stitchkit 0.94.0 → 0.94.1

package/dist/{index-mp5sn43f.js → index-p9e0w8hs.js}

@@ -10,7 +10,7 @@ import {
   AgentStoredRunSchema,
   appendEventIn,
   createAgentRuntimeStore
-} from "./index-58k4fp34.js";
+} from "./index-wsm5w4ee.js";
 import {
   AgentRecoverableDescriptorSchema,
   AgentRecoverablePageSchema,
@@ -18,7 +18,7 @@ import {
   AgentStoreEventPageSchema,
   AppendAgentStoreEventSchema,
   canonicalAgentJson
-} from "./index-1nd48tm9.js";
+} from "./index-gxrt5h6v.js";
 import {
   AgentMessageSchema,
   AgentRunSchema

package/dist/{index-rewkc2hj.js → index-p9sh0xx4.js}

@@ -1,13 +1,13 @@
 import {
   collectTools,
   createToolRunner
-} from "./index-2cr1cqhn.js";
+} from "./index-khtgb21r.js";
 import {
   toolErrorFromResult
-} from "./index-j05z5gn4.js";
+} from "./index-55hkhm67.js";
 import {
   assertUniqueToolName
-} from "./index-dydjcp8z.js";
+} from "./index-np4m8hd3.js";
 import {
   AppError
 } from "./index-2vtcmrj9.js";

package/dist/{index-70yj2ebz.js → index-paz6sgdp.js}

@@ -11,113 +11,12 @@ import { randomUUID } from "node:crypto";
 import { constants } from "node:fs";
 import { link, mkdir, open, realpath, rename, stat, unlink } from "node:fs/promises";
 import { basename, dirname, resolve } from "node:path";
-var DEFAULT_MAX_BYTES = 100 * 1024 * 1024;
-var DEFAULT_INSPECTION_BYTES = 64 * 1024;
-var DEFAULT_INSPECTION_TIMEOUT_MS = 15000;
-var nofollowFlag;
-var noFollow = () => {
-  nofollowFlag ??= constants.O_NOFOLLOW ?? 0;
-  return nofollowFlag;
-};
+
+// src/files/file-io.ts
 var ManagedFileInspectionSchema = ManagedFileRefSchema.pick({
   mediaType: true,
   name: true
 });
-
-class ManagedFileError extends Error {
-  code;
-  constructor(code, message, options) {
-    super(message, options);
-    this.code = code;
-    this.name = "ManagedFileError";
-  }
-}
-function positiveLimit(value, fallback, name) {
-  const resolved = value ?? fallback;
-  if (!Number.isSafeInteger(resolved) || resolved <= 0) {
-    throw new TypeError(`${name} must be a positive safe integer`);
-  }
-  return resolved;
-}
-function filePath(path) {
-  const parsed = ManagedFilePathSchema.safeParse(path);
-  if (!parsed.success) {
-    throw new ManagedFileError("FILE_INVALID_PATH", "invalid managed-file path");
-  }
-  return parsed.data;
-}
-function errorCode(error) {
-  if (typeof error !== "object" || error === null || !("code" in error))
-    return;
-  return typeof error.code === "string" ? error.code : undefined;
-}
-function ioError(message, error) {
-  if (error instanceof ManagedFileError)
-    return error;
-  return new ManagedFileError("FILE_IO_ERROR", message, { cause: error });
-}
-async function realpathOrNull(path, message) {
-  try {
-    return await realpath(path);
-  } catch (error) {
-    if (errorCode(error) === "ENOENT")
-      return null;
-    throw ioError(message, error);
-  }
-}
-async function bindRoot(config) {
-  const requested = resolve(config.root);
-  let canonical = await realpathOrNull(requested, "failed to resolve managed-file root");
-  if (canonical === null && config.createRoot) {
-    const parent = await realpathOrNull(dirname(requested), "failed to resolve managed-file root parent");
-    if (parent === null) {
-      throw new ManagedFileError("FILE_NOT_FOUND", "managed-file root parent must exist");
-    }
-    const parentInfo = await stat(parent).catch((error) => {
-      throw ioError("failed to inspect managed-file root parent", error);
-    });
-    if (!parentInfo.isDirectory()) {
-      throw new ManagedFileError("FILE_NOT_REGULAR", "managed-file root parent must be a directory");
-    }
-    try {
-      await mkdir(requested, { mode: 448 });
-    } catch (error) {
-      if (errorCode(error) !== "EEXIST") {
-        if (errorCode(error) === "ENOENT") {
-          throw new ManagedFileError("FILE_NOT_FOUND", "managed-file root parent must exist");
-        }
-        throw ioError("failed to create managed-file root", error);
-      }
-    }
-    canonical = await realpathOrNull(requested, "failed to resolve managed-file root");
-  }
-  if (canonical === null) {
-    throw new ManagedFileError("FILE_NOT_FOUND", "managed-file root must exist");
-  }
-  const info = await stat(canonical).catch((error) => {
-    throw ioError("failed to inspect managed-file root", error);
-  });
-  if (!info.isDirectory()) {
-    throw new ManagedFileError("FILE_NOT_REGULAR", "managed-file root must be a directory");
-  }
-  return canonical;
-}
-async function existingParent(root, target) {
-  const parent = await realpathOrNull(dirname(target), "failed to resolve managed-file parent directory");
-  if (parent === null) {
-    throw new ManagedFileError("FILE_NOT_FOUND", "managed-file parent directory not found");
-  }
-  if (!isWithinDir(root, parent)) {
-    throw new ManagedFileError("FILE_OUTSIDE_ROOT", "managed-file path escapes its boundary");
-  }
-  const info = await stat(parent).catch((error) => {
-    throw ioError("failed to inspect managed-file parent directory", error);
-  });
-  if (!info.isDirectory()) {
-    throw new ManagedFileError("FILE_NOT_REGULAR", "managed-file parent is not a directory");
-  }
-  return parent;
-}
 function abortReason(signal) {
   return signal.reason ?? new DOMException("The operation was aborted", "AbortError");
 }
@@ -249,6 +148,111 @@ async function writeSource(handle, source, maxBytes, inspectionBytes, signal) {
   }
   return { size, prefix };
 }
+
+// src/files/boundary.ts
+var DEFAULT_MAX_BYTES = 100 * 1024 * 1024;
+var DEFAULT_INSPECTION_BYTES = 64 * 1024;
+var DEFAULT_INSPECTION_TIMEOUT_MS = 15000;
+var nofollowFlag;
+var noFollow = () => {
+  nofollowFlag ??= constants.O_NOFOLLOW ?? 0;
+  return nofollowFlag;
+};
+
+class ManagedFileError extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+    this.name = "ManagedFileError";
+  }
+}
+function positiveLimit(value, fallback, name) {
+  const resolved = value ?? fallback;
+  if (!Number.isSafeInteger(resolved) || resolved <= 0) {
+    throw new TypeError(`${name} must be a positive safe integer`);
+  }
+  return resolved;
+}
+function filePath(path) {
+  const parsed = ManagedFilePathSchema.safeParse(path);
+  if (!parsed.success) {
+    throw new ManagedFileError("FILE_INVALID_PATH", "invalid managed-file path");
+  }
+  return parsed.data;
+}
+function errorCode(error) {
+  if (typeof error !== "object" || error === null || !("code" in error))
+    return;
+  return typeof error.code === "string" ? error.code : undefined;
+}
+function ioError(message, error) {
+  if (error instanceof ManagedFileError)
+    return error;
+  return new ManagedFileError("FILE_IO_ERROR", message, { cause: error });
+}
+async function realpathOrNull(path, message) {
+  try {
+    return await realpath(path);
+  } catch (error) {
+    if (errorCode(error) === "ENOENT")
+      return null;
+    throw ioError(message, error);
+  }
+}
+async function bindRoot(config) {
+  const requested = resolve(config.root);
+  let canonical = await realpathOrNull(requested, "failed to resolve managed-file root");
+  if (canonical === null && config.createRoot) {
+    const parent = await realpathOrNull(dirname(requested), "failed to resolve managed-file root parent");
+    if (parent === null) {
+      throw new ManagedFileError("FILE_NOT_FOUND", "managed-file root parent must exist");
+    }
+    const parentInfo = await stat(parent).catch((error) => {
+      throw ioError("failed to inspect managed-file root parent", error);
+    });
+    if (!parentInfo.isDirectory()) {
+      throw new ManagedFileError("FILE_NOT_REGULAR", "managed-file root parent must be a directory");
+    }
+    try {
+      await mkdir(requested, { mode: 448 });
+    } catch (error) {
+      if (errorCode(error) !== "EEXIST") {
+        if (errorCode(error) === "ENOENT") {
+          throw new ManagedFileError("FILE_NOT_FOUND", "managed-file root parent must exist");
+        }
+        throw ioError("failed to create managed-file root", error);
+      }
+    }
+    canonical = await realpathOrNull(requested, "failed to resolve managed-file root");
+  }
+  if (canonical === null) {
+    throw new ManagedFileError("FILE_NOT_FOUND", "managed-file root must exist");
+  }
+  const info = await stat(canonical).catch((error) => {
+    throw ioError("failed to inspect managed-file root", error);
+  });
+  if (!info.isDirectory()) {
+    throw new ManagedFileError("FILE_NOT_REGULAR", "managed-file root must be a directory");
+  }
+  return canonical;
+}
+async function existingParent(root, target) {
+  const parent = await realpathOrNull(dirname(target), "failed to resolve managed-file parent directory");
+  if (parent === null) {
+    throw new ManagedFileError("FILE_NOT_FOUND", "managed-file parent directory not found");
+  }
+  if (!isWithinDir(root, parent)) {
+    throw new ManagedFileError("FILE_OUTSIDE_ROOT", "managed-file path escapes its boundary");
+  }
+  const info = await stat(parent).catch((error) => {
+    throw ioError("failed to inspect managed-file parent directory", error);
+  });
+  if (!info.isDirectory()) {
+    throw new ManagedFileError("FILE_NOT_REGULAR", "managed-file parent is not a directory");
+  }
+  return parent;
+}
 async function createManagedFileBoundary(config) {
   const root = await bindRoot(config);
   const maxReadBytes = positiveLimit(config.maxReadBytes, DEFAULT_MAX_BYTES, "maxReadBytes");

package/dist/{index-bn2cjajt.js → index-px2gm2jp.js}

@@ -1,29 +1,21 @@
+// src/agent-runtime/contained-scan.ts
+import path3 from "node:path";
+
 // src/agent-runtime/contained-files.ts
+import { constants } from "node:fs";
+import { lstat, mkdir, open, readdir, realpath } from "node:fs/promises";
+import path2 from "node:path";
+
+// src/agent-runtime/contained-darwin.ts
 import {
   close as closeDescriptor,
-  constants,
   existsSync,
-  fchmod,
   fstat,
-  read as readDescriptor,
-  write as writeDescriptor
+  read as readDescriptor
 } from "node:fs";
-import {
-  lstat,
-  mkdir,
-  open,
-  readdir,
-  realpath,
-  rename,
-  unlink,
-  writeFile
-} from "node:fs/promises";
 import { createRequire } from "node:module";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-function containedEntryKind(entry) {
-  return entry.isDirectory() ? "directory" : entry.isSymbolicLink() ? "symlink" : entry.isFile() ? "file" : "other";
-}
 var FILE_TYPE_MASK = 61440;
 var FILE_TYPE_DIRECTORY = 16384;
 var FILE_TYPE_REGULAR = 32768;
@@ -87,6 +79,11 @@ class NumericFileHandle {
     });
   }
 }
+
+// src/agent-runtime/contained-files.ts
+function containedEntryKind(entry) {
+  return entry.isDirectory() ? "directory" : entry.isSymbolicLink() ? "symlink" : entry.isFile() ? "file" : "other";
+}
 function descriptorPath(handle) {
   if (process.platform === "linux")
     return `/proc/self/fd/${handle.fd}`;
@@ -113,7 +110,7 @@ async function openPinnedDirectory(absolute) {
   }
 }
 function safeSegments(relative) {
-  if (path.isAbsolute(relative))
+  if (path2.isAbsolute(relative))
     throw new Error("Contained paths must be relative");
   const segments = relative.split(/[\\/]/u);
   if (segments.length === 0 || segments.some((segment) => segment === "" || segment === "." || segment === "..")) {
@@ -125,13 +122,13 @@ async function openDirectoryAt(directory, name) {
   if (process.platform === "darwin") {
     return new NumericFileHandle(loadDarwinBinding().openDirectoryAt(directory.fd, name));
   }
-  return open(path.join(descriptorPath(directory), name), constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+  return open(path2.join(descriptorPath(directory), name), constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
 }
 async function openFileAt(directory, name) {
   if (process.platform === "darwin") {
     return new NumericFileHandle(loadDarwinBinding().openFileAt(directory.fd, name));
   }
-  return open(path.join(descriptorPath(directory), name), constants.O_RDONLY | constants.O_NOFOLLOW);
+  return open(path2.join(descriptorPath(directory), name), constants.O_RDONLY | constants.O_NOFOLLOW);
 }
 function entryMetadata(mode, size) {
   return {
@@ -147,7 +144,7 @@ async function statAt(directory, name) {
     const metadata = loadDarwinBinding().statAt(directory.fd, name);
     return metadata ? entryMetadata(metadata.mode, metadata.size) : null;
   }
-  return lstat(path.join(descriptorPath(directory), name)).catch((error) => {
+  return lstat(path2.join(descriptorPath(directory), name)).catch((error) => {
     if (error.code === "ENOENT")
       return null;
     throw error;
@@ -179,7 +176,7 @@ async function listContainedDirectory(root, relative, maxEntries, authorizePath)
     const admitted = [];
     const denied = [];
     for (const entry of raw) {
-      const entryPath = relative === "." ? entry.name : path.join(relative, entry.name);
+      const entryPath = relative === "." ? entry.name : path2.join(relative, entry.name);
       if (authorizePath && !await authorizePath(entryPath)) {
         denied.push({ name: entry.name, kind: containedEntryKind(entry) });
         continue;
@@ -220,7 +217,7 @@ async function createDirectoryAt(directory, name) {
     return loadDarwinBinding().createDirectoryAt(directory.fd, name, 511);
   }
   try {
-    await mkdir(path.join(descriptorPath(directory), name));
+    await mkdir(path2.join(descriptorPath(directory), name));
     return true;
   } catch (error) {
     if (error.code === "EEXIST")
@@ -238,7 +235,7 @@ async function missingContainedDirectories(root, relative) {
     for (const segment of segments) {
       walked = [...walked, segment];
       if (missing.length > 0) {
-        missing.push(walked.join(path.sep));
+        missing.push(walked.join(path2.sep));
         continue;
       }
       const next = await openDirectoryAt(current, segment).catch((error) => {
@@ -247,7 +244,7 @@ async function missingContainedDirectories(root, relative) {
         throw error;
       });
       if (!next) {
-        missing.push(walked.join(path.sep));
+        missing.push(walked.join(path2.sep));
         continue;
       }
       await current.close();
@@ -317,81 +314,6 @@ async function assertContainedParentCurrent(root, relative, expected) {
     await current.handle.close();
   }
 }
-async function writeDescriptorFully(descriptor, content) {
-  const bytes = Buffer.from(content);
-  let offset = 0;
-  while (offset < bytes.byteLength) {
-    const written = await new Promise((resolve, reject) => {
-      writeDescriptor(descriptor, bytes, offset, bytes.byteLength - offset, null, (error, bytesWritten) => error ? reject(error) : resolve(bytesWritten));
-    });
-    if (written === 0)
-      throw new Error("Contained file write made no progress");
-    offset += written;
-  }
-}
-async function chmodDescriptor(descriptor, mode) {
-  await new Promise((resolve, reject) => {
-    fchmod(descriptor, mode & 4095, (error) => error ? reject(error) : resolve());
-  });
-}
-async function createDarwinFile(parent, name, content, mode) {
-  const binding = loadDarwinBinding();
-  const descriptor = binding.createFileAt(parent.fd, name, mode & 4095);
-  let failed;
-  try {
-    await writeDescriptorFully(descriptor, content);
-    await chmodDescriptor(descriptor, mode);
-  } catch (error) {
-    failed = error;
-  } finally {
-    try {
-      await new NumericFileHandle(descriptor).close();
-    } catch (error) {
-      failed ??= error;
-    }
-  }
-  if (failed) {
-    binding.unlinkAt(parent.fd, name);
-    throw failed;
-  }
-}
-async function writeContainedFile(input) {
-  const mode = input.mode ?? 438;
-  if (!input.replace) {
-    if (process.platform === "darwin") {
-      await createDarwinFile(input.parent.handle, input.parent.basename, input.content, mode);
-      return;
-    }
-    await writeFile(path.join(descriptorPath(input.parent.handle), input.parent.basename), input.content, { flag: "wx", mode });
-    return;
-  }
-  const temporary = `.${input.parent.basename}.${process.pid}.${crypto.randomUUID()}.tmp`;
-  if (process.platform === "darwin") {
-    const binding = loadDarwinBinding();
-    let created = false;
-    try {
-      await createDarwinFile(input.parent.handle, temporary, input.content, mode);
-      created = true;
-      binding.renameAt(input.parent.handle.fd, temporary, input.parent.basename);
-    } catch (error) {
-      if (created)
-        binding.unlinkAt(input.parent.handle.fd, temporary);
-      throw error;
-    }
-    return;
-  }
-  const directory = descriptorPath(input.parent.handle);
-  const temporaryPath = path.join(directory, temporary);
-  try {
-    await writeFile(temporaryPath, input.content, { flag: "wx", mode });
-    await rename(temporaryPath, path.join(directory, input.parent.basename));
-  } catch (error) {
-    await unlink(temporaryPath).catch(() => {
-      return;
-    });
-    throw error;
-  }
-}
 async function containedEntryMetadata(parent) {
   return statAt(parent.handle, parent.basename);
 }
@@ -425,6 +347,8 @@ async function readContainedUtf8Handle(handle, maxBytes) {
     mode: metadata.mode
   };
 }
+
+// src/agent-runtime/contained-scan.ts
 async function walkContainedFiles(input) {
   const scan = await scanContainedFiles({ ...input, symlinks: "refuse" });
   if (scan.truncated)
@@ -449,7 +373,7 @@ async function scanContainedFiles(input) {
     const entries = [...await listAt(directory)];
     entries.sort((left, right) => left.name.localeCompare(right.name));
     for (const entry of entries) {
-      const relative = relativeDirectory ? path.join(relativeDirectory, entry.name) : entry.name;
+      const relative = relativeDirectory ? path3.join(relativeDirectory, entry.name) : entry.name;
       const kind = entry.isDirectory() ? "directory" : entry.isSymbolicLink() ? "symlink" : entry.isFile() ? "file" : "other";
       if (kind === "file" && input.includeFile && !input.includeFile(relative))
         continue;
@@ -521,4 +445,4 @@ async function scanContainedFiles(input) {
   return { files, truncated, skippedDirectories, skippedSymlinks, denied, deniedTruncated };
 }
 
-export { listContainedDirectory, missingContainedDirectories, openContainedParent, openContainedFile, assertContainedFileCurrent, assertContainedParentCurrent, writeContainedFile, containedEntryMetadata, openContainedParentFile, readContainedUtf8Handle, walkContainedFiles, scanContainedFiles };
+export { loadDarwinBinding, NumericFileHandle, descriptorPath, listContainedDirectory, missingContainedDirectories, openContainedParent, openContainedFile, assertContainedFileCurrent, assertContainedParentCurrent, containedEntryMetadata, openContainedParentFile, readContainedUtf8Handle, walkContainedFiles, scanContainedFiles };

package/dist/index-s812ycat.js

@@ -0,0 +1,65 @@
+// src/internal/atomic-file.ts
+import { randomBytes } from "node:crypto";
+import {
+  closeSync,
+  fchmodSync,
+  fsyncSync,
+  openSync,
+  renameSync,
+  unlinkSync,
+  writeSync
+} from "node:fs";
+import { open, rename, unlink } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+var DEFAULT_MODE = 384;
+function stagingPath(target) {
+  return join(dirname(target), `.${basename(target)}.${randomBytes(12).toString("hex")}.tmp`);
+}
+function bytesOf(data) {
+  return typeof data === "string" ? new TextEncoder().encode(data) : data;
+}
+async function writeFileAtomic(target, data, options = {}) {
+  const mode = options.mode ?? DEFAULT_MODE;
+  const staged = stagingPath(target);
+  const handle = await open(staged, "wx", mode);
+  try {
+    try {
+      await handle.writeFile(bytesOf(data));
+      await handle.chmod(mode);
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    await rename(staged, target);
+  } catch (error) {
+    await unlink(staged).catch(() => {
+      return;
+    });
+    throw error;
+  }
+}
+function writeFileAtomicSync(target, data, options = {}) {
+  const mode = options.mode ?? DEFAULT_MODE;
+  const bytes = bytesOf(data);
+  const staged = stagingPath(target);
+  const handle = openSync(staged, "wx", mode);
+  try {
+    try {
+      for (let offset = 0;offset < bytes.byteLength; ) {
+        offset += writeSync(handle, bytes, offset, bytes.byteLength - offset);
+      }
+      fchmodSync(handle, mode);
+      fsyncSync(handle);
+    } finally {
+      closeSync(handle);
+    }
+    renameSync(staged, target);
+  } catch (error) {
+    try {
+      unlinkSync(staged);
+    } catch {}
+    throw error;
+  }
+}
+
+export { writeFileAtomic, writeFileAtomicSync };

package/dist/{index-xsqjkha9.js → index-sp1tzwnb.js}

@@ -7,12 +7,12 @@ import {
   createAgentRuntimeStore,
   isActiveRunState,
   replaceMessage
-} from "./index-58k4fp34.js";
+} from "./index-wsm5w4ee.js";
 import {
   AgentRecoverablePageSchema,
   AgentStoreEventEnvelopeSchema,
   AgentStoreEventPageSchema
-} from "./index-1nd48tm9.js";
+} from "./index-gxrt5h6v.js";
 import {
   AgentMessageSchema,
   AgentRecordIdSchema