yuurei 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Shimpei Takamatsu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,231 @@
+# yuurei
+
+> Isolated, reproducible runtime environments for coding agents
+
+![Yuurei ghost DJ operating a mixing console](docs/assets/yuurei-top.jpg)
+
+`yuurei` isolates coding-agent runtime environments (Claude Code, Codex)
+from your normal global configuration, so different harness profiles
+(skills, instructions, settings, hooks) can be swapped and run
+reproducibly without touching or breaking your everyday setup.
+
+## Why
+
+Comparing harness or profile variants safely usually means backing up,
+swapping, restarting, and restoring your global config by hand — a
+process that gets fragile fast as the number of variants grows. `yuurei`
+builds a temporary, isolated execution cell per run instead, and emits a
+runtime-agnostic trace record (`trace.json`) that other tools — such as a
+future ROI tracker — can consume. `yuurei` itself stays agnostic of any
+such consumer; the dependency only ever points one way, from that tool
+toward `yuurei`.
+
+## Quickstart
+
+Install yuurei from npm, or build it from a source checkout:
+
+```sh
+npm install -g yuurei
+```
+
+Check that the CLI is on your PATH:
+
+```sh
+yuurei --help
+```
+
+### Required authentication setup
+
+`yuurei` forwards explicit credential variables into the isolated runtime. It
+does **not** read your interactive login from the OS credential store, so you
+must make a credential available explicitly before running a task. Keep
+credentials out of profile and task files.
+
+#### Claude Code
+
+**Subscription login (default path):** Run `claude setup-token` once in this
+shell to obtain a long-lived token, then export it before running any task:
+
+```sh
+claude setup-token
+# follow the prompts, then copy the token it prints
+export ANTHROPIC_AUTH_TOKEN='<token from claude setup-token>'
+```
+
+**API key:** export `ANTHROPIC_API_KEY` instead:
+
+```sh
+export ANTHROPIC_API_KEY='<api-key>'
+```
+
+Note: `claude auth status` may report `loggedIn: true` while `yuurei doctor`
+reports `authentication: required`. These check different stores — `claude auth
+status` reads the OS credential store; yuurei checks for an explicit environment
+variable. A shell export applies only to that shell and its child processes; do
+not persist the token in a profile, task, or committed file.
+
+#### Codex
+
+**API key (default path):** export `OPENAI_API_KEY`:
+
+```sh
+export OPENAI_API_KEY='<api-key>'
+```
+
+**Existing interactive login (experimental, opt-in):** if you already have a
+`~/.codex/auth.json` from a `codex` interactive login, you can reuse it in the
+isolated run with `--bridge-codex-auth-file`:
+
+```sh
+yuurei run <run-name> --bridge-codex-auth-file
+```
+
+This flag is experimental and off by default. When enabled, yuurei copies
+exactly `~/.codex/auth.json` into the isolated run, runs with it, and scrubs
+the isolated copy afterward. The real global file is never modified. It is an
+explicit opt-in because that file can carry a rotating OAuth access/refresh
+token pair: if the token refreshes mid-run, only the isolated copy receives the
+new state while the real file stays stale, and the valid rotated copy is then
+discarded on cleanup. Do not copy credentials into profiles, tasks, traces,
+artifacts, or logs.
+
+#### Verify the environment
+
+Check that the environment is ready:
+
+```sh
+yuurei doctor
+```
+
+Each runtime prints as a compact status block:
+
+```text
+claude-code
+  status: installed
+  version: <installed-version>
+  supported: yes
+  authentication: ready
+
+codex
+  status: installed
+  version: <installed-version>
+  supported: yes
+  authentication: required
+    Export OPENAI_API_KEY in this shell and re-run `yuurei doctor`. ...
+```
+
+Look for `authentication: ready` for the runtime you plan to use. If a runtime
+reports `authentication: required`, `yuurei doctor` prints safe,
+runtime-specific next steps. Note that the check reflects an explicit
+environment credential, not whether an interactive login exists: Codex can
+report `authentication: required` even when a `~/.codex/auth.json` is available
+for explicit bridging, because the check detects `OPENAI_API_KEY` only. Verify a
+credential variable is present without printing its value:
+
+```sh
+[ -n "$ANTHROPIC_AUTH_TOKEN" ] && echo present || echo absent
+[ -n "$OPENAI_API_KEY" ] && echo present || echo absent
+```
+
+Orphaned temp directories are listed with a prominent count and the
+`yuurei clean` recovery command. Pass `--json` for machine-readable output that
+scripts can consume, one JSON object per line:
+
+```text
+{"level":"info","message":"claude-code: installed","version":"<installed-version>","versionSupported":true,"authUsable":true}
+```
+
+### Create a first project
+
+A Yuurei project keeps its configuration under `.yuurei/`. The project
+configuration names profiles and runs. A profile selects a runtime and its
+runtime-native config files. A task is the instruction sent to that runtime.
+Each run creates a trace and logs under `.yuurei/runs/<run-id>/`.
+
+Create the smallest Claude Code project with the scaffold command:
+
+```sh
+mkdir yuurei-demo
+cd yuurei-demo
+yuurei init
+```
+
+`init` writes a valid `.yuurei/yuurei.yaml`, one profile
+(`profiles/claude-basic/profile.yaml`), and one safe task
+(`tasks/hello.md`). It never overwrites existing files and creates no
+credentials. Pass options to change the runtime, profile, task, run, or
+target directory:
+
+```sh
+yuurei init --runtime codex --profile codex-basic --task hello --run first-run
+yuurei init ../other-project
+```
+
+The default profile is `claude-basic` and the default task is `hello`.
+The named run resolves `profile` and `task` from `.yuurei/yuurei.yaml`:
+
+```sh
+yuurei profile list
+yuurei inspect claude-basic
+yuurei run hello
+```
+
+To choose both values at the command line, run:
+
+```sh
+yuurei run --profile claude-basic --task .yuurei/tasks/hello.md
+```
+
+After a run, use the printed run ID to inspect the result:
+
+```sh
+RUN_ID='<run-id>'
+yuurei trace show "$RUN_ID"
+cat ".yuurei/runs/$RUN_ID/trace.json"
+cat ".yuurei/runs/$RUN_ID/stdout.log"
+cat ".yuurei/runs/$RUN_ID/stderr.log"
+cat ".yuurei/runs/$RUN_ID/artifacts.json"
+```
+
+The trace records the runtime, exit status, timeout status, profile and task
+digests, and isolation result. Yuurei does not copy your project source into
+the temporary execution cell, and it does not import your global runtime
+configuration automatically.
+
+The `task` path in a named run must stay inside `.yuurei/`. A direct
+`--task` path is an explicit operator choice and may point elsewhere. Keep
+profile and task files trusted because the runtime executes their contents.
+
+For runtime-specific authentication, config files, isolation levels, and
+security details, read the [Getting started guide](https://github.com/shimpeiws/yuurei/blob/main/docs/getting-started.md).
+
+`yuurei doctor` also reports isolated temp directories orphaned by an abnormal
+termination (SIGKILL, power loss, hard crash); `yuurei clean` removes them.
+
+```sh
+yuurei init [--runtime <runtime>] [--profile <name>] [--task <name>] [--run <name>] [directory]
+yuurei doctor
+yuurei profile list
+yuurei inspect <profile-name>
+yuurei run <run-name>
+yuurei run --profile <profile> --task <path/to/task.md>
+yuurei run <run-name> --keep
+yuurei run <run-name> --bridge-codex-auth-file
+yuurei trace show <run-id>
+yuurei clean
+```
+
+## Status
+
+v0.3 scope: single-runtime "native cell" execution (Pattern A) for Claude
+Code and Codex, treated as independent runtime × model × harness × task
+combinations. Not yet in scope: cross-runtime harness portability, local
+LLM support, output quality auto-scoring, cost/ROI dashboards, OS-level
+sandboxing, or team auth.
+
+## Learn more
+
+See the
+[design document](https://github.com/shimpeiws/yuurei/blob/main/docs/design/yuurei-design-v0.3.md)
+for the full design, and the
+[release process](https://github.com/shimpeiws/yuurei/blob/main/docs/releasing.md).

package/dist/artifact/collector.d.ts

@@ -0,0 +1,15 @@
+import type { ArtifactManifest } from './types.js';
+export declare const DEFAULT_ARTIFACT_MAX_BYTES: number;
+export interface CollectArtifactsOptions {
+    maxBytes?: number;
+    truncatedPaths?: readonly string[];
+}
+/**
+ * Collects known output files from a run directory into an artifact
+ * manifest. What counts as an artifact and how large a file it will
+ * digest is deliberately narrow in v0.3 (design doc §10: don't
+ * unconditionally duplicate secrets or huge files).
+ */
+export declare function collectArtifacts(runDir: string, paths: string[], options?: CollectArtifactsOptions): Promise<ArtifactManifest>;
+export declare function writeArtifactManifest(runDir: string, manifest: ArtifactManifest): Promise<void>;
+//# sourceMappingURL=collector.d.ts.map

package/dist/artifact/collector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collector.d.ts","sourceRoot":"","sources":["../../src/artifact/collector.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAY,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE7D,eAAO,MAAM,0BAA0B,QAAc,CAAC;AAEtD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,gBAAgB,CAAC,CAc3B;AA+DD,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/artifact/collector.js

@@ -0,0 +1,87 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { rename, rm, stat, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+export const DEFAULT_ARTIFACT_MAX_BYTES = 1024 * 1024;
+/**
+ * Collects known output files from a run directory into an artifact
+ * manifest. What counts as an artifact and how large a file it will
+ * digest is deliberately narrow in v0.3 (design doc §10: don't
+ * unconditionally duplicate secrets or huge files).
+ */
+export async function collectArtifacts(runDir, paths, options = {}) {
+    const maxBytes = options.maxBytes ?? DEFAULT_ARTIFACT_MAX_BYTES;
+    validateMaxBytes(maxBytes);
+    const artifacts = [];
+    for (const path of paths) {
+        const artifact = await collectArtifact(runDir, path, maxBytes, options.truncatedPaths?.includes(path));
+        if (artifact)
+            artifacts.push(artifact);
+    }
+    return { artifacts };
+}
+function validateMaxBytes(maxBytes) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) {
+        throw new RangeError('maxBytes must be a non-negative safe integer');
+    }
+}
+async function collectArtifact(runDir, path, maxBytes, knownTruncated = false) {
+    const sourcePath = join(runDir, path);
+    const tempPath = `${sourcePath}.tmp-${randomUUID()}`;
+    const hash = createHash('sha256');
+    let bytes = 0;
+    let truncated = knownTruncated;
+    let needsRewrite = false;
+    try {
+        const source = createReadStream(sourcePath);
+        const chunks = [];
+        for await (const chunk of source) {
+            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            const remaining = maxBytes - bytes;
+            if (remaining <= 0) {
+                truncated = true;
+                needsRewrite = true;
+                break;
+            }
+            const kept = buffer.subarray(0, remaining);
+            chunks.push(kept);
+            hash.update(kept);
+            bytes += kept.length;
+            if (kept.length < buffer.length) {
+                truncated = true;
+                needsRewrite = true;
+                break;
+            }
+        }
+        if (needsRewrite) {
+            const sourceStats = await stat(sourcePath);
+            await writeFile(tempPath, Buffer.concat(chunks), { mode: sourceStats.mode & 0o7777 });
+            await rename(tempPath, sourcePath);
+        }
+    }
+    catch (error) {
+        await rm(tempPath, { force: true });
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+    const artifact = {
+        path,
+        kind: kindFor(path),
+        digest: `sha256:${hash.digest('hex')}`,
+    };
+    if (truncated)
+        artifact.truncated = true;
+    return artifact;
+}
+export async function writeArtifactManifest(runDir, manifest) {
+    await writeFile(join(runDir, 'artifacts.json'), JSON.stringify(manifest, null, 2), 'utf8');
+}
+function kindFor(path) {
+    if (path.endsWith('.diff'))
+        return 'patch';
+    if (path.endsWith('.log'))
+        return 'log';
+    return 'file';
+}
+//# sourceMappingURL=collector.js.map

package/dist/artifact/collector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collector.js","sourceRoot":"","sources":["../../src/artifact/collector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,GAAG,IAAI,CAAC;AAOtD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,KAAe,EACf,UAAmC,EAAE;IAErC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,0BAA0B,CAAC;IAChE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,eAAe,CACpC,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,IAAI,CAAC,CACvC,CAAC;QACF,IAAI,QAAQ;YAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,UAAU,CAAC,8CAA8C,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,IAAY,EACZ,QAAgB,EAChB,cAAc,GAAG,KAAK;IAEtB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,GAAG,UAAU,QAAQ,UAAU,EAAE,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,SAAS,GAAG,cAAc,CAAC;IAC/B,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnE,MAAM,SAAS,GAAG,QAAQ,GAAG,KAAK,CAAC;YACnC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;gBACnB,SAAS,GAAG,IAAI,CAAC;gBACjB,YAAY,GAAG,IAAI,CAAC;gBACpB,MAAM;YACR,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAClB,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBAChC,SAAS,GAAG,IAAI,CAAC;gBACjB,YAAY,GAAG,IAAI,CAAC;gBACpB,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC;YACtF,MAAM,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAa;QACzB,IAAI;QACJ,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC;QACnB,MAAM,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;KACvC,CAAC;IACF,IAAI,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC;IACzC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,QAA0B;IAE1B,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/artifact/types.d.ts

@@ -0,0 +1,10 @@
+export interface Artifact {
+    path: string;
+    kind: string;
+    digest: string;
+    truncated?: boolean;
+}
+export interface ArtifactManifest {
+    artifacts: Artifact[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/artifact/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/artifact/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,QAAQ,EAAE,CAAC;CACvB"}

package/dist/artifact/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/artifact/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/artifact/types.ts"],"names":[],"mappings":""}

package/dist/cell/digest.d.ts

@@ -0,0 +1,10 @@
+import type { CellIdentityInput } from './types.js';
+/**
+ * cell_digest = hash(runtime identity, requested model, resolved profile
+ * contents, task contents, yuurei version, relevant execution options) —
+ * design doc §7.3. Hashed over resolved content, never over profile/task
+ * names alone, so two profiles with the same name but different contents
+ * never collide.
+ */
+export declare function computeCellDigest(input: CellIdentityInput): string;
+//# sourceMappingURL=digest.d.ts.map

package/dist/cell/digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.d.ts","sourceRoot":"","sources":["../../src/cell/digest.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAElE"}

package/dist/cell/digest.js

@@ -0,0 +1,13 @@
+import { canonicalJsonStringify } from '../util/json.js';
+import { sha256Digest } from '../util/hash.js';
+/**
+ * cell_digest = hash(runtime identity, requested model, resolved profile
+ * contents, task contents, yuurei version, relevant execution options) —
+ * design doc §7.3. Hashed over resolved content, never over profile/task
+ * names alone, so two profiles with the same name but different contents
+ * never collide.
+ */
+export function computeCellDigest(input) {
+    return sha256Digest(canonicalJsonStringify(input));
+}
+//# sourceMappingURL=digest.js.map

package/dist/cell/digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.js","sourceRoot":"","sources":["../../src/cell/digest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG/C;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAwB;IACxD,OAAO,YAAY,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC;AACrD,CAAC"}

package/dist/cell/resolver.d.ts

@@ -0,0 +1,18 @@
+import type { ResolvedProfile } from '../profile/types.js';
+import type { IsolationStrategy } from '../isolation/types.js';
+import type { ResolvedCell } from './types.js';
+export interface CellResolutionInput {
+    runtimeId: string;
+    requestedModel: string;
+    profile: ResolvedProfile;
+    taskPath: string;
+    yuureiVersion: string;
+    executionOptions?: Record<string, unknown>;
+    isolationStrategy: IsolationStrategy;
+}
+/**
+ * Cell Resolver: combines runtime + model + resolved profile + resolved
+ * task into one identified execution cell (design doc §7.3).
+ */
+export declare function resolveCell(input: CellResolutionInput): Promise<ResolvedCell>;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/cell/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/cell/resolver.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,OAAO,KAAK,EAAE,YAAY,EAAmB,MAAM,YAAY,CAAC;AAEhE,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,eAAe,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,iBAAiB,EAAE,iBAAiB,CAAC;CACtC;AAQD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CA6BnF"}

package/dist/cell/resolver.js

@@ -0,0 +1,41 @@
+import { readFile } from 'node:fs/promises';
+import { sha256Digest } from '../util/hash.js';
+import { computeCellDigest } from './digest.js';
+/** Resolves a task file into its content plus a content digest. */
+async function resolveTask(taskPath) {
+    const content = await readFile(taskPath, 'utf8');
+    return { source: taskPath, content, digest: sha256Digest(content) };
+}
+/**
+ * Cell Resolver: combines runtime + model + resolved profile + resolved
+ * task into one identified execution cell (design doc §7.3).
+ */
+export async function resolveCell(input) {
+    const resolvedTask = await resolveTask(input.taskPath);
+    const resolvedProfile = {
+        name: input.profile.name,
+        content: input.profile.content,
+        digest: input.profile.digest,
+    };
+    const executionOptions = input.executionOptions ?? {};
+    const cellDigest = computeCellDigest({
+        runtimeId: input.runtimeId,
+        requestedModel: input.requestedModel,
+        resolvedProfile,
+        resolvedTask,
+        yuureiVersion: input.yuureiVersion,
+        executionOptions,
+        isolationStrategy: input.isolationStrategy,
+    });
+    return {
+        runtimeId: input.runtimeId,
+        requestedModel: input.requestedModel,
+        resolvedProfile,
+        resolvedTask,
+        yuureiVersion: input.yuureiVersion,
+        executionOptions,
+        isolationStrategy: input.isolationStrategy,
+        cellDigest,
+    };
+}
+//# sourceMappingURL=resolver.js.map

package/dist/cell/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../src/cell/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAahD,mEAAmE;AACnE,KAAK,UAAU,WAAW,CAAC,QAAgB;IACzC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAA0B;IAC1D,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,eAAe,GAAG;QACtB,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;QAC9B,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;KAC7B,CAAC;IACF,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;IAEtD,MAAM,UAAU,GAAG,iBAAiB,CAAC;QACnC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,eAAe;QACf,YAAY;QACZ,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,gBAAgB;QAChB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;IAEH,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,eAAe;QACf,YAAY;QACZ,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,gBAAgB;QAChB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/cell/types.d.ts

@@ -0,0 +1,48 @@
+import type { ProfileContent } from '../profile/types.js';
+import type { IsolationStrategy } from '../isolation/types.js';
+/**
+ * A resolved profile bundled with its content digest. `content` is the
+ * fully-loaded profile data (not just a name reference), because cell
+ * identity must be computed over resolved content — see cell_digest below.
+ */
+export interface ResolvedProfileRef {
+    name: string;
+    content: ProfileContent;
+    digest: string;
+}
+export interface ResolvedTaskRef {
+    source: string;
+    content: string;
+    digest: string;
+}
+/**
+ * The fully-resolved combination of runtime, model, harness profile, and
+ * task that identifies one execution cell (design doc §7: runtime × model
+ * × native harness × task).
+ */
+export interface ResolvedCell {
+    runtimeId: string;
+    requestedModel: string;
+    resolvedProfile: ResolvedProfileRef;
+    resolvedTask: ResolvedTaskRef;
+    yuureiVersion: string;
+    executionOptions: Record<string, unknown>;
+    /**
+     * Isolation strategy the cell runs under (design doc §7.3, §9.3). Part of
+     * cell identity: level0 and level1 runs have materially different
+     * HOME/config semantics and must never share a cellDigest.
+     */
+    isolationStrategy: IsolationStrategy;
+    /** sha256 digest over the canonicalized combination of the fields above. */
+    cellDigest: string;
+}
+export interface CellIdentityInput {
+    runtimeId: string;
+    requestedModel: string;
+    resolvedProfile: ResolvedProfileRef;
+    resolvedTask: ResolvedTaskRef;
+    yuureiVersion: string;
+    executionOptions: Record<string, unknown>;
+    isolationStrategy: IsolationStrategy;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/cell/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/cell/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,kBAAkB,CAAC;IACpC,YAAY,EAAE,eAAe,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C;;;;OAIG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,kBAAkB,CAAC;IACpC,YAAY,EAAE,eAAe,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,iBAAiB,EAAE,iBAAiB,CAAC;CACtC"}

package/dist/cell/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/cell/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/cell/types.ts"],"names":[],"mappings":""}

package/dist/cli/clean.d.ts

@@ -0,0 +1,16 @@
+import { type RemoveOrphanTempDirsResult } from '../isolation/tempdir.js';
+import type { Logger } from '../util/logger.js';
+export interface CleanOptions {
+    /** Scan root for orphaned temp dirs. Defaults to `os.tmpdir()`. Injectable for tests. */
+    tempDir?: string;
+}
+/**
+ * `yuurei clean` — removes `yuurei-*` temp directories left behind by
+ * abnormal termination (SIGKILL, power loss, hard crash) that are old
+ * enough to be safe to delete. This is the recovery half of the design
+ * doc §15 safety regression; `yuurei doctor` reports the orphans, this
+ * command deletes them. Deletion is best-effort: failures are reported
+ * via the logger and the result, never abort the sweep.
+ */
+export declare function runClean(logger: Logger, options?: CleanOptions): Promise<RemoveOrphanTempDirsResult>;
+//# sourceMappingURL=clean.d.ts.map

package/dist/cli/clean.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clean.d.ts","sourceRoot":"","sources":["../../src/cli/clean.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,WAAW,YAAY;IAC3B,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,0BAA0B,CAAC,CAkBrC"}

package/dist/cli/clean.js

@@ -0,0 +1,24 @@
+import { removeOrphanTempDirs } from '../isolation/tempdir.js';
+/**
+ * `yuurei clean` — removes `yuurei-*` temp directories left behind by
+ * abnormal termination (SIGKILL, power loss, hard crash) that are old
+ * enough to be safe to delete. This is the recovery half of the design
+ * doc §15 safety regression; `yuurei doctor` reports the orphans, this
+ * command deletes them. Deletion is best-effort: failures are reported
+ * via the logger and the result, never abort the sweep.
+ */
+export async function runClean(logger, options) {
+    const result = await removeOrphanTempDirs(options?.tempDir === undefined ? undefined : { root: options.tempDir });
+    if (result.removed.length === 0) {
+        logger.info('no orphaned isolation temp directories found');
+    }
+    else {
+        const noun = result.removed.length === 1 ? 'directory' : 'directories';
+        logger.info(`removed ${result.removed.length} orphaned isolation temp ${noun}`);
+    }
+    for (const failed of result.failed) {
+        logger.warn(`failed to remove orphaned isolation temp directory: ${failed.path} (${failed.error})`);
+    }
+    return result;
+}
+//# sourceMappingURL=clean.js.map

package/dist/cli/clean.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clean.js","sourceRoot":"","sources":["../../src/cli/clean.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAmC,MAAM,yBAAyB,CAAC;AAQhG;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAc,EACd,OAAsB;IAEtB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CACvC,OAAO,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,CACvE,CAAC;IAEF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC9D,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,4BAA4B,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CACT,uDAAuD,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,GAAG,CACvF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/cli/doctor.d.ts

@@ -0,0 +1,29 @@
+import { type OrphanTempDir } from '../isolation/tempdir.js';
+import type { Logger, LogFormat } from '../util/logger.js';
+interface DoctorRuntimeCheck {
+    runtimeId: string;
+    installed: boolean;
+    version: string | null;
+    versionSupported: boolean | null;
+    authUsable: boolean | null;
+    authGuidance?: string;
+}
+export interface DoctorReport {
+    runtimes: DoctorRuntimeCheck[];
+    canWriteOutputDir: boolean;
+    /** `yuurei-*` temp dirs left behind by abnormal termination (design doc §15). */
+    orphanTempDirs: OrphanTempDir[];
+}
+export interface DoctorOptions {
+    /** Scan root for orphaned temp dirs. Defaults to `os.tmpdir()`. Injectable for tests. */
+    tempDir?: string;
+}
+/**
+ * `yuurei doctor` — inspection only, never mutates the environment
+ * (design doc §8.1). Authentication is reported only when an installed
+ * runtime has credentials available through its supported default path.
+ */
+export declare function runDoctor(options?: DoctorOptions): Promise<DoctorReport>;
+export declare function printDoctorReport(report: DoctorReport, logger: Logger, format: LogFormat): void;
+export {};
+//# sourceMappingURL=doctor.d.ts.map

package/dist/cli/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE3D,UAAU,kBAAkB;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,gBAAgB,EAAE,OAAO,GAAG,IAAI,CAAC;IACjC,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,iFAAiF;IACjF,cAAc,EAAE,aAAa,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAqB9E;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CAM/F"}