vigiles 2.3.0 → 2.5.0

package/dist/harness-test.js

@@ -1,6 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveHarness = exports.loadPlugin = exports.scriptModel = void 0;
+exports.sandboxAvailable = exports.specTrusted = exports.decideSandbox = exports.resolveHarness = exports.loadPlugin = exports.scriptModel = void 0;
+exports.parseToolCalls = parseToolCalls;
+exports.parseResultEvent = parseResultEvent;
+exports.parseOutput = parseOutput;
+exports.parseHooks = parseHooks;
+exports.buildClaudeArgs = buildClaudeArgs;
 exports.claudeAvailable = claudeAvailable;
 exports.runHarnessTest = runHarnessTest;
 /**
@@ -27,10 +32,11 @@ exports.runHarnessTest = runHarnessTest;
  * The "steps" are the scripted model turns — their real home is deterministic
  * harness testing, not production enforcement.
  *
- * Note: the simple mock drives the Bash tool and Stop hooks reliably; the
- * Edit/Write tools are gated in headless mode and don't fire via the mock —
- * drive file actions through Bash, or use the real-model eval tier (`eval.ts`)
- * for Edit/Write hooks.
+ * Note: the mock drives Bash and Stop hooks, and — verified on claude 2.1.169 —
+ * the Edit/Write tools too (allowlisted past the permission prompt), so their
+ * PreToolUse/PostToolUse hooks fire in this tier. The events the mock can't
+ * trigger (PreCompact / Notification / SessionEnd / SubagentStop) belong to the
+ * `runHook` unit tier.
  */
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
@@ -38,11 +44,159 @@ const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const mock_model_js_1 = require("./mock-model.js");
 const plugin_loader_js_1 = require("./plugin-loader.js");
+const sandbox_js_1 = require("./sandbox.js");
 var mock_model_js_2 = require("./mock-model.js");
 Object.defineProperty(exports, "scriptModel", { enumerable: true, get: function () { return mock_model_js_2.scriptModel; } });
 var plugin_loader_js_2 = require("./plugin-loader.js");
 Object.defineProperty(exports, "loadPlugin", { enumerable: true, get: function () { return plugin_loader_js_2.loadPlugin; } });
 Object.defineProperty(exports, "resolveHarness", { enumerable: true, get: function () { return plugin_loader_js_2.resolveHarness; } });
+var sandbox_js_2 = require("./sandbox.js");
+Object.defineProperty(exports, "decideSandbox", { enumerable: true, get: function () { return sandbox_js_2.decideSandbox; } });
+Object.defineProperty(exports, "specTrusted", { enumerable: true, get: function () { return sandbox_js_2.specTrusted; } });
+Object.defineProperty(exports, "sandboxAvailable", { enumerable: true, get: function () { return sandbox_js_2.sandboxAvailable; } });
+function contentText(content) {
+    if (typeof content === "string")
+        return content;
+    if (!Array.isArray(content))
+        return "";
+    return content
+        .map((b) => {
+        if (typeof b === "string")
+            return b;
+        const t = b.text;
+        return typeof t === "string" ? t : "";
+    })
+        .join("");
+}
+/**
+ * Parse `--output-format stream-json` (the `transcript: true` output) into the
+ * tools the agent invoked, each joined to its result by id. Returns [] for the
+ * non-stream `json` output. The seam that lets a test assert on the agent's
+ * actions, not a brittle stdout substring.
+ */
+function parseToolCalls(streamJson) {
+    const uses = [];
+    const results = new Map();
+    for (const line of streamJson.split("\n")) {
+        if (!line.trim())
+            continue;
+        let evt;
+        try {
+            evt = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        const content = evt.message?.content;
+        if (!Array.isArray(content))
+            continue;
+        for (const b of content) {
+            if (b.type === "tool_use" && typeof b.name === "string") {
+                const id = typeof b.id === "string" ? b.id : "";
+                uses.push({ id, name: b.name, input: b.input });
+            }
+            else if (b.type === "tool_result") {
+                const id = typeof b.tool_use_id === "string" ? b.tool_use_id : "";
+                results.set(id, {
+                    text: contentText(b.content),
+                    isError: b.is_error === true,
+                });
+            }
+        }
+    }
+    return uses.map((u) => ({
+        name: u.name,
+        input: u.input,
+        resultText: results.get(u.id)?.text ?? "",
+        isError: results.get(u.id)?.isError ?? false,
+    }));
+}
+/**
+ * The terminal `result` event — present in BOTH `--output-format` shapes (a
+ * `{type:"result", …}` line in stream-json, the single object in `json`), or
+ * null. The seam for the final answer + turn count without parsing twice.
+ */
+function parseResultEvent(stdout) {
+    for (const line of stdout.split("\n")) {
+        if (!line.trim())
+            continue;
+        let evt;
+        try {
+            evt = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (evt.type === "result")
+            return evt;
+    }
+    return null;
+}
+/** The agent's final answer text from a transcript / result object, or "". */
+function parseOutput(stdout) {
+    const result = parseResultEvent(stdout)?.result;
+    return typeof result === "string" ? result : "";
+}
+/**
+ * The hooks that fired, recorded from the CLI's `hook_response` stream events
+ * (`--output-format stream-json`). Each carries the hook name/event, its exit
+ * code, and whether it blocked — the honest record vs. inferring from marker
+ * files. Returns [] for the non-stream `json` output (no per-hook events).
+ */
+function toHookFire(evt) {
+    const exitCode = typeof evt.exit_code === "number" ? evt.exit_code : undefined;
+    return {
+        name: typeof evt.hook_name === "string" ? evt.hook_name : "",
+        event: typeof evt.hook_event === "string" ? evt.hook_event : "",
+        exitCode,
+        blocked: evt.outcome === "error" || (exitCode !== undefined && exitCode !== 0),
+        output: typeof evt.output === "string" ? evt.output : "",
+    };
+}
+function parseHooks(stdout) {
+    const hooks = [];
+    for (const line of stdout.split("\n")) {
+        if (!line.trim())
+            continue;
+        let evt;
+        try {
+            evt = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (evt.type === "system" && evt.subtype === "hook_response") {
+            hooks.push(toHookFire(evt));
+        }
+    }
+    return hooks;
+}
+/**
+ * The `claude` CLI argv for a harness run (shared by the direct and sandboxed
+ * paths). `ANTHROPIC_BASE_URL` is set by the caller's environment / wrapper, not
+ * here. Pure, so the arg shape is unit-tested.
+ */
+function buildClaudeArgs(spec, hasSettings) {
+    const tools = spec.allowedTools ?? ["Read", "Edit", "Write", "Bash"];
+    return [
+        "-p",
+        spec.prompt ?? "go",
+        ...(spec.transcript
+            ? ["--output-format", "stream-json", "--verbose"]
+            : ["--output-format", "json"]),
+        "--model",
+        "claude-sonnet-4-5",
+        ...(spec.pluginDir !== undefined
+            ? ["--plugin-dir", (0, node_path_1.resolve)(spec.pluginDir)]
+            : []),
+        ...(hasSettings ? ["--settings", "settings.json"] : []),
+        "--allowedTools",
+        ...tools,
+    ];
+}
+/* v8 ignore start -- spawns the real claude CLI + filesystem; exercised by the
+   claude-backed suite, excluded from the deterministic coverage gate (the parse
+   helpers above carry the testable logic). */
 /** Whether the `claude` CLI is available — harness tests need it. */
 function claudeAvailable() {
     try {
@@ -92,8 +246,20 @@ function spawnClaude(args, cwd, baseUrl, timeoutMs) {
 /**
  * Run the real `claude` CLI against a scripted mock model, with the given
  * fixture and settings (hooks). Deterministic — same script, same result.
+ *
+ * Safe by default: an external `plugin` / `pluginDir` brings in untrusted
+ * third-party hooks and is confined under bubblewrap (`spec.sandbox`, default
+ * `"auto"`); if no sandbox is available the run REFUSES rather than executing
+ * unconfined. See `src/sandbox.ts`.
  */
 async function runHarnessTest(spec) {
+    const decision = (0, sandbox_js_1.decideSandbox)({
+        trusted: (0, sandbox_js_1.specTrusted)(spec),
+        mode: spec.sandbox ?? "auto",
+        available: (0, sandbox_js_1.sandboxAvailable)(),
+    });
+    if (decision.action === "throw")
+        throw new Error(decision.reason);
     const cwd = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), "vigiles-harness-"));
     const { files, settings } = (0, plugin_loader_js_1.resolveHarness)({
         plugin: spec.plugin,
@@ -101,38 +267,45 @@ async function runHarnessTest(spec) {
         files: spec.files,
     });
     writeFixture(cwd, files, settings);
+    const args = buildClaudeArgs(spec, settings !== undefined);
+    const timeoutMs = spec.timeoutMs ?? 60000;
+    const build = (out, turns, modelRequests) => ({
+        exitCode: out.code,
+        stdout: out.stdout,
+        stderr: out.stderr ?? "",
+        cwd,
+        turns,
+        toolCalls: parseToolCalls(out.stdout),
+        hooks: parseHooks(out.stdout),
+        output: parseOutput(out.stdout),
+        modelRequests,
+        file: (p) => {
+            const f = (0, node_path_1.resolve)(cwd, p);
+            return (0, node_fs_1.existsSync)(f) ? (0, node_fs_1.readFileSync)(f, "utf-8") : null;
+        },
+        cleanup: () => {
+            (0, node_fs_1.rmSync)(cwd, { recursive: true, force: true });
+        },
+    });
+    // Confined path: the mock is co-launched inside the sandbox's netns.
+    if (decision.action === "sandbox") {
+        const out = await (0, sandbox_js_1.runSandboxed)({
+            cwd,
+            claudeArgs: args,
+            script: spec.model,
+            timeoutMs,
+        });
+        return build(out, out.requests.length, out.requests);
+    }
+    // Direct path: mock runs in this process; claude reaches it over localhost.
     const mock = await (0, mock_model_js_1.startMock)(spec.model);
     try {
-        const tools = spec.allowedTools ?? ["Read", "Edit", "Write", "Bash"];
-        const args = [
-            "-p",
-            spec.prompt ?? "go",
-            "--output-format",
-            "json",
-            "--model",
-            "claude-sonnet-4-5",
-            ...(settings !== undefined ? ["--settings", "settings.json"] : []),
-            "--allowedTools",
-            ...tools,
-        ];
-        const out = await spawnClaude(args, cwd, mock.url, spec.timeoutMs ?? 60000);
-        return {
-            exitCode: out.code,
-            stdout: out.stdout,
-            stderr: out.stderr,
-            cwd,
-            turns: mock.count,
-            file: (p) => {
-                const f = (0, node_path_1.resolve)(cwd, p);
-                return (0, node_fs_1.existsSync)(f) ? (0, node_fs_1.readFileSync)(f, "utf-8") : null;
-            },
-            cleanup: () => {
-                (0, node_fs_1.rmSync)(cwd, { recursive: true, force: true });
-            },
-        };
+        const out = await spawnClaude(args, cwd, mock.url, timeoutMs);
+        return build(out, mock.count, [...mock.requests]);
     }
     finally {
         mock.close();
     }
 }
+/* v8 ignore stop */
 //# sourceMappingURL=harness-test.js.map

package/dist/judge.js

@@ -36,6 +36,7 @@ function firstJsonObject(s) {
         return null;
     }
 }
+/* v8 ignore start -- spawns the real claude CLI; parseJudgeOutput holds the logic */
 /** Grade `output` against `rubric` with a model. Synchronous (for `measure`). */
 function judge(opts) {
     const threshold = opts.threshold ?? 0.5;
@@ -65,6 +66,7 @@ function judge(opts) {
     }
     return parseJudgeOutput(res.stdout ?? "", threshold);
 }
+/* v8 ignore stop */
 /**
  * Parse a verdict out of the grader's stdout — pure, so the parsing is testable
  * without a model. Handles `claude --output-format json` (text wrapped in a

package/dist/linters.d.ts

@@ -24,6 +24,12 @@ export interface DetectedLinter {
 }
 /** @internal */ export declare function extractLinterName(enforcedBy: string): string;
 /** @internal */ export declare function extractRuleName(enforcedBy: string): string | null;
+/**
+ * Levenshtein distance for short-string typo detection. Rule names are
+ * short so edit distance is more appropriate than NCD (which is tuned
+ * for longer texts).
+ */
+export declare function editDistance(a: string, b: string): number;
 /** @internal */ export declare function clearCedarCache(): void;
 /**
  * Check a single linter rule reference (e.g., "eslint/no-console").

package/dist/linters.js

@@ -13,6 +13,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractLinterName = extractLinterName;
 exports.extractRuleName = extractRuleName;
+exports.editDistance = editDistance;
 exports.clearCedarCache = clearCedarCache;
 exports.checkLinterRule = checkLinterRule;
 const node_fs_1 = require("node:fs");

package/dist/mcp.d.ts

@@ -0,0 +1,48 @@
+export interface McpServerConfig {
+    readonly command: string;
+    readonly args?: readonly string[];
+    readonly env?: Record<string, string>;
+    readonly cwd?: string;
+}
+export interface McpToolInfo {
+    readonly name: string;
+    readonly description?: string;
+}
+/**
+ * Start an MCP server over stdio, complete the handshake, and return its tools.
+ * Kills the server when done. Throws on spawn/timeout/exit/protocol error.
+ */
+export declare function listMcpTools(server: McpServerConfig, timeoutMs?: number): Promise<McpToolInfo[]>;
+export interface McpRefResult {
+    readonly exists: boolean;
+    readonly available: string[];
+    readonly suggestions: string[];
+}
+/**
+ * Verify `toolName` exists on `server`; on a miss, suggest the closest tool names
+ * (edit distance) — "did you mean issue_write?".
+ */
+export declare function verifyMcpTool(server: McpServerConfig, toolName: string, timeoutMs?: number): Promise<McpRefResult>;
+export interface McpRef {
+    readonly server: string;
+    readonly tool: string;
+    readonly line: number;
+}
+export type McpRefReason = "server-undeclared" | "server-unreachable" | "tool-missing";
+export interface McpRefError extends McpRef {
+    readonly reason: McpRefReason;
+    readonly suggestions: string[];
+}
+/** Parse `vigiles:mcp server#tool` marks from a markdown file's inline spans. */
+export declare function parseMcpRefs(markdown: string): McpRef[];
+/** Read `mcpServers` from `.mcp.json` (the stdio-server config map), or `{}`. */
+export declare function loadMcpServers(cwd: string): Record<string, McpServerConfig>;
+/**
+ * Verify every `vigiles:mcp server#tool` mark in `markdown` against the live
+ * servers in `mcpServers` (each referenced server is started once). A reference
+ * to an undeclared server, an unreachable server, or a missing tool is an error.
+ */
+export declare function verifyMcpRefs(markdown: string, mcpServers: Record<string, McpServerConfig>, timeoutMs?: number): Promise<McpRefError[]>;
+/** Human-readable message for an MCP reference error (with "did you mean"). */
+export declare function mcpRefMessage(e: McpRefError): string;
+//# sourceMappingURL=mcp.d.ts.map

package/dist/mcp.js

@@ -0,0 +1,247 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listMcpTools = listMcpTools;
+exports.verifyMcpTool = verifyMcpTool;
+exports.parseMcpRefs = parseMcpRefs;
+exports.loadMcpServers = loadMcpServers;
+exports.verifyMcpRefs = verifyMcpRefs;
+exports.mcpRefMessage = mcpRefMessage;
+/**
+ * Minimal MCP client over stdio — start a server, do the JSON-RPC handshake, and
+ * list its tools. This lets vigiles VERIFY a referenced `mcp__server__tool`
+ * resolves against the real server (the way `enforce()` resolves a linter rule
+ * against its catalog), catching a skill/CLAUDE.md that cites an MCP tool that was
+ * renamed or removed — e.g. the GitHub MCP server renaming `create_issue` →
+ * `issue_write`, which otherwise fails silently at runtime.
+ *
+ * MCP stdio transport = newline-delimited JSON-RPC 2.0.
+ */
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const refs_js_1 = require("./refs.js");
+const hash_js_1 = require("./hash.js");
+function dispatch(line, pending) {
+    let msg;
+    try {
+        msg = JSON.parse(line);
+    }
+    catch {
+        return;
+    }
+    if (typeof msg.id !== "number")
+        return;
+    const p = pending.get(msg.id);
+    if (p) {
+        pending.delete(msg.id);
+        p.resolve(msg);
+    }
+}
+/**
+ * Start an MCP server over stdio, complete the handshake, and return its tools.
+ * Kills the server when done. Throws on spawn/timeout/exit/protocol error.
+ */
+async function listMcpTools(server, timeoutMs = 10000) {
+    const child = (0, node_child_process_1.spawn)(server.command, [...(server.args ?? [])], {
+        env: server.env ? { ...process.env, ...server.env } : process.env,
+        cwd: server.cwd,
+        stdio: ["pipe", "pipe", "ignore"],
+    });
+    const { stdin, stdout } = child;
+    if (!stdin || !stdout) {
+        child.kill("SIGKILL");
+        throw new Error("failed to open MCP server stdio");
+    }
+    const pending = new Map();
+    const failAll = (err) => {
+        for (const [, p] of pending)
+            p.reject(err);
+        pending.clear();
+    };
+    let buffer = "";
+    stdout.setEncoding("utf-8");
+    stdout.on("data", (chunk) => {
+        buffer += chunk;
+        let nl = buffer.indexOf("\n");
+        while (nl >= 0) {
+            const line = buffer.slice(0, nl).trim();
+            buffer = buffer.slice(nl + 1);
+            if (line)
+                dispatch(line, pending);
+            nl = buffer.indexOf("\n");
+        }
+    });
+    child.on("error", (e) => {
+        failAll(e);
+    });
+    child.on("close", () => {
+        failAll(new Error("MCP server exited before responding"));
+    });
+    const send = (obj) => {
+        stdin.write(`${JSON.stringify(obj)}\n`);
+    };
+    const request = (id, method, params) => new Promise((resolve, reject) => {
+        pending.set(id, { resolve, reject });
+        send({ jsonrpc: "2.0", id, method, params });
+    });
+    const timer = setTimeout(() => {
+        failAll(new Error(`MCP server timed out after ${String(timeoutMs)}ms`));
+        child.kill("SIGKILL");
+    }, timeoutMs);
+    try {
+        await request(1, "initialize", {
+            protocolVersion: "2024-11-05",
+            capabilities: {},
+            clientInfo: { name: "vigiles", version: "0" },
+        });
+        send({ jsonrpc: "2.0", method: "notifications/initialized" });
+        const res = await request(2, "tools/list", {});
+        if (res.error) {
+            throw new Error(`tools/list failed: ${res.error.message ?? "unknown"}`);
+        }
+        return (res.result?.tools ?? []).map((t) => ({
+            name: t.name,
+            description: t.description,
+        }));
+    }
+    finally {
+        clearTimeout(timer);
+        child.kill("SIGKILL");
+    }
+}
+/**
+ * Verify `toolName` exists on `server`; on a miss, suggest the closest tool names
+ * (edit distance) — "did you mean issue_write?".
+ */
+async function verifyMcpTool(server, toolName, timeoutMs = 10000) {
+    const available = (await listMcpTools(server, timeoutMs)).map((t) => t.name);
+    const exists = available.includes(toolName);
+    return {
+        exists,
+        available,
+        suggestions: exists ? [] : closest(toolName, available),
+    };
+}
+function editDistance(a, b) {
+    if (a === b)
+        return 0;
+    const m = a.length;
+    const n = b.length;
+    if (m === 0)
+        return n;
+    if (n === 0)
+        return m;
+    const dp = Array.from({ length: n + 1 }, (_, i) => i);
+    for (let i = 1; i <= m; i++) {
+        let prev = dp[0];
+        dp[0] = i;
+        for (let j = 1; j <= n; j++) {
+            const tmp = dp[j];
+            dp[j] =
+                a[i - 1] === b[j - 1] ? prev : 1 + Math.min(prev, dp[j], dp[j - 1]);
+            prev = tmp;
+        }
+    }
+    return dp[n];
+}
+function closest(target, candidates, max = 4) {
+    return candidates
+        .map((c) => ({ c, d: editDistance(target, c) }))
+        .filter((x) => x.d <= max)
+        .sort((a, b) => a.d - b.d)
+        .slice(0, 3)
+        .map((x) => x.c);
+}
+// --- MCP tool references in instruction files ------------------------------
+// `vigiles:mcp <server>#<tool>` inside an inline code span — the MCP analogue of
+// the `vigiles:symbol path#name` mark. Self-contained (server + tool in one
+// token) so it binds unambiguously.
+const MCP_MARK = /^vigiles:mcp\s+([\w-]+)#([\w.-]+)$/;
+/** Parse `vigiles:mcp server#tool` marks from a markdown file's inline spans. */
+function parseMcpRefs(markdown) {
+    const refs = [];
+    for (const span of (0, refs_js_1.inlineSpans)(markdown)) {
+        const m = MCP_MARK.exec(span.text);
+        if (m)
+            refs.push({ server: m[1], tool: m[2], line: span.line });
+    }
+    return refs;
+}
+/** Read `mcpServers` from `.mcp.json` (the stdio-server config map), or `{}`. */
+function loadMcpServers(cwd) {
+    const p = (0, node_path_1.join)(cwd, ".mcp.json");
+    if (!(0, node_fs_1.existsSync)(p))
+        return {};
+    try {
+        const json = JSON.parse((0, node_fs_1.readFileSync)(p, "utf-8"));
+        return json.mcpServers ?? {};
+    }
+    catch {
+        return {};
+    }
+}
+async function verifyOneServer(group, cfg, timeoutMs) {
+    if (!cfg) {
+        return group.map((r) => ({
+            ...r,
+            reason: "server-undeclared",
+            suggestions: [],
+        }));
+    }
+    let available;
+    try {
+        available = (await listMcpTools(cfg, timeoutMs)).map((t) => t.name);
+    }
+    catch {
+        return group.map((r) => ({
+            ...r,
+            reason: "server-unreachable",
+            suggestions: [],
+        }));
+    }
+    const errs = [];
+    for (const r of group) {
+        if (!available.includes(r.tool)) {
+            errs.push({
+                ...r,
+                reason: "tool-missing",
+                suggestions: closest(r.tool, available),
+            });
+        }
+    }
+    return errs;
+}
+/**
+ * Verify every `vigiles:mcp server#tool` mark in `markdown` against the live
+ * servers in `mcpServers` (each referenced server is started once). A reference
+ * to an undeclared server, an unreachable server, or a missing tool is an error.
+ */
+async function verifyMcpRefs(markdown, mcpServers, timeoutMs = 10000) {
+    const byServer = new Map();
+    for (const r of parseMcpRefs(markdown)) {
+        const arr = byServer.get(r.server) ?? [];
+        arr.push(r);
+        byServer.set(r.server, arr);
+    }
+    const all = [];
+    for (const [server, group] of byServer) {
+        all.push(...(await verifyOneServer(group, mcpServers[server], timeoutMs)));
+    }
+    return all;
+}
+/** Human-readable message for an MCP reference error (with "did you mean"). */
+function mcpRefMessage(e) {
+    switch (e.reason) {
+        case "server-undeclared":
+            return `MCP server "${e.server}" is not declared in .mcp.json`;
+        case "server-unreachable":
+            return `MCP server "${e.server}" failed to start`;
+        case "tool-missing":
+            return `MCP tool "${e.server}#${e.tool}" not found${e.suggestions.length > 0
+                ? ` — did you mean ${e.suggestions.map((s) => `"${s}"`).join(", ")}?`
+                : ""}`;
+        default:
+            return (0, hash_js_1.assertNever)(e.reason);
+    }
+}
+//# sourceMappingURL=mcp.js.map

package/dist/mock-entry.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=mock-entry.d.ts.map

package/dist/mock-entry.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * vigiles — the in-sandbox mock entry.
+ *
+ * Run as a subprocess INSIDE the bubblewrap network namespace (see
+ * `src/sandbox.ts`), so the scripted mock lives on the sandbox's isolated
+ * loopback — reachable by the confined `claude`, unreachable from outside.
+ * Reads the model script from a file, streams each captured request to an ndjson
+ * file the parent reads back (for `trace.modelRequests`), and writes its chosen
+ * port so the wrapper can point `ANTHROPIC_BASE_URL` at it.
+ *
+ *   node mock-entry.js <scriptFile> <requestsFile> <portFile>
+ *
+ * Not unit-tested directly (it's a daemon driven only through a live sandbox);
+ * exercised end-to-end by the bwrap-backed integration test.
+ */
+const node_fs_1 = require("node:fs");
+const mock_model_js_1 = require("./mock-model.js");
+void (async () => {
+    const [scriptFile, requestsFile, portFile] = process.argv.slice(2);
+    if (!scriptFile || !requestsFile || !portFile) {
+        process.stderr.write("mock-entry: scriptFile requestsFile portFile\n");
+        process.exit(2);
+    }
+    const turns = JSON.parse((0, node_fs_1.readFileSync)(scriptFile, "utf-8"));
+    const handle = await (0, mock_model_js_1.startMock)(turns, {
+        onRequest: (req) => {
+            (0, node_fs_1.appendFileSync)(requestsFile, JSON.stringify(req) + "\n");
+        },
+    });
+    // Signal readiness last: the wrapper waits for a non-empty port file.
+    (0, node_fs_1.writeFileSync)(portFile, new URL(handle.url).port);
+    // Stay alive until the wrapper kills us once `claude` has finished.
+})();
+//# sourceMappingURL=mock-entry.js.map