@bendyline/gezel 0.1.0 → 1.0.1

package/dist/native/index.d.ts

@@ -23,10 +23,12 @@ export { D as DEVICE_HARD_TEMPERATURE_C } from '../device-safety-DezzpNyR.js';
  *   const bin = resolveNativeBinaryPath('llama-server', import.meta.url, probe.backend);
  *
  * Caching: the result is memoized at
- * `<home>/engines/llama-cpp/backend.json` so subsequent launches
- * skip the probe. Cache invalidates whenever `engineVersion`
- * changes — bumping the llama.cpp pin may prefer a different
- * backend.
+ * `<home>/engines/llama-cpp/backend.json`. Subsequent launches reuse
+ * it only while the cheap driver-library check still resolves to the
+ * same backend. That matters when a user installs or removes a GPU
+ * driver between launches. The cache also invalidates whenever
+ * `engineVersion` changes — bumping the llama.cpp pin may prefer a
+ * different backend.
  */
 type LlamaBackend = 'cuda' | 'vulkan' | 'metal' | 'cpu';
 /**
@@ -376,44 +378,36 @@ declare function resolveNativeBinaryUnder(root: string, name: NativeBinaryName,
 declare function discoverNativeBinaries(input: DiscoverInput): DiscoverResult;
 
 /**
- * Windows console-allocation policy for spawned native children.
- *
- * Console-subsystem executables (llama-server, ds4-server, bundled Node) get
- * a console allocated by the loader unless the creator says otherwise. Under
- * the machine-wide service there is nothing to allocate one from: the daemon
- * runs in non-interactive Session 0, where — as
- * `native/helpers/service-host/src/main.cpp` records — `AllocConsole` fails
- * with error 317. `DETACHED_PROCESS`, which Node exposes as `detached: true`,
- * asks for no console at all.
- *
- * `windowsHide` is NOT that flag. It maps to `CREATE_NO_WINDOW`, which still
- * allocates a console and only withholds the window.
- *
- * `detached` is deliberately scoped to win32. On POSIX the same option means
- * `setsid()`, which changes process-group and signal semantics that callers
- * may depend on; there is no console problem to solve there.
- *
- * ## What this does not fix
- *
- * This helper was introduced in v1.26215.31 believing it fixed the
- * `spawn EPERM` that killed every native-engine launch under the machine
- * service. It did not. That release shipped the flag and the failure
- * continued, on two machines, with the daemon's own log showing the engine,
- * the bundled device-health helper, `nvidia-smi`, `amd-smi` and `rocm-smi`
- * all denied at once. The cause was the service token: `sc sidtype ...
- * restricted` write-restricts it, and libuv creates a named pipe per piped
- * stdio handle before every `CreateProcess`, which that token cannot do. The
- * installer now assigns `unrestricted` (see
- * `packages/app/installer/nsis-hooks.nsh`), and `probeChildProcessSpawn` in
- * the service catches a recurrence at boot.
- *
- * The flag is still correct and still used — a console the service cannot
- * allocate is one Windows should not be asked for — but it is a tidiness
- * measure, not a fix for a permission error. If `spawn EPERM` appears again,
- * do not reach for spawn flags: look at the token.
+ * Windows console-window policy for owned child processes.
+ *
+ * Node documents `detached: true` on Windows as giving the child its own
+ * console window. That is the opposite of what short-lived helpers and
+ * supervised engines want: it is what caused Windows Terminal to flash a
+ * fresh command prompt for every native signature check. `windowsHide` is
+ * the dedicated Node/libuv option for suppressing a subprocess console
+ * window, and it leaves the child's lifetime and process-group ownership
+ * unchanged.
+ *
+ * Keep this win32-only. The option is ignored on POSIX, but omitting it there
+ * makes the platform contract explicit and keeps captured spawn options
+ * deterministic in tests.
+ */
+declare function windowsHeadlessSpawnOptions(platform?: NodeJS.Platform): {
+    windowsHide: true;
+} | Record<string, never>;
+/**
+ * Windows options for a genuine fire-and-forget child that must outlive its
+ * parent. Detachment is a lifetime decision, not a headless-launch strategy;
+ * pair it with `windowsHide` so Windows does not surface the child's new
+ * console while it starts.
+ *
+ * Most callers should use {@link windowsHeadlessSpawnOptions}. In particular,
+ * awaited probes, package installers, and supervised engines are owned
+ * children and must not be detached.
  */
 declare function windowsDetachedSpawnOptions(platform?: NodeJS.Platform): {
     detached: true;
+    windowsHide: true;
 } | Record<string, never>;
 
 /**
@@ -647,4 +641,4 @@ interface FindGpuPanicOptions {
  */
 declare function findRecentGpuPanics(opts?: FindGpuPanicOptions): GpuPanicRecord[];
 
-export { type CommandResult, DEFAULT_DEVICE_SAFETY_POLICY, type DetectInput, type DetectResult, type DeviceHealthCommandRunner, type DeviceHealthDecision, DeviceHealthGate, type DeviceHealthGateOptions, type DeviceHealthProbe, type DeviceHealthReading, type DeviceHealthSample, type DeviceHealthState, type DeviceHealthStatusSnapshot, type DeviceSafetyMode, type DeviceSafetyPolicyInput, type DeviceTelemetryFailurePolicy, type DeviceVendor, type DiscoverInput, type DiscoverResult, type FindGpuPanicOptions, GPU_PANIC_RE, type GpuPanicRecord, type GpuVendorHint, LLAMA_ENGINE_VERSION, type LlamaBackend, type LlamaQuarantineEntry, type NativeBinaryName, type QuarantineIo, type ResolvedDeviceSafetyPolicy, type ResolvedLlamaBinary, type SystemDeviceHealthProbeOptions, binaryFingerprint, createSystemDeviceHealthProbe, detectLlamaBackend, discoverNativeBinaries, evaluateDeviceHealth, findRecentGpuPanics, isBinaryQuarantined, llamaQuarantinePath, parseAmdSmiJson, parseNvidiaSmiCsv, readLlamaQuarantine, recordLlamaQuarantine, resolveAvailableLlamaBinary, resolveDeviceSafetyPolicy, resolveNativeBinaryUnder, resolvePlatformKey, windowsDetachedSpawnOptions };
+export { type CommandResult, DEFAULT_DEVICE_SAFETY_POLICY, type DetectInput, type DetectResult, type DeviceHealthCommandRunner, type DeviceHealthDecision, DeviceHealthGate, type DeviceHealthGateOptions, type DeviceHealthProbe, type DeviceHealthReading, type DeviceHealthSample, type DeviceHealthState, type DeviceHealthStatusSnapshot, type DeviceSafetyMode, type DeviceSafetyPolicyInput, type DeviceTelemetryFailurePolicy, type DeviceVendor, type DiscoverInput, type DiscoverResult, type FindGpuPanicOptions, GPU_PANIC_RE, type GpuPanicRecord, type GpuVendorHint, LLAMA_ENGINE_VERSION, type LlamaBackend, type LlamaQuarantineEntry, type NativeBinaryName, type QuarantineIo, type ResolvedDeviceSafetyPolicy, type ResolvedLlamaBinary, type SystemDeviceHealthProbeOptions, binaryFingerprint, createSystemDeviceHealthProbe, detectLlamaBackend, discoverNativeBinaries, evaluateDeviceHealth, findRecentGpuPanics, isBinaryQuarantined, llamaQuarantinePath, parseAmdSmiJson, parseNvidiaSmiCsv, readLlamaQuarantine, recordLlamaQuarantine, resolveAvailableLlamaBinary, resolveDeviceSafetyPolicy, resolveNativeBinaryUnder, resolvePlatformKey, windowsDetachedSpawnOptions, windowsHeadlessSpawnOptions };

package/dist/native/index.js

@@ -10,6 +10,16 @@ import {
 } from "fs";
 import { dirname, join } from "path";
 import { arch as nodeArch, platform as nodePlatform } from "process";
+
+// src/native/console-detach.ts
+function windowsHeadlessSpawnOptions(platform = process.platform) {
+  return platform === "win32" ? { windowsHide: true } : {};
+}
+function windowsDetachedSpawnOptions(platform = process.platform) {
+  return platform === "win32" ? { detached: true, windowsHide: true } : {};
+}
+
+// src/native/llama-backend.ts
 function resolveAvailableLlamaBinary(preferredBackend, resolveBinary, allowFallbacks, isUsable) {
   const fallbackOrder = {
     cuda: ["cuda", "vulkan", "cpu"],
@@ -50,9 +60,41 @@ function anyExists(paths, probe) {
   }
   return null;
 }
+var LINUX_CUDA_DRIVER_PATHS = [
+  "/usr/lib/x86_64-linux-gnu/libcuda.so.1",
+  "/usr/lib/aarch64-linux-gnu/libcuda.so.1",
+  "/usr/lib64/libcuda.so.1",
+  "/usr/lib/libcuda.so.1",
+  "/lib/x86_64-linux-gnu/libcuda.so.1",
+  "/lib/aarch64-linux-gnu/libcuda.so.1"
+];
+var LINUX_VULKAN_LOADER_PATHS = [
+  "/usr/lib/x86_64-linux-gnu/libvulkan.so.1",
+  "/usr/lib/aarch64-linux-gnu/libvulkan.so.1",
+  "/usr/lib64/libvulkan.so.1",
+  "/usr/lib/libvulkan.so.1"
+];
+function windowsSystem32() {
+  return process.env.SYSTEMROOT ? join(process.env.SYSTEMROOT, "System32") : "C:\\Windows\\System32";
+}
+function detectDriverBackend(os, probeFile) {
+  if (os === "linux") {
+    const libcuda = anyExists(LINUX_CUDA_DRIVER_PATHS, probeFile);
+    if (libcuda) return { backend: "cuda", path: libcuda };
+    const libvulkan = anyExists(LINUX_VULKAN_LOADER_PATHS, probeFile);
+    if (libvulkan) return { backend: "vulkan", path: libvulkan };
+    return { backend: "cpu" };
+  }
+  const sys32 = windowsSystem32();
+  const nvcuda = anyExists([join(sys32, "nvcuda.dll"), join(sys32, "nvml.dll")], probeFile);
+  if (nvcuda) return { backend: "cuda", path: nvcuda };
+  const vulkan = anyExists([join(sys32, "vulkan-1.dll")], probeFile);
+  if (vulkan) return { backend: "vulkan", path: vulkan };
+  return { backend: "cpu" };
+}
 function commandOkDefault(cmd) {
   try {
-    execSync(cmd, { stdio: "ignore" });
+    execSync(cmd, { stdio: "ignore", ...windowsHeadlessSpawnOptions() });
     return true;
   } catch {
     return false;
@@ -87,7 +129,7 @@ function detectVendor(os, probeFile, readFileText, readDir) {
     if (found.has("intel")) return "intel";
     return void 0;
   }
-  const sys32 = process.env.SYSTEMROOT ? join(process.env.SYSTEMROOT, "System32") : "C:\\Windows\\System32";
+  const sys32 = windowsSystem32();
   if (probeFile(join(sys32, "nvcuda.dll")) || probeFile(join(sys32, "nvapi64.dll"))) {
     return "nvidia";
   }
@@ -101,52 +143,20 @@ function detectVendor(os, probeFile, readFileText, readDir) {
 }
 function detectLinuxOrWin(os, probeFile, probeCmd, readFileText, readDir) {
   const vendorHint = detectVendor(os, probeFile, readFileText, readDir);
-  if (os === "linux") {
-    const libcuda = anyExists(
-      [
-        "/usr/lib/x86_64-linux-gnu/libcuda.so.1",
-        "/usr/lib/aarch64-linux-gnu/libcuda.so.1",
-        "/usr/lib64/libcuda.so.1",
-        "/usr/lib/libcuda.so.1",
-        "/lib/x86_64-linux-gnu/libcuda.so.1",
-        "/lib/aarch64-linux-gnu/libcuda.so.1"
-      ],
-      probeFile
-    );
-    if (libcuda) {
+  const driver = detectDriverBackend(os, probeFile);
+  if (driver.backend === "cuda" && driver.path) {
+    if (os === "linux") {
       const smiOk = probeCmd("nvidia-smi -L");
       return {
         backend: "cuda",
-        reason: `found ${libcuda}${smiOk ? ", nvidia-smi ok" : ", nvidia-smi absent or failing (proceeding anyway)"}`,
+        reason: `found ${driver.path}${smiOk ? ", nvidia-smi ok" : ", nvidia-smi absent or failing (proceeding anyway)"}`,
         vendorHint
       };
     }
-  } else {
-    const sys32 = process.env.SYSTEMROOT ? join(process.env.SYSTEMROOT, "System32") : "C:\\Windows\\System32";
-    const nvcuda = anyExists([join(sys32, "nvcuda.dll"), join(sys32, "nvml.dll")], probeFile);
-    if (nvcuda) {
-      return { backend: "cuda", reason: `found ${nvcuda}`, vendorHint };
-    }
+    return { backend: "cuda", reason: `found ${driver.path}`, vendorHint };
   }
-  if (os === "linux") {
-    const libvulkan = anyExists(
-      [
-        "/usr/lib/x86_64-linux-gnu/libvulkan.so.1",
-        "/usr/lib/aarch64-linux-gnu/libvulkan.so.1",
-        "/usr/lib64/libvulkan.so.1",
-        "/usr/lib/libvulkan.so.1"
-      ],
-      probeFile
-    );
-    if (libvulkan) {
-      return { backend: "vulkan", reason: `found ${libvulkan}`, vendorHint };
-    }
-  } else {
-    const sys32 = process.env.SYSTEMROOT ? join(process.env.SYSTEMROOT, "System32") : "C:\\Windows\\System32";
-    const vk = anyExists([join(sys32, "vulkan-1.dll")], probeFile);
-    if (vk) {
-      return { backend: "vulkan", reason: `found ${vk}`, vendorHint };
-    }
+  if (driver.backend === "vulkan" && driver.path) {
+    return { backend: "vulkan", reason: `found ${driver.path}`, vendorHint };
   }
   return { backend: "cpu", reason: "no CUDA driver and no Vulkan loader found", vendorHint };
 }
@@ -177,11 +187,15 @@ function probeOrCached(input) {
   const probeReadFile = input.probe?.readFileText ?? readFileTextDefault;
   const probeReadDir = input.probe?.readDir ?? readDirDefault;
   const cachePath = join(input.home, "engines", "llama-cpp", "backend.json");
+  const plat = input.probe?.platform ?? nodePlatform;
+  const ar = input.probe?.arch ?? nodeArch;
   if (fileExistsDefault(cachePath)) {
     try {
       const cached = JSON.parse(readFileSync(cachePath, "utf8"));
       const schemaOk = (cached.probeSchemaVersion ?? 0) >= PROBE_SCHEMA_VERSION;
-      if (cached.engineVersion === input.engineVersion && schemaOk) {
+      const currentDriverBackend = plat === "linux" && (ar === "x64" || ar === "arm64") || plat === "win32" && ar === "x64" ? detectDriverBackend(plat, probeFile).backend : void 0;
+      const driverStateUnchanged = currentDriverBackend === void 0 || currentDriverBackend === cached.backend;
+      if (cached.engineVersion === input.engineVersion && schemaOk && driverStateUnchanged) {
         return {
           backend: cached.backend,
           cached: true,
@@ -193,8 +207,6 @@ function probeOrCached(input) {
     } catch {
     }
   }
-  const plat = input.probe?.platform ?? nodePlatform;
-  const ar = input.probe?.arch ?? nodeArch;
   let result;
   if (plat === "darwin") {
     if (ar === "arm64") {
@@ -455,11 +467,6 @@ function discoverNativeBinaries(input) {
   return result;
 }
 
-// src/native/console-detach.ts
-function windowsDetachedSpawnOptions(platform = process.platform) {
-  return platform === "win32" ? { detached: true } : {};
-}
-
 // src/native/device-health.ts
 import { execFile as nodeExecFile } from "child_process";
 
@@ -730,13 +737,10 @@ function defaultCommandRunner(command, args, timeoutMs) {
     nodeExecFile(
       command,
       args,
-      // nvidia-smi / amd-smi are console-subsystem, and the Session 0 service
-      // has no console for the loader to allocate from, so they start with
-      // DETACHED_PROCESS; `windowsHide` (CREATE_NO_WINDOW) still allocates
-      // one. When these probes fail the daemon sees no GPU at all and plans
-      // capacity against system RAM — the symptom that made a token-level
-      // spawn denial look like a GPU-detection bug.
-      { timeout: timeoutMs, ...windowsDetachedSpawnOptions() },
+      // Hardware CLIs are short-lived, owned children. Hide their Windows
+      // console instead of detaching them; detachment gives each probe its
+      // own console window and produces a visible terminal flash.
+      { timeout: timeoutMs, ...windowsHeadlessSpawnOptions() },
       (error, stdout, stderr) => {
         if (error) {
           reject(error);
@@ -1117,5 +1121,6 @@ export {
   resolveDeviceSafetyPolicy,
   resolveNativeBinaryUnder,
   resolvePlatformKey,
-  windowsDetachedSpawnOptions
+  windowsDetachedSpawnOptions,
+  windowsHeadlessSpawnOptions
 };

package/dist/paths.d.ts

@@ -207,6 +207,8 @@ declare function projectLocalDir(root: string, projectId: string): string;
 declare function projectMetaFile(root: string, projectId: string): string;
 /** Durable user/worker lifecycle for indexed code findings. Account-private. */
 declare function projectFindingLifecycleFile(root: string, projectId: string): string;
+/** Durable Boekwachter issue identity + lifecycle. Account-private. */
+declare function projectBoekwachterIssuesFile(root: string, projectId: string): string;
 /** Durable per-project code-review records for this account. */
 declare function projectCodeReviewsFile(root: string, projectId: string): string;
 /** Durable per-account report-action lifecycle records. */
@@ -215,6 +217,16 @@ declare function projectReportActionsFile(root: string, projectId: string): stri
 declare function projectDocsDir(root: string, projectId: string, external?: ExternalFolders): string;
 /** Per-project artifacts folder — agent-generated outputs. */
 declare function projectArtifactsDir(root: string, projectId: string, external?: ExternalFolders): string;
+/**
+ * Reserved artifacts subtree holding gezel-generated shadow files: markdown
+ * representations of workspace content (converted office documents, image
+ * descriptions, audio transcripts). Lives under artifacts — never the
+ * workspace, which may be read-only — and is a regenerable cache: write-denied
+ * to gezels/users, safe to delete, rebuilt by indexing.
+ */
+declare const PROJECT_SHADOW_DIR_NAME = "shadow";
+/** Per-project `artifacts/shadow/` root. */
+declare function projectShadowDir(root: string, projectId: string, external?: ExternalFolders): string;
 /** Per-project memories folder (daily markdown + summary + vectra index). */
 declare function projectMemoriesDir(root: string, projectId: string, external?: ExternalFolders): string;
 /**
@@ -394,8 +406,11 @@ declare function projectLocalRoot(workspaceDir: string): string;
 declare function projectLocalIndexDir(workspaceDir: string): string;
 declare function projectLocalIndexDbFile(workspaceDir: string): string;
 /**
- * Converted-document artifacts (squisq-flavored markdown + media + CSV),
- * mirroring the source tree under `.gezel/files/<mirror>/<name>_files/`.
+ * Legacy converted-document location under the workspace's own
+ * `.gezel/files/<mirror>/<name>_files/`. Workspace conversions now live in
+ * the project's `artifacts/shadow/` tree ({@link projectShadowDir}) so a
+ * read-only workspace never loses them; this helper remains only so the
+ * indexer can clean the old tree up.
  */
 declare function projectLocalFilesDir(workspaceDir: string): string;
 /**
@@ -418,6 +433,14 @@ declare function fallbackProjectIndexDir(root: string, projectId: string): strin
  * always use the account-private fallback to prevent cross-daemon SQLite use.
  */
 declare function projectContentIndexDbFile(root: string, projectId: string, workspaceDir: string): string;
+/**
+ * Derived FTS index over a project's artifact corpora (connector records under
+ * `artifacts/data/**`). Always in the account-private sidecar, never inside
+ * the artifacts tree itself — the database must not surface in the corpus
+ * browser, and mutable SQLite must not ride an externalized artifacts folder.
+ * Rebuildable cache, safe to delete.
+ */
+declare function projectArtifactsIndexDbFile(root: string, projectId: string): string;
 /**
  * The committable code-map "city file": placement anchors, user overrides, and
  * the layout journal. Deliberately OUTSIDE the self-gitignored `.gezel/index/`
@@ -575,4 +598,4 @@ declare function keurmeesterDigestStatePath(root: string): string;
  */
 declare function readConfigRaw(root: string): Promise<Record<string, unknown>>;
 
-export { type ExternalFolders, type GezelPaths, MACHINE_SHARED_MARKER, type MachineStorageScope, activeMachineSharedHome, backupsDir, channelsDir, craftbookShardPrefix, craftbookTemplateDir, craftbookTemplateManifestFile, craftbookTemplateScriptFile, craftbookTemplateScriptsDir, craftbookTemplateVersionDir, craftbookTemplateVersionManifestFile, craftbookTemplatesRoot, daemonTransactionsRoot, deviceIdentityFile, fallbackProjectIndexDir, fallbackProjectVillageFile, foldersStateDir, gezelDir, gezelGrowthPath, gezelHome, gezelLocalDir, gezelMemoriesDir, gezelPaths, gezelPoppetjePath, gezelSessionFile, gezelSessionsDir, gezelStorageScope, gezelToolsPath, gezelToolsetsFile, gezelToolsetsInstallDir, gildeLiveRoot, gildeLiveStateFile, gildeLiveVersionDir, gildeLiveVersionsDir, globalHistoryFile, globalIndexDbFile, globalIndexDir, keurmeesterCasesDir, keurmeesterDigestStatePath, keurmeesterDigestsDir, keurmeesterDir, machineSharedGezelDir, machineSharedHome, machineSharedMarkerFile, machineSharedProjectDir, meesterStatusDir, meesterStatusFile, meesterStatusStateFile, pendingGrantsFile, playwrightBrowsersDir, projectActivityFile, projectArtifactsDir, projectCodeReviewsFile, projectContentIndexDbFile, projectCreateTransactionsRoot, projectDir, projectDocsDir, projectFindingLifecycleFile, projectHistoryFile, projectIndexDir, projectInternalGithubDir, projectLocalConfigFile, projectLocalCraftbookDir, projectLocalCraftbooksRoot, projectLocalDir, projectLocalFilesDir, projectLocalGezelDir, projectLocalGezelsRoot, projectLocalImportsFile, projectLocalIndexDbFile, projectLocalIndexDir, projectLocalPendingImportsFile, projectLocalQuarantineDir, projectLocalRoot, projectLocalVillageFile, projectMemoriesDir, projectMemoryIndexDir, projectMetaFile, projectPrivateDir, projectQuestionsFile, projectReportActionsFile, projectScriptFile, projectScriptRunFile, projectScriptRunsDir, projectScriptsDir, projectStorageDir, projectStorageScope, projectTaskAboutFile, projectTaskDir, projectTaskFile, projectTaskNextIdFile, projectTaskNotesFile, projectTasksDir, projectTerminalFile, projectTerminalsDir, projectToolsetsFile, projectToolsetsInstallDir, projectTypeDir, projectTypeManifestFile, projectTypeShardPrefix, projectTypeVersionDir, projectTypeVersionManifestFile, projectTypesRoot, readConfigRaw, remotesFile, secretsFile, secretsKeyFile, sharedCloneDir, sharedClonesRoot, sharedToolsetsFile, sharedToolsetsInstallDir, systemInstalledToolsetsFile, systemToolsetsFile, systemToolsetsInstallDir, tokensFile, toolsetConfigFile, toolsetConfigsDir, userGezelDir, userProjectDir, userScriptFile, userScriptsDir };
+export { type ExternalFolders, type GezelPaths, MACHINE_SHARED_MARKER, type MachineStorageScope, PROJECT_SHADOW_DIR_NAME, activeMachineSharedHome, backupsDir, channelsDir, craftbookShardPrefix, craftbookTemplateDir, craftbookTemplateManifestFile, craftbookTemplateScriptFile, craftbookTemplateScriptsDir, craftbookTemplateVersionDir, craftbookTemplateVersionManifestFile, craftbookTemplatesRoot, daemonTransactionsRoot, deviceIdentityFile, fallbackProjectIndexDir, fallbackProjectVillageFile, foldersStateDir, gezelDir, gezelGrowthPath, gezelHome, gezelLocalDir, gezelMemoriesDir, gezelPaths, gezelPoppetjePath, gezelSessionFile, gezelSessionsDir, gezelStorageScope, gezelToolsPath, gezelToolsetsFile, gezelToolsetsInstallDir, gildeLiveRoot, gildeLiveStateFile, gildeLiveVersionDir, gildeLiveVersionsDir, globalHistoryFile, globalIndexDbFile, globalIndexDir, keurmeesterCasesDir, keurmeesterDigestStatePath, keurmeesterDigestsDir, keurmeesterDir, machineSharedGezelDir, machineSharedHome, machineSharedMarkerFile, machineSharedProjectDir, meesterStatusDir, meesterStatusFile, meesterStatusStateFile, pendingGrantsFile, playwrightBrowsersDir, projectActivityFile, projectArtifactsDir, projectArtifactsIndexDbFile, projectBoekwachterIssuesFile, projectCodeReviewsFile, projectContentIndexDbFile, projectCreateTransactionsRoot, projectDir, projectDocsDir, projectFindingLifecycleFile, projectHistoryFile, projectIndexDir, projectInternalGithubDir, projectLocalConfigFile, projectLocalCraftbookDir, projectLocalCraftbooksRoot, projectLocalDir, projectLocalFilesDir, projectLocalGezelDir, projectLocalGezelsRoot, projectLocalImportsFile, projectLocalIndexDbFile, projectLocalIndexDir, projectLocalPendingImportsFile, projectLocalQuarantineDir, projectLocalRoot, projectLocalVillageFile, projectMemoriesDir, projectMemoryIndexDir, projectMetaFile, projectPrivateDir, projectQuestionsFile, projectReportActionsFile, projectScriptFile, projectScriptRunFile, projectScriptRunsDir, projectScriptsDir, projectShadowDir, projectStorageDir, projectStorageScope, projectTaskAboutFile, projectTaskDir, projectTaskFile, projectTaskNextIdFile, projectTaskNotesFile, projectTasksDir, projectTerminalFile, projectTerminalsDir, projectToolsetsFile, projectToolsetsInstallDir, projectTypeDir, projectTypeManifestFile, projectTypeShardPrefix, projectTypeVersionDir, projectTypeVersionManifestFile, projectTypesRoot, readConfigRaw, remotesFile, secretsFile, secretsKeyFile, sharedCloneDir, sharedClonesRoot, sharedToolsetsFile, sharedToolsetsInstallDir, systemInstalledToolsetsFile, systemToolsetsFile, systemToolsetsInstallDir, tokensFile, toolsetConfigFile, toolsetConfigsDir, userGezelDir, userProjectDir, userScriptFile, userScriptsDir };

package/dist/paths.js

@@ -2,6 +2,47 @@
 import { existsSync, lstatSync, readFileSync } from "fs";
 import { homedir } from "os";
 import { join, posix, win32 } from "path";
+
+// src/entity-id.ts
+var SAFE_ENTITY_ID = /^[A-Za-z0-9@][A-Za-z0-9@._-]{0,199}$/;
+var RESERVED_WINDOWS_IDS = /* @__PURE__ */ new Set([
+  "CON",
+  "PRN",
+  "AUX",
+  "NUL",
+  "COM1",
+  "COM2",
+  "COM3",
+  "COM4",
+  "COM5",
+  "COM6",
+  "COM7",
+  "COM8",
+  "COM9",
+  "LPT1",
+  "LPT2",
+  "LPT3",
+  "LPT4",
+  "LPT5",
+  "LPT6",
+  "LPT7",
+  "LPT8",
+  "LPT9"
+]);
+function isSafeEntityId(value) {
+  if (typeof value !== "string" || !SAFE_ENTITY_ID.test(value)) return false;
+  const windowsStem = (value.split(".")[0] ?? "").toUpperCase();
+  return !RESERVED_WINDOWS_IDS.has(windowsStem);
+}
+function assertSafeEntityId(value, label = "entity id") {
+  if (!isSafeEntityId(value)) {
+    throw new TypeError(
+      `${label} must be a portable single-segment id (letters, numbers, @, ., _, or -)`
+    );
+  }
+}
+
+// src/paths.ts
 var MACHINE_SHARED_MARKER = ".gezel-machine-shared-v1.json";
 function machineSharedHome(platform = process.platform, env = process.env) {
   const override = env.GEZEL_MACHINE_SHARED_HOME;
@@ -42,19 +83,23 @@ function activeMachineSharedHome(env = process.env) {
   }
 }
 function userGezelDir(root, gezelId, external) {
+  assertSafeEntityId(gezelId, "gezel id");
   return join(external?.gezels ?? join(root, "gezels"), gezelId);
 }
 function userProjectDir(root, projectId) {
+  assertSafeEntityId(projectId, "project id");
   return join(root, "projects", projectId);
 }
 function projectPrivateDir(root, projectId) {
   return userProjectDir(root, projectId);
 }
 function machineSharedGezelDir(gezelId) {
+  assertSafeEntityId(gezelId, "gezel id");
   const shared = activeMachineSharedHome();
   return shared ? join(shared, "gezels", gezelId) : null;
 }
 function machineSharedProjectDir(projectId) {
+  assertSafeEntityId(projectId, "project id");
   const shared = activeMachineSharedHome();
   return shared ? join(shared, "projects", projectId) : null;
 }
@@ -113,6 +158,7 @@ function gezelDir(root, gezelId, external) {
   return userGezelDir(root, gezelId, external);
 }
 function gezelLocalDir(root, gezelId) {
+  assertSafeEntityId(gezelId, "gezel id");
   return join(root, "gezels", gezelId);
 }
 function gezelSessionsDir(root, gezelId, external) {
@@ -149,6 +195,7 @@ function gezelPoppetjePath(root, gezelId, external) {
   return join(gezelDir(root, gezelId, external), "poppetje.json");
 }
 function projectDir(root, projectId, external) {
+  assertSafeEntityId(projectId, "project id");
   if (projectStorageScope(root, projectId) === "machine-shared") {
     return machineSharedProjectDir(projectId);
   }
@@ -169,6 +216,9 @@ function projectMetaFile(root, projectId) {
 function projectFindingLifecycleFile(root, projectId) {
   return join(projectPrivateDir(root, projectId), "finding-lifecycle.json");
 }
+function projectBoekwachterIssuesFile(root, projectId) {
+  return join(projectPrivateDir(root, projectId), "boekwachter-issues.json");
+}
 function projectCodeReviewsFile(root, projectId) {
   return join(projectPrivateDir(root, projectId), "code-reviews.json");
 }
@@ -181,6 +231,10 @@ function projectDocsDir(root, projectId, external) {
 function projectArtifactsDir(root, projectId, external) {
   return join(projectDir(root, projectId, external), "artifacts");
 }
+var PROJECT_SHADOW_DIR_NAME = "shadow";
+function projectShadowDir(root, projectId, external) {
+  return join(projectArtifactsDir(root, projectId, external), PROJECT_SHADOW_DIR_NAME);
+}
 function projectMemoriesDir(root, projectId, external) {
   return join(projectDir(root, projectId, external), "memories");
 }
@@ -331,6 +385,9 @@ function fallbackProjectIndexDir(root, projectId) {
 function projectContentIndexDbFile(root, projectId, workspaceDir) {
   return projectStorageScope(root, projectId) === "machine-shared" ? join(fallbackProjectIndexDir(root, projectId), "index.db") : projectLocalIndexDbFile(workspaceDir);
 }
+function projectArtifactsIndexDbFile(root, projectId) {
+  return join(fallbackProjectIndexDir(root, projectId), "artifacts.db");
+}
 function projectLocalVillageFile(workspaceDir) {
   return join(projectLocalRoot(workspaceDir), "village.json");
 }
@@ -350,6 +407,7 @@ function projectLocalGezelsRoot(workspaceDir) {
   return join(projectLocalRoot(workspaceDir), "gezels");
 }
 function projectLocalGezelDir(workspaceDir, localId) {
+  assertSafeEntityId(localId, "project-local gezel id");
   return join(projectLocalGezelsRoot(workspaceDir), localId);
 }
 function projectLocalCraftbooksRoot(workspaceDir) {
@@ -450,6 +508,7 @@ async function readConfigRaw(root) {
 }
 export {
   MACHINE_SHARED_MARKER,
+  PROJECT_SHADOW_DIR_NAME,
   activeMachineSharedHome,
   backupsDir,
   channelsDir,
@@ -501,6 +560,8 @@ export {
   playwrightBrowsersDir,
   projectActivityFile,
   projectArtifactsDir,
+  projectArtifactsIndexDbFile,
+  projectBoekwachterIssuesFile,
   projectCodeReviewsFile,
   projectContentIndexDbFile,
   projectCreateTransactionsRoot,
@@ -534,6 +595,7 @@ export {
   projectScriptRunFile,
   projectScriptRunsDir,
   projectScriptsDir,
+  projectShadowDir,
   projectStorageDir,
   projectStorageScope,
   projectTaskAboutFile,