PtcRunner.Kernel.ManifestRepl (PtcRunner v0.14.0)

Shared manifest-backed REPL acquisition and lifecycle boundary.

Manifest mode uses the same bounded host catalog, sealed native request, inert runtime services, audited-local checks, active-lifecycle marker, and active provider acquisition prefix as a one-shot command. Phase-6 trace and terminal authority is decided before the opening owner starts. A successful opening returns a process-affine PtcRunner.Kernel.ReplSession whose owner retains one provider session for every evaluation and owns terminal cleanup.

A private manifest requires private_terminal: true and an attached stdin and stdout before provider activity, and admits only interactive input. That attached-terminal check is an accident guard, not access control — the same isatty limits documented on PtcRunner.Kernel.AnalysisSessionBuilder. Unlike private analysis profiles, there is deliberately no unattended private destination here: a private manifest can carry caller-supplied private input, not only captured runtime telemetry, so the gate stays interactive-only by design rather than offering a --private-unattended equivalent.

Summary

Types

failure()

Functions

open(application, host_config, opts \\ [])

Opens one manifest-backed REPL session after phase-6 privacy authorization.

Types

failure()

@type failure() :: %{
  :code => atom(),
  :provider_activity => boolean(),
  optional(:diagnostic) => PtcRunner.Kernel.CommandDiagnostic.t(),
  optional(:declared) => [binary()]
}

Functions

open(application, host_config, opts \\ [])

@spec open(binary(), binary() | nil, keyword()) ::
  {:ok, PtcRunner.Kernel.ReplSession.t()} | {:error, failure()}

Opens one manifest-backed REPL session after phase-6 privacy authorization.

:input_mode is the frontend-classified mode. Mix supplies terminal attachment from AnalysisTerminal; tests and other trusted frontends may pass the already classified boolean explicitly.