subharness 0.0.4 → 0.0.5

package/dist/config/access.js

@@ -1,62 +1,145 @@
-import { appendFile, mkdir, readFile } from "node:fs/promises";
+import { appendFile, lstat, mkdir, readFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { AgentError } from "../errors.js";
 import { git, resolveProject } from "./project.js";
+import { quoteDiagnosticPath, recordAccessProvenance } from "./access-provenance.js";
 export { resolveAccess } from "./resolve-access.js";
 export function configError(message) {
     throw new AgentError("INVALID_CONFIG", message);
 }
+function schemaError(location, message, file, code = "INVALID_CONFIG") {
+    const settings = file === undefined
+        ? "Personal access settings"
+        : `Personal access settings at ${quoteDiagnosticPath(file)}`;
+    throw new AgentError(code, `${settings} are invalid at ${location}: ${message}`);
+}
 function record(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-export function parseConnection(value) {
-    if (!record(value) || !["subscription", "api-key", "vercel-api-key", "vercel-oidc"].includes(value.type))
-        configError("Unknown access connection type.");
-    const allowed = value.type === "subscription" ? ["type"] : ["type", "env", "envFile", ...(value.type === "vercel-oidc" ? ["project"] : [])];
+function parseConnectionAt(value, location, file, harness) {
+    if (!record(value))
+        schemaError(location, "Connection must be an object.", file);
+    if (!["subscription", "api-key", "vercel-api-key", "vercel-oidc"].includes(value.type))
+        schemaError(`${location}.type`, "Unknown access connection type.", file);
+    const allowed = value.type === "subscription" ? ["type", "provider"] : ["type", "env", "envFile", ...(value.type === "api-key" ? ["provider", "baseUrl", "wireApi", "apiVersion", "wireModel"] : value.type === "vercel-oidc" ? ["project"] : [])];
     if (Object.keys(value).some((key) => !allowed.includes(key)))
-        configError("Unknown access connection field; secrets must be supplied through environment references.");
+        schemaError(location, "Unknown access connection field; secrets must be supplied through environment references.", file);
     if (value.env !== undefined && (typeof value.env !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(value.env)))
-        configError("Invalid credential variable name.");
-    for (const field of ["envFile", "project"]) {
+        schemaError(`${location}.env`, "Invalid credential variable name.", file);
+    for (const field of ["envFile", "project", "provider", "baseUrl", "apiVersion", "wireModel"]) {
         if (value[field] !== undefined && (typeof value[field] !== "string" || !value[field].trim()))
-            configError(`${field} must be a nonempty path.`);
+            schemaError(`${location}.${field}`, field === "envFile" || field === "project" ? "Value must be a nonempty path." : "Value must be a nonempty string.", file);
     }
+    if (value.wireApi !== undefined && !["completions", "responses"].includes(value.wireApi))
+        schemaError(`${location}.wireApi`, "Invalid wire API selection.", file);
+    if (value.baseUrl !== undefined)
+        validateBaseUrl(value.baseUrl, `${location}.baseUrl`, file);
+    if (harness)
+        validateHarnessConnection(value, harness, location, file);
     return value;
 }
-export function parseAccess(value) {
+function validateBaseUrl(value, location, file) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return schemaError(location, "baseUrl must be an absolute HTTP or HTTPS URL without credentials, query, or fragment.", file);
+    }
+    if (!/^https?:\/\//iu.test(value) || value.trim() !== value || /[\s?#\\]/u.test(value)
+        || !["http:", "https:"].includes(url.protocol) || !url.hostname || url.username || url.password
+        || /^https?:\/\/[^/]*@/iu.test(value)) {
+        schemaError(location, "baseUrl must be an absolute HTTP or HTTPS URL without credentials, query, or fragment.", file);
+    }
+}
+function validateHarnessConnection(connection, kind, location, file) {
+    if (connection.type === "vercel-api-key" || connection.type === "vercel-oidc") {
+        if (kind === "cursor")
+            schemaError(`${location}.type`, `cursor does not support ${connection.type} access.`, file, "UNSUPPORTED_OPTION");
+        return;
+    }
+    if (connection.type === "subscription") {
+        const providers = kind === "fx" ? ["gateway", "codex", "grok"]
+            : kind === "opencode" ? ["openai", "github-copilot", "xai"] : undefined;
+        if (providers ? !providers.includes(connection.provider ?? "") : connection.provider !== undefined) {
+            schemaError(`${location}.provider`, `${kind} requires its documented native login provider selection.`, file);
+        }
+        return;
+    }
+    let allowed = ["type", "env", "envFile"];
+    if (kind === "fx" || kind === "opencode") {
+        if (!connection.provider)
+            schemaError(`${location}.provider`, `${kind} direct API keys require provider and env.`, file);
+        if (!connection.env)
+            schemaError(`${location}.env`, `${kind} direct API keys require provider and env.`, file);
+        allowed.push("provider");
+        if (kind === "fx" && ["gateway", "codex", "grok"].includes(connection.provider))
+            schemaError(`${location}.provider`, "fx direct API keys require a named custom connection.", file);
+        if (kind === "opencode") {
+            if (!["anthropic", "openai", "google", "groq", "openrouter", "xai", "mistral", "cohere", "opencode", "opencode-go"].includes(connection.provider))
+                schemaError(`${location}.provider`, "Unsupported OpenCode API-key provider.", file);
+            allowed.push("baseUrl");
+        }
+    }
+    else if (kind === "copilot") {
+        if (!["github", "openai", "anthropic", "azure"].includes(connection.provider ?? ""))
+            schemaError(`${location}.provider`, "Copilot API keys require a supported provider.", file);
+        allowed.push("provider");
+        if (connection.provider !== "github")
+            allowed.push("baseUrl", "wireModel");
+        if (connection.provider === "openai" || connection.provider === "azure")
+            allowed.push("wireApi");
+        if (connection.provider === "azure") {
+            allowed.push("apiVersion");
+            if (!connection.baseUrl)
+                schemaError(`${location}.baseUrl`, "Copilot Azure API keys require baseUrl.", file);
+        }
+    }
+    const inapplicable = ["provider", "baseUrl", "wireApi", "apiVersion", "wireModel"]
+        .find(field => Object.hasOwn(connection, field) && !allowed.includes(field));
+    if (inapplicable)
+        schemaError(`${location}.${inapplicable}`, `Inapplicable ${kind} API-key connection field.`, file);
+}
+export function parseConnection(value, harness) {
+    return parseConnectionAt(value, "connection", undefined, harness);
+}
+function parseAccessAt(value, file) {
     if (!record(value) || Object.keys(value).some((key) => key !== "access"))
-        configError("Personal settings must contain only an optional access map.");
+        schemaError("root object", "Expected only an optional access map.", file);
     if (value.access === undefined)
         return {};
     if (!record(value.access))
-        configError("access must be an object.");
+        schemaError("access", "Value must be an object.", file);
     for (const [kind, connections] of Object.entries(value.access)) {
-        if (kind !== "codex" && kind !== "claudeCode" && kind !== "fx")
-            configError("Unsupported harness in personal access settings.");
+        if (!["codex", "claudeCode", "fx", "opencode", "copilot", "cursor"].includes(kind))
+            schemaError("access", "Unsupported harness entry.", file);
         if (!Array.isArray(connections))
-            configError("Each harness access selection must be an array.");
-        connections.forEach(parseConnection);
+            schemaError(`access.${kind}`, "Harness access selection must be an array.", file);
+        connections.forEach((connection, index) => parseConnectionAt(connection, `access.${kind}[${index}]`, file, kind));
     }
     return value;
 }
-async function ensureExcluded(mainRoot) {
+export function parseAccess(value) {
+    return parseAccessAt(value);
+}
+async function ensureExcluded(mainRoot, file) {
     try {
         await git(mainRoot, ["rev-parse", "--git-dir"]);
     }
     catch (error) {
         if (error instanceof Error && error.message.includes("not a git repository"))
             return;
-        configError("Cannot inspect Git configuration for personal settings.");
+        settingsFileError(file, "Cannot inspect Git configuration for personal settings");
     }
     let tracked = false;
     try {
         tracked = !!await git(mainRoot, ["ls-files", "--", ".subharness/agents.local.json"]);
     }
     catch {
-        configError("Cannot inspect whether personal access settings are tracked by Git.");
+        settingsFileError(file, "Cannot inspect whether personal access settings are tracked by Git");
     }
     if (tracked)
-        configError("Personal access settings are tracked. Remove .subharness/agents.local.json from the Git index before using it.");
+        settingsFileError(file, "Personal access settings are tracked. Remove .subharness/agents.local.json from the Git index before using it");
     const exclude = await git(mainRoot, ["rev-parse", "--path-format=absolute", "--git-path", "info/exclude"]);
     let contents = "";
     try {
@@ -64,7 +147,7 @@ async function ensureExcluded(mainRoot) {
     }
     catch (error) {
         if (error.code !== "ENOENT")
-            configError("Cannot read Git's local exclude file.");
+            settingsFileError(file, "Cannot read Git's local exclude file");
     }
     const pattern = "/.subharness/agents.local.json";
     if (!contents.split(/\r?\n/).includes(pattern)) {
@@ -72,6 +155,9 @@ async function ensureExcluded(mainRoot) {
         await appendFile(exclude, `${contents.endsWith("\n") || !contents ? "" : "\n"}${pattern}\n`);
     }
 }
+function settingsFileError(file, message) {
+    configError(`${message}. Personal access settings file: ${quoteDiagnosticPath(file)}.`);
+}
 export async function loadAccess(cwd) {
     const { mainRoot } = await resolveProject(cwd);
     const file = join(mainRoot, ".subharness", "agents.local.json");
@@ -80,18 +166,30 @@ export async function loadAccess(cwd) {
         contents = await readFile(file, "utf8");
     }
     catch (error) {
-        if (error.code === "ENOENT")
-            return {};
-        configError(`Cannot read personal settings: ${file}`);
+        if (error.code === "ENOENT") {
+            const settings = {};
+            const legacyFile = join(mainRoot, ".agents", "agents.local.json");
+            let legacyEntry;
+            try {
+                await lstat(legacyFile);
+                legacyEntry = legacyFile;
+            }
+            catch { /* Legacy inspection must not replace the original startup error. */ }
+            recordAccessProvenance(settings, { file, present: false, ...(legacyEntry ? { legacyFile: legacyEntry } : {}) });
+            return settings;
+        }
+        settingsFileError(file, "Cannot read personal settings");
     }
-    await ensureExcluded(mainRoot);
+    await ensureExcluded(mainRoot, file);
     let value;
     try {
         value = JSON.parse(contents);
     }
     catch {
-        configError(`Invalid JSON in personal settings: ${file}`);
+        settingsFileError(file, "Invalid JSON in personal settings");
     }
-    return parseAccess(value);
+    const settings = parseAccessAt(value, file);
+    recordAccessProvenance(settings, { file, present: true });
+    return settings;
 }
 //# sourceMappingURL=access.js.map

package/dist/config/access.js.map

@@ -1 +1 @@
-{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/config/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAWpD,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAc,CAAC;QAAE,WAAW,CAAC,iCAAiC,CAAC,CAAC;IACnK,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5I,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,WAAW,CAAC,2FAA2F,CAAC,CAAC;IACvK,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAE,WAAW,CAAC,mCAAmC,CAAC,CAAC;IAChK,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YAAE,WAAW,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAC;IACjJ,CAAC;IACD,OAAO,KAAyB,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC;QAAE,WAAW,CAAC,6DAA6D,CAAC,CAAC;IACrJ,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,WAAW,CAAC,2BAA2B,CAAC,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,IAAI;YAAE,WAAW,CAAC,kDAAkD,CAAC,CAAC;QAChI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;YAAE,WAAW,CAAC,iDAAiD,CAAC,CAAC;QAChG,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAqB,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB;IAC5C,IAAI,CAAC;QAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IAAC,CAAC;IACxD,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAAE,OAAO;QACrF,WAAW,CAAC,yDAAyD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QAAC,OAAO,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,+BAA+B,CAAC,CAAC,CAAC;IAAC,CAAC;IAC7F,MAAM,CAAC;QAAC,WAAW,CAAC,qEAAqE,CAAC,CAAC;IAAC,CAAC;IAC7F,IAAI,OAAO;QAAE,WAAW,CAAC,gHAAgH,CAAC,CAAC;IAC3I,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;IAC3G,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IACnD,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,WAAW,CAAC,uCAAuC,CAAC,CAAC;IAAC,CAAC;IAC/H,MAAM,OAAO,GAAG,gCAAgC,CAAC;IACjD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,IAAI,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW;IAC1C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;IAChE,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAChD,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAClE,WAAW,CAAC,kCAAkC,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IACrC,MAAM,CAAC;QAAC,WAAW,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IACpE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC","sourcesContent":["import { appendFile, mkdir, readFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { AgentError } from \"../errors.js\";\nimport type { HarnessKind } from \"../sdk/types.js\";\nimport { git, resolveProject } from \"./project.js\";\nexport { resolveAccess } from \"./resolve-access.js\";\n\nexport type AccessConnection =\n  | { type: \"subscription\" }\n  | { type: \"api-key\" | \"vercel-api-key\"; env?: string; envFile?: string }\n  | { type: \"vercel-oidc\"; env?: string; envFile?: string; project?: string };\n\nexport interface AccessConfig {\n  access?: Partial<Record<HarnessKind, AccessConnection[]>>;\n}\n\nexport function configError(message: string): never {\n  throw new AgentError(\"INVALID_CONFIG\", message);\n}\n\nfunction record(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nexport function parseConnection(value: unknown): AccessConnection {\n  if (!record(value) || ![\"subscription\", \"api-key\", \"vercel-api-key\", \"vercel-oidc\"].includes(value.type as string)) configError(\"Unknown access connection type.\");\n  const allowed = value.type === \"subscription\" ? [\"type\"] : [\"type\", \"env\", \"envFile\", ...(value.type === \"vercel-oidc\" ? [\"project\"] : [])];\n  if (Object.keys(value).some((key) => !allowed.includes(key))) configError(\"Unknown access connection field; secrets must be supplied through environment references.\");\n  if (value.env !== undefined && (typeof value.env !== \"string\" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(value.env))) configError(\"Invalid credential variable name.\");\n  for (const field of [\"envFile\", \"project\"]) {\n    if (value[field] !== undefined && (typeof value[field] !== \"string\" || !value[field].trim())) configError(`${field} must be a nonempty path.`);\n  }\n  return value as AccessConnection;\n}\n\nexport function parseAccess(value: unknown): AccessConfig {\n  if (!record(value) || Object.keys(value).some((key) => key !== \"access\")) configError(\"Personal settings must contain only an optional access map.\");\n  if (value.access === undefined) return {};\n  if (!record(value.access)) configError(\"access must be an object.\");\n  for (const [kind, connections] of Object.entries(value.access)) {\n    if (kind !== \"codex\" && kind !== \"claudeCode\" && kind !== \"fx\") configError(\"Unsupported harness in personal access settings.\");\n    if (!Array.isArray(connections)) configError(\"Each harness access selection must be an array.\");\n    connections.forEach(parseConnection);\n  }\n  return value as AccessConfig;\n}\n\nasync function ensureExcluded(mainRoot: string): Promise<void> {\n  try { await git(mainRoot, [\"rev-parse\", \"--git-dir\"]); }\n  catch (error) {\n    if (error instanceof Error && error.message.includes(\"not a git repository\")) return;\n    configError(\"Cannot inspect Git configuration for personal settings.\");\n  }\n  let tracked = false;\n  try { tracked = !!await git(mainRoot, [\"ls-files\", \"--\", \".subharness/agents.local.json\"]); }\n  catch { configError(\"Cannot inspect whether personal access settings are tracked by Git.\"); }\n  if (tracked) configError(\"Personal access settings are tracked. Remove .subharness/agents.local.json from the Git index before using it.\");\n  const exclude = await git(mainRoot, [\"rev-parse\", \"--path-format=absolute\", \"--git-path\", \"info/exclude\"]);\n  let contents = \"\";\n  try { contents = await readFile(exclude, \"utf8\"); }\n  catch (error) { if ((error as NodeJS.ErrnoException).code !== \"ENOENT\") configError(\"Cannot read Git's local exclude file.\"); }\n  const pattern = \"/.subharness/agents.local.json\";\n  if (!contents.split(/\\r?\\n/).includes(pattern)) {\n    await mkdir(dirname(exclude), { recursive: true });\n    await appendFile(exclude, `${contents.endsWith(\"\\n\") || !contents ? \"\" : \"\\n\"}${pattern}\\n`);\n  }\n}\n\nexport async function loadAccess(cwd: string): Promise<AccessConfig> {\n  const { mainRoot } = await resolveProject(cwd);\n  const file = join(mainRoot, \".subharness\", \"agents.local.json\");\n  let contents: string;\n  try { contents = await readFile(file, \"utf8\"); }\n  catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return {};\n    configError(`Cannot read personal settings: ${file}`);\n  }\n  await ensureExcluded(mainRoot);\n  let value: unknown;\n  try { value = JSON.parse(contents); }\n  catch { configError(`Invalid JSON in personal settings: ${file}`); }\n  return parseAccess(value);\n}\n"]}
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/config/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAapD,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,OAAe,EAAE,IAAa,EAAE,IAAI,GAAG,gBAAgB;IAC5F,MAAM,QAAQ,GAAG,IAAI,KAAK,SAAS;QACjC,CAAC,CAAC,0BAA0B;QAC5B,CAAC,CAAC,+BAA+B,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;IAC/D,MAAM,IAAI,UAAU,CAAC,IAAI,EAAE,GAAG,QAAQ,mBAAmB,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,QAAgB,EAAE,IAAa,EAAE,OAAqB;IAC/F,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,WAAW,CAAC,QAAQ,EAAE,+BAA+B,EAAE,IAAI,CAAC,CAAC;IACjF,IAAI,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAc,CAAC;QAAE,WAAW,CAAC,GAAG,QAAQ,OAAO,EAAE,iCAAiC,EAAE,IAAI,CAAC,CAAC;IAC3K,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnP,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,WAAW,CAAC,QAAQ,EAAE,2FAA2F,EAAE,IAAI,CAAC,CAAC;IACvL,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAE,WAAW,CAAC,GAAG,QAAQ,MAAM,EAAE,mCAAmC,EAAE,IAAI,CAAC,CAAC;IACzL,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;QAC7F,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YAAE,WAAW,CAAC,GAAG,QAAQ,IAAI,KAAK,EAAE,EAAE,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,kCAAkC,EAAE,IAAI,CAAC,CAAC;IAC9P,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAiB,CAAC;QAAE,WAAW,CAAC,GAAG,QAAQ,UAAU,EAAE,6BAA6B,EAAE,IAAI,CAAC,CAAC;IAC5K,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,eAAe,CAAC,KAAK,CAAC,OAAiB,EAAE,GAAG,QAAQ,UAAU,EAAE,IAAI,CAAC,CAAC;IACvG,IAAI,OAAO;QAAE,yBAAyB,CAAC,KAAyB,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC3F,OAAO,KAAyB,CAAC;AACnC,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,QAAgB,EAAE,IAAa;IACrE,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,WAAW,CAAC,QAAQ,EAAE,wFAAwF,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IACrK,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;WACjF,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;WAC5F,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,WAAW,CAAC,QAAQ,EAAE,wFAAwF,EAAE,IAAI,CAAC,CAAC;IACxH,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,UAA4B,EAAE,IAAiB,EAAE,QAAgB,EAAE,IAAa;IACjH,IAAI,UAAU,CAAC,IAAI,KAAK,gBAAgB,IAAI,UAAU,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC9E,IAAI,IAAI,KAAK,QAAQ;YAAE,WAAW,CAAC,GAAG,QAAQ,OAAO,EAAE,2BAA2B,UAAU,CAAC,IAAI,UAAU,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;QACzI,OAAO;IACT,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC;YAC5D,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnG,WAAW,CAAC,GAAG,QAAQ,WAAW,EAAE,GAAG,IAAI,2DAA2D,EAAE,IAAI,CAAC,CAAC;QAChH,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,GAAa,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACnD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,QAAQ;YAAE,WAAW,CAAC,GAAG,QAAQ,WAAW,EAAE,GAAG,IAAI,4CAA4C,EAAE,IAAI,CAAC,CAAC;QACzH,IAAI,CAAC,UAAU,CAAC,GAAG;YAAE,WAAW,CAAC,GAAG,QAAQ,MAAM,EAAE,GAAG,IAAI,4CAA4C,EAAE,IAAI,CAAC,CAAC;QAC/G,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzB,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,WAAW,CAAC,GAAG,QAAQ,WAAW,EAAE,uDAAuD,EAAE,IAAI,CAAC,CAAC;QACpL,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,WAAW,CAAC,GAAG,QAAQ,WAAW,EAAE,wCAAwC,EAAE,IAAI,CAAC,CAAC;YACvO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC;YAAE,WAAW,CAAC,GAAG,QAAQ,WAAW,EAAE,gDAAgD,EAAE,IAAI,CAAC,CAAC;QACjL,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzB,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC3E,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,IAAI,UAAU,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjG,IAAI,UAAU,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC3B,IAAI,CAAC,UAAU,CAAC,OAAO;gBAAE,WAAW,CAAC,GAAG,QAAQ,UAAU,EAAE,yCAAyC,EAAE,IAAI,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC;SAC/E,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/E,IAAI,YAAY;QAAE,WAAW,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,EAAE,gBAAgB,IAAI,4BAA4B,EAAE,IAAI,CAAC,CAAC;AACvH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,OAAqB;IACnE,OAAO,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,IAAa;IAClD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC;QAAE,WAAW,CAAC,aAAa,EAAE,uCAAuC,EAAE,IAAI,CAAC,CAAC;IACpJ,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,WAAW,CAAC,QAAQ,EAAE,0BAA0B,EAAE,IAAI,CAAC,CAAC;IACnF,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,WAAW,CAAC,QAAQ,EAAE,4BAA4B,EAAE,IAAI,CAAC,CAAC;QAC9I,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;YAAE,WAAW,CAAC,UAAU,IAAI,EAAE,EAAE,4CAA4C,EAAE,IAAI,CAAC,CAAC;QACnH,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,UAAU,EAAE,UAAU,IAAI,IAAI,KAAK,GAAG,EAAE,IAAI,EAAE,IAAmB,CAAC,CAAC,CAAC;IACnI,CAAC;IACD,OAAO,KAAqB,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,IAAY;IAC1D,IAAI,CAAC;QAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IAAC,CAAC;IACxD,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAAE,OAAO;QACrF,iBAAiB,CAAC,IAAI,EAAE,wDAAwD,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QAAC,OAAO,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,+BAA+B,CAAC,CAAC,CAAC;IAAC,CAAC;IAC7F,MAAM,CAAC;QAAC,iBAAiB,CAAC,IAAI,EAAE,oEAAoE,CAAC,CAAC;IAAC,CAAC;IACxG,IAAI,OAAO;QAAE,iBAAiB,CAAC,IAAI,EAAE,+GAA+G,CAAC,CAAC;IACtJ,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;IAC3G,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IACnD,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,iBAAiB,CAAC,IAAI,EAAE,sCAAsC,CAAC,CAAC;IAAC,CAAC;IAC1I,MAAM,OAAO,GAAG,gCAAgC,CAAC;IACjD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,IAAI,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,OAAe;IACtD,WAAW,CAAC,GAAG,OAAO,oCAAoC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW;IAC1C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;IAChE,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAChD,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,QAAQ,GAAiB,EAAE,CAAC;YAClC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;YAClE,IAAI,WAA+B,CAAC;YACpC,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;gBAAC,WAAW,GAAG,UAAU,CAAC;YAAC,CAAC;YAC1D,MAAM,CAAC,CAAC,oEAAoE,CAAC,CAAC;YAC9E,sBAAsB,CAAC,QAAQ,EAAE,EAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAC,UAAU,EAAE,WAAW,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAC,CAAC,CAAC;YAC5G,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,iBAAiB,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IACrC,MAAM,CAAC;QAAC,iBAAiB,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;IAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5C,sBAAsB,CAAC,QAAQ,EAAE,EAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAC,CAAC,CAAC;IACxD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import { appendFile, lstat, mkdir, readFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { AgentError } from \"../errors.js\";\nimport type { HarnessKind } from \"../sdk/types.js\";\nimport { git, resolveProject } from \"./project.js\";\nimport { quoteDiagnosticPath, recordAccessProvenance } from \"./access-provenance.js\";\nexport { resolveAccess } from \"./resolve-access.js\";\n\nexport type AccessConnection =\n  | { type: \"subscription\"; provider?: string }\n  | { type: \"api-key\"; provider?: string; env?: string; envFile?: string; baseUrl?: string;\n      wireApi?: \"completions\" | \"responses\"; apiVersion?: string; wireModel?: string }\n  | { type: \"vercel-api-key\"; env?: string; envFile?: string }\n  | { type: \"vercel-oidc\"; env?: string; envFile?: string; project?: string };\n\nexport interface AccessConfig {\n  access?: Partial<Record<HarnessKind, AccessConnection[]>>;\n}\n\nexport function configError(message: string): never {\n  throw new AgentError(\"INVALID_CONFIG\", message);\n}\n\nfunction schemaError(location: string, message: string, file?: string, code = \"INVALID_CONFIG\"): never {\n  const settings = file === undefined\n    ? \"Personal access settings\"\n    : `Personal access settings at ${quoteDiagnosticPath(file)}`;\n  throw new AgentError(code, `${settings} are invalid at ${location}: ${message}`);\n}\n\nfunction record(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction parseConnectionAt(value: unknown, location: string, file?: string, harness?: HarnessKind): AccessConnection {\n  if (!record(value)) schemaError(location, \"Connection must be an object.\", file);\n  if (![\"subscription\", \"api-key\", \"vercel-api-key\", \"vercel-oidc\"].includes(value.type as string)) schemaError(`${location}.type`, \"Unknown access connection type.\", file);\n  const allowed = value.type === \"subscription\" ? [\"type\", \"provider\"] : [\"type\", \"env\", \"envFile\", ...(value.type === \"api-key\" ? [\"provider\", \"baseUrl\", \"wireApi\", \"apiVersion\", \"wireModel\"] : value.type === \"vercel-oidc\" ? [\"project\"] : [])];\n  if (Object.keys(value).some((key) => !allowed.includes(key))) schemaError(location, \"Unknown access connection field; secrets must be supplied through environment references.\", file);\n  if (value.env !== undefined && (typeof value.env !== \"string\" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(value.env))) schemaError(`${location}.env`, \"Invalid credential variable name.\", file);\n  for (const field of [\"envFile\", \"project\", \"provider\", \"baseUrl\", \"apiVersion\", \"wireModel\"]) {\n    if (value[field] !== undefined && (typeof value[field] !== \"string\" || !value[field].trim())) schemaError(`${location}.${field}`, field === \"envFile\" || field === \"project\" ? \"Value must be a nonempty path.\" : \"Value must be a nonempty string.\", file);\n  }\n  if (value.wireApi !== undefined && ![\"completions\", \"responses\"].includes(value.wireApi as string)) schemaError(`${location}.wireApi`, \"Invalid wire API selection.\", file);\n  if (value.baseUrl !== undefined) validateBaseUrl(value.baseUrl as string, `${location}.baseUrl`, file);\n  if (harness) validateHarnessConnection(value as AccessConnection, harness, location, file);\n  return value as AccessConnection;\n}\n\nfunction validateBaseUrl(value: string, location: string, file?: string): void {\n  let url: URL;\n  try { url = new URL(value); } catch { return schemaError(location, \"baseUrl must be an absolute HTTP or HTTPS URL without credentials, query, or fragment.\", file); }\n  if (!/^https?:\\/\\//iu.test(value) || value.trim() !== value || /[\\s?#\\\\]/u.test(value)\n    || ![\"http:\", \"https:\"].includes(url.protocol) || !url.hostname || url.username || url.password\n    || /^https?:\\/\\/[^/]*@/iu.test(value)) {\n    schemaError(location, \"baseUrl must be an absolute HTTP or HTTPS URL without credentials, query, or fragment.\", file);\n  }\n}\n\nfunction validateHarnessConnection(connection: AccessConnection, kind: HarnessKind, location: string, file?: string): void {\n  if (connection.type === \"vercel-api-key\" || connection.type === \"vercel-oidc\") {\n    if (kind === \"cursor\") schemaError(`${location}.type`, `cursor does not support ${connection.type} access.`, file, \"UNSUPPORTED_OPTION\");\n    return;\n  }\n  if (connection.type === \"subscription\") {\n    const providers = kind === \"fx\" ? [\"gateway\", \"codex\", \"grok\"]\n      : kind === \"opencode\" ? [\"openai\", \"github-copilot\", \"xai\"] : undefined;\n    if (providers ? !providers.includes(connection.provider ?? \"\") : connection.provider !== undefined) {\n      schemaError(`${location}.provider`, `${kind} requires its documented native login provider selection.`, file);\n    }\n    return;\n  }\n  let allowed: string[] = [\"type\", \"env\", \"envFile\"];\n  if (kind === \"fx\" || kind === \"opencode\") {\n    if (!connection.provider) schemaError(`${location}.provider`, `${kind} direct API keys require provider and env.`, file);\n    if (!connection.env) schemaError(`${location}.env`, `${kind} direct API keys require provider and env.`, file);\n    allowed.push(\"provider\");\n    if (kind === \"fx\" && [\"gateway\", \"codex\", \"grok\"].includes(connection.provider)) schemaError(`${location}.provider`, \"fx direct API keys require a named custom connection.\", file);\n    if (kind === \"opencode\") {\n      if (![\"anthropic\", \"openai\", \"google\", \"groq\", \"openrouter\", \"xai\", \"mistral\", \"cohere\", \"opencode\", \"opencode-go\"].includes(connection.provider)) schemaError(`${location}.provider`, \"Unsupported OpenCode API-key provider.\", file);\n      allowed.push(\"baseUrl\");\n    }\n  } else if (kind === \"copilot\") {\n    if (![\"github\", \"openai\", \"anthropic\", \"azure\"].includes(connection.provider ?? \"\")) schemaError(`${location}.provider`, \"Copilot API keys require a supported provider.\", file);\n    allowed.push(\"provider\");\n    if (connection.provider !== \"github\") allowed.push(\"baseUrl\", \"wireModel\");\n    if (connection.provider === \"openai\" || connection.provider === \"azure\") allowed.push(\"wireApi\");\n    if (connection.provider === \"azure\") {\n      allowed.push(\"apiVersion\");\n      if (!connection.baseUrl) schemaError(`${location}.baseUrl`, \"Copilot Azure API keys require baseUrl.\", file);\n    }\n  }\n  const inapplicable = [\"provider\", \"baseUrl\", \"wireApi\", \"apiVersion\", \"wireModel\"]\n    .find(field => Object.hasOwn(connection, field) && !allowed.includes(field));\n  if (inapplicable) schemaError(`${location}.${inapplicable}`, `Inapplicable ${kind} API-key connection field.`, file);\n}\n\nexport function parseConnection(value: unknown, harness?: HarnessKind): AccessConnection {\n  return parseConnectionAt(value, \"connection\", undefined, harness);\n}\n\nfunction parseAccessAt(value: unknown, file?: string): AccessConfig {\n  if (!record(value) || Object.keys(value).some((key) => key !== \"access\")) schemaError(\"root object\", \"Expected only an optional access map.\", file);\n  if (value.access === undefined) return {};\n  if (!record(value.access)) schemaError(\"access\", \"Value must be an object.\", file);\n  for (const [kind, connections] of Object.entries(value.access)) {\n    if (![\"codex\", \"claudeCode\", \"fx\", \"opencode\", \"copilot\", \"cursor\"].includes(kind)) schemaError(\"access\", \"Unsupported harness entry.\", file);\n    if (!Array.isArray(connections)) schemaError(`access.${kind}`, \"Harness access selection must be an array.\", file);\n    connections.forEach((connection, index) => parseConnectionAt(connection, `access.${kind}[${index}]`, file, kind as HarnessKind));\n  }\n  return value as AccessConfig;\n}\n\nexport function parseAccess(value: unknown): AccessConfig {\n  return parseAccessAt(value);\n}\n\nasync function ensureExcluded(mainRoot: string, file: string): Promise<void> {\n  try { await git(mainRoot, [\"rev-parse\", \"--git-dir\"]); }\n  catch (error) {\n    if (error instanceof Error && error.message.includes(\"not a git repository\")) return;\n    settingsFileError(file, \"Cannot inspect Git configuration for personal settings\");\n  }\n  let tracked = false;\n  try { tracked = !!await git(mainRoot, [\"ls-files\", \"--\", \".subharness/agents.local.json\"]); }\n  catch { settingsFileError(file, \"Cannot inspect whether personal access settings are tracked by Git\"); }\n  if (tracked) settingsFileError(file, \"Personal access settings are tracked. Remove .subharness/agents.local.json from the Git index before using it\");\n  const exclude = await git(mainRoot, [\"rev-parse\", \"--path-format=absolute\", \"--git-path\", \"info/exclude\"]);\n  let contents = \"\";\n  try { contents = await readFile(exclude, \"utf8\"); }\n  catch (error) { if ((error as NodeJS.ErrnoException).code !== \"ENOENT\") settingsFileError(file, \"Cannot read Git's local exclude file\"); }\n  const pattern = \"/.subharness/agents.local.json\";\n  if (!contents.split(/\\r?\\n/).includes(pattern)) {\n    await mkdir(dirname(exclude), { recursive: true });\n    await appendFile(exclude, `${contents.endsWith(\"\\n\") || !contents ? \"\" : \"\\n\"}${pattern}\\n`);\n  }\n}\n\nfunction settingsFileError(file: string, message: string): never {\n  configError(`${message}. Personal access settings file: ${quoteDiagnosticPath(file)}.`);\n}\n\nexport async function loadAccess(cwd: string): Promise<AccessConfig> {\n  const { mainRoot } = await resolveProject(cwd);\n  const file = join(mainRoot, \".subharness\", \"agents.local.json\");\n  let contents: string;\n  try { contents = await readFile(file, \"utf8\"); }\n  catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") {\n      const settings: AccessConfig = {};\n      const legacyFile = join(mainRoot, \".agents\", \"agents.local.json\");\n      let legacyEntry: string | undefined;\n      try { await lstat(legacyFile); legacyEntry = legacyFile; }\n      catch { /* Legacy inspection must not replace the original startup error. */ }\n      recordAccessProvenance(settings, {file, present: false, ...(legacyEntry ? {legacyFile: legacyEntry} : {})});\n      return settings;\n    }\n    settingsFileError(file, \"Cannot read personal settings\");\n  }\n  await ensureExcluded(mainRoot, file);\n  let value: unknown;\n  try { value = JSON.parse(contents); }\n  catch { settingsFileError(file, \"Invalid JSON in personal settings\"); }\n  const settings = parseAccessAt(value, file);\n  recordAccessProvenance(settings, {file, present: true});\n  return settings;\n}\n"]}

package/dist/config/loader.js

@@ -13,6 +13,7 @@ const safeDiagnostics = new Set([
     "Names must start with a letter and contain at most 64 letters, digits, underscores, or hyphens.",
     "fast must be a boolean.", "Unsupported harness kind.", "At least one harness is required.",
     "Claude effort must be low, medium, high, xhigh, or max.",
+    "Cursor sandboxMode must be enabled or disabled.",
     "Subagent definitions cannot contain recursive references.",
     "Tools require a Zod 4 object schema.", "Tool execute must be a function.",
     "Tool input schema cannot be represented as JSON Schema.",

package/dist/config/loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAE9C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAW9C,uEAAuE;AACvE,wFAAwF;AACxF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,kCAAkC,EAAE,8BAA8B;IAClE,iGAAiG;IACjG,yBAAyB,EAAE,2BAA2B,EAAE,mCAAmC;IAC3F,yDAAyD;IACzD,2DAA2D;IAC3D,sCAAsC,EAAE,kCAAkC;IAC1E,yDAAyD;IACzD,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,6BAA6B,CAAC;CAC9H,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,SAAS,GAAa,EAAE;IACzE,IAAI,UAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACtF,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;eACrE,KAAoB,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO;YACtE,CAAC,CAAC,6FAA6F,CAAC;QAClG,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,GAAG,IAAI,eAAe,IAAI,oBAAoB,CAAC,CAAC;QACvG,UAAU,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,SAAiB;IACpC,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QAAC,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IACpE,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAClE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,gCAAgC,SAAS,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;aACrD,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,OAAO,GAAsB,EAAE;IACzE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,CAAU,EAAE,CAAC;QAC7F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,GAAG,IAAI,2BAA2B,UAAU,CAAC,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC;YACpJ,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3I,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import { readdir } from \"node:fs/promises\";\nimport { homedir } from \"node:os\";\nimport { join, resolve } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport { tsImport } from \"tsx/esm/api\";\nimport { AgentError } from \"../errors.js\";\nimport { agent } from \"../sdk/definitions.js\";\nimport type { AgentDefinition } from \"../sdk/types.js\";\nimport { resolveProject } from \"./project.js\";\n\nexport interface CatalogEntry {\n  id: string;\n  name: string;\n  description: string;\n  scope: \"repo\" | \"global\";\n  file: string;\n  definition: AgentDefinition;\n}\n\n// Only fixed SDK diagnostics may cross the module-evaluation boundary.\n// User exceptions can contain credential values, including exceptions named AgentError.\nconst safeDiagnostics = new Set([\n  \"Expected a configuration object.\", \"Unknown configuration field.\",\n  \"Names must start with a letter and contain at most 64 letters, digits, underscores, or hyphens.\",\n  \"fast must be a boolean.\", \"Unsupported harness kind.\", \"At least one harness is required.\",\n  \"Claude effort must be low, medium, high, xhigh, or max.\",\n  \"Subagent definitions cannot contain recursive references.\",\n  \"Tools require a Zod 4 object schema.\", \"Tool execute must be a function.\",\n  \"Tool input schema cannot be represented as JSON Schema.\",\n  ...[\"Model\", \"Effort\", \"Description\", \"Instructions\", \"Tool description\"].map(label => `${label} must be a nonempty string.`),\n]);\n\nexport async function loadDefinition(file: string, subagents: string[] = []): Promise<AgentDefinition> {\n  let definition: AgentDefinition;\n  try {\n    const url = pathToFileURL(resolve(file));\n    url.searchParams.set(\"load\", crypto.randomUUID());\n    const loaded = await tsImport(url.href, import.meta.url);\n    const exported = loaded.default?.__esModule ? loaded.default.default : loaded.default;\n    definition = agent(exported);\n  } catch (error) {\n    const reason = error instanceof Error && safeDiagnostics.has(error.message)\n      && (error as AgentError).code === \"INVALID_DEFINITION\" ? error.message\n      : \"Definition could not be loaded. Check its imports, dependencies, and module initialization.\";\n    throw new AgentError(\"INVALID_DEFINITION\", `${file}: ${reason}`);\n  }\n  for (const name of subagents) {\n    const children = definition.subagents ?? {};\n    const child = Object.hasOwn(children, name) ? children[name] : undefined;\n    if (!child) throw new AgentError(\"INVALID_DEFINITION\", `${file}: Subagent '${name}' is not declared.`);\n    definition = child;\n  }\n  return definition;\n}\n\nasync function files(directory: string): Promise<string[]> {\n  let entries;\n  try { entries = await readdir(directory, { withFileTypes: true }); }\n  catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return [];\n    throw new AgentError(\"INVALID_CONFIG\", `Cannot read agent directory: ${directory}`);\n  }\n  const found: string[] = [];\n  for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {\n    const file = join(directory, entry.name);\n    if (entry.isDirectory()) found.push(...await files(file));\n    else if (entry.isFile() && entry.name.endsWith(\".ts\") && !entry.name.endsWith(\".d.ts\")) found.push(file);\n  }\n  return found;\n}\n\nexport async function discover(cwd: string, options: { home?: string } = {}): Promise<CatalogEntry[]> {\n  const { root } = await resolveProject(cwd);\n  const entries: CatalogEntry[] = [];\n  for (const [scope, base] of [[\"repo\", root], [\"global\", options.home ?? homedir()]] as const) {\n    const names = new Set<string>();\n    for (const file of await files(join(base, \".subharness\", \"agents\"))) {\n      const definition = await loadDefinition(file);\n      if (names.has(definition.name)) throw new AgentError(\"INVALID_DEFINITION\", `${file}: Duplicate agent name '${definition.name}' in ${scope} scope.`);\n      names.add(definition.name);\n      entries.push({ id: `${scope}:${definition.name}`, name: definition.name, description: definition.description, scope, file, definition });\n    }\n  }\n  return entries;\n}\n"]}
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAE9C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAW9C,uEAAuE;AACvE,wFAAwF;AACxF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,kCAAkC,EAAE,8BAA8B;IAClE,iGAAiG;IACjG,yBAAyB,EAAE,2BAA2B,EAAE,mCAAmC;IAC3F,yDAAyD;IACzD,iDAAiD;IACjD,2DAA2D;IAC3D,sCAAsC,EAAE,kCAAkC;IAC1E,yDAAyD;IACzD,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,6BAA6B,CAAC;CAC9H,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,SAAS,GAAa,EAAE;IACzE,IAAI,UAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACtF,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;eACrE,KAAoB,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO;YACtE,CAAC,CAAC,6FAA6F,CAAC;QAClG,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,GAAG,IAAI,eAAe,IAAI,oBAAoB,CAAC,CAAC;QACvG,UAAU,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,SAAiB;IACpC,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QAAC,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IACpE,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAClE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,gCAAgC,SAAS,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;aACrD,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,OAAO,GAAsB,EAAE;IACzE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,CAAU,EAAE,CAAC;QAC7F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,GAAG,IAAI,2BAA2B,UAAU,CAAC,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC;YACpJ,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3I,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import { readdir } from \"node:fs/promises\";\nimport { homedir } from \"node:os\";\nimport { join, resolve } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport { tsImport } from \"tsx/esm/api\";\nimport { AgentError } from \"../errors.js\";\nimport { agent } from \"../sdk/definitions.js\";\nimport type { AgentDefinition } from \"../sdk/types.js\";\nimport { resolveProject } from \"./project.js\";\n\nexport interface CatalogEntry {\n  id: string;\n  name: string;\n  description: string;\n  scope: \"repo\" | \"global\";\n  file: string;\n  definition: AgentDefinition;\n}\n\n// Only fixed SDK diagnostics may cross the module-evaluation boundary.\n// User exceptions can contain credential values, including exceptions named AgentError.\nconst safeDiagnostics = new Set([\n  \"Expected a configuration object.\", \"Unknown configuration field.\",\n  \"Names must start with a letter and contain at most 64 letters, digits, underscores, or hyphens.\",\n  \"fast must be a boolean.\", \"Unsupported harness kind.\", \"At least one harness is required.\",\n  \"Claude effort must be low, medium, high, xhigh, or max.\",\n  \"Cursor sandboxMode must be enabled or disabled.\",\n  \"Subagent definitions cannot contain recursive references.\",\n  \"Tools require a Zod 4 object schema.\", \"Tool execute must be a function.\",\n  \"Tool input schema cannot be represented as JSON Schema.\",\n  ...[\"Model\", \"Effort\", \"Description\", \"Instructions\", \"Tool description\"].map(label => `${label} must be a nonempty string.`),\n]);\n\nexport async function loadDefinition(file: string, subagents: string[] = []): Promise<AgentDefinition> {\n  let definition: AgentDefinition;\n  try {\n    const url = pathToFileURL(resolve(file));\n    url.searchParams.set(\"load\", crypto.randomUUID());\n    const loaded = await tsImport(url.href, import.meta.url);\n    const exported = loaded.default?.__esModule ? loaded.default.default : loaded.default;\n    definition = agent(exported);\n  } catch (error) {\n    const reason = error instanceof Error && safeDiagnostics.has(error.message)\n      && (error as AgentError).code === \"INVALID_DEFINITION\" ? error.message\n      : \"Definition could not be loaded. Check its imports, dependencies, and module initialization.\";\n    throw new AgentError(\"INVALID_DEFINITION\", `${file}: ${reason}`);\n  }\n  for (const name of subagents) {\n    const children = definition.subagents ?? {};\n    const child = Object.hasOwn(children, name) ? children[name] : undefined;\n    if (!child) throw new AgentError(\"INVALID_DEFINITION\", `${file}: Subagent '${name}' is not declared.`);\n    definition = child;\n  }\n  return definition;\n}\n\nasync function files(directory: string): Promise<string[]> {\n  let entries;\n  try { entries = await readdir(directory, { withFileTypes: true }); }\n  catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return [];\n    throw new AgentError(\"INVALID_CONFIG\", `Cannot read agent directory: ${directory}`);\n  }\n  const found: string[] = [];\n  for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {\n    const file = join(directory, entry.name);\n    if (entry.isDirectory()) found.push(...await files(file));\n    else if (entry.isFile() && entry.name.endsWith(\".ts\") && !entry.name.endsWith(\".d.ts\")) found.push(file);\n  }\n  return found;\n}\n\nexport async function discover(cwd: string, options: { home?: string } = {}): Promise<CatalogEntry[]> {\n  const { root } = await resolveProject(cwd);\n  const entries: CatalogEntry[] = [];\n  for (const [scope, base] of [[\"repo\", root], [\"global\", options.home ?? homedir()]] as const) {\n    const names = new Set<string>();\n    for (const file of await files(join(base, \".subharness\", \"agents\"))) {\n      const definition = await loadDefinition(file);\n      if (names.has(definition.name)) throw new AgentError(\"INVALID_DEFINITION\", `${file}: Duplicate agent name '${definition.name}' in ${scope} scope.`);\n      names.add(definition.name);\n      entries.push({ id: `${scope}:${definition.name}`, name: definition.name, description: definition.description, scope, file, definition });\n    }\n  }\n  return entries;\n}\n"]}

package/dist/config/oidc.js

@@ -44,8 +44,10 @@ export async function validateOidc(token, mainRoot, project, env) {
         || (claims.nbf !== undefined && (typeof claims.nbf !== "number" || !Number.isFinite(claims.nbf)))) {
         configError("Configured OIDC token has invalid validity claims.");
     }
-    if (claims.exp <= now || (claims.nbf !== undefined && claims.nbf > now))
-        configError("Configured OIDC token is expired or not yet valid; refresh its credential source.");
+    if (claims.exp <= now)
+        configError("Configured OIDC token has expired; refresh the configured credential source.");
+    if (claims.nbf !== undefined && claims.nbf > now)
+        configError("Configured OIDC token is not yet valid; check the system clock or wait until validity begins.");
     const expected = await projectIdentity(mainRoot, project, env);
     if (claims.project_id !== expected.projectId || claims.owner_id !== expected.orgId)
         configError("Configured OIDC token does not match the selected Vercel project and organization.");

package/dist/config/oidc.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../src/config/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI1C,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,OAA2B,EAAE,GAAsB;IAClG,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QAAC,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,IAAI,GAAG,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IACpG,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,OAAO,KAAK,SAAS,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;YAC9H,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;QACxE,CAAC;QACD,WAAW,CAAC,yEAAyE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACvC,MAAM,CAAC;QAAC,WAAW,CAAC,oDAAoD,CAAC,CAAC;IAAC,CAAC;IAC5E,IAAI,OAAO,QAAQ,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC5H,WAAW,CAAC,+DAA+D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,QAAgB,EAAE,OAA2B,EAAE,GAAsB;IACrH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,WAAW,CAAC,qCAAqC,CAAC,CAAC;IACnI,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACtF,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QAAC,WAAW,CAAC,qCAAqC,CAAC,CAAC;IAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAC9B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;WAC7D,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;WAC9D,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,WAAW,CAAC,oDAAoD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;QAAE,WAAW,CAAC,mFAAmF,CAAC,CAAC;IAC1K,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,KAAK;QAAE,WAAW,CAAC,oFAAoF,CAAC,CAAC;AACxL,CAAC","sourcesContent":["import { readFile } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { configError } from \"./access.js\";\n\ninterface ProjectIdentity { projectId: string; orgId: string }\n\nasync function projectIdentity(mainRoot: string, project: string | undefined, env: NodeJS.ProcessEnv): Promise<ProjectIdentity> {\n  let content: string;\n  try { content = await readFile(resolve(mainRoot, project ?? \".\", \".vercel/project.json\"), \"utf8\"); }\n  catch (error) {\n    if (project === undefined && (error as NodeJS.ErrnoException).code === \"ENOENT\" && env.VERCEL_PROJECT_ID && env.VERCEL_ORG_ID) {\n      return { projectId: env.VERCEL_PROJECT_ID, orgId: env.VERCEL_ORG_ID };\n    }\n    configError(\"Selected OIDC project requires accessible .vercel/project.json linkage.\");\n  }\n  let identity;\n  try { identity = JSON.parse(content); }\n  catch { configError(\"Selected Vercel project linkage is not valid JSON.\"); }\n  if (typeof identity?.projectId !== \"string\" || !identity.projectId || typeof identity.orgId !== \"string\" || !identity.orgId) {\n    configError(\"Selected Vercel project linkage requires projectId and orgId.\");\n  }\n  return identity;\n}\n\nexport async function validateOidc(token: string, mainRoot: string, project: string | undefined, env: NodeJS.ProcessEnv): Promise<void> {\n  const parts = token.split(\".\");\n  if (parts.length !== 3 || parts.some((part) => !/^[A-Za-z0-9_-]+$/.test(part))) configError(\"Configured OIDC token is malformed.\");\n  let claims;\n  try {\n    const header = JSON.parse(Buffer.from(parts[0]!, \"base64url\").toString(\"utf8\"));\n    if (!header || typeof header !== \"object\" || Array.isArray(header)) throw new Error();\n    claims = JSON.parse(Buffer.from(parts[1]!, \"base64url\").toString(\"utf8\"));\n  } catch { configError(\"Configured OIDC token is malformed.\"); }\n  const now = Date.now() / 1000;\n  if (!claims || typeof claims !== \"object\" || Array.isArray(claims)\n    || typeof claims.exp !== \"number\" || !Number.isFinite(claims.exp)\n    || (claims.nbf !== undefined && (typeof claims.nbf !== \"number\" || !Number.isFinite(claims.nbf)))) {\n    configError(\"Configured OIDC token has invalid validity claims.\");\n  }\n  if (claims.exp <= now || (claims.nbf !== undefined && claims.nbf > now)) configError(\"Configured OIDC token is expired or not yet valid; refresh its credential source.\");\n  const expected = await projectIdentity(mainRoot, project, env);\n  if (claims.project_id !== expected.projectId || claims.owner_id !== expected.orgId) configError(\"Configured OIDC token does not match the selected Vercel project and organization.\");\n}\n"]}
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../src/config/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI1C,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,OAA2B,EAAE,GAAsB;IAClG,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QAAC,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,IAAI,GAAG,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IACpG,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,OAAO,KAAK,SAAS,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;YAC9H,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;QACxE,CAAC;QACD,WAAW,CAAC,yEAAyE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACvC,MAAM,CAAC;QAAC,WAAW,CAAC,oDAAoD,CAAC,CAAC;IAAC,CAAC;IAC5E,IAAI,OAAO,QAAQ,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC5H,WAAW,CAAC,+DAA+D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,QAAgB,EAAE,OAA2B,EAAE,GAAsB;IACrH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,WAAW,CAAC,qCAAqC,CAAC,CAAC;IACnI,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACtF,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QAAC,WAAW,CAAC,qCAAqC,CAAC,CAAC;IAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAC9B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;WAC7D,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;WAC9D,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,WAAW,CAAC,oDAAoD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,IAAI,GAAG;QAAE,WAAW,CAAC,8EAA8E,CAAC,CAAC;IACnH,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG;QAAE,WAAW,CAAC,+FAA+F,CAAC,CAAC;IAC/J,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,KAAK;QAAE,WAAW,CAAC,oFAAoF,CAAC,CAAC;AACxL,CAAC","sourcesContent":["import { readFile } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { configError } from \"./access.js\";\n\ninterface ProjectIdentity { projectId: string; orgId: string }\n\nasync function projectIdentity(mainRoot: string, project: string | undefined, env: NodeJS.ProcessEnv): Promise<ProjectIdentity> {\n  let content: string;\n  try { content = await readFile(resolve(mainRoot, project ?? \".\", \".vercel/project.json\"), \"utf8\"); }\n  catch (error) {\n    if (project === undefined && (error as NodeJS.ErrnoException).code === \"ENOENT\" && env.VERCEL_PROJECT_ID && env.VERCEL_ORG_ID) {\n      return { projectId: env.VERCEL_PROJECT_ID, orgId: env.VERCEL_ORG_ID };\n    }\n    configError(\"Selected OIDC project requires accessible .vercel/project.json linkage.\");\n  }\n  let identity;\n  try { identity = JSON.parse(content); }\n  catch { configError(\"Selected Vercel project linkage is not valid JSON.\"); }\n  if (typeof identity?.projectId !== \"string\" || !identity.projectId || typeof identity.orgId !== \"string\" || !identity.orgId) {\n    configError(\"Selected Vercel project linkage requires projectId and orgId.\");\n  }\n  return identity;\n}\n\nexport async function validateOidc(token: string, mainRoot: string, project: string | undefined, env: NodeJS.ProcessEnv): Promise<void> {\n  const parts = token.split(\".\");\n  if (parts.length !== 3 || parts.some((part) => !/^[A-Za-z0-9_-]+$/.test(part))) configError(\"Configured OIDC token is malformed.\");\n  let claims;\n  try {\n    const header = JSON.parse(Buffer.from(parts[0]!, \"base64url\").toString(\"utf8\"));\n    if (!header || typeof header !== \"object\" || Array.isArray(header)) throw new Error();\n    claims = JSON.parse(Buffer.from(parts[1]!, \"base64url\").toString(\"utf8\"));\n  } catch { configError(\"Configured OIDC token is malformed.\"); }\n  const now = Date.now() / 1000;\n  if (!claims || typeof claims !== \"object\" || Array.isArray(claims)\n    || typeof claims.exp !== \"number\" || !Number.isFinite(claims.exp)\n    || (claims.nbf !== undefined && (typeof claims.nbf !== \"number\" || !Number.isFinite(claims.nbf)))) {\n    configError(\"Configured OIDC token has invalid validity claims.\");\n  }\n  if (claims.exp <= now) configError(\"Configured OIDC token has expired; refresh the configured credential source.\");\n  if (claims.nbf !== undefined && claims.nbf > now) configError(\"Configured OIDC token is not yet valid; check the system clock or wait until validity begins.\");\n  const expected = await projectIdentity(mainRoot, project, env);\n  if (claims.project_id !== expected.projectId || claims.owner_id !== expected.orgId) configError(\"Configured OIDC token does not match the selected Vercel project and organization.\");\n}\n"]}

package/dist/config/project.js

@@ -2,6 +2,7 @@ import { execFile } from "node:child_process";
 import { realpath, stat } from "node:fs/promises";
 import { promisify } from "node:util";
 import { AgentError } from "../errors.js";
+import { quoteDiagnosticPath } from "./access-provenance.js";
 const execute = promisify(execFile);
 // These variables describe a caller's repository, not the explicit execution directory.
 // Keep normal user/system Git configuration and leave the caller's environment untouched.
@@ -30,7 +31,7 @@ export async function resolveProject(cwd) {
             throw new Error();
     }
     catch {
-        throw new AgentError("INVALID_CONFIG", `Execution directory is not accessible: ${cwd}`);
+        throw new AgentError("INVALID_CONFIG", `Execution directory is not accessible: ${quoteDiagnosticPath(cwd)}`);
     }
     try {
         if ((await git(directory, ["rev-parse", "--is-bare-repository"])) === "true") {

package/dist/config/project.js.map

@@ -1 +1 @@
-{"version":3,"file":"project.js","sourceRoot":"","sources":["../../src/config/project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEpC,wFAAwF;AACxF,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,wBAAwB;IACtE,gBAAgB,EAAE,sBAAsB,EAAE,kCAAkC;IAC5E,gBAAgB,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAqB;IAC5E,YAAY,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,sBAAsB;IAC3F,yBAAyB,EAAE,iCAAiC,EAAE,uBAAuB;IACrF,YAAY,EAAE,uBAAuB,EAAE,kBAAkB;CAC1D,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc;IACnD,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IAC/F,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,0CAA0C,GAAG,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YAC7E,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,0DAA0D,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;QAClF,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,UAAU;YAAE,MAAM,KAAK,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,IAAI,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QAC9F,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,0DAA0D,CAAC,CAAC;IACrG,CAAC;AACH,CAAC","sourcesContent":["import { execFile } from \"node:child_process\";\nimport { realpath, stat } from \"node:fs/promises\";\nimport { promisify } from \"node:util\";\nimport { AgentError } from \"../errors.js\";\n\nconst execute = promisify(execFile);\n\n// These variables describe a caller's repository, not the explicit execution directory.\n// Keep normal user/system Git configuration and leave the caller's environment untouched.\nconst repositoryVariables = new Set([\n  \"GIT_DIR\", \"GIT_WORK_TREE\", \"GIT_COMMON_DIR\", \"GIT_IMPLICIT_WORK_TREE\",\n  \"GIT_INDEX_FILE\", \"GIT_OBJECT_DIRECTORY\", \"GIT_ALTERNATE_OBJECT_DIRECTORIES\",\n  \"GIT_GRAFT_FILE\", \"GIT_SHALLOW_FILE\", \"GIT_NAMESPACE\", \"GIT_QUARANTINE_PATH\",\n  \"GIT_PREFIX\", \"GIT_INTERNAL_SUPER_PREFIX\", \"GIT_NO_REPLACE_OBJECTS\", \"GIT_REPLACE_REF_BASE\",\n  \"GIT_CEILING_DIRECTORIES\", \"GIT_DISCOVERY_ACROSS_FILESYSTEM\", \"GIT_REFERENCE_BACKEND\",\n  \"GIT_CONFIG\", \"GIT_CONFIG_PARAMETERS\", \"GIT_CONFIG_COUNT\",\n]);\n\nexport async function git(cwd: string, args: string[]): Promise<string> {\n  const env = { ...process.env };\n  for (const key of Object.keys(env)) {\n    if (repositoryVariables.has(key) || /^GIT_CONFIG_(KEY|VALUE)_\\d+$/.test(key)) delete env[key];\n  }\n  const { stdout } = await execute(\"git\", [\"-C\", cwd, ...args], { env, maxBuffer: 1024 * 1024 });\n  return stdout.trim();\n}\n\nexport async function resolveProject(cwd: string): Promise<{ root: string; mainRoot: string }> {\n  let directory: string;\n  try {\n    directory = await realpath(cwd);\n    if (!(await stat(directory)).isDirectory()) throw new Error();\n  } catch {\n    throw new AgentError(\"INVALID_CONFIG\", `Execution directory is not accessible: ${cwd}`);\n  }\n  try {\n    if ((await git(directory, [\"rev-parse\", \"--is-bare-repository\"])) === \"true\") {\n      throw new AgentError(\"INVALID_CONFIG\", \"Bare repositories are unsupported execution directories.\");\n    }\n    const root = await git(directory, [\"rev-parse\", \"--show-toplevel\"]);\n    const worktrees = await git(directory, [\"worktree\", \"list\", \"--porcelain\", \"-z\"]);\n    const first = worktrees.split(\"\\0\").find((line) => line.startsWith(\"worktree \"));\n    if (!first) throw new Error();\n    const mainRoot = await realpath(first.slice(\"worktree \".length));\n    return { root: await realpath(root), mainRoot };\n  } catch (error) {\n    if (error instanceof AgentError) throw error;\n    const message = error instanceof Error ? error.message : \"\";\n    if (message.includes(\"not a git repository\")) return { root: directory, mainRoot: directory };\n    throw new AgentError(\"INVALID_CONFIG\", \"The Git project or its main checkout cannot be accessed.\");\n  }\n}\n"]}
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../../src/config/project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEpC,wFAAwF;AACxF,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,wBAAwB;IACtE,gBAAgB,EAAE,sBAAsB,EAAE,kCAAkC;IAC5E,gBAAgB,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAqB;IAC5E,YAAY,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,sBAAsB;IAC3F,yBAAyB,EAAE,iCAAiC,EAAE,uBAAuB;IACrF,YAAY,EAAE,uBAAuB,EAAE,kBAAkB;CAC1D,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc;IACnD,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IAC/F,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,0CAA0C,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YAC7E,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,0DAA0D,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;QAClF,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,UAAU;YAAE,MAAM,KAAK,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,IAAI,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QAC9F,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,0DAA0D,CAAC,CAAC;IACrG,CAAC;AACH,CAAC","sourcesContent":["import { execFile } from \"node:child_process\";\nimport { realpath, stat } from \"node:fs/promises\";\nimport { promisify } from \"node:util\";\nimport { AgentError } from \"../errors.js\";\nimport { quoteDiagnosticPath } from \"./access-provenance.js\";\n\nconst execute = promisify(execFile);\n\n// These variables describe a caller's repository, not the explicit execution directory.\n// Keep normal user/system Git configuration and leave the caller's environment untouched.\nconst repositoryVariables = new Set([\n  \"GIT_DIR\", \"GIT_WORK_TREE\", \"GIT_COMMON_DIR\", \"GIT_IMPLICIT_WORK_TREE\",\n  \"GIT_INDEX_FILE\", \"GIT_OBJECT_DIRECTORY\", \"GIT_ALTERNATE_OBJECT_DIRECTORIES\",\n  \"GIT_GRAFT_FILE\", \"GIT_SHALLOW_FILE\", \"GIT_NAMESPACE\", \"GIT_QUARANTINE_PATH\",\n  \"GIT_PREFIX\", \"GIT_INTERNAL_SUPER_PREFIX\", \"GIT_NO_REPLACE_OBJECTS\", \"GIT_REPLACE_REF_BASE\",\n  \"GIT_CEILING_DIRECTORIES\", \"GIT_DISCOVERY_ACROSS_FILESYSTEM\", \"GIT_REFERENCE_BACKEND\",\n  \"GIT_CONFIG\", \"GIT_CONFIG_PARAMETERS\", \"GIT_CONFIG_COUNT\",\n]);\n\nexport async function git(cwd: string, args: string[]): Promise<string> {\n  const env = { ...process.env };\n  for (const key of Object.keys(env)) {\n    if (repositoryVariables.has(key) || /^GIT_CONFIG_(KEY|VALUE)_\\d+$/.test(key)) delete env[key];\n  }\n  const { stdout } = await execute(\"git\", [\"-C\", cwd, ...args], { env, maxBuffer: 1024 * 1024 });\n  return stdout.trim();\n}\n\nexport async function resolveProject(cwd: string): Promise<{ root: string; mainRoot: string }> {\n  let directory: string;\n  try {\n    directory = await realpath(cwd);\n    if (!(await stat(directory)).isDirectory()) throw new Error();\n  } catch {\n    throw new AgentError(\"INVALID_CONFIG\", `Execution directory is not accessible: ${quoteDiagnosticPath(cwd)}`);\n  }\n  try {\n    if ((await git(directory, [\"rev-parse\", \"--is-bare-repository\"])) === \"true\") {\n      throw new AgentError(\"INVALID_CONFIG\", \"Bare repositories are unsupported execution directories.\");\n    }\n    const root = await git(directory, [\"rev-parse\", \"--show-toplevel\"]);\n    const worktrees = await git(directory, [\"worktree\", \"list\", \"--porcelain\", \"-z\"]);\n    const first = worktrees.split(\"\\0\").find((line) => line.startsWith(\"worktree \"));\n    if (!first) throw new Error();\n    const mainRoot = await realpath(first.slice(\"worktree \".length));\n    return { root: await realpath(root), mainRoot };\n  } catch (error) {\n    if (error instanceof AgentError) throw error;\n    const message = error instanceof Error ? error.message : \"\";\n    if (message.includes(\"not a git repository\")) return { root: directory, mainRoot: directory };\n    throw new AgentError(\"INVALID_CONFIG\", \"The Git project or its main checkout cannot be accessed.\");\n  }\n}\n"]}

package/dist/config/resolve-access.js

@@ -3,21 +3,17 @@ import { resolve } from "node:path";
 import { parseEnv } from "node:util";
 import { AgentError } from "../errors.js";
 import { configError, parseConnection } from "./access.js";
+import { quoteDiagnosticPath } from "./access-provenance.js";
 import { resolveProject } from "./project.js";
 import { validateOidc } from "./oidc.js";
 export async function resolveAccess(connection, harness, cwd, env = process.env) {
-    parseConnection(connection);
     const kind = typeof harness === "string" ? harness : harness.kind;
+    parseConnection(connection, kind);
     if (connection.type === "subscription") {
-        if (kind === "fx")
-            throw new AgentError("ACCESS_UNAVAILABLE", "fx does not support subscription access.");
-        return { type: "subscription" };
-    }
-    if (kind === "fx" && connection.type === "api-key") {
-        throw new AgentError("UNSUPPORTED_OPTION", "fx does not support direct provider API keys.");
+        return { ...connection };
     }
     const variable = connection.env ?? (connection.type === "api-key"
-        ? kind === "codex" ? "OPENAI_API_KEY" : "ANTHROPIC_API_KEY"
+        ? defaultApiKeyVariable(kind, connection.provider)
         : connection.type === "vercel-api-key" ? "AI_GATEWAY_API_KEY" : "VERCEL_OIDC_TOKEN");
     const { mainRoot } = await resolveProject(cwd);
     let token;
@@ -27,7 +23,7 @@ export async function resolveAccess(connection, harness, cwd, env = process.env)
         }
         catch (error) {
             if (error.code === "ENOENT")
-                throw new AgentError("ACCESS_UNAVAILABLE", `Credential file is missing: ${connection.envFile}`);
+                throw new AgentError("ACCESS_UNAVAILABLE", `Credential file is missing: ${quoteDiagnosticPath(connection.envFile)}`);
             configError(`Cannot read credential variable ${variable} from its configured file.`);
         }
     }
@@ -37,6 +33,24 @@ export async function resolveAccess(connection, harness, cwd, env = process.env)
         throw new AgentError("ACCESS_UNAVAILABLE", `Credential variable ${variable} is missing or empty.`);
     if (connection.type === "vercel-oidc")
         await validateOidc(token, mainRoot, connection.project, env);
-    return { type: connection.type, token };
+    const access = { type: connection.type, token };
+    if (connection.type === "api-key") {
+        for (const field of ["provider", "baseUrl", "wireApi", "apiVersion", "wireModel"]) {
+            if (connection[field] !== undefined)
+                Object.assign(access, { [field]: connection[field] });
+        }
+    }
+    return access;
+}
+function defaultApiKeyVariable(kind, provider) {
+    if (kind === "copilot")
+        return ({ github: "COPILOT_GITHUB_TOKEN", openai: "OPENAI_API_KEY", anthropic: "ANTHROPIC_API_KEY", azure: "AZURE_OPENAI_API_KEY" })[provider];
+    if (kind === "codex")
+        return "OPENAI_API_KEY";
+    if (kind === "cursor")
+        return "CURSOR_API_KEY";
+    if (kind === "claudeCode")
+        return "ANTHROPIC_API_KEY";
+    return configError(`${kind} direct API keys require env.`);
 }
 //# sourceMappingURL=resolve-access.js.map

package/dist/config/resolve-access.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-access.js","sourceRoot":"","sources":["../../src/config/resolve-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAyB,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAA4B,EAC5B,OAAoC,EACpC,GAAW,EACX,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,eAAe,CAAC,UAAU,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAClE,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACvC,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,0CAA0C,CAAC,CAAC;QAC1G,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAClC,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,+CAA+C,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS;QAC/D,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,mBAAmB;QAC3D,CAAC,CAAC,UAAU,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;IACvF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,KAAyB,CAAC;IAC9B,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC;YAAC,KAAK,GAAG,QAAQ,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAClG,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,+BAA+B,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;YACxJ,WAAW,CAAC,mCAAmC,QAAQ,4BAA4B,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;;QAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,uBAAuB,QAAQ,uBAAuB,CAAC,CAAC;IACvH,IAAI,UAAU,CAAC,IAAI,KAAK,aAAa;QAAE,MAAM,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACpG,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AAC1C,CAAC","sourcesContent":["import { readFile } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { parseEnv } from \"node:util\";\nimport type { ResolvedAccess } from \"../adapters/types.js\";\nimport { AgentError } from \"../errors.js\";\nimport type { HarnessConfig, HarnessKind } from \"../sdk/types.js\";\nimport { type AccessConnection, configError, parseConnection } from \"./access.js\";\nimport { resolveProject } from \"./project.js\";\nimport { validateOidc } from \"./oidc.js\";\n\nexport async function resolveAccess(\n  connection: AccessConnection,\n  harness: HarnessKind | HarnessConfig,\n  cwd: string,\n  env: NodeJS.ProcessEnv = process.env,\n): Promise<ResolvedAccess> {\n  parseConnection(connection);\n  const kind = typeof harness === \"string\" ? harness : harness.kind;\n  if (connection.type === \"subscription\") {\n    if (kind === \"fx\") throw new AgentError(\"ACCESS_UNAVAILABLE\", \"fx does not support subscription access.\");\n    return { type: \"subscription\" };\n  }\n  if (kind === \"fx\" && connection.type === \"api-key\") {\n    throw new AgentError(\"UNSUPPORTED_OPTION\", \"fx does not support direct provider API keys.\");\n  }\n  const variable = connection.env ?? (connection.type === \"api-key\"\n    ? kind === \"codex\" ? \"OPENAI_API_KEY\" : \"ANTHROPIC_API_KEY\"\n    : connection.type === \"vercel-api-key\" ? \"AI_GATEWAY_API_KEY\" : \"VERCEL_OIDC_TOKEN\");\n  const { mainRoot } = await resolveProject(cwd);\n  let token: string | undefined;\n  if (connection.envFile !== undefined) {\n    try { token = parseEnv(await readFile(resolve(mainRoot, connection.envFile), \"utf8\"))[variable]; }\n    catch (error) {\n      if ((error as NodeJS.ErrnoException).code === \"ENOENT\") throw new AgentError(\"ACCESS_UNAVAILABLE\", `Credential file is missing: ${connection.envFile}`);\n      configError(`Cannot read credential variable ${variable} from its configured file.`);\n    }\n  } else token = env[variable];\n  if (!token?.trim()) throw new AgentError(\"ACCESS_UNAVAILABLE\", `Credential variable ${variable} is missing or empty.`);\n  if (connection.type === \"vercel-oidc\") await validateOidc(token, mainRoot, connection.project, env);\n  return { type: connection.type, token };\n}\n"]}
+{"version":3,"file":"resolve-access.js","sourceRoot":"","sources":["../../src/config/resolve-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAyB,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAA4B,EAC5B,OAAoC,EACpC,GAAW,EACX,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAClE,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAClC,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACvC,OAAO,EAAE,GAAG,UAAU,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS;QAC/D,CAAC,CAAC,qBAAqB,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC;QAClD,CAAC,CAAC,UAAU,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;IACvF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,KAAyB,CAAC;IAC9B,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC;YAAC,KAAK,GAAG,QAAQ,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAClG,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,+BAA+B,mBAAmB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC7K,WAAW,CAAC,mCAAmC,QAAQ,4BAA4B,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;;QAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,uBAAuB,QAAQ,uBAAuB,CAAC,CAAC;IACvH,IAAI,UAAU,CAAC,IAAI,KAAK,aAAa;QAAE,MAAM,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACpG,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IAChE,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,CAAU,EAAE,CAAC;YAC3F,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,SAAS;gBAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAiB,EAAE,QAAiB;IACjE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,mBAAmB,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC,QAAuD,CAAC,CAAC;IACtN,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,gBAAgB,CAAC;IAC9C,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC;IAC/C,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,mBAAmB,CAAC;IACtD,OAAO,WAAW,CAAC,GAAG,IAAI,+BAA+B,CAAC,CAAC;AAC7D,CAAC","sourcesContent":["import { readFile } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { parseEnv } from \"node:util\";\nimport type { ResolvedAccess } from \"../adapters/types.js\";\nimport { AgentError } from \"../errors.js\";\nimport type { HarnessConfig, HarnessKind } from \"../sdk/types.js\";\nimport { type AccessConnection, configError, parseConnection } from \"./access.js\";\nimport { quoteDiagnosticPath } from \"./access-provenance.js\";\nimport { resolveProject } from \"./project.js\";\nimport { validateOidc } from \"./oidc.js\";\n\nexport async function resolveAccess(\n  connection: AccessConnection,\n  harness: HarnessKind | HarnessConfig,\n  cwd: string,\n  env: NodeJS.ProcessEnv = process.env,\n): Promise<ResolvedAccess> {\n  const kind = typeof harness === \"string\" ? harness : harness.kind;\n  parseConnection(connection, kind);\n  if (connection.type === \"subscription\") {\n    return { ...connection };\n  }\n  const variable = connection.env ?? (connection.type === \"api-key\"\n    ? defaultApiKeyVariable(kind, connection.provider)\n    : connection.type === \"vercel-api-key\" ? \"AI_GATEWAY_API_KEY\" : \"VERCEL_OIDC_TOKEN\");\n  const { mainRoot } = await resolveProject(cwd);\n  let token: string | undefined;\n  if (connection.envFile !== undefined) {\n    try { token = parseEnv(await readFile(resolve(mainRoot, connection.envFile), \"utf8\"))[variable]; }\n    catch (error) {\n      if ((error as NodeJS.ErrnoException).code === \"ENOENT\") throw new AgentError(\"ACCESS_UNAVAILABLE\", `Credential file is missing: ${quoteDiagnosticPath(connection.envFile)}`);\n      configError(`Cannot read credential variable ${variable} from its configured file.`);\n    }\n  } else token = env[variable];\n  if (!token?.trim()) throw new AgentError(\"ACCESS_UNAVAILABLE\", `Credential variable ${variable} is missing or empty.`);\n  if (connection.type === \"vercel-oidc\") await validateOidc(token, mainRoot, connection.project, env);\n  const access: ResolvedAccess = { type: connection.type, token };\n  if (connection.type === \"api-key\") {\n    for (const field of [\"provider\", \"baseUrl\", \"wireApi\", \"apiVersion\", \"wireModel\"] as const) {\n      if (connection[field] !== undefined) Object.assign(access, { [field]: connection[field] });\n    }\n  }\n  return access;\n}\n\nfunction defaultApiKeyVariable(kind: HarnessKind, provider?: string): string {\n  if (kind === \"copilot\") return ({ github: \"COPILOT_GITHUB_TOKEN\", openai: \"OPENAI_API_KEY\", anthropic: \"ANTHROPIC_API_KEY\", azure: \"AZURE_OPENAI_API_KEY\" })[provider as \"github\" | \"openai\" | \"anthropic\" | \"azure\"];\n  if (kind === \"codex\") return \"OPENAI_API_KEY\";\n  if (kind === \"cursor\") return \"CURSOR_API_KEY\";\n  if (kind === \"claudeCode\") return \"ANTHROPIC_API_KEY\";\n  return configError(`${kind} direct API keys require env.`);\n}\n"]}

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { agent, codex, claudeCode, fx } from "./sdk/definitions.js";
+export { agent, codex, claudeCode, fx, opencode, copilot, cursor } from "./sdk/definitions.js";
 export { tool, toolResult } from "./sdk/tools.js";
 export type { ToolContent, ToolResult } from "./sdk/tools.js";
-export type { AgentDefinition, ClaudeCodeConfig, ClaudeCodeOptions, CodexConfig, CodexOptions, FxConfig, FxOptions, HarnessConfig, HarnessKind, ToolDefinition, } from "./sdk/types.js";
+export type { AgentDefinition, ClaudeCodeConfig, ClaudeCodeOptions, CodexConfig, CodexOptions, FxConfig, FxOptions, OpencodeConfig, OpencodeOptions, CopilotConfig, CopilotOptions, CursorConfig, CursorOptions, HarnessConfig, HarnessKind, ToolDefinition, } from "./sdk/types.js";

package/dist/index.js

@@ -1,3 +1,3 @@
-export { agent, codex, claudeCode, fx } from "./sdk/definitions.js";
+export { agent, codex, claudeCode, fx, opencode, copilot, cursor } from "./sdk/definitions.js";
 export { tool, toolResult } from "./sdk/tools.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC","sourcesContent":["export { agent, codex, claudeCode, fx } from \"./sdk/definitions.js\";\nexport { tool, toolResult } from \"./sdk/tools.js\";\nexport type { ToolContent, ToolResult } from \"./sdk/tools.js\";\nexport type {\n  AgentDefinition,\n  ClaudeCodeConfig,\n  ClaudeCodeOptions,\n  CodexConfig,\n  CodexOptions,\n  FxConfig,\n  FxOptions,\n  HarnessConfig,\n  HarnessKind,\n  ToolDefinition,\n} from \"./sdk/types.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC/F,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC","sourcesContent":["export { agent, codex, claudeCode, fx, opencode, copilot, cursor } from \"./sdk/definitions.js\";\nexport { tool, toolResult } from \"./sdk/tools.js\";\nexport type { ToolContent, ToolResult } from \"./sdk/tools.js\";\nexport type {\n  AgentDefinition,\n  ClaudeCodeConfig,\n  ClaudeCodeOptions,\n  CodexConfig,\n  CodexOptions,\n  FxConfig,\n  FxOptions,\n  OpencodeConfig,\n  OpencodeOptions,\n  CopilotConfig,\n  CopilotOptions,\n  CursorConfig,\n  CursorOptions,\n  HarnessConfig,\n  HarnessKind,\n  ToolDefinition,\n} from \"./sdk/types.js\";\n"]}

package/dist/process-diagnostics.d.ts

@@ -0,0 +1,2 @@
+/** Formats only bounded, observed child-process termination metadata. */
+export declare function processExitDescription(code: unknown, signal: unknown): string;

package/dist/process-diagnostics.js

@@ -0,0 +1,11 @@
+import { constants } from "node:os";
+/** Formats only bounded, observed child-process termination metadata. */
+export function processExitDescription(code, signal) {
+    if (typeof signal === "string" && Object.hasOwn(constants.signals, signal)) {
+        return ` (signal ${signal})`;
+    }
+    return typeof code === "number" && Number.isSafeInteger(code)
+        ? ` (exit code ${code})`
+        : "";
+}
+//# sourceMappingURL=process-diagnostics.js.map

package/dist/process-diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-diagnostics.js","sourceRoot":"","sources":["../src/process-diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEpC,yEAAyE;AACzE,MAAM,UAAU,sBAAsB,CAAC,IAAa,EAAE,MAAe;IACnE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,YAAY,MAAM,GAAG,CAAC;IAC/B,CAAC;IACD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC;QAC3D,CAAC,CAAC,eAAe,IAAI,GAAG;QACxB,CAAC,CAAC,EAAE,CAAC;AACT,CAAC","sourcesContent":["import { constants } from \"node:os\";\n\n/** Formats only bounded, observed child-process termination metadata. */\nexport function processExitDescription(code: unknown, signal: unknown): string {\n  if (typeof signal === \"string\" && Object.hasOwn(constants.signals, signal)) {\n    return ` (signal ${signal})`;\n  }\n  return typeof code === \"number\" && Number.isSafeInteger(code)\n    ? ` (exit code ${code})`\n    : \"\";\n}\n"]}

package/dist/runtime/access-errors.d.ts

@@ -0,0 +1,4 @@
+import type { NativeSession } from "../adapters/types.js";
+import { AgentError } from "../errors.js";
+export declare function withAccessContext(error: AgentError, context: string): AgentError;
+export declare function withSessionAccessContext(native: NativeSession, context: string): NativeSession;

package/dist/runtime/access-errors.js

@@ -0,0 +1,25 @@
+import { AgentError } from "../errors.js";
+export function withAccessContext(error, context) {
+    return new AgentError(error.code, `${error.message}\n${context}`);
+}
+async function sessionCall(operation, context) {
+    try {
+        return await operation();
+    }
+    catch (error) {
+        if (error instanceof AgentError && error.code === "INVALID_CONFIG") {
+            throw withAccessContext(error, context);
+        }
+        throw error;
+    }
+}
+export function withSessionAccessContext(native, context) {
+    return {
+        turn: prompt => sessionCall(() => native.turn(prompt), context),
+        steer: prompt => sessionCall(() => native.steer(prompt), context),
+        interrupt: () => sessionCall(() => native.interrupt(), context),
+        resume: () => sessionCall(() => native.resume(), context),
+        close: () => sessionCall(() => native.close(), context),
+    };
+}
+//# sourceMappingURL=access-errors.js.map