `.catch` is a separate promise consumer and only
-        // exists to keep Node's unhandled-rejection tracking quiet.
-        accepted.catch(() => undefined);
-        const reg = {
-            issueId,
-            identifier,
-            token,
-            resolve: (s) => {
-                if (reg.settled)
-                    return;
-                reg.settled = true;
-                this.pending.delete(token);
-                resolveFn(s);
-            },
-            reject: (err) => {
-                if (reg.settled)
-                    return;
-                reg.settled = true;
-                this.pending.delete(token);
-                rejectFn(err);
-            },
-            settled: false,
-        };
-        this.pending.set(token, reg);
-        log.debug('acp bridge registered', { issue_id: issueId, issue_identifier: identifier });
-        return {
-            token,
-            accepted,
-            cancel: (reason) => reg.reject(new Error(`acp bridge cancel: ${reason}`)),
-        };
-    }
-    /**
-     * Stop accepting new connections, reject all pending registrations, and force-close
-     * any live sockets. We deliberately tear down live sockets rather than waiting on
-     * them — `server.close()` blocks until every active connection ends, and an unhappy
-     * adapter / abruptly-killed VM can leave sockets half-open and stall SIGTERM
-     * indefinitely. The runner's cleanup path already destroys its end on attempt exit,
-     * so the only time this matters is symphony shutdown while an attempt is mid-flight.
-     */
-    async stop() {
-        if (this.stopped)
-            return;
-        this.stopped = true;
-        for (const reg of [...this.pending.values()]) {
-            reg.reject(new Error('acp bridge stopped'));
-        }
-        this.pending.clear();
-        // Tear down BOTH pre-auth and live sockets. Pre-auth left to the 10s auth deadline
-        // would delay SIGTERM by exactly that long for every idle client (e.g. a port scan
-        // or a broken in-VM proxy that connects but never sends the bearer).
-        for (const s of [...this.preAuthSockets, ...this.liveSockets]) {
-            try {
-                s.destroy();
-            }
-            catch {
-                /* ignore */
-            }
-        }
-        this.preAuthSockets.clear();
-        this.liveSockets.clear();
-        const srv = this.server;
-        this.server = null;
-        if (!srv)
-            return;
-        await new Promise((resolve) => srv.close(() => resolve()));
-        log.info('acp bridge stopped');
-    }
-    /**
-     * Per-connection handshake. We accumulate bytes on the socket until we see the first
-     * newline, parse `Bearer <token>` from that line, validate against a pending
-     * registration in constant time, and either hand the socket back to the awaiter
-     * (consuming any post-newline bytes that arrived in the same packet) or close.
-     */
-    handleConnection(socket) {
-        socket.setNoDelay(true);
-        // Track every accepted connection (even pre-auth) so stop() can tear them down.
-        // Removed from preAuthSockets either when fail() destroys them or when the bearer
-        // handshake succeeds and they move into liveSockets.
-        this.preAuthSockets.add(socket);
-        socket.once('close', () => this.preAuthSockets.delete(socket));
-        let buf = Buffer.alloc(0);
-        let handled = false;
-        const fail = (reason) => {
-            if (handled)
-                return;
-            handled = true;
-            log.warn('acp bridge rejected connection', {
-                remote: `${socket.remoteAddress}:${socket.remotePort}`,
-                reason,
-            });
-            // Destroy (not just end) the socket. A misbehaving peer that ignores our half-close
-            // would otherwise keep the connection counted by `server.close()` and stall
-            // symphony shutdown indefinitely.
-            try {
-                socket.destroy();
-            }
-            catch {
-                /* ignore */
-            }
-        };
-        // Authentication deadline: if the in-VM agent doesn't send the bearer line within
-        // the configured window of connecting, the connection is almost certainly stuck or
-        // malformed. The dispatch's own timeout would also catch this; this is just a tighter
-        // guard.
-        const authDeadline = setTimeout(() => fail('auth timeout'), this.authTimeoutMs);
-        const onData = (chunk) => {
-            buf = Buffer.concat([buf, chunk]);
-            const nl = buf.indexOf(0x0a);
-            if (nl === -1) {
-                // Cap the unauthenticated buffer at 1 KiB so a misbehaving client can't grow
-                // memory before failing auth.
-                if (buf.length > 1024)
-                    fail('auth header too large');
-                return;
-            }
-            const headerLine = buf.subarray(0, nl).toString('utf8').trim();
-            const remainder = buf.subarray(nl + 1);
-            clearTimeout(authDeadline);
-            socket.removeListener('data', onData);
-            const matched = this.authenticate(socket, headerLine, fail);
-            if (!matched)
-                return;
-            handled = true;
-            this.promoteToLive(socket, remainder);
-            matched.resolve(socket);
-        };
-        socket.on('data', onData);
-        socket.on('error', (err) => {
-            // Connection errors before auth get swallowed; after auth the AcpClient owns the
-            // socket and will see the error itself.
-            if (!handled) {
-                clearTimeout(authDeadline);
-                fail(`socket error: ${err.message}`);
-            }
-        });
-    }
-    authenticate(socket, headerLine, fail) {
-        const match = /^Bearer\s+(\S+)$/.exec(headerLine);
-        if (!match) {
-            fail('malformed bearer line');
-            return null;
-        }
-        const matched = this.findPendingByToken(match[1]);
-        if (!matched) {
-            fail('invalid token');
-            return null;
-        }
-        log.info('acp bridge accepted', {
-            issue_id: matched.issueId,
-            issue_identifier: matched.identifier,
-            remote: `${socket.remoteAddress}:${socket.remotePort}`,
-        });
-        return matched;
-    }
-    // Constant-time compare against each pending token. With max_concurrent_agents = 1
-    // there's typically ONE pending entry, but loop anyway for correctness.
-    findPendingByToken(presented) {
-        const presentedBuf = Buffer.from(presented, 'utf8');
-        for (const reg of this.pending.values()) {
-            const expected = Buffer.from(reg.token, 'utf8');
-            if (expected.length !== presentedBuf.length)
-                continue;
-            if (timingSafeEqual(expected, presentedBuf))
-                return reg;
-        }
-        return null;
-    }
-    // CRITICAL: the temporary `data` listener in handleConnection put the socket in flowing
-    // mode. Removing that listener does NOT auto-pause it — any bytes already buffered in
-    // the kernel or arriving immediately after will be re-emitted in flowing mode and
-    // dropped if no listener is attached yet, which is exactly the window between
-    // `resolve(socket)` and AcpClient's microtask wiring up `ndJsonStream`. Pause
-    // explicitly so the next consumer is responsible for resuming. `unshift` puts the
-    // residual bytes (bearer + ACP-frame in one packet case) back in front of any
-    // subsequent kernel data.
-    promoteToLive(socket, remainder) {
-        socket.pause();
-        if (remainder.length > 0)
-            socket.unshift(remainder);
-        // Move from pre-auth tracking into live tracking. Both sets are tied into stop()
-        // for forced teardown on shutdown.
-        this.preAuthSockets.delete(socket);
-        this.liveSockets.add(socket);
-        socket.once('close', () => this.liveSockets.delete(socket));
-    }
-}
-//# sourceMappingURL=acp-bridge.js.map

package/dist/acp-bridge.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"acp-bridge.js","sourceRoot":"","sources":["../src/acp-bridge.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,+EAA+E;AAC/E,6DAA6D;AAC7D,EAAE;AACF,iFAAiF;AACjF,qFAAqF;AACrF,sFAAsF;AACtF,mFAAmF;AACnF,qDAAqD;AACrD,EAAE;AACF,qFAAqF;AACrF,sFAAsF;AACtF,+DAA+D;AAC/D,EAAE;AACF,sFAAsF;AACtF,mFAAmF;AACnF,yFAAyF;AACzF,oFAAoF;AACpF,oFAAoF;AACpF,+BAA+B;AAC/B,EAAE;AACF,aAAa;AACb,8EAA8E;AAC9E,iFAAiF;AACjF,2BAA2B;AAC3B,4EAA4E;AAC5E,sFAAsF;AACtF,aAAa;AACb,qFAAqF;AACrF,4EAA4E;AAC5E,6DAA6D;AAC7D,iEAAiE;AACjE,oFAAoF;AACpF,2FAA2F;AAC3F,gDAAgD;AAEhD,OAAO,EAAE,YAAY,EAA4B,MAAM,UAAU,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAoCnC;;;;;GAKG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,OAAO,SAAS;IACZ,MAAM,GAAkB,IAAI,CAAC;IAC7B,SAAS,GAAkB,IAAI,CAAC;IACxC,sFAAsF;IACtF,mFAAmF;IACnF,mCAAmC;IAC3B,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAClD,uFAAuF;IACvF,sFAAsF;IACtF,oFAAoF;IACpF,oFAAoF;IAC5E,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,sFAAsF;IACtF,iFAAiF;IACjF,uEAAuE;IAC/D,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,OAAO,GAAG,KAAK,CAAC;IACP,aAAa,CAAS;IACtB,YAAY,CAAU;IAEvC,YAAY,OAAyB,EAAE;QACrC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC;QAClD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,IAAY;QACpC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,4CAA4C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY;gBAC1E,uFAAuF,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QACtE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,OAAO,GAAG,CAAC,GAAU,EAAE,EAAE;gBAC7B,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;gBACtD,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC;YACF,MAAM,WAAW,GAAG,GAAG,EAAE;gBACvB,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC9C,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC;YACF,IAAI,CAAC,MAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACpC,IAAI,CAAC,MAAO,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAiC,CAAC;QAClE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC9C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC;QAC7B,CAAC;QACD,kFAAkF;QAClF,4DAA4D;QAC5D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/F,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACnE,CAAC;IAED;;;OAGG;IACH,IAAI;QACF,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,OAAe,EAAE,UAAkB;QAC1C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,SAA+B,CAAC;QACpC,IAAI,QAA6B,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAChD,SAAS,GAAG,GAAG,CAAC;YAChB,QAAQ,GAAG,GAAG,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,iFAAiF;QACjF,iFAAiF;QACjF,qFAAqF;QACrF,oFAAoF;QACpF,4DAA4D;QAC5D,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,GAAG,GAAiB;YACxB,OAAO;YACP,UAAU;YACV,KAAK;YACL,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,IAAI,GAAG,CAAC,OAAO;oBAAE,OAAO;gBACxB,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;gBACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC3B,SAAS,CAAC,CAAC,CAAC,CAAC;YACf,CAAC;YACD,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;gBACd,IAAI,GAAG,CAAC,OAAO;oBAAE,OAAO;gBACxB,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;gBACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC3B,QAAQ,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;YACD,OAAO,EAAE,KAAK;SACf,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC7B,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC;QACxF,OAAO;YACL,KAAK;YACL,QAAQ;YACR,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAC;SAC1E,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,mFAAmF;QACnF,mFAAmF;QACnF,qEAAqE;QACrE,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC;gBACH,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACjE,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACK,gBAAgB,CAAC,MAAc;QACrC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACxB,gFAAgF;QAChF,kFAAkF;QAClF,qDAAqD;QACrD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,IAAI,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE;YAC9B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE;gBACzC,MAAM,EAAE,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,UAAU,EAAE;gBACtD,MAAM;aACP,CAAC,CAAC;YACH,oFAAoF;YACpF,4EAA4E;YAC5E,kCAAkC;YAClC,IAAI,CAAC;gBACH,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC,CAAC;QACF,kFAAkF;QAClF,mFAAmF;QACnF,sFAAsF;QACtF,SAAS;QACT,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;YAC/B,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;YAClC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACd,6EAA6E;gBAC7E,8BAA8B;gBAC9B,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI;oBAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YACD,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/D,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACvC,YAAY,CAAC,YAAY,CAAC,CAAC;YAC3B,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;YAC5D,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACtC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,iFAAiF;YACjF,wCAAwC;YACxC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,YAAY,CAAC,YAAY,CAAC,CAAC;gBAC3B,IAAI,CAAC,iBAAiB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,YAAY,CAClB,MAAc,EACd,UAAkB,EAClB,IAA8B;QAE9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,eAAe,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE;YAC9B,QAAQ,EAAE,OAAO,CAAC,OAAO;YACzB,gBAAgB,EAAE,OAAO,CAAC,UAAU;YACpC,MAAM,EAAE,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,UAAU,EAAE;SACvD,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,mFAAmF;IACnF,wEAAwE;IAChE,kBAAkB,CAAC,SAAiB;QAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACpD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;gBAAE,SAAS;YACtD,IAAI,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC;gBAAE,OAAO,GAAG,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wFAAwF;IACxF,sFAAsF;IACtF,kFAAkF;IAClF,8EAA8E;IAC9E,8EAA8E;IAC9E,kFAAkF;IAClF,8EAA8E;IAC9E,0BAA0B;IAClB,aAAa,CAAC,MAAc,EAAE,SAAiB;QACrD,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpD,iFAAiF;QACjF,mCAAmC;QACnC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,CAAC;CACF"}

package/dist/actions/cache.js

@@ -1,191 +0,0 @@
-// Content-hash cache for run_in_vm actions (issue 36 AC4).
-//
-// Cache layout:
-//   <cacheRoot>/actions/run_in_vm/<name>/<sha256(workspace_tree ⊕ cmd ⊕ env)>/result.json
-//
-// The name is the first path segment so `symphony rerun --check=<name>` can
-// drop an entire check's cache without recomputing the workspace-dependent
-// hash (which the CLI doesn't know — it has no per-issue workspace). The
-// per-execution path computes the hash against the actual per-issue
-// workspace; the CLI just removes the namespace dir, and the next execution
-// re-runs because no cached hash entry exists.
-//
-// `workspace_tree` hashes the live workspace contents the VM command will
-// see: every file `git ls-files --cached --others --exclude-standard` would
-// list (tracked, untracked-not-gitignored), read from the working tree (not
-// from the index), so an uncommitted edit to a tracked file or a newly
-// added untracked source file forces a cache miss. This is the whole point
-// of `run_in_vm`: CI-style checks against the user's project as it exists
-// in the per-issue workspace, post-agent-edits.
-import { createHash } from 'node:crypto';
-import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
-import path from 'node:path';
-import { actionCacheDir, defaultCacheRoot } from '../reconciler/cache.js';
-import { runProcess } from '../util/process.js';
-export const RUN_IN_VM_CACHE_KIND = 'run_in_vm';
-/**
- * Hash the cache key. Order-stable over env keys so two callers with the
- * same env (but different key insertion order) hit the same cache entry.
- */
-export async function computeCacheHash(key) {
-    const h = createHash('sha256');
-    const tree = await workspaceTreeHash(key.workspacePath);
-    h.update('tree:');
-    h.update(tree);
-    h.update('\0cmd:');
-    for (const a of key.cmd) {
-        h.update(a);
-        h.update('\0');
-    }
-    h.update('env:');
-    const keys = Object.keys(key.env).sort();
-    for (const k of keys) {
-        h.update(k);
-        h.update('=');
-        h.update(key.env[k] ?? '');
-        h.update('\0');
-    }
-    return h.digest('hex');
-}
-/**
- * Hash of the workspace's live, .gitignore-aware contents — what the VM
- * command will actually see. Uses `git ls-files --cached --others
- * --exclude-standard -z` to enumerate (cheap, handles .gitignore correctly),
- * then reads each file from the working tree (so uncommitted modifications
- * are captured). Tracked-but-deleted-in-worktree paths are folded in as a
- * deletion marker so removing a file still bumps the hash.
- *
- * Returns `'no-git'` when the workspace is not a git repo so the cache key
- * still computes; the cmd/env contribution still differentiates calls.
- */
-async function workspaceTreeHash(workspacePath) {
-    const lsZ = await runGitCapture(['ls-files', '-z', '--cached', '--others', '--exclude-standard'], workspacePath);
-    if (lsZ === null)
-        return 'no-git';
-    // -z output: NUL-separated paths, possibly with a trailing NUL.
-    const paths = lsZ.split('\0').filter((p) => p.length > 0);
-    // A path can appear in both --cached and --others (a freshly added but
-    // git-add'd file may show up in both lists depending on git's index
-    // state); dedupe and sort so the hash is order-stable.
-    const unique = Array.from(new Set(paths)).sort();
-    const h = createHash('sha256');
-    for (const rel of unique) {
-        await foldWorkspacePathIntoHash(h, workspacePath, rel);
-    }
-    return h.digest('hex');
-}
-// Read one workspace path and fold it (or its deletion / error marker) into
-// `h`. Extracted from `workspaceTreeHash` to keep that function under the
-// shell-statement budget; the per-path branching is the same as before.
-async function foldWorkspacePathIntoHash(h, workspacePath, rel) {
-    const abs = path.join(workspacePath, rel);
-    let buf;
-    try {
-        buf = await readFile(abs);
-    }
-    catch (err) {
-        const code = err.code;
-        // ENOENT: tracked file deleted in worktree; record deletion so the
-        // cache key differs from "file still present." EISDIR / other errors:
-        // record as an error marker so we don't silently bucket two
-        // distinguishable states together.
-        h.update(code === 'ENOENT' ? 'D\0' : 'E\0');
-        h.update(rel);
-        h.update('\0');
-        return;
-    }
-    h.update('F\0');
-    h.update(rel);
-    h.update('\0');
-    h.update(buf.length.toString(10));
-    h.update('\0');
-    h.update(buf);
-}
-// Thin shape adapter: workspace-tree hashing wants `stdout | null` (null on
-// any non-zero/error). The unified `runProcess` returns the full result; we
-// throw away stderr (workspace-tree probes are quiet on the happy path) and
-// project exit_code into the nullable signal. `maxBytes` is raised well above
-// the unified default because `ls-files` output for a non-trivial workspace
-// quickly exceeds 64 KiB; the cache hash MUST see the complete file list.
-async function runGitCapture(args, cwd) {
-    const r = await runProcess('git', args, {
-        cwd,
-        maxBytes: 16 * 1024 * 1024,
-        appendErrorToStderr: false,
-    });
-    return r.exit_code === 0 ? r.stdout : null;
-}
-/**
- * Sanitize an action name for use as a path segment. We validate at parse
- * time (see parseActionsBlock for run_in_vm) but defensively encode here so
- * a future relaxation of the parser rule can't silently make two names
- * collide on the filesystem.
- */
-function sanitizeNameSegment(name) {
-    // Map every char outside [A-Za-z0-9._-] to `_<hex>`; the underscore prefix
-    // guarantees the encoded form is unambiguous against a literal "_" because
-    // a literal underscore would not be followed by two hex chars... actually
-    // since `_` is in the safe set, `_AB` is a possible literal name. To keep
-    // collision-freedom we use `%` as the escape sentinel (which is unsafe and
-    // therefore always escaped if it appears literally).
-    let out = '';
-    for (const ch of name) {
-        if (/[A-Za-z0-9._-]/.test(ch)) {
-            out += ch;
-        }
-        else {
-            out += '%' + ch.charCodeAt(0).toString(16).padStart(2, '0');
-        }
-    }
-    return out.length > 0 ? out : '_';
-}
-function cacheNameDir(cacheRoot, name) {
-    return path.join(actionCacheDir(cacheRoot, RUN_IN_VM_CACHE_KIND), sanitizeNameSegment(name));
-}
-function cacheEntryDir(cacheRoot, name, hash) {
-    return path.join(cacheNameDir(cacheRoot, name), hash);
-}
-export async function readCache(cacheRoot, name, hash) {
-    const dir = cacheEntryDir(cacheRoot, name, hash);
-    try {
-        const buf = await readFile(path.join(dir, 'result.json'), 'utf8');
-        const parsed = JSON.parse(buf);
-        if (typeof parsed.exit_code !== 'number')
-            return null;
-        return parsed;
-    }
-    catch {
-        return null;
-    }
-}
-export async function writeCache(cacheRoot, name, hash, result) {
-    const dir = cacheEntryDir(cacheRoot, name, hash);
-    await mkdir(dir, { recursive: true });
-    await writeFile(path.join(dir, 'result.json'), JSON.stringify(result), 'utf8');
-}
-/**
- * Drop every cache entry for a named check. Used by `symphony rerun
- * --check=<name>`: the operator names the check, not the workspace, and the
- * orchestrator's next dispatch into the state hosting it re-executes
- * because the namespace directory is empty.
- *
- * Per-name (rather than per-hash) invalidation is the cache-layout fix for
- * the rerun CLI: the CLI has no per-issue workspace to hash against, so any
- * hash-based invalidation would key off the wrong workspace and miss the
- * entry the per-issue execution actually wrote. Dropping the namespace dir
- * sidesteps the problem entirely.
- */
-export async function invalidateCacheByName(cacheRoot, name) {
-    const dir = cacheNameDir(cacheRoot, name);
-    try {
-        await rm(dir, { recursive: true, force: true });
-    }
-    catch {
-        // Best-effort.
-    }
-}
-/** Default cache root mirrors the bake resource. */
-export function runInVmCacheRoot() {
-    return defaultCacheRoot();
-}
-//# sourceMappingURL=cache.js.map

package/dist/actions/cache.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/actions/cache.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,gBAAgB;AAChB,0FAA0F;AAC1F,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,yEAAyE;AACzE,oEAAoE;AACpE,4EAA4E;AAC5E,+CAA+C;AAC/C,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,4EAA4E;AAC5E,uEAAuE;AACvE,2EAA2E;AAC3E,0EAA0E;AAC1E,gDAAgD;AAEhD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAAC;AAehD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAoB;IACzD,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACxD,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,iBAAiB,CAAC,aAAqB;IACpD,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAChE,aAAa,CACd,CAAC;IACF,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAClC,gEAAgE;IAChE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1D,uEAAuE;IACvE,oEAAoE;IACpE,uDAAuD;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,yBAAyB,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,4EAA4E;AAC5E,0EAA0E;AAC1E,wEAAwE;AACxE,KAAK,UAAU,yBAAyB,CACtC,CAAgC,EAChC,aAAqB,EACrB,GAAW;IAEX,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,mEAAmE;QACnE,sEAAsE;QACtE,4DAA4D;QAC5D,mCAAmC;QACnC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACf,OAAO;IACT,CAAC;IACD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,4EAA4E;AAC5E,4EAA4E;AAC5E,8EAA8E;AAC9E,4EAA4E;AAC5E,0EAA0E;AAC1E,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,GAAW;IACtD,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE;QACtC,GAAG;QACH,QAAQ,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;QAC1B,mBAAmB,EAAE,KAAK;KAC3B,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,qDAAqD;IACrD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,GAAG,IAAI,EAAE,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB,EAAE,IAAY;IACnD,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,oBAAoB,CAAC,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB,EAAE,IAAY,EAAE,IAAY;IAClE,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,SAAiB,EACjB,IAAY,EACZ,IAAY;IAEZ,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;QACtD,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACtD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,IAAY,EACZ,IAAY,EACZ,MAA2B;IAE3B,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,SAAiB,EAAE,IAAY;IACzE,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,gBAAgB;IAC9B,OAAO,gBAAgB,EAAE,CAAC;AAC5B,CAAC"}

package/dist/actions/effects.js

@@ -1,41 +0,0 @@
-// Effects-as-data foundation (issue 68): pure planner half of the
-// planActions/runEffects split. Effects are plain data describing IO so the
-// "decide what to do" half is unit-testable without spawning processes.
-// Issues 69/70 build on the `Effect` union.
-import { renderTree, TemplateError } from './templating.js';
-const DEFAULT_RETRY_COUNT = 3, DEFAULT_RETRY_BACKOFF_MS = 1_000;
-/** Pure planner — same inputs always produce the same `Effect[]`. */
-export function planActions(actions, ctx) {
-    return actions.map((action, index) => {
-        const snapshotKey = actionSnapshotKey(action, index);
-        try {
-            const rendered = renderTree(action, ctx);
-            return {
-                kind: 'run',
-                snapshotKey,
-                rendered,
-                predicate: rendered.if ?? undefined,
-                policy: effectivePolicy(action.on_error),
-            };
-        }
-        catch (err) {
-            const error = err instanceof TemplateError ? err.message : err.message;
-            return { kind: 'render_failed', snapshotKey, error };
-        }
-    });
-}
-function effectivePolicy(p) {
-    return {
-        retry: {
-            count: p?.retry?.count ?? DEFAULT_RETRY_COUNT,
-            backoff_ms: p?.retry?.backoff_ms ?? DEFAULT_RETRY_BACKOFF_MS,
-        },
-        then: p?.then ?? 'abort',
-    };
-}
-function actionSnapshotKey(action, idx) {
-    if (action.name && action.name.length > 0)
-        return `${action.kind}:${action.name}`;
-    return `${action.kind}:#${idx}`;
-}
-//# sourceMappingURL=effects.js.map

package/dist/actions/effects.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"effects.js","sourceRoot":"","sources":["../../src/actions/effects.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,4EAA4E;AAC5E,wEAAwE;AACxE,4CAA4C;AAG5C,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE5D,MAAM,mBAAmB,GAAG,CAAC,EAAE,wBAAwB,GAAG,KAAK,CAAC;AAqBhE,qEAAqE;AACrE,MAAM,UAAU,WAAW,CAAC,OAAkC,EAAE,GAAkB;IAChF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACnC,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACzC,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,WAAW;gBACX,QAAQ;gBACR,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,SAAS;gBACnC,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC;aACzC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAG,YAAY,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,GAAa,CAAC,OAAO,CAAC;YAClF,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QACvD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,CAAgC;IACvD,OAAO;QACL,KAAK,EAAE;YACL,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,mBAAmB;YAC7C,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,IAAI,wBAAwB;SAC7D;QACD,IAAI,EAAE,CAAC,EAAE,IAAI,IAAI,OAAO;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAsB,EAAE,GAAW;IAC5D,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;IAClF,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;AAClC,CAAC"}