@assemblyline-agents/runtime 2.0.0 → 3.0.0

package/dist/workspace-service.js

@@ -0,0 +1,619 @@
+import { randomUUID } from "node:crypto";
+import { shellQuote } from "@assemblyline-agents/core";
+import { resolveWorkspaceForRun, workspaceScopeKey } from "./workspace-id.js";
+import { createWorkspaceManifest, DEFAULT_WORKSPACE_LIMITS, encodeWorkspaceManifest, normalizeWorkspaceRelativePath, parseWorkspaceManifest, scanWorkspaceEntries, workspaceManifestSha256 } from "./workspace-manifest.js";
+import { buildWorkspaceSearchChunks, DEFAULT_WORKSPACE_SEARCH_LIMITS, directWorkspaceSearch, embedWorkspaceSearchQuery, mergeWorkspaceSearchResults } from "./workspace-search.js";
+import { WorkspaceOperations } from "./workspace-operations.js";
+import { SlidingWindowWorkspaceOperationLimiter } from "./workspace-operation-limiter.js";
+import { RESERVED_WORKSPACE_DIRS } from "./sandbox-fs.js";
+export class WorkspaceService {
+    host;
+    limits;
+    searchLimits;
+    operationLimiter;
+    maxCheckpoints;
+    constructor(host) {
+        this.host = host;
+        this.limits = host.limits ?? DEFAULT_WORKSPACE_LIMITS;
+        this.searchLimits = host.searchLimits ?? DEFAULT_WORKSPACE_SEARCH_LIMITS;
+        this.operationLimiter = host.operationLimiter ?? new SlidingWindowWorkspaceOperationLimiter();
+        this.maxCheckpoints = Math.max(1, Math.floor(host.maxCheckpoints ?? 1_000));
+    }
+    async resolveForRun(run) {
+        return resolveWorkspaceForRun(this.host.state, this.host.agentScope, run);
+    }
+    async loadManifest(workspace, versionId = workspace.headVersionId) {
+        if (versionId === null) {
+            return { manifest: createWorkspaceManifest(workspace.id, [], this.host.now().toISOString()) };
+        }
+        if (!versionId)
+            versionId = workspace.headVersionId;
+        if (!versionId)
+            return { manifest: createWorkspaceManifest(workspace.id, [], this.host.now().toISOString()) };
+        const version = await this.host.state.getWorkspaceVersion(versionId);
+        if (!version || version.workspaceId !== workspace.id)
+            throw new Error(`Workspace version not found: ${versionId}`);
+        const bytes = await this.host.blob.get(version.manifestBlobKey);
+        if (!bytes)
+            throw new Error(`Workspace manifest blob is missing: ${version.manifestBlobKey}`);
+        const sha256 = workspaceManifestSha256(bytes);
+        if (sha256 !== version.manifestSha256)
+            throw new Error(`Workspace manifest hash mismatch: ${version.id}`);
+        const manifest = parseWorkspaceManifest(bytes);
+        if (manifest.workspaceId !== workspace.id && !await this.isInheritedForkManifest(workspace, version)) {
+            throw new Error(`Workspace manifest belongs to another workspace: ${version.id}`);
+        }
+        if (manifest.fileCount !== version.fileCount || manifest.totalBytes !== version.totalBytes) {
+            throw new Error(`Workspace version totals do not match its manifest: ${version.id}`);
+        }
+        return { version, manifest };
+    }
+    async hydrate(run, sandbox, sessionKey) {
+        const workspace = await this.resolveForRun(run);
+        this.operationLimiter.assertAllowed("hydrate", workspace.id, this.host.now());
+        const session = await this.host.state.getSandboxSession(sessionKey);
+        if (session?.dirty) {
+            const sessionWorkspaceId = stringValue(session.manifest.workspaceId);
+            if (sessionWorkspaceId !== workspace.id) {
+                throw new Error(`Dirty sandbox belongs to workspace ${sessionWorkspaceId ?? "unknown"}, not ${workspace.id}.`);
+            }
+            const current = await this.loadManifest(workspace, stringValue(session.manifest.baseVersionId) ?? workspace.headVersionId);
+            return { workspace, ...current, skippedDirty: true };
+        }
+        const current = await this.loadManifest(workspace);
+        this.assertVersionSize(current.manifest, "hydrate");
+        await clearWorkspaceTree(sandbox);
+        for (const entry of current.manifest.entries) {
+            const contents = await this.host.blob.get(entry.blobKey);
+            if (!contents)
+                throw new Error(`Workspace content blob is missing: ${entry.blobKey}`);
+            if (contents.byteLength !== entry.sizeBytes || workspaceManifestSha256(contents) !== entry.sha256) {
+                throw new Error(`Workspace content failed integrity verification: ${entry.path}`);
+            }
+            await sandbox.writeFile(`/workspace/${entry.path}`, contents);
+            if ((entry.mode & 0o111) !== 0) {
+                await sandbox.shell(`chmod 755 -- ${shellQuote(entry.path)}`, { cwd: "/workspace" });
+            }
+        }
+        const manifest = {
+            ...(session?.manifest ?? {}),
+            workspaceId: workspace.id,
+            baseVersionId: workspace.headVersionId ?? null,
+            workspaceManifestSha256: current.version?.manifestSha256 ?? null,
+            sandboxRoot: sandbox.root,
+            sessionKey
+        };
+        await this.host.state.updateSandboxSession(sessionKey, {
+            runId: run.id,
+            sandboxId: sandbox.id,
+            state: "clean",
+            dirty: false,
+            lastSeenAt: this.host.now().toISOString(),
+            manifest
+        });
+        await this.host.state.appendEvent(run.id, "workspace.hydrated", {
+            workspaceId: workspace.id,
+            versionId: workspace.headVersionId ?? null,
+            fileCount: current.manifest.fileCount,
+            totalBytes: current.manifest.totalBytes
+        });
+        return { workspace, ...current, skippedDirty: false };
+    }
+    async sync(input) {
+        const workspace = await this.host.state.getWorkspace(input.workspaceId);
+        if (!workspace)
+            throw new Error(`Workspace not found: ${input.workspaceId}`);
+        const selected = await this.resolveForRun(input.run);
+        if (selected.id !== workspace.id)
+            throw new Error(`Sandbox workspace does not match run workspace: ${workspace.id}`);
+        this.operationLimiter.assertAllowed("sync", workspace.id, this.host.now());
+        const base = await this.loadManifest(workspace, input.baseVersionId);
+        const rawEntries = await listWorkspaceFiles(input.sandbox);
+        const scanned = scanWorkspaceEntries(rawEntries, this.limits);
+        const baseByPath = new Map(base.manifest.entries.map((entry) => [entry.path, entry]));
+        const scannedPaths = new Set(scanned.map((entry) => entry.path));
+        const deletedPaths = base.manifest.entries.filter((entry) => !scannedPaths.has(entry.path)).map((entry) => entry.path);
+        const changedPaths = [];
+        const entries = [];
+        for (const file of scanned) {
+            const previous = baseByPath.get(file.path);
+            if (previous && previous.sha256 === file.sha256 && previous.mode === file.mode) {
+                entries.push(previous);
+                continue;
+            }
+            const blobKey = workspaceContentBlobKey(file.sha256);
+            const blob = await this.host.blob.put(blobKey, file.contents, { contentType: file.contentType, visibility: "private" });
+            if (blob.sha256 !== file.sha256 || blob.size !== file.sizeBytes)
+                throw new Error(`Workspace blob write failed integrity verification: ${file.path}`);
+            changedPaths.push(file.path);
+            entries.push({
+                path: file.path,
+                blobKey: blob.key,
+                sha256: file.sha256,
+                sizeBytes: file.sizeBytes,
+                contentType: file.contentType,
+                mode: file.mode
+            });
+        }
+        const manifest = createWorkspaceManifest(workspace.id, entries, this.host.now().toISOString());
+        const manifestBytes = encodeWorkspaceManifest(manifest);
+        const manifestSha256 = workspaceManifestSha256(manifestBytes);
+        const manifestBlob = await this.host.blob.put(workspaceManifestBlobKey(manifestSha256), manifestBytes, {
+            contentType: "application/json",
+            visibility: "private"
+        });
+        if (manifestBlob.sha256 !== manifestSha256)
+            throw new Error(`Workspace manifest write failed integrity verification: ${workspace.id}`);
+        const committed = await this.host.state.commitWorkspaceVersion({
+            workspaceId: workspace.id,
+            expectedHeadVersionId: input.baseVersionId,
+            manifestBlobKey: manifestBlob.key,
+            manifestSha256,
+            fileCount: manifest.fileCount,
+            totalBytes: manifest.totalBytes,
+            reason: "sync",
+            runId: input.run.id,
+            idempotencyKey: `workspace-sync:${input.syncJobId}`,
+            metadata: { changedPaths, deletedPaths }
+        });
+        const committedManifest = committed.created
+            ? manifest
+            : (await this.loadManifest(committed.workspace, committed.version.id)).manifest;
+        const committedChangedPaths = committed.created
+            ? changedPaths
+            : stringArray(committed.version.metadata.changedPaths);
+        const committedDeletedPaths = committed.created
+            ? deletedPaths
+            : stringArray(committed.version.metadata.deletedPaths);
+        await this.host.state.appendEvent(input.run.id, "workspace.version_created", {
+            workspaceId: workspace.id,
+            versionId: committed.version.id,
+            parentVersionId: committed.version.parentVersionId ?? null,
+            fileCount: committedManifest.fileCount,
+            totalBytes: committedManifest.totalBytes,
+            changedPaths: committedChangedPaths,
+            deletedPaths: committedDeletedPaths,
+            created: committed.created
+        });
+        await this.tryIndexVersion(workspace.id, committed.version.id, input.run.id);
+        return {
+            ...committed,
+            manifest: committedManifest,
+            changedPaths: committedChangedPaths,
+            deletedPaths: committedDeletedPaths
+        };
+    }
+    async status(workspaceId) {
+        const workspace = await this.requireWorkspace(workspaceId);
+        const versions = await this.host.state.listWorkspaceVersions(workspace.id, { limit: 10_000 });
+        const checkpoints = await this.host.state.listWorkspaceCheckpoints(workspace.id);
+        const status = { workspace, checkpoints, versionCount: versions.length };
+        if (workspace.headVersionId) {
+            const head = versions.find((version) => version.id === workspace.headVersionId)
+                ?? await this.host.state.getWorkspaceVersion(workspace.headVersionId);
+            if (!head)
+                throw new Error(`Workspace head version is missing: ${workspace.headVersionId}`);
+            status.head = head;
+        }
+        return status;
+    }
+    async statusForRun(run) {
+        return this.status((await this.resolveForRun(run)).id);
+    }
+    retention(workspaceId, input = {}) {
+        return this.operations().retention(workspaceId, input);
+    }
+    reachability() {
+        return this.operations().reachability();
+    }
+    garbageCollect(input = {}) {
+        return this.operations().garbageCollect(input);
+    }
+    usage() {
+        return this.operations().usage();
+    }
+    diagnostics() {
+        return this.operations().diagnostics();
+    }
+    verify(workspaceId) {
+        return this.operations().verify(workspaceId);
+    }
+    repairBlob(input) {
+        return this.operations().repairBlob(input);
+    }
+    repairHead(input) {
+        return this.operations().repairHead(input);
+    }
+    async readFile(workspaceId, path, versionId) {
+        const workspace = await this.requireWorkspace(workspaceId);
+        const current = await this.loadManifest(workspace, versionId);
+        if (!current.version)
+            throw new Error(`Workspace has no committed version: ${workspace.id}`);
+        const normalized = normalizeWorkspaceRelativePath(path);
+        const entry = current.manifest.entries.find((candidate) => candidate.path === normalized);
+        if (!entry)
+            throw new Error(`Workspace file not found: ${normalized}`);
+        const contents = await this.host.blob.get(entry.blobKey);
+        if (!contents)
+            throw new Error(`Workspace content blob is missing: ${entry.blobKey}`);
+        if (contents.byteLength !== entry.sizeBytes || workspaceManifestSha256(contents) !== entry.sha256) {
+            throw new Error(`Workspace content failed integrity verification: ${entry.path}`);
+        }
+        return { workspaceId: workspace.id, versionId: current.version.id, entry, contents };
+    }
+    async listFiles(workspaceId, input = {}) {
+        const workspace = await this.requireWorkspace(workspaceId);
+        const current = await this.loadManifest(workspace, input.versionId);
+        if (!current.version)
+            throw new Error(`Workspace has no committed version: ${workspace.id}`);
+        const prefix = input.prefix ? normalizeWorkspaceRelativePath(input.prefix).replace(/\/$/u, "") : undefined;
+        const entries = prefix
+            ? current.manifest.entries.filter((entry) => entry.path === prefix || entry.path.startsWith(`${prefix}/`))
+            : current.manifest.entries;
+        return { workspaceId: workspace.id, versionId: current.version.id, entries };
+    }
+    async grep(workspaceId, pattern, input = {}) {
+        if (!pattern || pattern.length > 1_000)
+            throw new Error("Workspace grep pattern must contain 1 to 1000 characters.");
+        const workspace = await this.requireWorkspace(workspaceId);
+        const current = await this.loadManifest(workspace, input.versionId);
+        if (!current.version)
+            throw new Error(`Workspace has no committed version: ${workspace.id}`);
+        const flags = input.caseSensitive === true ? "g" : "gi";
+        const source = input.literal === false ? pattern : escapeRegExp(pattern);
+        let matcher;
+        try {
+            matcher = new RegExp(source, flags);
+        }
+        catch (error) {
+            throw new Error(`Invalid workspace grep pattern: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const limit = boundedSearchLimit(input.limit, 100);
+        const results = [];
+        for (const entry of current.manifest.entries) {
+            if (!entry.contentType.startsWith("text/") && entry.contentType !== "application/json")
+                continue;
+            const file = await this.readFile(workspace.id, entry.path, current.version.id);
+            const lines = Buffer.from(file.contents).toString("utf8").split("\n");
+            for (let index = 0; index < lines.length; index += 1) {
+                const line = lines[index] ?? "";
+                matcher.lastIndex = 0;
+                const match = matcher.exec(line);
+                if (!match)
+                    continue;
+                results.push({ path: entry.path, versionId: current.version.id, line: index + 1, column: match.index + 1, text: line });
+                if (results.length >= limit)
+                    return { workspaceId: workspace.id, versionId: current.version.id, results };
+            }
+        }
+        return { workspaceId: workspace.id, versionId: current.version.id, results };
+    }
+    async indexVersion(workspaceId, versionId) {
+        const workspace = await this.requireWorkspace(workspaceId);
+        const current = await this.loadManifest(workspace, versionId);
+        if (!current.version)
+            throw new Error(`Workspace has no committed version: ${workspace.id}`);
+        const built = await buildWorkspaceSearchChunks({
+            workspaceId: workspace.id,
+            versionId: current.version.id,
+            manifest: current.manifest,
+            blob: this.host.blob,
+            now: this.host.now(),
+            limits: this.searchLimits,
+            ...(this.host.embeddingProvider ? { embeddingProvider: this.host.embeddingProvider } : {})
+        });
+        const index = await this.host.state.replaceWorkspaceSearchChunks({
+            workspaceId: workspace.id,
+            versionId: current.version.id,
+            chunks: built.chunks,
+            ...(built.embeddingModel ? { embeddingModel: built.embeddingModel } : {})
+        });
+        return { ...index, excluded: built.excluded };
+    }
+    async search(workspaceId, query, input = {}) {
+        if (!query.trim() || query.length > 2_000)
+            throw new Error("Workspace search query must contain 1 to 2000 characters.");
+        const workspace = await this.requireWorkspace(workspaceId);
+        const current = await this.loadManifest(workspace, input.versionId);
+        if (!current.version)
+            throw new Error(`Workspace has no committed version: ${workspace.id}`);
+        const index = await this.host.state.getWorkspaceSearchIndex(workspace.id);
+        const indexStale = index?.versionId !== current.version.id;
+        if (indexStale) {
+            return {
+                workspaceId: workspace.id,
+                versionId: current.version.id,
+                ...(index ? { indexedVersionId: index.versionId } : {}),
+                indexStale: true,
+                results: await directWorkspaceSearch({
+                    workspaceId: workspace.id,
+                    versionId: current.version.id,
+                    manifest: current.manifest,
+                    blob: this.host.blob,
+                    query,
+                    ...(input.limit !== undefined ? { limit: input.limit } : {}),
+                    limits: this.searchLimits
+                })
+            };
+        }
+        const fullText = await this.host.state.searchWorkspaceChunks({
+            workspaceId: workspace.id,
+            versionId: current.version.id,
+            query,
+            ...(input.limit !== undefined ? { limit: input.limit } : {})
+        });
+        let results = fullText;
+        if (this.host.embeddingProvider && index.embeddingModel) {
+            try {
+                const embedded = await embedWorkspaceSearchQuery(this.host.embeddingProvider, query);
+                const semantic = await this.host.state.searchWorkspaceEmbeddings({
+                    workspaceId: workspace.id,
+                    versionId: current.version.id,
+                    embedding: embedded.embedding,
+                    model: embedded.model,
+                    ...(input.limit !== undefined ? { limit: input.limit } : {})
+                });
+                results = mergeWorkspaceSearchResults(fullText, semantic, input.limit);
+            }
+            catch {
+                results = fullText;
+            }
+        }
+        return {
+            workspaceId: workspace.id,
+            versionId: current.version.id,
+            indexedVersionId: index.versionId,
+            indexStale: false,
+            results
+        };
+    }
+    async createCheckpoint(input) {
+        const workspace = await this.requireWorkspace(input.workspaceId);
+        this.operationLimiter.assertAllowed("checkpoint", workspace.id, this.host.now());
+        if (!workspace.headVersionId)
+            throw new Error(`Workspace has no version to checkpoint: ${workspace.id}`);
+        const name = normalizeCheckpointName(input.name);
+        const head = await this.host.state.getWorkspaceVersion(workspace.headVersionId);
+        if (!head)
+            throw new Error(`Workspace head version is missing: ${workspace.headVersionId}`);
+        const current = await this.loadManifest(workspace, head.id);
+        this.assertVersionSize(current.manifest, "checkpoint");
+        const existingCheckpoint = await this.host.state.getWorkspaceCheckpoint(workspace.id, name);
+        if (!existingCheckpoint && (await this.host.state.listWorkspaceCheckpoints(workspace.id)).length >= this.maxCheckpoints) {
+            throw new Error(`Workspace checkpoint limit exceeded. Maximum is ${this.maxCheckpoints}.`);
+        }
+        const checkpoint = await this.host.state.createWorkspaceCheckpoint({
+            workspaceId: workspace.id,
+            name,
+            versionId: workspace.headVersionId,
+            ...(input.replace !== undefined ? { replace: input.replace } : {})
+        });
+        if (input.runId) {
+            await this.host.state.appendEvent(input.runId, "workspace.checkpoint_created", {
+                workspaceId: workspace.id,
+                checkpointId: checkpoint.id,
+                name: checkpoint.name,
+                versionId: checkpoint.versionId,
+                replaced: input.replace === true
+            });
+        }
+        return checkpoint;
+    }
+    async listCheckpoints(workspaceId) {
+        await this.requireWorkspace(workspaceId);
+        return this.host.state.listWorkspaceCheckpoints(workspaceId);
+    }
+    async getCheckpoint(workspaceId, name) {
+        await this.requireWorkspace(workspaceId);
+        return this.host.state.getWorkspaceCheckpoint(workspaceId, normalizeCheckpointName(name));
+    }
+    async deleteCheckpoint(input) {
+        await this.requireWorkspace(input.workspaceId);
+        const name = normalizeCheckpointName(input.name);
+        const deleted = await this.host.state.deleteWorkspaceCheckpoint(input.workspaceId, name);
+        if (deleted && input.runId) {
+            await this.host.state.appendEvent(input.runId, "workspace.checkpoint_deleted", {
+                workspaceId: input.workspaceId,
+                name
+            });
+        }
+        return deleted;
+    }
+    async restoreCheckpoint(input) {
+        const workspace = await this.requireWorkspace(input.workspaceId);
+        this.operationLimiter.assertAllowed("restore", workspace.id, this.host.now());
+        const name = normalizeCheckpointName(input.name);
+        const checkpoint = await this.host.state.getWorkspaceCheckpoint(workspace.id, name);
+        if (!checkpoint)
+            throw new Error(`Workspace checkpoint not found: ${name}`);
+        const source = await this.host.state.getWorkspaceVersion(checkpoint.versionId);
+        if (!source || source.workspaceId !== workspace.id)
+            throw new Error(`Workspace checkpoint version is missing: ${checkpoint.versionId}`);
+        const current = await this.loadManifest(workspace, source.id);
+        this.assertVersionSize(current.manifest, "restore");
+        const restored = await this.host.state.commitWorkspaceVersion({
+            workspaceId: workspace.id,
+            expectedHeadVersionId: workspace.headVersionId ?? null,
+            manifestBlobKey: source.manifestBlobKey,
+            manifestSha256: source.manifestSha256,
+            fileCount: source.fileCount,
+            totalBytes: source.totalBytes,
+            reason: "restore",
+            ...(input.runId ? { runId: input.runId } : {}),
+            sourceVersionId: source.id,
+            sourceCheckpointId: checkpoint.id,
+            idempotencyKey: input.idempotencyKey ?? `workspace-restore:${workspace.id}:${checkpoint.id}:${workspace.headVersionId ?? "empty"}:${randomUUID()}`,
+            metadata: { checkpointName: checkpoint.name }
+        });
+        if (input.runId) {
+            await this.host.state.appendEvent(input.runId, "workspace.restored", {
+                workspaceId: workspace.id,
+                checkpointId: checkpoint.id,
+                checkpointName: checkpoint.name,
+                sourceVersionId: source.id,
+                previousHeadVersionId: workspace.headVersionId ?? null,
+                versionId: restored.version.id,
+                created: restored.created
+            });
+        }
+        await this.tryIndexVersion(workspace.id, restored.version.id, input.runId);
+        return restored;
+    }
+    async fork(input) {
+        const sourceWorkspace = await this.requireWorkspace(input.sourceWorkspaceId);
+        this.operationLimiter.assertAllowed("fork", sourceWorkspace.id, this.host.now());
+        if (sourceWorkspace.scope.tenantId !== input.tenantId) {
+            throw new Error(`Workspace is outside the tenant scope: ${sourceWorkspace.id}`);
+        }
+        let sourceVersionId = input.sourceVersionId ?? sourceWorkspace.headVersionId;
+        if (input.checkpointName) {
+            const checkpoint = await this.host.state.getWorkspaceCheckpoint(sourceWorkspace.id, normalizeCheckpointName(input.checkpointName));
+            if (!checkpoint)
+                throw new Error(`Workspace checkpoint not found: ${input.checkpointName}`);
+            sourceVersionId = checkpoint.versionId;
+        }
+        if (!sourceVersionId)
+            throw new Error(`Workspace has no version to fork: ${sourceWorkspace.id}`);
+        const sourceVersion = await this.host.state.getWorkspaceVersion(sourceVersionId);
+        if (!sourceVersion || sourceVersion.workspaceId !== sourceWorkspace.id) {
+            throw new Error(`Workspace version does not belong to source workspace: ${sourceVersionId}`);
+        }
+        const current = await this.loadManifest(sourceWorkspace, sourceVersion.id);
+        this.assertVersionSize(current.manifest, "fork");
+        const workspaceId = input.workspaceId ?? randomUUID();
+        const scope = {
+            agentScope: this.host.agentScope,
+            kind: "explicit",
+            scopeId: workspaceId,
+            ...(input.tenantId ? { tenantId: input.tenantId } : {})
+        };
+        const forked = await this.host.state.forkWorkspace({
+            id: workspaceId,
+            sourceWorkspaceId: sourceWorkspace.id,
+            sourceVersionId,
+            scope,
+            scopeKey: workspaceScopeKey(scope),
+            ...(input.name ? { name: input.name } : {})
+        });
+        if (forked.headVersionId)
+            await this.tryIndexVersion(forked.id, forked.headVersionId);
+        return forked;
+    }
+    async tryIndexVersion(workspaceId, versionId, runId) {
+        try {
+            const indexed = await this.indexVersion(workspaceId, versionId);
+            if (runId) {
+                await this.host.state.appendEvent(runId, "workspace.indexed", {
+                    workspaceId,
+                    versionId,
+                    chunkCount: indexed.chunkCount,
+                    excludedCount: indexed.excluded.length,
+                    embeddingModel: indexed.embeddingModel ?? null
+                });
+            }
+        }
+        catch (error) {
+            if (runId) {
+                await this.host.state.appendEvent(runId, "workspace.index_failed", {
+                    workspaceId,
+                    versionId,
+                    error: error instanceof Error ? error.message : String(error)
+                });
+            }
+        }
+    }
+    async requireWorkspace(workspaceId) {
+        const workspace = await this.host.state.getWorkspace(workspaceId);
+        if (!workspace)
+            throw new Error(`Workspace not found: ${workspaceId}`);
+        if (workspace.scope.agentScope !== this.host.agentScope) {
+            throw new Error(`Workspace is outside the agent scope: ${workspace.id}`);
+        }
+        return workspace;
+    }
+    async isInheritedForkManifest(workspace, version) {
+        if (version.reason !== "fork" || !version.sourceVersionId || !workspace.sourceWorkspaceId)
+            return false;
+        const source = await this.host.state.getWorkspaceVersion(version.sourceVersionId);
+        return Boolean(source &&
+            source.workspaceId === workspace.sourceWorkspaceId &&
+            source.manifestBlobKey === version.manifestBlobKey &&
+            source.manifestSha256 === version.manifestSha256);
+    }
+    operations() {
+        return new WorkspaceOperations({
+            state: this.host.state,
+            blob: this.host.blob,
+            agentScope: this.host.agentScope,
+            now: this.host.now,
+            requireWorkspace: (workspaceId) => this.requireWorkspace(workspaceId),
+            loadManifest: (workspace, versionId) => this.loadManifest(workspace, versionId)
+        });
+    }
+    assertVersionSize(manifest, operation) {
+        if (manifest.fileCount > this.limits.maxFiles || manifest.totalBytes > this.limits.maxTotalBytes ||
+            manifest.entries.some((entry) => entry.sizeBytes > this.limits.maxFileBytes)) {
+            throw new Error(`Workspace ${operation} exceeds the configured file or byte limit.`);
+        }
+    }
+}
+export function workspaceContentBlobKey(sha256) {
+    return `workspaces/content/${sha256.slice(0, 2)}/${sha256}`;
+}
+export function workspaceManifestBlobKey(sha256) {
+    return `workspaces/manifests/${sha256.slice(0, 2)}/${sha256}.json`;
+}
+async function clearWorkspaceTree(sandbox) {
+    const entries = await listWorkspaceFiles(sandbox);
+    if (entries.length === 0)
+        return;
+    if (!sandbox.deletePath)
+        throw new Error("Sandbox adapter must support deletePath for durable workspace hydration.");
+    for (const entry of entries)
+        await sandbox.deletePath(`/workspace/${entry.path}`, { recursive: false });
+}
+async function listWorkspaceFiles(sandbox) {
+    if (!sandbox.listFiles)
+        throw new Error("Sandbox adapter must support listFiles for durable workspaces.");
+    const listed = await sandbox.listFiles("/workspace", {
+        excludeTopLevel: RESERVED_WORKSPACE_DIRS,
+        includeContents: true
+    });
+    const entries = [];
+    for (const entry of listed) {
+        const relative = relativeWorkspacePath(entry.path);
+        if (!relative || relative === ".keep")
+            continue;
+        entries.push({ ...entry, path: relative });
+    }
+    return entries;
+}
+function relativeWorkspacePath(path) {
+    const normalized = path.replace(/\\/g, "/").replace(/\/+/g, "/");
+    const relative = normalized === "/workspace"
+        ? ""
+        : normalized.startsWith("/workspace/")
+            ? normalized.slice("/workspace/".length)
+            : normalized.replace(/^\/+/, "");
+    return relative ? normalizeWorkspaceRelativePath(relative) : "";
+}
+function stringValue(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function stringArray(value) {
+    return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+function normalizeCheckpointName(value) {
+    const name = value.trim();
+    if (!name || name.length > 128 || /[\u0000-\u001f\u007f]/u.test(name)) {
+        throw new Error("Workspace checkpoint names must contain 1 to 128 visible characters.");
+    }
+    return name;
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+}
+function boundedSearchLimit(value, fallback) {
+    return Math.max(1, Math.min(1_000, Math.floor(value ?? fallback)));
+}
+//# sourceMappingURL=workspace-service.js.map