superpowers-manager 0.5.2 → 0.6.0

package/dist/harnesses/codex/publication.js

@@ -3,9 +3,8 @@ import { failureResult, successResult, } from "../../adapter-result.js";
 import { beginDirectoryPublication, } from "../../atomic.js";
 import { digestArtifactTree } from "../../artifact-tree.js";
 import { assertNoFollowType, classifyPathNoFollow } from "../../safe-path.js";
-import { codexInspect, codexInstallRefreshMode, codexRemove, codexReadNativeState, } from "./adapter.js";
+import { codexInspectControl, codexInspectOwnership, codexInstallRefreshMode, codexRemove, codexReadNativeState, } from "./adapter.js";
 import { readCodexAssessment } from "./compatibility.js";
-import { requireManagedUpdateControl, requireNoLegacyState, } from "./lifecycle.js";
 import { readCodexMarketplace, stageCodexMarketplace, } from "./marketplace.js";
 import { assertCodexPreparationSeparate, codexPathFailureDetails, codexPaths, } from "./paths.js";
 import { codexPreparationLocation } from "./prepare.js";
@@ -13,7 +12,8 @@ import { beginCodexRecovery, finishCodexRecovery, readCodexRecovery, verifyCodex
 import { hasFilesystemAccessFailure, pathsEqual } from "./state.js";
 const DEFAULTS = {
     readNative: codexReadNativeState,
-    inspectNative: codexInspect,
+    inspectOwnership: codexInspectOwnership,
+    inspectControl: codexInspectControl,
     beginPublication: beginDirectoryPublication,
 };
 const REMOVAL_DEFAULTS = {
@@ -26,16 +26,6 @@ function fail(code, message, messages) {
 function removalFailure(code, message, messages) {
     return failureResult("uninstall-codex", code, message, [], messages);
 }
-function objectResult(result) {
-    if (result.status !== 0 ||
-        !result.outcome.ok ||
-        result.outcome.result === null ||
-        typeof result.outcome.result !== "object" ||
-        Array.isArray(result.outcome.result)) {
-        throw new Error("Codex inspection failed");
-    }
-    return result.outcome.result;
-}
 function acceptedNative(result) {
     if (result.status !== 0 || !result.outcome.ok) {
         throw new Error("Codex native observation failed");
@@ -54,26 +44,18 @@ function acceptedNative(result) {
     return value;
 }
 function requireOwnership(result) {
-    const value = objectResult(result);
-    if (typeof value.identity_state !== "string" ||
-        requireNoLegacyState(value.identity_state).kind !== "ok" ||
-        !Array.isArray(value.conflicts) ||
-        value.conflicts.length !== 0) {
-        throw new Error("Codex ownership blocks publication");
+    if (result.status !== 0 || !result.outcome.ok) {
+        throw new Error("Codex inspection failed");
     }
-    const resources = value.resources;
-    if (typeof resources !== "object" ||
-        resources === null ||
-        Array.isArray(resources) ||
-        typeof resources.plugin !== "boolean" ||
-        typeof resources.marketplace !== "boolean") {
-        throw new Error("Codex ownership inspection is malformed");
+    if (result.outcome.result?.installEligibility?.kind !== "allowed") {
+        throw new Error("Codex ownership blocks publication");
     }
 }
 function requireControl(result) {
-    const value = objectResult(result);
-    if (typeof value.update_control !== "string" ||
-        !requireManagedUpdateControl(value.update_control).ok) {
+    if (result.status !== 0 || !result.outcome.ok) {
+        throw new Error("Codex inspection failed");
+    }
+    if (result.outcome.result?.mutationEligibility?.kind !== "allowed") {
         throw new Error("Codex update control blocks publication");
     }
 }
@@ -262,10 +244,10 @@ async function observeNative(ctx, dependencies, messages) {
     return acceptedNative(result);
 }
 async function requireEligibility(ctx, dependencies, messages) {
-    const ownership = await dependencies.inspectNative("ownership", ctx);
+    const ownership = await dependencies.inspectOwnership(ctx);
     messages.push(...ownership.outcome.messages);
     requireOwnership(ownership);
-    const control = await dependencies.inspectNative("update-control", ctx);
+    const control = await dependencies.inspectControl(ctx);
     messages.push(...control.outcome.messages);
     requireControl(control);
 }

package/dist/python-json-format.js

@@ -1,72 +1,3 @@
-import { SafetyError } from "./safety-error.js";
-/**
- * Render a JSON number token the way CPython's `json.dump` does.
- *
- * Classification is by source text, matching CPython's own: a token containing
- * `.` or `e`/`E` parses as a float, anything else as an arbitrary-width int.
- * Integers are emitted verbatim so widths above 2^53 survive; `-0` is the only
- * normalization JSON's grammar leaves room for, since leading zeros and a
- * leading `+` are already forbidden.
- */
-export function formatPythonNumber(raw) {
-    if (!/[.eE]/.test(raw)) {
-        // NaN/Infinity/-Infinity contain no `.` or `e`/`E`, so they would
-        // otherwise fall into the "emit verbatim" integer branch and echo back
-        // as invalid JSON. A reader running a non-standard-constants accept
-        // profile (see src/strict-json.ts) can hand this function exactly these
-        // three tokens as a raw number source, so this function must reject them
-        // itself rather than assume its caller already did. CPython's
-        // `json.dump(..., allow_nan=False)` raises ValueError for all three.
-        if (raw === "NaN" || raw === "Infinity" || raw === "-Infinity") {
-            throw new SafetyError("manifest-overlay", `JSON number out of range: ${raw}`);
-        }
-        return raw === "-0" ? "0" : raw;
-    }
-    const value = Number(raw);
-    if (!Number.isFinite(value)) {
-        throw new SafetyError("manifest-overlay", `JSON number out of range: ${raw}`);
-    }
-    return formatPythonFloat(value);
-}
-function formatPythonFloat(value) {
-    // toExponential() drops the sign of negative zero; CPython's repr keeps it.
-    // Note this differs from the integer -0, which normalizes to 0 — consistent,
-    // because -0 has no `.` or `e` and so classifies as an integer.
-    if (Object.is(value, -0))
-        return "-0.0";
-    // Called with no argument, toExponential() yields the shortest digit string
-    // that uniquely identifies the double — the same guarantee CPython's repr
-    // relies on. Taking digits and exponent separately is what lets us apply
-    // CPython's notation threshold instead of JavaScript's.
-    const [mantissa, exponentText] = value.toExponential().split("e");
-    const exponent = Number(exponentText);
-    const negative = mantissa.startsWith("-");
-    const digits = mantissa.replace("-", "").replace(".", "");
-    let body;
-    if (exponent >= -4 && exponent < 16) {
-        // Fixed notation, built by MOVING the decimal point through the digit
-        // string above. Do NOT route this through value.toFixed(): toExponential()
-        // has already produced the shortest digits that identify this double, and
-        // toFixed performs a second, independent rounding of the full decimal
-        // expansion. The two disagree — 1888570120608320.2 formats as
-        // ...320.3 via toFixed and ...320.2 in CPython. Measured 2026-07-31.
-        if (exponent >= digits.length - 1) {
-            body = `${digits}${"0".repeat(exponent - (digits.length - 1))}.0`;
-        }
-        else if (exponent >= 0) {
-            body = `${digits.slice(0, exponent + 1)}.${digits.slice(exponent + 1)}`;
-        }
-        else {
-            body = `0.${"0".repeat(-exponent - 1)}${digits}`;
-        }
-    }
-    else {
-        const sign = exponent < 0 ? "-" : "+";
-        const magnitude = String(Math.abs(exponent)).padStart(2, "0");
-        body = `${mantissa.replace("-", "")}e${sign}${magnitude}`;
-    }
-    return negative ? `-${body}` : body;
-}
 /**
  * Apply CPython's `ensure_ascii=True` to an already-JSON-encoded string. Input
  * must be the output of JSON.stringify, which has already escaped quotes,

package/dist/python-json.js

@@ -1,29 +1,4 @@
+import { escapeNonAscii } from "./python-json-format.js";
 export function escapePythonJsonString(value) {
-    let escaped = "";
-    const shortEscapes = {
-        0x08: "\\b",
-        0x09: "\\t",
-        0x0a: "\\n",
-        0x0c: "\\f",
-        0x0d: "\\r",
-    };
-    for (let index = 0; index < value.length; index += 1) {
-        const code = value.charCodeAt(index);
-        if (code === 0x22) {
-            escaped += '\\"';
-        }
-        else if (code === 0x5c) {
-            escaped += "\\\\";
-        }
-        else if (Object.hasOwn(shortEscapes, code)) {
-            escaped += shortEscapes[code];
-        }
-        else if (code < 0x20 || code >= 0x7f) {
-            escaped += `\\u${code.toString(16).padStart(4, "0")}`;
-        }
-        else {
-            escaped += value[index];
-        }
-    }
-    return escaped;
+    return escapeNonAscii(JSON.stringify(value).slice(1, -1));
 }

package/dist/python-text.js

@@ -1,75 +1,15 @@
-// CPython `str.strip()` whitespace, from Unicode's Bidi/White_Space tables as
-// CPython applies them. Deliberately excludes U+FEFF, which JavaScript's
-// `trim()` removes and Python's `strip()` does not.
-const PYTHON_WHITESPACE = new Set([
-    "\t",
-    "\n",
-    "\v",
-    "\f",
-    "\r",
-    " ",
-    "\x1c",
-    "\x1d",
-    "\x1e",
-    "\x1f",
-    "\x85",
-    " ",
-    " ",
-    " ",
-    " ",
-    " ",
-    " ",
-    " ",
-    " ",
-    " ",
-    " ",
-    " ",
-    " ",
-    " ",
-    "
",
-    "
",
-    " ",
-    " ",
-    "　",
-]);
-// CPython `str.splitlines()` boundaries. `\r\n` is handled as a pair below.
-const PYTHON_LINE_BOUNDARIES = new Set([
-    "\n",
-    "\r",
-    "\v",
-    "\f",
-    "\x1c",
-    "\x1d",
-    "\x1e",
-    "\x85",
-    "
",
-    "
",
-]);
+// Match first through last non-whitespace; avoid suffix retries on internal runs.
 export function pythonStrip(value) {
-    let start = 0;
-    let end = value.length;
-    while (start < end && PYTHON_WHITESPACE.has(value[start]))
-        start += 1;
-    while (end > start && PYTHON_WHITESPACE.has(value[end - 1]))
-        end -= 1;
-    return value.slice(start, end);
+    return (value.match(
+    // oxlint-disable-next-line no-control-regex -- exact CPython whitespace includes C0 separators.
+    /[^\u0009-\u000d\u001c-\u0020\u0085\u00a0\u1680\u2000-\u200a\u2028-\u2029\u202f\u205f\u3000](?:[\s\S]*[^\u0009-\u000d\u001c-\u0020\u0085\u00a0\u1680\u2000-\u200a\u2028-\u2029\u202f\u205f\u3000])?/)?.[0] ?? "");
 }
+// CRLF is one boundary; a terminating boundary adds no final empty line.
 export function pythonSplitlines(value) {
-    const lines = [];
-    let start = 0;
-    let index = 0;
-    while (index < value.length) {
-        const character = value[index];
-        if (!PYTHON_LINE_BOUNDARIES.has(character)) {
-            index += 1;
-            continue;
-        }
-        lines.push(value.slice(start, index));
-        index += character === "\r" && value[index + 1] === "\n" ? 2 : 1;
-        start = index;
-    }
-    if (start < value.length)
-        lines.push(value.slice(start));
+    // oxlint-disable-next-line no-control-regex -- CPython boundaries include C0 controls.
+    const lines = value.split(/\r\n|[\n\r\v\f\u001c-\u001e\u0085\u2028\u2029]/);
+    if (lines.at(-1) === "")
+        lines.pop();
     return lines;
 }
 /** Python `sorted()` orders by code point; JavaScript's default sort does not. */

package/dist/validator.js

@@ -2,21 +2,16 @@ import { spawn } from "node:child_process";
 import { lstat, realpath, stat } from "node:fs/promises";
 import { sep } from "node:path";
 import { hasTerminalControl, pythonUnicodeEscapeBytes, } from "./adapter-result.js";
-// The legacy SUPERPOWERS_VALIDATOR path. Its behaviour is frozen by parity, so it
-// carries no limits at all; see the spec's D2. Bounding it is PR 12's row.
-export const UNBOUNDED_LEGACY = { kind: "unbounded" };
 // SUPERPOWERS_VALIDATOR_EXECUTABLE. 30s is ~270x a measured realistic validator run
 // (0.11s, dominated by interpreter startup); 64 KiB per stream clears a
 // one-diagnostic-line-per-file report (30 KB on a real tree) with headroom.
 export const BOUNDED_EXECUTABLE = {
-    kind: "bounded",
     timeoutMs: 30_000,
     graceMs: 2_000,
     drainMs: 200,
     maxBytesPerStream: 64 * 1024,
 };
-// Retains the first `limit` bytes and counts the rest. A null limit retains
-// everything, which is the unbounded policy's contract. push() always consumes the
+// Retains the first `limit` bytes and counts the rest. push() always consumes the
 // whole chunk: ceasing to consume would block the child on a full pipe.
 class Sink {
     chunks = [];
@@ -27,10 +22,6 @@ class Sink {
         this.limit = limit;
     }
     push(chunk) {
-        if (this.limit === null) {
-            this.chunks.push(chunk);
-            return;
-        }
         const room = this.limit - this.kept;
         if (room <= 0) {
             this.dropped += chunk.length;
@@ -42,21 +33,15 @@ class Sink {
         this.dropped += chunk.length - take.length;
     }
     done() {
-        // Buffer.toString, NOT TextDecoder: TextDecoder strips a leading BOM and the
-        // legacy path's current string accumulator preserves it. Measured:
-        // decode(<BOM>hi) is "hi" but toString("utf8") is "\ufeffhi". The legacy path
-        // must be byte-identical, so BOTH paths use toString.
+        // Buffer.toString preserves a leading BOM; TextDecoder would strip it.
         return {
             text: Buffer.concat(this.chunks).toString("utf8"),
             droppedBytes: this.dropped,
         };
     }
 }
-// Signal the child's whole process group. Only meaningful for a child spawned
-// under the BOUNDED policy: that spawn passes `detached: true`, so the child
-// leads a group of its own and -pid reaches its descendants. The LEGACY path
-// spawns without `detached`, so its child does not lead a group and this
-// function is not for it. Wrapped because the group is already gone in the
+// Signal the child's whole process group. The child leads a group of its own,
+// so -pid reaches descendants. Wrapped because the group is already gone in
 // ordinary race between SIGTERM and SIGKILL.
 function signalGroup(child, signal) {
     if (child.pid === undefined)
@@ -71,9 +56,8 @@ function signalGroup(child, signal) {
 export function runValidator(argv, policy, env, workspace, cwd) {
     return new Promise((resolveRun) => {
         const [command, ...args] = argv;
-        const limit = policy.kind === "bounded" ? policy.maxBytesPerStream : null;
-        const out = new Sink(limit);
-        const err = new Sink(limit);
+        const out = new Sink(policy.maxBytesPerStream);
+        const err = new Sink(policy.maxBytesPerStream);
         let settled = false;
         // Settlement and termination are independent BY CONSTRUCTION, which is why
         // there is no grace-timer handle to clear here: the timedOut settle is nested
@@ -113,20 +97,15 @@ export function runValidator(argv, policy, env, workspace, cwd) {
                 env: { ...process.env, ...env, TMPDIR: workspace },
                 cwd,
                 stdio: ["ignore", "pipe", "pipe"],
-                // D4: under the BOUNDED policy only, the child leads its own process group
-                // so a timeout can signal the GROUP -- signalling the process alone leaves
-                // descendants holding the inherited pipes, and `close` then waits for them
-                // (measured at 5279 ms against a 300 ms timeout). The LEGACY path must not
-                // acquire group leadership: that changes process and session semantics for
-                // a path whose whole contract is that it is unchanged.
-                detached: policy.kind === "bounded",
+                // The child leads its own process group so a timeout can signal the GROUP --
+                // signalling the process alone leaves descendants holding inherited pipes.
+                detached: true,
             });
         }
         catch (cause) {
             settle({
                 kind: "launchFailed",
                 errno: cause.code ?? "UNKNOWN",
-                cause,
             });
             return;
         }
@@ -136,7 +115,7 @@ export function runValidator(argv, policy, env, workspace, cwd) {
         child.stderr.on("data", (chunk) => err.push(chunk));
         // Both error and close fire on a launch failure, so settle() is idempotent.
         child.on("error", (cause) => {
-            settle({ kind: "launchFailed", errno: cause.code ?? "UNKNOWN", cause });
+            settle({ kind: "launchFailed", errno: cause.code ?? "UNKNOWN" });
         });
         child.on("close", (code) => {
             // On the timeout path, settling here would resolve BEFORE SIGKILL and the
@@ -154,12 +133,6 @@ export function runValidator(argv, policy, env, workspace, cwd) {
             // may lag it indefinitely. Capture the code here or a successful validator
             // whose descendant lingers would settle with a null code and be rejected.
             lastCode = code;
-            // BOUNDED ONLY. The legacy path settles on `close`, exactly as it does today:
-            // a validator that backgrounds `(sleep 0.6; echo late) &` has "late" captured
-            // under `close` and lost under a 200 ms drain, and that output is captured
-            // today.
-            if (policy.kind !== "bounded")
-                return;
             // The TIMEOUT path owns its own settlement, after the escalation has run.
             if (timedOut)
                 return;
@@ -186,31 +159,29 @@ export function runValidator(argv, policy, env, workspace, cwd) {
                 });
             }, policy.drainMs);
         });
-        if (policy.kind === "bounded") {
-            timeoutTimer = setTimeout(() => {
-                timedOut = true;
-                // Signal the GROUP, not the process: descendants hold the pipes. SIGTERM
-                // first, because the contract promises stderr carries the reason, and
-                // reading continues through the grace window so the child can print it.
-                signalGroup(child, "SIGTERM");
+        timeoutTimer = setTimeout(() => {
+            timedOut = true;
+            // Signal the GROUP, not the process: descendants hold the pipes. SIGTERM
+            // first, because the contract promises stderr carries the reason, and
+            // reading continues through the grace window so the child can print it.
+            signalGroup(child, "SIGTERM");
+            setTimeout(() => {
+                signalGroup(child, "SIGKILL");
+                // Settle ONLY after SIGKILL has been sent. An earlier revision settled
+                // first and left the escalation on an unref'ed timer, which never fires
+                // because the CLI exits as soon as its handler returns -- measured, the
+                // manager exited at 146 ms and the descendant survived. The wall-clock
+                // bound is therefore timeout + grace + drain, which is still a bound.
                 setTimeout(() => {
-                    signalGroup(child, "SIGKILL");
-                    // Settle ONLY after SIGKILL has been sent. An earlier revision settled
-                    // first and left the escalation on an unref'ed timer, which never fires
-                    // because the CLI exits as soon as its handler returns -- measured, the
-                    // manager exited at 146 ms and the descendant survived. The wall-clock
-                    // bound is therefore timeout + grace + drain, which is still a bound.
-                    setTimeout(() => {
-                        settle({
-                            kind: "timedOut",
-                            afterMs: policy.timeoutMs,
-                            stdout: out.done(),
-                            stderr: err.done(),
-                        });
-                    }, policy.drainMs);
-                }, policy.graceMs);
-            }, policy.timeoutMs);
-        }
+                    settle({
+                        kind: "timedOut",
+                        afterMs: policy.timeoutMs,
+                        stdout: out.done(),
+                        stderr: err.done(),
+                    });
+                }, policy.drainMs);
+            }, policy.graceMs);
+        }, policy.timeoutMs);
     });
 }
 // Every probe below is best-effort BY DESIGN: spawn is the authority on whether the
@@ -297,22 +268,14 @@ const VALIDATOR_COMMANDS = new Set([
     "install",
     "update",
 ]);
-// Legacy emptiness semantics exactly: empty string means unset, whitespace-only
-// counts as set. No trimming — a trim would silently change legacy behaviour.
-export function bothConfigured(env) {
-    return ((env.SUPERPOWERS_VALIDATOR || "").length > 0 &&
-        (env.SUPERPOWERS_VALIDATOR_EXECUTABLE || "").length > 0);
-}
 // The second exported accessor preflight derives its enforcement from. It is an
 // accessor rather than an inline check because an accessor that under-reports what
 // preflight enforces is the blind spot slice 2 closed.
 export function configurationErrors(cmd, env) {
-    if (!VALIDATOR_COMMANDS.has(cmd))
-        return [];
-    if (!bothConfigured(env))
+    if (!VALIDATOR_COMMANDS.has(cmd) || !env.SUPERPOWERS_VALIDATOR)
         return [];
     return [
-        "SUPERPOWERS_VALIDATOR and SUPERPOWERS_VALIDATOR_EXECUTABLE are both set — " +
-            "unset one; the manager never chooses between them silently",
+        "SUPERPOWERS_VALIDATOR has been removed; unset it and configure " +
+            "SUPERPOWERS_VALIDATOR_EXECUTABLE with an executable validator.",
     ];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "superpowers-manager",
-  "version": "0.5.2",
+  "version": "0.6.0",
   "description": "Install obra/superpowers directly from upstream for Codex and Pi. Stay on a known-good release or commit, try a branch, and upgrade when you choose.",
   "keywords": [
     "superpowers",

package/dist/selection-state-cli.js

@@ -1,85 +0,0 @@
-import { realpathSync } from "node:fs";
-import { writeFile } from "node:fs/promises";
-import { displaySource, normalizePinnedArguments, normalizeSaved, validateSource, } from "./selection.js";
-import { readSelectionState, writeSelectionState } from "./selection-store.js";
-import { oneLine, parseFlags, UsageError } from "./cli-arguments.js";
-const COMMAND_FLAGS = {
-    read: ["path", "output"],
-    "write-pinned": ["path", "source", "requested-ref", "resolved-ref", "commit"],
-    "write-track-latest": ["path", "source"],
-    "validate-source": ["source"],
-    "display-source": ["source"],
-};
-function parseCommand(argv) {
-    const [name, ...rest] = argv;
-    if (name === undefined)
-        throw new UsageError("a subcommand is required");
-    if (!Object.hasOwn(COMMAND_FLAGS, name)) {
-        throw new UsageError(`unknown subcommand: ${name}`);
-    }
-    const command = name;
-    return { name: command, flags: parseFlags(rest, COMMAND_FLAGS[command]) };
-}
-async function dispatch({ name, flags }) {
-    if (name === "read") {
-        const normalized = normalizeSaved(await readSelectionState(flags.path));
-        try {
-            await writeFile(flags.output, `${JSON.stringify(normalized, null, 2)}\n`, "utf8");
-        }
-        catch (cause) {
-            const message = cause instanceof Error ? cause.message : String(cause);
-            throw new Error(`cannot write normalized selection output ${flags.output}: ${message}`, { cause });
-        }
-        return;
-    }
-    if (name === "write-pinned") {
-        await writeSelectionState(flags.path, normalizePinnedArguments({
-            source: flags.source,
-            requestedRef: flags["requested-ref"],
-            resolvedRef: flags["resolved-ref"],
-            commit: flags.commit,
-        }));
-        return;
-    }
-    if (name === "write-track-latest") {
-        await writeSelectionState(flags.path, {
-            schema_version: 1,
-            mode: "track-latest",
-            source: flags.source,
-        });
-        return;
-    }
-    if (name === "validate-source") {
-        validateSource(flags.source);
-        return;
-    }
-    if (name === "display-source") {
-        process.stdout.write(`${displaySource(flags.source)}\n`);
-        return;
-    }
-    const unreachable = name;
-    throw new Error(`unhandled subcommand: ${String(unreachable)}`);
-}
-export async function runSelectionStateCli(argv) {
-    let command;
-    try {
-        command = parseCommand(argv);
-    }
-    catch (cause) {
-        process.stderr.write(`usage: selection-state-cli <subcommand> [options]\n`);
-        process.stderr.write(`error: ${oneLine(cause)}\n`);
-        return 2;
-    }
-    try {
-        await dispatch(command);
-        return 0;
-    }
-    catch (cause) {
-        process.stderr.write(`error: ${oneLine(cause)}\n`);
-        return 1;
-    }
-}
-const entry = process.argv[1];
-if (entry !== undefined && import.meta.filename === realpathSync(entry)) {
-    process.exitCode = await runSelectionStateCli(process.argv.slice(2));
-}