@bastani/atomic 0.9.12 → 0.9.13-alpha.2

package/dist/core/tools/session-temp-dir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-temp-dir.js","sourceRoot":"","sources":["../../../src/core/tools/session-temp-dir.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAc,MAAM,SAAS,CAAC;AAC5F,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACN,4CAA4C,EAC5C,8BAA8B,GAC9B,MAAM,iCAAiC,CAAC;AAEzC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAE3C,8DAA8D;AAC9D,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAE5C,0EAA0E;AAC1E,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC,MAAM,0BAA0B,GAAG,SAAS,CAAC;AAC7C,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAExC;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,QAAgB;IACxE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC;IAC3B,OAAO,KAAK,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9E,KAAK,EAAE,CAAC;IACT,CAAC;IACD,OAAO,GAAG,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAClF,GAAG,EAAE,CAAC;IACP,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;IAClF,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpD,CAAC;AAED,IAAI,oBAAwC,CAAC;AAE7C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACvD,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,sCAAsC;IACtC,MAAM,UAAU,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAC;IACjF,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjF,OAAO,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAwB;IACxD,MAAM,OAAO,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACvE,wEAAwE;IACxE,kEAAkE;IAClE,kEAAkE;IAClE,+DAA+D;IAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IACzE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc;IACtB,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,oBAAoB,CAAC;IAC7B,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO,oBAAoB,CAAC;IAC7B,CAAC;IACD,IAAI,IAAwB,CAAC;IAC7B,IAAI,CAAC;QACJ,IAAI,GAAG,QAAQ,EAAE,CAAC,QAAQ,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,sEAAsE;QACtE,oEAAoE;QACpE,IAAI,GAAG,SAAS,CAAC;IAClB,CAAC;IACD,oBAAoB,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,OAAO,oBAAoB,CAAC;AAC7B,CAAC;AAOD,IAAI,kBAA4C,CAAC;AAEjD;;;;GAIG;AACH,SAAS,YAAY;IACpB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,IAAI,kBAAkB,EAAE,GAAG,KAAK,GAAG,EAAE,CAAC;QACrC,OAAO,kBAAkB,CAAC;IAC3B,CAAC;IACD,IAAI,SAAS,GAAG,GAAG,CAAC;IACpB,IAAI,CAAC;QACJ,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,sDAAsD;IACvD,CAAC;IACD,kBAAkB,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IACxC,OAAO,kBAAkB,CAAC;AAC3B,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc;IAC7B,MAAM,GAAG,GAAG,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,cAAc,EAAE,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAAkB;IAC3D,MAAM,EAAE,GAAG,SAAS,IAAI,eAAe,IAAI,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;IAChE,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,yBAAyB,CAAC,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;AAEtC,2EAA2E;AAC3E,SAAS,eAAe,CAAC,IAAY;IACpC,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,mGAAmG;AACnG,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,IAAY,EAAE,MAAc;QACvC,KAAK,CAAC,kCAAkC,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACnC,CAAC;CACD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,oBAAoB,CAAC,IAAY,EAAE,KAAa;IACxD,IAAI,IAAI,GAAG,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO;IACR,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACjD,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,qBAAqB,EAAE,CAAC;QACnD,OAAO;IACR,CAAC;IACD,IAAI,CAAC;QACJ,SAAS,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACvC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,wCAAwC,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,qBAAqB,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,wCAAwC,CAAC,CAAC;IAC/E,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACzC,IAAI,IAAuB,CAAC;IAC5B,IAAI,CAAC;QACJ,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,IAAI,GAAG,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC;YACJ,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,uEAAuE;YACvE,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACtC,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;YAChE,CAAC;QACF,CAAC;QACD,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO;IACR,CAAC;IACD,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACvC,IAAI,CAAC;QACJ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,wEAAwE;IACzE,CAAC;IACD,oBAAoB,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,+EAA+E;AAC/E,SAAS,kBAAkB,CAAC,GAAW,EAAE,IAAkB;IAC1D,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,GAAG,SAAS,GAAG,GAAG,EAAE,CAAC;QACpC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AACD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACxC,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU;aACtB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACP,sEAAsE;QACtE,0EAA0E;QAC1E,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACrD,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAC1E,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACF,CAAC;IACD,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAkB;IACnD,OAAO,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,oBAAoB,CAAC,WAAoB;IACxD,OAAO,aAAa,CAAC,WAAW,IAAI,yBAAyB,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,IAAI,eAAmC,CAAC;AAExC;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAOtD,4DAA4D;AAC5D,MAAM,UAAU,qBAAqB,CAAC,KAAwB;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC5B,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO;QACN,OAAO;YACN,IAAI,QAAQ,EAAE,CAAC;gBACd,OAAO;YACR,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,SAAS,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC3D,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;oBACnB,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC1C,CAAC;qBAAM,CAAC;oBACP,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAClC,CAAC;YACF,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACvD,eAAe,GAAG,SAAS,CAAC;IAC5B,OAAO,yBAAyB,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,2BAA2B;IAC1C,OAAO,IAAI,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,kCAAkC;IACjD,eAAe,GAAG,SAAS,CAAC;IAC5B,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC5B,WAAW,CAAC,KAAK,EAAE,CAAC;IACpB,oBAAoB,GAAG,SAAS,CAAC;IACjC,kBAAkB,GAAG,SAAS,CAAC;IAC/B,4CAA4C,EAAE,CAAC;AAChD,CAAC","sourcesContent":["/**\n * Owner- and session-scoped temp storage for tool output files.\n *\n * Every file a tool spills to the system temp directory (bash overflow logs,\n * async bash logs, `OutputAccumulator` spill files, and the in-memory-session\n * tool-result fallback) lands under:\n *\n * ```text\n * <tmpdir>/<APP_NAME>-<owner>/<sanitized-session-id>/\n * ```\n *\n * The owner segment mirrors the upstream Claude Code `claude-{uid}` convention\n * (mehmoodosman/claude-code): a shared multi-user temp directory must never let\n * one account write into (or read) another account's tree. The session segment\n * makes the tree reapable as a unit by the age-based sweeper in\n * `session-temp-cleanup.ts` once the session is long gone.\n */\n\nimport { createHash } from \"node:crypto\";\nimport { chmodSync, lstatSync, mkdirSync, realpathSync, rmSync, type Stats } from \"node:fs\";\nimport { tmpdir, userInfo } from \"node:os\";\nimport { dirname, join, sep } from \"node:path\";\nimport { APP_NAME } from \"../../config.ts\";\nimport { getErrnoCode } from \"./errno.ts\";\nimport {\n\tresetWindowsDirectorySecurityStateForTesting,\n\tverifyWindowsDirectorySecurity,\n} from \"./windows-directory-security.ts\";\n\n/** Directory mode for every directory this module creates (owner-only). */\nexport const SESSION_TEMP_DIR_MODE = 0o700;\n\n/** File mode for persisted tool-output files (owner-only). */\nexport const SESSION_TEMP_FILE_MODE = 0o600;\n\n/** Longest path component this module will emit for a sanitized value. */\nconst MAX_PATH_COMPONENT_LENGTH = 64;\n\nconst FALLBACK_SESSION_COMPONENT = \"session\";\nconst FALLBACK_OWNER_COMPONENT = \"user\";\n\n/**\n * Reduce a value to a single safe path component.\n *\n * Disallowed characters collapse to `_`; leading `.`/`_` and trailing `.`/`_`\n * are stripped so the result can never be `.`, `..`, a hidden sweeper marker\n * file name, or anything that escapes the parent directory. Trimming uses a\n * linear scan rather than a `/^[._]+|[._]+$/` regex to avoid polynomial-time\n * backtracking on adversarial ids (CodeQL js/polynomial-redos).\n */\nexport function sanitizeTempPathComponent(value: string, fallback: string): string {\n\tconst collapsed = value.replace(/[^a-zA-Z0-9._-]+/g, \"_\");\n\tlet start = 0;\n\tlet end = collapsed.length;\n\twhile (start < end && (collapsed[start] === \"_\" || collapsed[start] === \".\")) {\n\t\tstart++;\n\t}\n\twhile (end > start && (collapsed[end - 1] === \"_\" || collapsed[end - 1] === \".\")) {\n\t\tend--;\n\t}\n\tconst sanitized = collapsed.slice(start, end).slice(0, MAX_PATH_COMPONENT_LENGTH);\n\treturn sanitized.length > 0 ? sanitized : fallback;\n}\n\nlet cachedOwnerComponent: string | undefined;\n\n/**\n * Derive the owner component for a named (non-uid) account.\n *\n * Sanitizing a name to a safe path component is lossy, and two distinct\n * accounts can reduce to the same component (`aliceé` and `aliceø` both yield\n * `alice_`). Where the system temp directory is machine-wide and\n * shared-accessible, that would put two accounts in one tree. Appending a short\n * digest of the raw identity keeps distinct accounts on distinct roots, with\n * the readable component in front so the directory stays recognizable.\n *\n * This prevents collision; it is not owner verification. Ownership is proven\n * separately by `verifyOwnedDirectory` — a uid check on POSIX, an owner-SID\n * and DACL check on Windows.\n *\n * Exported as a pure function so the collision property can be tested directly:\n * its only caller reaches this branch on Windows, which a POSIX test host\n * cannot enter.\n */\nexport function deriveOwnerComponent(rawIdentity: string): string {\n\t// Windows account names are case-insensitive, so `Alice` and `alice` are one\n\t// account and must resolve to one root. Normalize before both the readable\n\t// component and the digest: normalizing only the digest would still emit two\n\t// spellings of one directory, which NTFS then treats as the same path while\n\t// the sweeper's bookkeeping sees two.\n\tconst normalized = rawIdentity.toLowerCase();\n\tconst readable = sanitizeTempPathComponent(normalized, FALLBACK_OWNER_COMPONENT);\n\tconst digest = createHash(\"sha256\").update(normalized).digest(\"hex\").slice(0, 8);\n\treturn `${readable}-${digest}`;\n}\n\n/**\n * Assemble the account identity used where there is no uid.\n *\n * `userInfo().username` returns the bare account name, so `CONTOSO\\Alice` and\n * `FABRIKAM\\Alice` would otherwise be one identity and share a tree. Exported\n * for tests: its caller only reaches this branch on Windows.\n */\nexport function windowsPrincipal(name: string | undefined): string {\n\tconst account = name || process.env.USERNAME || process.env.USER || \"\";\n\t// USERDOMAIN is the NetBIOS domain and is set for both domain and local\n\t// accounts; USERDNSDOMAIN appears only on domain-joined hosts and\n\t// distinguishes two forests that share a NetBIOS name. Neither is\n\t// authoritative on its own, so both take part in the identity.\n\tconst domain = process.env.USERDNSDOMAIN || process.env.USERDOMAIN || \"\";\n\treturn domain ? `${domain}\\\\${account}` : account;\n}\n\n/**\n * Identify the account that owns the temp tree.\n *\n * POSIX uses the numeric uid, which is already collision-free. Windows has no\n * `process.getuid`, so the domain-qualified principal stands in.\n */\nfunction ownerComponent(): string {\n\tif (cachedOwnerComponent !== undefined) {\n\t\treturn cachedOwnerComponent;\n\t}\n\tconst uid = typeof process.getuid === \"function\" ? process.getuid() : undefined;\n\tif (typeof uid === \"number\" && Number.isFinite(uid)) {\n\t\tcachedOwnerComponent = String(uid);\n\t\treturn cachedOwnerComponent;\n\t}\n\tlet name: string | undefined;\n\ttry {\n\t\tname = userInfo().username;\n\t} catch {\n\t\t// A container without a passwd entry cannot name the account; the env\n\t\t// fallback inside windowsPrincipal still separates the common case.\n\t\tname = undefined;\n\t}\n\tcachedOwnerComponent = deriveOwnerComponent(windowsPrincipal(name));\n\treturn cachedOwnerComponent;\n}\n\ninterface BaseTempDirs {\n\traw: string;\n\tcanonical: string;\n}\n\nlet cachedBaseTempDirs: BaseTempDirs | undefined;\n\n/**\n * Preserve the OS-provided temp spelling for returned paths while caching a\n * canonical form for internal component checks (macOS `/var` → `/private/var`,\n * for example). Nothing below the base is resolved through `realpath`.\n */\nfunction baseTempDirs(): BaseTempDirs {\n\tconst raw = tmpdir();\n\tif (cachedBaseTempDirs?.raw === raw) {\n\t\treturn cachedBaseTempDirs;\n\t}\n\tlet canonical = raw;\n\ttry {\n\t\tcanonical = realpathSync(raw);\n\t} catch {\n\t\t// An unresolvable temp directory is checked as given.\n\t}\n\tcachedBaseTempDirs = { raw, canonical };\n\treturn cachedBaseTempDirs;\n}\n\n/** `<tmpdir>/<APP_NAME>-<owner>` — the root every session temp tree lives under. */\nexport function getTempRootDir(): string {\n\tconst app = sanitizeTempPathComponent(APP_NAME, \"atomic\");\n\treturn join(baseTempDirs().raw, `${app}-${ownerComponent()}`);\n}\n\n/**\n * The temp directory path for a session, without creating it.\n *\n * Falls back to the process-scoped component when no session id is available,\n * so a tool running outside a transcript session still writes inside the\n * owner-scoped root instead of directly into the system temp directory.\n */\nexport function resolveSessionTempDirPath(sessionId?: string): string {\n\tconst id = sessionId ?? activeSessionId ?? `pid-${process.pid}`;\n\treturn join(getTempRootDir(), sanitizeTempPathComponent(id, FALLBACK_SESSION_COMPONENT));\n}\n\nconst ensuredDirs = new Set<string>();\n\n/** An existing real directory — not a symlink, not a file, not missing. */\nfunction isRealDirectory(path: string): boolean {\n\ttry {\n\t\tconst stat = lstatSync(path);\n\t\treturn stat.isDirectory() && !stat.isSymbolicLink();\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/** Raised when a temp directory cannot be created or trusted; callers degrade to no spill file. */\nexport class TempDirRefusedError extends Error {\n\tconstructor(path: string, reason: string) {\n\t\tsuper(`Refusing to use temp directory ${path}: ${reason}`);\n\t\tthis.name = \"TempDirRefusedError\";\n\t}\n}\n\n/**\n * Confirm one existing component is a directory this account owns, at mode 0700.\n *\n * A looser mode is tightened and re-checked; a component owned by another\n * account, or one whose mode cannot be tightened, is refused rather than used.\n *\n * Windows has no uid or POSIX mode, so the proof comes from the security\n * descriptor instead: the owner SID must be a trusted principal and the DACL\n * must grant access to trusted principals only\n * (see `windows-directory-security.ts`). Node exposes neither — `lstatSync`\n * reports uid/gid 0 on Windows — so the read goes through a PowerShell\n * `Get-Acl` subprocess. Successful verifications are cached per path per\n * process, keyed to the directory's metadata identity so a swapped directory\n * or an in-place DACL edit forces a fresh read. Domain-qualifying the\n * principal (see `windowsPrincipal`) stops two accounts *colliding* by\n * accident, which is a different problem and is not a substitute for this\n * verification.\n */\nfunction verifyOwnedDirectory(path: string, known?: Stats): void {\n\tlet stat = known ?? lstatSync(path);\n\tif (stat.isSymbolicLink()) {\n\t\tthrow new TempDirRefusedError(path, \"it is a symbolic link\");\n\t}\n\tif (!stat.isDirectory()) {\n\t\tthrow new TempDirRefusedError(path, \"it is not a directory\");\n\t}\n\tif (process.platform === \"win32\") {\n\t\tconst refusal = verifyWindowsDirectorySecurity(path);\n\t\tif (refusal !== undefined) {\n\t\t\tthrow new TempDirRefusedError(path, refusal);\n\t\t}\n\t\treturn;\n\t}\n\tconst uid = typeof process.getuid === \"function\" ? process.getuid() : undefined;\n\tif (typeof uid === \"number\" && stat.uid !== uid) {\n\t\tthrow new TempDirRefusedError(path, \"it is owned by another account\");\n\t}\n\tif ((stat.mode & 0o777) === SESSION_TEMP_DIR_MODE) {\n\t\treturn;\n\t}\n\ttry {\n\t\tchmodSync(path, SESSION_TEMP_DIR_MODE);\n\t\tstat = lstatSync(path);\n\t} catch {\n\t\tthrow new TempDirRefusedError(path, \"its permissions could not be tightened\");\n\t}\n\tif ((stat.mode & 0o777) !== SESSION_TEMP_DIR_MODE) {\n\t\tthrow new TempDirRefusedError(path, \"its permissions could not be tightened\");\n\t}\n}\n\n/**\n * Create or adopt one path component, never following a link to get there.\n *\n * Creation is non-recursive on purpose: `mkdir -p` resolves an existing symlink\n * on the way down, which is how a link planted at the predictable owner root\n * redirects every later write outside the tree.\n */\nfunction ensureOwnedDirectory(path: string): void {\n\tlet stat: Stats | undefined;\n\ttry {\n\t\tstat = lstatSync(path);\n\t} catch {\n\t\tstat = undefined;\n\t}\n\tif (stat === undefined) {\n\t\ttry {\n\t\t\tmkdirSync(path, { recursive: false, mode: SESSION_TEMP_DIR_MODE });\n\t\t} catch (error) {\n\t\t\t// A concurrent creator winning the race is fine; anything else is not.\n\t\t\tif (getErrnoCode(error) !== \"EEXIST\") {\n\t\t\t\tthrow new TempDirRefusedError(path, \"it could not be created\");\n\t\t\t}\n\t\t}\n\t\tverifyOwnedDirectory(path);\n\t\treturn;\n\t}\n\tverifyOwnedDirectory(path, stat);\n}\n\n/**\n * Adopt the final component, replacing something that is not a directory.\n *\n * Only the leaf gets this treatment: a stale file or link left where a session\n * directory belongs is ours to clear, and removing a symlink removes the link\n * alone. A parent — above all the owner root — is refused instead, because\n * deleting it would be acting on a directory this process does not own.\n */\nfunction ensureLeafDirectory(dir: string): void {\n\ttry {\n\t\tif (!lstatSync(dir).isDirectory()) {\n\t\t\trmSync(dir, { force: true });\n\t\t}\n\t} catch {\n\t\t// Nothing at the path yet, or it cannot be inspected; creation decides.\n\t}\n\tensureOwnedDirectory(dir);\n}\n\n/** Map a lexical temp child to the same path below the canonical temp base. */\nfunction canonicalTempChild(dir: string, base: BaseTempDirs): string | undefined {\n\tfor (const candidate of [base.raw, base.canonical]) {\n\t\tconst prefix = `${candidate}${sep}`;\n\t\tif (dir.startsWith(prefix)) {\n\t\t\treturn join(base.canonical, dir.slice(prefix.length));\n\t\t}\n\t}\n\treturn undefined;\n}\n/**\n * Create `dir` with owner-only permissions, validating every component below the\n * system temp directory.\n *\n * Temp children always revalidate the canonical owner root and every later\n * component, even after a cache hit. A system temp reaper can delete a session\n * tree, and an attacker must not turn a memoized path into a symlink bypass.\n * Caller-owned paths outside the temp base may use the memo after confirming\n * the leaf is still a real directory.\n *\n * Throws {@link TempDirRefusedError} when a component cannot be trusted. Every\n * caller treats that as \"no spill file\", never as a fatal error: failing closed\n * loses a convenience artifact, while failing open writes tool output into a\n * directory someone else controls.\n */\nexport function ensureTempDir(dir: string): string {\n\tconst base = baseTempDirs();\n\tconst checkedDir = canonicalTempChild(dir, base);\n\tif (checkedDir !== undefined) {\n\t\tconst prefix = `${base.canonical}${sep}`;\n\t\tconst parts = checkedDir\n\t\t\t.slice(prefix.length)\n\t\t\t.split(sep)\n\t\t\t.filter((part) => part.length > 0);\n\t\tlet current = base.canonical;\n\t\tfor (const part of parts.slice(0, -1)) {\n\t\t\tcurrent = join(current, part);\n\t\t\tensureOwnedDirectory(current);\n\t\t}\n\t\tensureLeafDirectory(checkedDir);\n\t} else {\n\t\t// A caller-supplied directory outside the system temp base (a session\n\t\t// directory, for instance) is the caller's to own; only the leaf is ours.\n\t\tif (!(ensuredDirs.has(dir) && isRealDirectory(dir))) {\n\t\t\tmkdirSync(dirname(dir), { recursive: true, mode: SESSION_TEMP_DIR_MODE });\n\t\t\tensureLeafDirectory(dir);\n\t\t}\n\t}\n\tensuredDirs.add(dir);\n\treturn dir;\n}\n\n/**\n * Resolve and create the temp directory for a session.\n *\n * Pass an already-resolved directory to reuse a caller-provided path (still\n * created lazily with the same mode).\n */\nexport function getSessionTempDir(sessionId?: string): string {\n\treturn ensureTempDir(resolveSessionTempDirPath(sessionId));\n}\n\n/** Create `explicitDir` when supplied, otherwise the active session's temp directory. */\nexport function ensureSessionTempDir(explicitDir?: string): string {\n\treturn ensureTempDir(explicitDir ?? resolveSessionTempDirPath());\n}\n\nlet activeSessionId: string | undefined;\n\n/**\n * Refcounted protection for directories the sweeper must not reap.\n *\n * A count rather than a set, because protection has more than one holder and\n * more than one lifetime: a session protects its own tree, an async spill writer\n * outlives the session object it started under, and one session can be replaced\n * by another wrapping the same paths. Releasing one holder must not unprotect a\n * directory another is still writing to, and a session that is gone must stop\n * protecting a tree the startup sweep exists to collect.\n */\nconst protectedPathCounts = new Map<string, number>();\n\n/** A protection claim held by one owner; releasing twice is a no-op. */\nexport interface ProtectedPathLease {\n\trelease(): void;\n}\n\n/** Protect `paths` until the returned lease is released. */\nexport function acquireProtectedPaths(paths: readonly string[]): ProtectedPathLease {\n\tconst claimed = paths.filter((path) => path.length > 0);\n\tfor (const path of claimed) {\n\t\tprotectedPathCounts.set(path, (protectedPathCounts.get(path) ?? 0) + 1);\n\t}\n\tlet released = false;\n\treturn {\n\t\trelease() {\n\t\t\tif (released) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\treleased = true;\n\t\t\tfor (const path of claimed) {\n\t\t\t\tconst remaining = (protectedPathCounts.get(path) ?? 0) - 1;\n\t\t\t\tif (remaining > 0) {\n\t\t\t\t\tprotectedPathCounts.set(path, remaining);\n\t\t\t\t} else {\n\t\t\t\t\tprotectedPathCounts.delete(path);\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t};\n}\n\n/**\n * Make `sessionId` the default target for writers without a session handle.\n *\n * Deliberately separate from protection: a disposed session must stop protecting\n * its tree, but whichever session ran last still names where an unattached\n * writer spills.\n */\nexport function setActiveSessionTempId(sessionId: string): string {\n\tactiveSessionId = sessionId;\n\treturn resolveSessionTempDirPath(sessionId);\n}\n\n/** Directories this process must not reap: session temp trees and live tool-results. */\nexport function getProtectedSessionTempDirs(): ReadonlySet<string> {\n\treturn new Set(protectedPathCounts.keys());\n}\n\n/** Test seam: forget the process-level active/protected session state. */\nexport function resetSessionTempDirStateForTesting(): void {\n\tactiveSessionId = undefined;\n\tprotectedPathCounts.clear();\n\tensuredDirs.clear();\n\tcachedOwnerComponent = undefined;\n\tcachedBaseTempDirs = undefined;\n\tresetWindowsDirectorySecurityStateForTesting();\n}\n"]}

package/dist/core/tools/tool-definition-wrapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-definition-wrapper.d.ts","sourceRoot":"","sources":["../../../src/core/tools/tool-definition-wrapper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAU,OAAO,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE/E,OAAO,QAAQ,+BAA+B,CAAC;IAC9C,UAAU,SAAS,CAAC,WAAW,SAAS,OAAO,GAAG,OAAO,EAAE,QAAQ,GAAG,GAAG;QACxE,qGAAqG;QACrG,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,2FAA2F;QAC3F,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5B;CACD;AAYD,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,OAAO,SAAS,OAAO,EAAE,QAAQ,GAAG,OAAO,EAC7E,UAAU,EAAE,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,EAC7C,UAAU,CAAC,EAAE,MAAM,gBAAgB,GACjC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CA6B9B;AAED,0EAA0E;AAC1E,wBAAgB,mBAAmB,CAClC,WAAW,EAAE,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAC/C,UAAU,CAAC,EAAE,MAAM,gBAAgB,GACjC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAE/B;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAAC,OAAO,SAAS,OAAO,GAAG,OAAO,EAAE,QAAQ,GAAG,OAAO,EACtG,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,GAChC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAqBnC"}
+{"version":3,"file":"tool-definition-wrapper.d.ts","sourceRoot":"","sources":["../../../src/core/tools/tool-definition-wrapper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAU,OAAO,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE/E,OAAO,QAAQ,+BAA+B,CAAC;IAC9C,UAAU,SAAS,CAAC,WAAW,SAAS,OAAO,GAAG,OAAO,EAAE,QAAQ,GAAG,GAAG;QACxE,qGAAqG;QACrG,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,2FAA2F;QAC3F,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5B;CACD;AAYD,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,OAAO,SAAS,OAAO,EAAE,QAAQ,GAAG,OAAO,EAC7E,UAAU,EAAE,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,EAC7C,UAAU,CAAC,EAAE,MAAM,gBAAgB,GACjC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CA+B9B;AAED,0EAA0E;AAC1E,wBAAgB,mBAAmB,CAClC,WAAW,EAAE,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAC/C,UAAU,CAAC,EAAE,MAAM,gBAAgB,GACjC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAE/B;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAAC,OAAO,SAAS,OAAO,GAAG,OAAO,EAAE,QAAQ,GAAG,OAAO,EACtG,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,GAChC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAqBnC"}

package/dist/core/tools/tool-definition-wrapper.js

@@ -9,6 +9,8 @@ export function wrapToolDefinition(definition, ctxFactory) {
         ...(Object.hasOwn(definition, "constrainedSampling")
             ? { constrainedSampling: definition.constrainedSampling }
             : {}),
+        promptSnippet: definition.promptSnippet,
+        promptGuidelines: definition.promptGuidelines ? [...definition.promptGuidelines] : undefined,
         maxResultSizeChars: definition.maxResultSizeChars,
         prepareArguments: definition.prepareArguments
             ? (args) => runSynchronousCallback({ kind: "tool.prepare", name: definition.name }, () => definition.prepareArguments?.(args))

package/dist/core/tools/tool-definition-wrapper.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-definition-wrapper.js","sourceRoot":"","sources":["../../../src/core/tools/tool-definition-wrapper.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAuB9E,oEAAoE;AACpE,MAAM,UAAU,kBAAkB,CACjC,UAA6C,EAC7C,UAAmC;IAEnC,OAAO;QACN,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,qBAAqB,CAAC;YACnD,CAAC,CAAC,EAAE,mBAAmB,EAAE,UAAU,CAAC,mBAAmB,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;QACN,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;QACjD,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;YAC5C,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CACT,sBAAsB,CACrB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAC/C,GAAG,EAAE,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAA8B,CACtE;YACH,CAAC,CAAC,SAAS;QACZ,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAA0B,EAAE,EAAE,CAC7E,WAAW,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,CAC7E,UAAU,CAAC,OAAO,CACjB,UAAU,EACV,MAAyB,EACzB,MAAM,EACN,QAAQ,EACR,OAAO,IAAK,UAAU,EAAE,EAAuB,CAC/C,CACD;KACF,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,mBAAmB,CAClC,WAA+C,EAC/C,UAAmC;IAEnC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AACpF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iCAAiC,CAChD,IAAkC;IAElC,OAAO;QACN,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxG,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAoB,CAAC,CAAC,CAAC,SAAS;QAChH,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAC/D,IAAI,CAAC,OAAqD,CAC1D,UAAU,EACV,MAA+B,EAC/B,MAAM,EACN,QAAQ,EACR,OAAO,CACP;KACF,CAAC;AACH,CAAC","sourcesContent":["import type { AgentTool } from \"@earendil-works/pi-agent-core\";\nimport type { Static, TSchema } from \"typebox\";\nimport { runCallback, runSynchronousCallback } from \"../callback-activity.ts\";\nimport type { ExtensionContext, ToolDefinition } from \"../extensions/types.ts\";\n\ndeclare module \"@earendil-works/pi-agent-core\" {\n\tinterface AgentTool<TParameters extends TSchema = TSchema, TDetails = any> {\n\t\t/** Optional per-tool character cap for model-visible result persistence. Use Infinity to opt out. */\n\t\tmaxResultSizeChars?: number;\n\t\t/** Optional prompt metadata retained by factory-created tools registered as extensions. */\n\t\tpromptSnippet?: string;\n\t\tpromptGuidelines?: string[];\n\t}\n}\n\ntype PiToolParams<TParams extends TSchema> = Parameters<AgentTool<TParams>[\"execute\"]>[1];\ntype PiPreparedParams<TParams extends TSchema> = ReturnType<NonNullable<AgentTool<TParams>[\"prepareArguments\"]>>;\ntype ContextualAgentExecute<TParams extends TSchema, TDetails> = (\n\ttoolCallId: string,\n\tparams: PiToolParams<TParams>,\n\tsignal?: AbortSignal,\n\tonUpdate?: Parameters<AgentTool<TParams, TDetails>[\"execute\"]>[3],\n\tcontext?: ExtensionContext,\n) => ReturnType<AgentTool<TParams, TDetails>[\"execute\"]>;\n\n/** Wrap a ToolDefinition into an AgentTool for the core runtime. */\nexport function wrapToolDefinition<TParams extends TSchema, TDetails = unknown>(\n\tdefinition: ToolDefinition<TParams, TDetails>,\n\tctxFactory?: () => ExtensionContext,\n): AgentTool<TParams, TDetails> {\n\treturn {\n\t\tname: definition.name,\n\t\tlabel: definition.label,\n\t\tdescription: definition.description,\n\t\tparameters: definition.parameters,\n\t\t...(Object.hasOwn(definition, \"constrainedSampling\")\n\t\t\t? { constrainedSampling: definition.constrainedSampling }\n\t\t\t: {}),\n\t\tmaxResultSizeChars: definition.maxResultSizeChars,\n\t\tprepareArguments: definition.prepareArguments\n\t\t\t? (args) =>\n\t\t\t\t\trunSynchronousCallback(\n\t\t\t\t\t\t{ kind: \"tool.prepare\", name: definition.name },\n\t\t\t\t\t\t() => definition.prepareArguments?.(args) as PiPreparedParams<TParams>,\n\t\t\t\t\t)\n\t\t\t: undefined,\n\t\texecutionMode: definition.executionMode,\n\t\texecute: (toolCallId, params, signal, onUpdate, context?: ExtensionContext) =>\n\t\t\trunCallback({ kind: \"tool.execute\", name: definition.name, toolCallId }, () =>\n\t\t\t\tdefinition.execute(\n\t\t\t\t\ttoolCallId,\n\t\t\t\t\tparams as Static<TParams>,\n\t\t\t\t\tsignal,\n\t\t\t\t\tonUpdate,\n\t\t\t\t\tcontext ?? (ctxFactory?.() as ExtensionContext),\n\t\t\t\t),\n\t\t\t),\n\t};\n}\n\n/** Wrap multiple ToolDefinitions into AgentTools for the core runtime. */\nexport function wrapToolDefinitions(\n\tdefinitions: ToolDefinition<TSchema, unknown>[],\n\tctxFactory?: () => ExtensionContext,\n): AgentTool<TSchema, unknown>[] {\n\treturn definitions.map((definition) => wrapToolDefinition(definition, ctxFactory));\n}\n\n/**\n * Synthesize a minimal ToolDefinition from an AgentTool.\n *\n * This keeps AgentSession's internal registry definition-first even when a caller\n * provides plain AgentTool overrides that do not include prompt metadata or renderers.\n */\nexport function createToolDefinitionFromAgentTool<TParams extends TSchema = TSchema, TDetails = unknown>(\n\ttool: AgentTool<TParams, TDetails>,\n): ToolDefinition<TParams, TDetails> {\n\treturn {\n\t\tname: tool.name,\n\t\tlabel: tool.label,\n\t\tdescription: tool.description,\n\t\tparameters: tool.parameters,\n\t\t...(Object.hasOwn(tool, \"constrainedSampling\") ? { constrainedSampling: tool.constrainedSampling } : {}),\n\t\tpromptSnippet: tool.promptSnippet,\n\t\tpromptGuidelines: tool.promptGuidelines,\n\t\tmaxResultSizeChars: tool.maxResultSizeChars,\n\t\tprepareArguments: tool.prepareArguments ? (args) => tool.prepareArguments?.(args) as Static<TParams> : undefined,\n\t\texecutionMode: tool.executionMode,\n\t\texecute: async (toolCallId, params, signal, onUpdate, context) =>\n\t\t\t(tool.execute as ContextualAgentExecute<TParams, TDetails>)(\n\t\t\t\ttoolCallId,\n\t\t\t\tparams as PiToolParams<TParams>,\n\t\t\t\tsignal,\n\t\t\t\tonUpdate,\n\t\t\t\tcontext,\n\t\t\t),\n\t};\n}\n"]}
+{"version":3,"file":"tool-definition-wrapper.js","sourceRoot":"","sources":["../../../src/core/tools/tool-definition-wrapper.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAuB9E,oEAAoE;AACpE,MAAM,UAAU,kBAAkB,CACjC,UAA6C,EAC7C,UAAmC;IAEnC,OAAO;QACN,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,qBAAqB,CAAC;YACnD,CAAC,CAAC,EAAE,mBAAmB,EAAE,UAAU,CAAC,mBAAmB,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;QACN,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5F,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;QACjD,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;YAC5C,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CACT,sBAAsB,CACrB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAC/C,GAAG,EAAE,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAA8B,CACtE;YACH,CAAC,CAAC,SAAS;QACZ,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAA0B,EAAE,EAAE,CAC7E,WAAW,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,CAC7E,UAAU,CAAC,OAAO,CACjB,UAAU,EACV,MAAyB,EACzB,MAAM,EACN,QAAQ,EACR,OAAO,IAAK,UAAU,EAAE,EAAuB,CAC/C,CACD;KACF,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,mBAAmB,CAClC,WAA+C,EAC/C,UAAmC;IAEnC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AACpF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iCAAiC,CAChD,IAAkC;IAElC,OAAO;QACN,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxG,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAoB,CAAC,CAAC,CAAC,SAAS;QAChH,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAC/D,IAAI,CAAC,OAAqD,CAC1D,UAAU,EACV,MAA+B,EAC/B,MAAM,EACN,QAAQ,EACR,OAAO,CACP;KACF,CAAC;AACH,CAAC","sourcesContent":["import type { AgentTool } from \"@earendil-works/pi-agent-core\";\nimport type { Static, TSchema } from \"typebox\";\nimport { runCallback, runSynchronousCallback } from \"../callback-activity.ts\";\nimport type { ExtensionContext, ToolDefinition } from \"../extensions/types.ts\";\n\ndeclare module \"@earendil-works/pi-agent-core\" {\n\tinterface AgentTool<TParameters extends TSchema = TSchema, TDetails = any> {\n\t\t/** Optional per-tool character cap for model-visible result persistence. Use Infinity to opt out. */\n\t\tmaxResultSizeChars?: number;\n\t\t/** Optional prompt metadata retained by factory-created tools registered as extensions. */\n\t\tpromptSnippet?: string;\n\t\tpromptGuidelines?: string[];\n\t}\n}\n\ntype PiToolParams<TParams extends TSchema> = Parameters<AgentTool<TParams>[\"execute\"]>[1];\ntype PiPreparedParams<TParams extends TSchema> = ReturnType<NonNullable<AgentTool<TParams>[\"prepareArguments\"]>>;\ntype ContextualAgentExecute<TParams extends TSchema, TDetails> = (\n\ttoolCallId: string,\n\tparams: PiToolParams<TParams>,\n\tsignal?: AbortSignal,\n\tonUpdate?: Parameters<AgentTool<TParams, TDetails>[\"execute\"]>[3],\n\tcontext?: ExtensionContext,\n) => ReturnType<AgentTool<TParams, TDetails>[\"execute\"]>;\n\n/** Wrap a ToolDefinition into an AgentTool for the core runtime. */\nexport function wrapToolDefinition<TParams extends TSchema, TDetails = unknown>(\n\tdefinition: ToolDefinition<TParams, TDetails>,\n\tctxFactory?: () => ExtensionContext,\n): AgentTool<TParams, TDetails> {\n\treturn {\n\t\tname: definition.name,\n\t\tlabel: definition.label,\n\t\tdescription: definition.description,\n\t\tparameters: definition.parameters,\n\t\t...(Object.hasOwn(definition, \"constrainedSampling\")\n\t\t\t? { constrainedSampling: definition.constrainedSampling }\n\t\t\t: {}),\n\t\tpromptSnippet: definition.promptSnippet,\n\t\tpromptGuidelines: definition.promptGuidelines ? [...definition.promptGuidelines] : undefined,\n\t\tmaxResultSizeChars: definition.maxResultSizeChars,\n\t\tprepareArguments: definition.prepareArguments\n\t\t\t? (args) =>\n\t\t\t\t\trunSynchronousCallback(\n\t\t\t\t\t\t{ kind: \"tool.prepare\", name: definition.name },\n\t\t\t\t\t\t() => definition.prepareArguments?.(args) as PiPreparedParams<TParams>,\n\t\t\t\t\t)\n\t\t\t: undefined,\n\t\texecutionMode: definition.executionMode,\n\t\texecute: (toolCallId, params, signal, onUpdate, context?: ExtensionContext) =>\n\t\t\trunCallback({ kind: \"tool.execute\", name: definition.name, toolCallId }, () =>\n\t\t\t\tdefinition.execute(\n\t\t\t\t\ttoolCallId,\n\t\t\t\t\tparams as Static<TParams>,\n\t\t\t\t\tsignal,\n\t\t\t\t\tonUpdate,\n\t\t\t\t\tcontext ?? (ctxFactory?.() as ExtensionContext),\n\t\t\t\t),\n\t\t\t),\n\t};\n}\n\n/** Wrap multiple ToolDefinitions into AgentTools for the core runtime. */\nexport function wrapToolDefinitions(\n\tdefinitions: ToolDefinition<TSchema, unknown>[],\n\tctxFactory?: () => ExtensionContext,\n): AgentTool<TSchema, unknown>[] {\n\treturn definitions.map((definition) => wrapToolDefinition(definition, ctxFactory));\n}\n\n/**\n * Synthesize a minimal ToolDefinition from an AgentTool.\n *\n * This keeps AgentSession's internal registry definition-first even when a caller\n * provides plain AgentTool overrides that do not include prompt metadata or renderers.\n */\nexport function createToolDefinitionFromAgentTool<TParams extends TSchema = TSchema, TDetails = unknown>(\n\ttool: AgentTool<TParams, TDetails>,\n): ToolDefinition<TParams, TDetails> {\n\treturn {\n\t\tname: tool.name,\n\t\tlabel: tool.label,\n\t\tdescription: tool.description,\n\t\tparameters: tool.parameters,\n\t\t...(Object.hasOwn(tool, \"constrainedSampling\") ? { constrainedSampling: tool.constrainedSampling } : {}),\n\t\tpromptSnippet: tool.promptSnippet,\n\t\tpromptGuidelines: tool.promptGuidelines,\n\t\tmaxResultSizeChars: tool.maxResultSizeChars,\n\t\tprepareArguments: tool.prepareArguments ? (args) => tool.prepareArguments?.(args) as Static<TParams> : undefined,\n\t\texecutionMode: tool.executionMode,\n\t\texecute: async (toolCallId, params, signal, onUpdate, context) =>\n\t\t\t(tool.execute as ContextualAgentExecute<TParams, TDetails>)(\n\t\t\t\ttoolCallId,\n\t\t\t\tparams as PiToolParams<TParams>,\n\t\t\t\tsignal,\n\t\t\t\tonUpdate,\n\t\t\t\tcontext,\n\t\t\t),\n\t};\n}\n"]}

package/dist/core/tools/tool-limits.d.ts

@@ -22,4 +22,15 @@ export declare const PERSISTED_OUTPUT_TAG = "<persisted-output>";
 export declare const PERSISTED_OUTPUT_CLOSING_TAG = "</persisted-output>";
 /** Preview size in bytes shown inline in the persisted-output message. */
 export declare const PREVIEW_SIZE_BYTES = 2000;
+/**
+ * Hard cap on the number of bytes any single persisted tool-output file may hold.
+ *
+ * Persisted output exists so the model can read back what did not fit in context;
+ * past this size the file is no longer a useful artifact, only a way to fill the
+ * disk. Writers stop at the cap and append {@link PERSISTED_OUTPUT_TRUNCATION_MARKER}
+ * so the total file size never exceeds it.
+ */
+export declare const MAX_PERSISTED_OUTPUT_BYTES: number;
+/** Appended in place of the content dropped at {@link MAX_PERSISTED_OUTPUT_BYTES}. */
+export declare const PERSISTED_OUTPUT_TRUNCATION_MARKER = "\n[Output truncated: persisted-output cap of 67108864 bytes reached]\n";
 //# sourceMappingURL=tool-limits.d.ts.map

package/dist/core/tools/tool-limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-limits.d.ts","sourceRoot":"","sources":["../../../src/core/tools/tool-limits.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AAEpD,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAElD,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AACzD,eAAO,MAAM,4BAA4B,wBAAwB,CAAC;AAElE,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,OAAO,CAAC"}
+{"version":3,"file":"tool-limits.d.ts","sourceRoot":"","sources":["../../../src/core/tools/tool-limits.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AAEpD,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAElD,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AACzD,eAAO,MAAM,4BAA4B,wBAAwB,CAAC;AAElE,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,QAAmB,CAAC;AAE3D,sFAAsF;AACtF,eAAO,MAAM,kCAAkC,2EAAgG,CAAC"}

package/dist/core/tools/tool-limits.js

@@ -22,4 +22,15 @@ export const PERSISTED_OUTPUT_TAG = "<persisted-output>";
 export const PERSISTED_OUTPUT_CLOSING_TAG = "</persisted-output>";
 /** Preview size in bytes shown inline in the persisted-output message. */
 export const PREVIEW_SIZE_BYTES = 2000;
+/**
+ * Hard cap on the number of bytes any single persisted tool-output file may hold.
+ *
+ * Persisted output exists so the model can read back what did not fit in context;
+ * past this size the file is no longer a useful artifact, only a way to fill the
+ * disk. Writers stop at the cap and append {@link PERSISTED_OUTPUT_TRUNCATION_MARKER}
+ * so the total file size never exceeds it.
+ */
+export const MAX_PERSISTED_OUTPUT_BYTES = 64 * 1024 * 1024;
+/** Appended in place of the content dropped at {@link MAX_PERSISTED_OUTPUT_BYTES}. */
+export const PERSISTED_OUTPUT_TRUNCATION_MARKER = `\n[Output truncated: persisted-output cap of ${MAX_PERSISTED_OUTPUT_BYTES} bytes reached]\n`;
 //# sourceMappingURL=tool-limits.js.map

package/dist/core/tools/tool-limits.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-limits.js","sourceRoot":"","sources":["../../../src/core/tools/tool-limits.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAEpD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAElD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AACzD,MAAM,CAAC,MAAM,4BAA4B,GAAG,qBAAqB,CAAC;AAElE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC","sourcesContent":["/**\n * Constants related to tool result size limits.\n *\n * These mirror the conventions used by the upstream Claude Code tool-result\n * storage mechanism (mehmoodosman/claude-code, `src/constants/toolLimits.ts`):\n * oversized tool results are persisted to disk and replaced in model context\n * with a short preview that references the saved file.\n */\n\n/**\n * Default maximum size in characters for tool results before they get persisted\n * to disk. When exceeded, the result is saved to a file and the model receives\n * a preview with the file path instead of the full content.\n *\n * Individual tools may declare a lower cap, but this constant acts as a\n * system-wide ceiling regardless of what tools declare.\n */\nexport const DEFAULT_MAX_RESULT_SIZE_CHARS = 50_000;\n\n/** Subdirectory (within the session directory) for persisted tool results. */\nexport const TOOL_RESULTS_SUBDIR = \"tool-results\";\n\n/** XML tags wrapping a persisted-output preview message. */\nexport const PERSISTED_OUTPUT_TAG = \"<persisted-output>\";\nexport const PERSISTED_OUTPUT_CLOSING_TAG = \"</persisted-output>\";\n\n/** Preview size in bytes shown inline in the persisted-output message. */\nexport const PREVIEW_SIZE_BYTES = 2000;\n"]}
+{"version":3,"file":"tool-limits.js","sourceRoot":"","sources":["../../../src/core/tools/tool-limits.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAEpD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAElD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AACzD,MAAM,CAAC,MAAM,4BAA4B,GAAG,qBAAqB,CAAC;AAElE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3D,sFAAsF;AACtF,MAAM,CAAC,MAAM,kCAAkC,GAAG,gDAAgD,0BAA0B,mBAAmB,CAAC","sourcesContent":["/**\n * Constants related to tool result size limits.\n *\n * These mirror the conventions used by the upstream Claude Code tool-result\n * storage mechanism (mehmoodosman/claude-code, `src/constants/toolLimits.ts`):\n * oversized tool results are persisted to disk and replaced in model context\n * with a short preview that references the saved file.\n */\n\n/**\n * Default maximum size in characters for tool results before they get persisted\n * to disk. When exceeded, the result is saved to a file and the model receives\n * a preview with the file path instead of the full content.\n *\n * Individual tools may declare a lower cap, but this constant acts as a\n * system-wide ceiling regardless of what tools declare.\n */\nexport const DEFAULT_MAX_RESULT_SIZE_CHARS = 50_000;\n\n/** Subdirectory (within the session directory) for persisted tool results. */\nexport const TOOL_RESULTS_SUBDIR = \"tool-results\";\n\n/** XML tags wrapping a persisted-output preview message. */\nexport const PERSISTED_OUTPUT_TAG = \"<persisted-output>\";\nexport const PERSISTED_OUTPUT_CLOSING_TAG = \"</persisted-output>\";\n\n/** Preview size in bytes shown inline in the persisted-output message. */\nexport const PREVIEW_SIZE_BYTES = 2000;\n\n/**\n * Hard cap on the number of bytes any single persisted tool-output file may hold.\n *\n * Persisted output exists so the model can read back what did not fit in context;\n * past this size the file is no longer a useful artifact, only a way to fill the\n * disk. Writers stop at the cap and append {@link PERSISTED_OUTPUT_TRUNCATION_MARKER}\n * so the total file size never exceeds it.\n */\nexport const MAX_PERSISTED_OUTPUT_BYTES = 64 * 1024 * 1024;\n\n/** Appended in place of the content dropped at {@link MAX_PERSISTED_OUTPUT_BYTES}. */\nexport const PERSISTED_OUTPUT_TRUNCATION_MARKER = `\\n[Output truncated: persisted-output cap of ${MAX_PERSISTED_OUTPUT_BYTES} bytes reached]\\n`;\n"]}

package/dist/core/tools/windows-directory-security.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Windows owner-SID and DACL verification for the session temp tree.
+ *
+ * POSIX proves ownership of an existing temp component with a uid comparison
+ * and a mode check. Node exposes neither on Windows — `lstatSync` reports
+ * uid/gid 0 — so this module reads the real security descriptor through a
+ * PowerShell `Get-Acl` subprocess and decides from SIDs alone: the owner must
+ * be a trusted principal and every access-allowed ACE must grant only trusted
+ * principals. Names are never compared; two accounts can share a display name,
+ * but never a SID.
+ *
+ * A subprocess per directory creation would sit on the spill hot path, so a
+ * successful verification is cached per canonical path per process, keyed to
+ * the directory's metadata identity — creation time, NTFS change time, and
+ * last-write time. A directory swapped underneath the path carries a fresh
+ * creation time, and an in-place DACL edit bumps the change time, so either
+ * forces a fresh descriptor read rather than trust from a stale check (see
+ * `verifyWindowsDirectorySecurity`). Failures are not cached: a refusal means
+ * "no spill file this time", and a transient read failure must not disable
+ * persistence for the rest of the process.
+ */
+/** One DACL entry with its trustee resolved to a literal SID. */
+export interface WindowsAccessRule {
+    /** True for an access-allowed entry, false for access-denied. */
+    allow: boolean;
+    /** The SID the entry applies to. */
+    sid: string;
+}
+/** What the security read produces: the caller's SID plus the descriptor. */
+export interface WindowsDirectorySecurity {
+    /** SID of the current process token's user. */
+    currentSid: string;
+    /** SID owning the directory. */
+    ownerSid: string;
+    /** The DACL portion of the descriptor in SDDL form (may be empty). */
+    dacl: string;
+    /**
+     * Every DACL entry with its trustee as a literal SID (`GetAccessRules`
+     * resolves domain-relative SDDL abbreviations such as `LA` that a
+     * name-side parse cannot). The SDDL string above cross-checks that these
+     * rules describe the whole DACL: only plain allow/deny ACE types, one
+     * rule per ACE.
+     */
+    accessRules: readonly WindowsAccessRule[];
+}
+/**
+ * Decide whether a directory's descriptor is safe to adopt.
+ *
+ * Returns a refusal reason, or `undefined` when the directory is owned by a
+ * trusted principal and its DACL grants access to trusted principals only.
+ * Exported as a pure function so the decision table is testable on any host.
+ */
+export declare function evaluateWindowsDirectorySecurity(security: WindowsDirectorySecurity): string | undefined;
+/** Test seam: why the most recent `readWindowsDirectorySecurity` returned `undefined`. */
+export declare function getLastWindowsSecurityReadFailureForTesting(): string | undefined;
+/**
+ * Read the security descriptor of `path`, or `undefined` when it cannot be
+ * read (access denied, missing PowerShell, timeout). Callers treat
+ * `undefined` as unverifiable and refuse the directory.
+ */
+export declare function readWindowsDirectorySecurity(path: string): WindowsDirectorySecurity | undefined;
+type SecurityReader = (path: string) => WindowsDirectorySecurity | undefined;
+/**
+ * Verify `path` as adoptable, returning the refusal reason when it is not.
+ *
+ * The subprocess read sits on the spill path, so a successful verification
+ * is cached for the life of the process while the directory's metadata
+ * identity (creation, change, and last-write times) is unchanged. A swapped
+ * directory or an in-place DACL edit changes that identity and forces a
+ * fresh read; so does creating a file inside the directory, which trades one
+ * bounded subprocess per spill for never trusting a stale descriptor. The
+ * symlink/directory checks in `session-temp-dir.ts` still run on every use.
+ * A failure is never cached, so a transient read error does not permanently
+ * disable spills.
+ */
+export declare function verifyWindowsDirectorySecurity(path: string): string | undefined;
+/** Test seam: substitute the descriptor reader; pass `undefined` to restore. */
+export declare function setWindowsDirectorySecurityReaderForTesting(reader: SecurityReader | undefined): void;
+/** Test seam: forget verified paths so a suite can re-drive verification. */
+export declare function resetWindowsDirectorySecurityStateForTesting(): void;
+export {};
+//# sourceMappingURL=windows-directory-security.d.ts.map

package/dist/core/tools/windows-directory-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows-directory-security.d.ts","sourceRoot":"","sources":["../../../src/core/tools/windows-directory-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IACjC,iEAAiE;IACjE,KAAK,EAAE,OAAO,CAAC;IACf,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,6EAA6E;AAC7E,MAAM,WAAW,wBAAwB;IACxC,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,WAAW,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC1C;AAqBD;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,wBAAwB,GAAG,MAAM,GAAG,SAAS,CAoDvG;AAoCD,0FAA0F;AAC1F,wBAAgB,2CAA2C,IAAI,MAAM,GAAG,SAAS,CAEhF;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CA0B/F;AAqBD,KAAK,cAAc,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,wBAAwB,GAAG,SAAS,CAAC;AAuB7E;;;;;;;;;;;;GAYG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CA4B/E;AAED,gFAAgF;AAChF,wBAAgB,2CAA2C,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,GAAG,IAAI,CAEpG;AAED,6EAA6E;AAC7E,wBAAgB,4CAA4C,IAAI,IAAI,CAGnE"}

package/dist/core/tools/windows-directory-security.js

@@ -0,0 +1,238 @@
+/**
+ * Windows owner-SID and DACL verification for the session temp tree.
+ *
+ * POSIX proves ownership of an existing temp component with a uid comparison
+ * and a mode check. Node exposes neither on Windows — `lstatSync` reports
+ * uid/gid 0 — so this module reads the real security descriptor through a
+ * PowerShell `Get-Acl` subprocess and decides from SIDs alone: the owner must
+ * be a trusted principal and every access-allowed ACE must grant only trusted
+ * principals. Names are never compared; two accounts can share a display name,
+ * but never a SID.
+ *
+ * A subprocess per directory creation would sit on the spill hot path, so a
+ * successful verification is cached per canonical path per process, keyed to
+ * the directory's metadata identity — creation time, NTFS change time, and
+ * last-write time. A directory swapped underneath the path carries a fresh
+ * creation time, and an in-place DACL edit bumps the change time, so either
+ * forces a fresh descriptor read rather than trust from a stale check (see
+ * `verifyWindowsDirectorySecurity`). Failures are not cached: a refusal means
+ * "no spill file this time", and a transient read failure must not disable
+ * persistence for the rest of the process.
+ */
+import { spawnSync } from "node:child_process";
+import { statSync } from "node:fs";
+/**
+ * Principals allowed to own, or hold access-allowed ACEs on, a temp component.
+ *
+ * SYSTEM and Administrators hold both on any per-user Windows temp directory
+ * by inheritance, and both can reach any file on the volume regardless, so
+ * permitting them grants nothing an attacker did not already have. Elevated
+ * processes also create directories owned by the Administrators group rather
+ * than the user, which is why the owner check shares this set. CREATOR OWNER
+ * is inherit-only plumbing: it materializes as the creating account on
+ * descendants, and creation inside the tree is already restricted to the
+ * SIDs allowed here.
+ */
+const TRUSTED_STATIC_SIDS = new Set([
+    "S-1-5-18", // Local System
+    "S-1-5-32-544", // Builtin Administrators
+    "S-1-3-0", // Creator Owner
+    "S-1-3-4", // Owner Rights
+]);
+/**
+ * Decide whether a directory's descriptor is safe to adopt.
+ *
+ * Returns a refusal reason, or `undefined` when the directory is owned by a
+ * trusted principal and its DACL grants access to trusted principals only.
+ * Exported as a pure function so the decision table is testable on any host.
+ */
+export function evaluateWindowsDirectorySecurity(security) {
+    const trusted = (sid) => sid === security.currentSid || TRUSTED_STATIC_SIDS.has(sid);
+    if (!security.ownerSid.startsWith("S-1-")) {
+        return "its owner could not be verified";
+    }
+    if (!trusted(security.ownerSid)) {
+        return "it is owned by another account";
+    }
+    // `Get-Acl` renders a null DACL (everyone has full control) as an absent
+    // `D:` section; an empty DACL (`D:` with no ACEs) grants nobody anything
+    // and is fine.
+    const dacl = security.dacl.trim();
+    if (!dacl.startsWith("D:")) {
+        return "it has no access control list";
+    }
+    let rest = dacl.slice(2);
+    const flagsEnd = rest.indexOf("(");
+    const flags = flagsEnd === -1 ? rest : rest.slice(0, flagsEnd);
+    if (!/^[A-Z]*$/.test(flags)) {
+        return "its access control list could not be parsed";
+    }
+    rest = flagsEnd === -1 ? "" : rest.slice(flagsEnd);
+    const aces = rest.match(/\([^()]*\)/g) ?? [];
+    if (aces.join("") !== rest) {
+        return "its access control list could not be parsed";
+    }
+    for (const ace of aces) {
+        const type = ace.slice(1, -1).split(";")[0];
+        if (type !== "A" && type !== "D") {
+            // Conditional, object, and callback ACEs are not modeled by the
+            // resolved access rules below, so a DACL containing one cannot be
+            // proven restrictive.
+            return "its access control list could not be verified";
+        }
+    }
+    if (security.accessRules.length !== aces.length) {
+        // The resolved rules must describe the whole DACL; a mismatch means
+        // part of it was not translated and cannot be checked.
+        return "its access control list could not be verified";
+    }
+    for (const rule of security.accessRules) {
+        if (!rule.allow) {
+            continue; // A deny entry only ever removes access.
+        }
+        if (!rule.sid.startsWith("S-1-")) {
+            return "its access control list could not be verified";
+        }
+        if (!trusted(rule.sid)) {
+            return "it grants access to another account";
+        }
+    }
+    return undefined;
+}
+/**
+ * One PowerShell round trip: the caller's SID, the owner SID, the DACL in
+ * SDDL form, and one `Allow|Deny;SID` line per resolved access rule. The path
+ * travels through the environment rather than the command line so no quoting
+ * rules apply to it.
+ */
+const READ_SECURITY_SCRIPT = [
+    "$ErrorActionPreference = 'Stop'",
+    "$acl = Get-Acl -LiteralPath $env:ATOMIC_SECURITY_QUERY_PATH",
+    "$owner = $acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value",
+    "$dacl = $acl.GetSecurityDescriptorSddlForm('Access')",
+    "$user = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value",
+    "$lines = @($user, $owner, $dacl)",
+    "foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]))" +
+        ' { $lines += "$($rule.AccessControlType);$($rule.IdentityReference.Value)" }',
+    '[Console]::Out.Write(($lines -join "`n"))',
+].join("; ");
+/** Bounded wait for the security read; a wedged subprocess must not hang a spill. */
+const READ_SECURITY_TIMEOUT_MS = 30_000;
+/** PowerShell hosts to try, most specific first: an absolute Windows
+ * PowerShell path immune to a stripped `PATH`, then whichever of
+ * `powershell.exe`/`pwsh.exe` the environment resolves. */
+function powershellCandidates() {
+    const candidates = [];
+    const systemRoot = process.env.SystemRoot ?? process.env.windir ?? "C:\\Windows";
+    candidates.push(`${systemRoot}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`);
+    candidates.push("powershell.exe", "pwsh.exe");
+    return candidates;
+}
+let lastReadFailure;
+/** Test seam: why the most recent `readWindowsDirectorySecurity` returned `undefined`. */
+export function getLastWindowsSecurityReadFailureForTesting() {
+    return lastReadFailure;
+}
+/**
+ * Read the security descriptor of `path`, or `undefined` when it cannot be
+ * read (access denied, missing PowerShell, timeout). Callers treat
+ * `undefined` as unverifiable and refuse the directory.
+ */
+export function readWindowsDirectorySecurity(path) {
+    lastReadFailure = undefined;
+    const failures = [];
+    for (const executable of powershellCandidates()) {
+        const result = spawnSync(executable, ["-NoProfile", "-NonInteractive", "-Command", READ_SECURITY_SCRIPT], {
+            env: { ...process.env, ATOMIC_SECURITY_QUERY_PATH: path },
+            encoding: "utf8",
+            timeout: READ_SECURITY_TIMEOUT_MS,
+            windowsHide: true,
+        });
+        if (result.error || result.status !== 0 || typeof result.stdout !== "string") {
+            failures.push(`${executable}: status=${result.status} signal=${result.signal} error=${result.error?.message} stderr=${typeof result.stderr === "string" ? result.stderr.trim().slice(0, 500) : result.stderr}`);
+            continue;
+        }
+        const parsed = parseSecurityOutput(result.stdout);
+        if (parsed !== undefined) {
+            return parsed;
+        }
+        failures.push(`${executable}: unparseable output ${JSON.stringify(result.stdout.slice(0, 500))}`);
+    }
+    lastReadFailure = failures.join(" | ");
+    return undefined;
+}
+function parseSecurityOutput(stdout) {
+    const [currentSid, ownerSid, dacl, ...ruleLines] = stdout.split("\n").map((line) => line.trim());
+    if (!currentSid || !ownerSid || dacl === undefined) {
+        return undefined;
+    }
+    const accessRules = [];
+    for (const line of ruleLines) {
+        if (line.length === 0) {
+            continue;
+        }
+        const [type, sid] = line.split(";");
+        if ((type !== "Allow" && type !== "Deny") || !sid) {
+            return undefined;
+        }
+        accessRules.push({ allow: type === "Allow", sid });
+    }
+    return { currentSid, ownerSid, dacl, accessRules };
+}
+let securityReader = readWindowsDirectorySecurity;
+/** Verified paths mapped to the metadata identity observed *before* the
+ * descriptor was read. Snapshotting before the read means any mutation that
+ * races the read still changes the identity relative to the cache entry, so
+ * the next call re-verifies rather than trusting the racing state. */
+const verifiedPaths = new Map();
+/**
+ * Verify `path` as adoptable, returning the refusal reason when it is not.
+ *
+ * The subprocess read sits on the spill path, so a successful verification
+ * is cached for the life of the process while the directory's metadata
+ * identity (creation, change, and last-write times) is unchanged. A swapped
+ * directory or an in-place DACL edit changes that identity and forces a
+ * fresh read; so does creating a file inside the directory, which trades one
+ * bounded subprocess per spill for never trusting a stale descriptor. The
+ * symlink/directory checks in `session-temp-dir.ts` still run on every use.
+ * A failure is never cached, so a transient read error does not permanently
+ * disable spills.
+ */
+export function verifyWindowsDirectorySecurity(path) {
+    let identity;
+    try {
+        const stat = statSync(path);
+        identity = { birthtimeMs: stat.birthtimeMs, ctimeMs: stat.ctimeMs, mtimeMs: stat.mtimeMs };
+    }
+    catch {
+        return "its ownership could not be verified";
+    }
+    const cached = verifiedPaths.get(path);
+    if (cached !== undefined &&
+        cached.birthtimeMs === identity.birthtimeMs &&
+        cached.ctimeMs === identity.ctimeMs &&
+        cached.mtimeMs === identity.mtimeMs) {
+        return undefined;
+    }
+    const security = securityReader(path);
+    if (security === undefined) {
+        return "its ownership could not be verified";
+    }
+    const refusal = evaluateWindowsDirectorySecurity(security);
+    if (refusal !== undefined) {
+        verifiedPaths.delete(path);
+        return refusal;
+    }
+    verifiedPaths.set(path, identity);
+    return undefined;
+}
+/** Test seam: substitute the descriptor reader; pass `undefined` to restore. */
+export function setWindowsDirectorySecurityReaderForTesting(reader) {
+    securityReader = reader ?? readWindowsDirectorySecurity;
+}
+/** Test seam: forget verified paths so a suite can re-drive verification. */
+export function resetWindowsDirectorySecurityStateForTesting() {
+    verifiedPaths.clear();
+    securityReader = readWindowsDirectorySecurity;
+}
+//# sourceMappingURL=windows-directory-security.js.map

package/dist/core/tools/windows-directory-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows-directory-security.js","sourceRoot":"","sources":["../../../src/core/tools/windows-directory-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AA4BnC;;;;;;;;;;;GAWG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS;IAC3C,UAAU,EAAE,eAAe;IAC3B,cAAc,EAAE,yBAAyB;IACzC,SAAS,EAAE,gBAAgB;IAC3B,SAAS,EAAE,eAAe;CAC1B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,QAAkC;IAClF,MAAM,OAAO,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,UAAU,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,OAAO,iCAAiC,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,OAAO,gCAAgC,CAAC;IACzC,CAAC;IACD,yEAAyE;IACzE,yEAAyE;IACzE,eAAe;IACf,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,+BAA+B,CAAC;IACxC,CAAC;IACD,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,6CAA6C,CAAC;IACtD,CAAC;IACD,IAAI,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,6CAA6C,CAAC;IACtD,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClC,gEAAgE;YAChE,kEAAkE;YAClE,sBAAsB;YACtB,OAAO,+CAA+C,CAAC;QACxD,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACjD,oEAAoE;QACpE,uDAAuD;QACvD,OAAO,+CAA+C,CAAC;IACxD,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACjB,SAAS,CAAC,yCAAyC;QACpD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,+CAA+C,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,qCAAqC,CAAC;QAC9C,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG;IAC5B,iCAAiC;IACjC,6DAA6D;IAC7D,8EAA8E;IAC9E,sDAAsD;IACtD,8EAA8E;IAC9E,kCAAkC;IAClC,sGAAsG;QACrG,8EAA8E;IAC/E,2CAA2C;CAC3C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,qFAAqF;AACrF,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAExC;;2DAE2D;AAC3D,SAAS,oBAAoB;IAC5B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,aAAa,CAAC;IACjF,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,qDAAqD,CAAC,CAAC;IACpF,UAAU,CAAC,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;IAC9C,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,IAAI,eAAmC,CAAC;AAExC,0FAA0F;AAC1F,MAAM,UAAU,2CAA2C;IAC1D,OAAO,eAAe,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACxD,eAAe,GAAG,SAAS,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAE;YACzG,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,0BAA0B,EAAE,IAAI,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,wBAAwB;YACjC,WAAW,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9E,QAAQ,CAAC,IAAI,CACZ,GAAG,UAAU,YAAY,MAAM,CAAC,MAAM,WAAW,MAAM,CAAC,MAAM,UAAU,MAAM,CAAC,KAAK,EAAE,OAAO,WAC5F,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MACjF,EAAE,CACF,CAAC;YACF,SAAS;QACV,CAAC;QACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC;QACf,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,wBAAwB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc;IAC1C,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACjG,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,WAAW,GAAwB,EAAE,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,SAAS;QACV,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACnD,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,KAAK,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AACpD,CAAC;AAID,IAAI,cAAc,GAAmB,4BAA4B,CAAC;AAelE;;;sEAGsE;AACtE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAqC,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,8BAA8B,CAAC,IAAY;IAC1D,IAAI,QAAmC,CAAC;IACxC,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,QAAQ,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,qCAAqC,CAAC;IAC9C,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,IACC,MAAM,KAAK,SAAS;QACpB,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAC3C,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;QACnC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,EAClC,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,qCAAqC,CAAC;IAC9C,CAAC;IACD,MAAM,OAAO,GAAG,gCAAgC,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,OAAO,CAAC;IAChB,CAAC;IACD,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClC,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,2CAA2C,CAAC,MAAkC;IAC7F,cAAc,GAAG,MAAM,IAAI,4BAA4B,CAAC;AACzD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,4CAA4C;IAC3D,aAAa,CAAC,KAAK,EAAE,CAAC;IACtB,cAAc,GAAG,4BAA4B,CAAC;AAC/C,CAAC","sourcesContent":["/**\n * Windows owner-SID and DACL verification for the session temp tree.\n *\n * POSIX proves ownership of an existing temp component with a uid comparison\n * and a mode check. Node exposes neither on Windows — `lstatSync` reports\n * uid/gid 0 — so this module reads the real security descriptor through a\n * PowerShell `Get-Acl` subprocess and decides from SIDs alone: the owner must\n * be a trusted principal and every access-allowed ACE must grant only trusted\n * principals. Names are never compared; two accounts can share a display name,\n * but never a SID.\n *\n * A subprocess per directory creation would sit on the spill hot path, so a\n * successful verification is cached per canonical path per process, keyed to\n * the directory's metadata identity — creation time, NTFS change time, and\n * last-write time. A directory swapped underneath the path carries a fresh\n * creation time, and an in-place DACL edit bumps the change time, so either\n * forces a fresh descriptor read rather than trust from a stale check (see\n * `verifyWindowsDirectorySecurity`). Failures are not cached: a refusal means\n * \"no spill file this time\", and a transient read failure must not disable\n * persistence for the rest of the process.\n */\n\nimport { spawnSync } from \"node:child_process\";\nimport { statSync } from \"node:fs\";\n\n/** One DACL entry with its trustee resolved to a literal SID. */\nexport interface WindowsAccessRule {\n\t/** True for an access-allowed entry, false for access-denied. */\n\tallow: boolean;\n\t/** The SID the entry applies to. */\n\tsid: string;\n}\n\n/** What the security read produces: the caller's SID plus the descriptor. */\nexport interface WindowsDirectorySecurity {\n\t/** SID of the current process token's user. */\n\tcurrentSid: string;\n\t/** SID owning the directory. */\n\townerSid: string;\n\t/** The DACL portion of the descriptor in SDDL form (may be empty). */\n\tdacl: string;\n\t/**\n\t * Every DACL entry with its trustee as a literal SID (`GetAccessRules`\n\t * resolves domain-relative SDDL abbreviations such as `LA` that a\n\t * name-side parse cannot). The SDDL string above cross-checks that these\n\t * rules describe the whole DACL: only plain allow/deny ACE types, one\n\t * rule per ACE.\n\t */\n\taccessRules: readonly WindowsAccessRule[];\n}\n\n/**\n * Principals allowed to own, or hold access-allowed ACEs on, a temp component.\n *\n * SYSTEM and Administrators hold both on any per-user Windows temp directory\n * by inheritance, and both can reach any file on the volume regardless, so\n * permitting them grants nothing an attacker did not already have. Elevated\n * processes also create directories owned by the Administrators group rather\n * than the user, which is why the owner check shares this set. CREATOR OWNER\n * is inherit-only plumbing: it materializes as the creating account on\n * descendants, and creation inside the tree is already restricted to the\n * SIDs allowed here.\n */\nconst TRUSTED_STATIC_SIDS = new Set<string>([\n\t\"S-1-5-18\", // Local System\n\t\"S-1-5-32-544\", // Builtin Administrators\n\t\"S-1-3-0\", // Creator Owner\n\t\"S-1-3-4\", // Owner Rights\n]);\n\n/**\n * Decide whether a directory's descriptor is safe to adopt.\n *\n * Returns a refusal reason, or `undefined` when the directory is owned by a\n * trusted principal and its DACL grants access to trusted principals only.\n * Exported as a pure function so the decision table is testable on any host.\n */\nexport function evaluateWindowsDirectorySecurity(security: WindowsDirectorySecurity): string | undefined {\n\tconst trusted = (sid: string): boolean => sid === security.currentSid || TRUSTED_STATIC_SIDS.has(sid);\n\tif (!security.ownerSid.startsWith(\"S-1-\")) {\n\t\treturn \"its owner could not be verified\";\n\t}\n\tif (!trusted(security.ownerSid)) {\n\t\treturn \"it is owned by another account\";\n\t}\n\t// `Get-Acl` renders a null DACL (everyone has full control) as an absent\n\t// `D:` section; an empty DACL (`D:` with no ACEs) grants nobody anything\n\t// and is fine.\n\tconst dacl = security.dacl.trim();\n\tif (!dacl.startsWith(\"D:\")) {\n\t\treturn \"it has no access control list\";\n\t}\n\tlet rest = dacl.slice(2);\n\tconst flagsEnd = rest.indexOf(\"(\");\n\tconst flags = flagsEnd === -1 ? rest : rest.slice(0, flagsEnd);\n\tif (!/^[A-Z]*$/.test(flags)) {\n\t\treturn \"its access control list could not be parsed\";\n\t}\n\trest = flagsEnd === -1 ? \"\" : rest.slice(flagsEnd);\n\tconst aces = rest.match(/\\([^()]*\\)/g) ?? [];\n\tif (aces.join(\"\") !== rest) {\n\t\treturn \"its access control list could not be parsed\";\n\t}\n\tfor (const ace of aces) {\n\t\tconst type = ace.slice(1, -1).split(\";\")[0];\n\t\tif (type !== \"A\" && type !== \"D\") {\n\t\t\t// Conditional, object, and callback ACEs are not modeled by the\n\t\t\t// resolved access rules below, so a DACL containing one cannot be\n\t\t\t// proven restrictive.\n\t\t\treturn \"its access control list could not be verified\";\n\t\t}\n\t}\n\tif (security.accessRules.length !== aces.length) {\n\t\t// The resolved rules must describe the whole DACL; a mismatch means\n\t\t// part of it was not translated and cannot be checked.\n\t\treturn \"its access control list could not be verified\";\n\t}\n\tfor (const rule of security.accessRules) {\n\t\tif (!rule.allow) {\n\t\t\tcontinue; // A deny entry only ever removes access.\n\t\t}\n\t\tif (!rule.sid.startsWith(\"S-1-\")) {\n\t\t\treturn \"its access control list could not be verified\";\n\t\t}\n\t\tif (!trusted(rule.sid)) {\n\t\t\treturn \"it grants access to another account\";\n\t\t}\n\t}\n\treturn undefined;\n}\n\n/**\n * One PowerShell round trip: the caller's SID, the owner SID, the DACL in\n * SDDL form, and one `Allow|Deny;SID` line per resolved access rule. The path\n * travels through the environment rather than the command line so no quoting\n * rules apply to it.\n */\nconst READ_SECURITY_SCRIPT = [\n\t\"$ErrorActionPreference = 'Stop'\",\n\t\"$acl = Get-Acl -LiteralPath $env:ATOMIC_SECURITY_QUERY_PATH\",\n\t\"$owner = $acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value\",\n\t\"$dacl = $acl.GetSecurityDescriptorSddlForm('Access')\",\n\t\"$user = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value\",\n\t\"$lines = @($user, $owner, $dacl)\",\n\t\"foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]))\" +\n\t\t' { $lines += \"$($rule.AccessControlType);$($rule.IdentityReference.Value)\" }',\n\t'[Console]::Out.Write(($lines -join \"`n\"))',\n].join(\"; \");\n\n/** Bounded wait for the security read; a wedged subprocess must not hang a spill. */\nconst READ_SECURITY_TIMEOUT_MS = 30_000;\n\n/** PowerShell hosts to try, most specific first: an absolute Windows\n * PowerShell path immune to a stripped `PATH`, then whichever of\n * `powershell.exe`/`pwsh.exe` the environment resolves. */\nfunction powershellCandidates(): string[] {\n\tconst candidates: string[] = [];\n\tconst systemRoot = process.env.SystemRoot ?? process.env.windir ?? \"C:\\\\Windows\";\n\tcandidates.push(`${systemRoot}\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe`);\n\tcandidates.push(\"powershell.exe\", \"pwsh.exe\");\n\treturn candidates;\n}\n\nlet lastReadFailure: string | undefined;\n\n/** Test seam: why the most recent `readWindowsDirectorySecurity` returned `undefined`. */\nexport function getLastWindowsSecurityReadFailureForTesting(): string | undefined {\n\treturn lastReadFailure;\n}\n\n/**\n * Read the security descriptor of `path`, or `undefined` when it cannot be\n * read (access denied, missing PowerShell, timeout). Callers treat\n * `undefined` as unverifiable and refuse the directory.\n */\nexport function readWindowsDirectorySecurity(path: string): WindowsDirectorySecurity | undefined {\n\tlastReadFailure = undefined;\n\tconst failures: string[] = [];\n\tfor (const executable of powershellCandidates()) {\n\t\tconst result = spawnSync(executable, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", READ_SECURITY_SCRIPT], {\n\t\t\tenv: { ...process.env, ATOMIC_SECURITY_QUERY_PATH: path },\n\t\t\tencoding: \"utf8\",\n\t\t\ttimeout: READ_SECURITY_TIMEOUT_MS,\n\t\t\twindowsHide: true,\n\t\t});\n\t\tif (result.error || result.status !== 0 || typeof result.stdout !== \"string\") {\n\t\t\tfailures.push(\n\t\t\t\t`${executable}: status=${result.status} signal=${result.signal} error=${result.error?.message} stderr=${\n\t\t\t\t\ttypeof result.stderr === \"string\" ? result.stderr.trim().slice(0, 500) : result.stderr\n\t\t\t\t}`,\n\t\t\t);\n\t\t\tcontinue;\n\t\t}\n\t\tconst parsed = parseSecurityOutput(result.stdout);\n\t\tif (parsed !== undefined) {\n\t\t\treturn parsed;\n\t\t}\n\t\tfailures.push(`${executable}: unparseable output ${JSON.stringify(result.stdout.slice(0, 500))}`);\n\t}\n\tlastReadFailure = failures.join(\" | \");\n\treturn undefined;\n}\n\nfunction parseSecurityOutput(stdout: string): WindowsDirectorySecurity | undefined {\n\tconst [currentSid, ownerSid, dacl, ...ruleLines] = stdout.split(\"\\n\").map((line) => line.trim());\n\tif (!currentSid || !ownerSid || dacl === undefined) {\n\t\treturn undefined;\n\t}\n\tconst accessRules: WindowsAccessRule[] = [];\n\tfor (const line of ruleLines) {\n\t\tif (line.length === 0) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst [type, sid] = line.split(\";\");\n\t\tif ((type !== \"Allow\" && type !== \"Deny\") || !sid) {\n\t\t\treturn undefined;\n\t\t}\n\t\taccessRules.push({ allow: type === \"Allow\", sid });\n\t}\n\treturn { currentSid, ownerSid, dacl, accessRules };\n}\n\ntype SecurityReader = (path: string) => WindowsDirectorySecurity | undefined;\n\nlet securityReader: SecurityReader = readWindowsDirectorySecurity;\n\n/** The metadata identity a successful verification is bound to. */\ninterface VerifiedDirectoryIdentity {\n\t/** Creation time: a directory recreated at the path carries a fresh one. */\n\tbirthtimeMs: number;\n\t/** NTFS change time: bumped by an in-place DACL edit (and by entry\n\t * creation/removal inside the directory, which forces a harmless\n\t * re-read). */\n\tctimeMs: number;\n\t/** Last-write time: redundant with the change time on NTFS, kept so the\n\t * cache never outlives any observable metadata change. */\n\tmtimeMs: number;\n}\n\n/** Verified paths mapped to the metadata identity observed *before* the\n * descriptor was read. Snapshotting before the read means any mutation that\n * races the read still changes the identity relative to the cache entry, so\n * the next call re-verifies rather than trusting the racing state. */\nconst verifiedPaths = new Map<string, VerifiedDirectoryIdentity>();\n\n/**\n * Verify `path` as adoptable, returning the refusal reason when it is not.\n *\n * The subprocess read sits on the spill path, so a successful verification\n * is cached for the life of the process while the directory's metadata\n * identity (creation, change, and last-write times) is unchanged. A swapped\n * directory or an in-place DACL edit changes that identity and forces a\n * fresh read; so does creating a file inside the directory, which trades one\n * bounded subprocess per spill for never trusting a stale descriptor. The\n * symlink/directory checks in `session-temp-dir.ts` still run on every use.\n * A failure is never cached, so a transient read error does not permanently\n * disable spills.\n */\nexport function verifyWindowsDirectorySecurity(path: string): string | undefined {\n\tlet identity: VerifiedDirectoryIdentity;\n\ttry {\n\t\tconst stat = statSync(path);\n\t\tidentity = { birthtimeMs: stat.birthtimeMs, ctimeMs: stat.ctimeMs, mtimeMs: stat.mtimeMs };\n\t} catch {\n\t\treturn \"its ownership could not be verified\";\n\t}\n\tconst cached = verifiedPaths.get(path);\n\tif (\n\t\tcached !== undefined &&\n\t\tcached.birthtimeMs === identity.birthtimeMs &&\n\t\tcached.ctimeMs === identity.ctimeMs &&\n\t\tcached.mtimeMs === identity.mtimeMs\n\t) {\n\t\treturn undefined;\n\t}\n\tconst security = securityReader(path);\n\tif (security === undefined) {\n\t\treturn \"its ownership could not be verified\";\n\t}\n\tconst refusal = evaluateWindowsDirectorySecurity(security);\n\tif (refusal !== undefined) {\n\t\tverifiedPaths.delete(path);\n\t\treturn refusal;\n\t}\n\tverifiedPaths.set(path, identity);\n\treturn undefined;\n}\n\n/** Test seam: substitute the descriptor reader; pass `undefined` to restore. */\nexport function setWindowsDirectorySecurityReaderForTesting(reader: SecurityReader | undefined): void {\n\tsecurityReader = reader ?? readWindowsDirectorySecurity;\n}\n\n/** Test seam: forget verified paths so a suite can re-drive verification. */\nexport function resetWindowsDirectorySecurityStateForTesting(): void {\n\tverifiedPaths.clear();\n\tsecurityReader = readWindowsDirectorySecurity;\n}\n"]}

package/dist/core/tools/write.d.ts

@@ -6,6 +6,10 @@ declare const writeSchema: Type.TObject<{
     path: Type.TString;
     content: Type.TString;
 }>;
+export declare const writeToolSystemPromptContribution: Readonly<{
+    readonly snippet: "Create or overwrite a writable path selector.";
+    readonly guidelines: readonly ["Use write when replacing the full content of a target; use edit for source edits anchored to existing hashline snapshots."];
+}>;
 export type WriteToolInput = Static<typeof writeSchema>;
 export interface WriteToolDetails {
     resolvedPath?: string;

package/dist/core/tools/write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write.d.ts","sourceRoot":"","sources":["../../../src/core/tools/write.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAW/D,OAAO,EAAE,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAG5C,OAAO,KAAK,EAAE,cAAc,EAA2B,MAAM,wBAAwB,CAAC;AAGtF,OAAO,EAGN,KAAK,qBAAqB,EAI1B,MAAM,eAAe,CAAC;AAiBvB,QAAA,MAAM,WAAW;;;EAYhB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AACxD,MAAM,WAAW,gBAAgB;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACtD,WAAW,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC/B,8BAA8B;IAC9B,SAAS,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AAwFD,MAAM,WAAW,gBAAgB;IAChC,oEAAoE;IACpE,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,aAAa,CAAC,EAAE,qBAAqB,CAAC;CACtC;AA+ID,wBAAgB,yBAAyB,CACxC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,gBAAgB,GACxB,cAAc,CAAC,OAAO,WAAW,EAAE,gBAAgB,GAAG,SAAS,CAAC,CA2MlE;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC,OAAO,WAAW,CAAC,CAEtG"}
+{"version":3,"file":"write.d.ts","sourceRoot":"","sources":["../../../src/core/tools/write.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAW/D,OAAO,EAAE,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAG5C,OAAO,KAAK,EAAE,cAAc,EAA2B,MAAM,wBAAwB,CAAC;AAGtF,OAAO,EAGN,KAAK,qBAAqB,EAI1B,MAAM,eAAe,CAAC;AAiBvB,QAAA,MAAM,WAAW;;;EAYhB,CAAC;AAEF,eAAO,MAAM,iCAAiC;sBACpC,+CAA+C;;EAI9C,CAAC;AACZ,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AACxD,MAAM,WAAW,gBAAgB;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACtD,WAAW,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC/B,8BAA8B;IAC9B,SAAS,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AAwFD,MAAM,WAAW,gBAAgB;IAChC,oEAAoE;IACpE,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,aAAa,CAAC,EAAE,qBAAqB,CAAC;CACtC;AA+ID,wBAAgB,yBAAyB,CACxC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,gBAAgB,GACxB,cAAc,CAAC,OAAO,WAAW,EAAE,gBAAgB,GAAG,SAAS,CAAC,CAyMlE;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC,OAAO,WAAW,CAAC,CAEtG"}

package/dist/core/tools/write.js

@@ -20,6 +20,12 @@ const writeSchema = Type.Object({
         description: "Full replacement content. SQLite non-delete writes parse as a JSON5 object; empty content deletes a SQLite row when a row key exists.",
     }),
 }, { additionalProperties: false });
+export const writeToolSystemPromptContribution = Object.freeze({
+    snippet: "Create or overwrite a writable path selector.",
+    guidelines: Object.freeze([
+        "Use write when replacing the full content of a target; use edit for source edits anchored to existing hashline snapshots.",
+    ]),
+});
 async function findConflictBlocks(root, limit = 100) {
     const out = [];
     async function walk(dir) {
@@ -232,10 +238,8 @@ export function createWriteToolDefinition(cwd, options) {
         name: "write",
         label: "write",
         description: "Create or overwrite a file, writable internal resource, archive entry, SQLite row, or merge-conflict resolution.",
-        promptSnippet: "Create or overwrite a writable path selector.",
-        promptGuidelines: [
-            "Use write when replacing the full content of a target; use edit for source edits anchored to existing hashline snapshots.",
-        ],
+        promptSnippet: writeToolSystemPromptContribution.snippet,
+        promptGuidelines: [...writeToolSystemPromptContribution.guidelines],
         parameters: writeSchema,
         async execute(_toolCallId, { path, content }, signal, _onUpdate, _ctx) {
             const resourceCtx = _ctx;