@calliopelabs/cli 3.1.0 → 3.2.0

package/dist/isolation/coordinator.js

@@ -0,0 +1,79 @@
+import * as fs from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { canonicalJson, canonicalPath } from '../approvals/index.js';
+import { authorizeSessionAction } from '../session-management/index.js';
+import { throwIfCancelled } from '../cancellation.js';
+import { readCollectedArtifact, recordExecutorArtifact } from '../orchestration/verification.js';
+import { OrchestrationError } from '../orchestration/types.js';
+import { createWorkerWorktree, pinWorktreeBase } from './worktree.js';
+import { runIsolatedCommand } from './process.js';
+export async function taskWorktree(store, task, options) {
+    const context = store.context();
+    if (!context.plan.workspace.isolation)
+        return undefined;
+    const project = store.manifest.project.root;
+    await authorizeSessionAction(project, 'orchestration_workspace', { path: project, runId: store.manifest.id, taskId: task.id, planHash: store.manifest.planHash, storage: store.root }, options);
+    const base = await pinWorktreeBase(store.root, project, store.manifest.source.path, store.manifest.planHash, options.signal);
+    const state = store.read().state, root = join(store.root, `worker-${task.id}-${state.tasks[task.id].attempts}`);
+    const workspace = await createWorkerWorktree(root, project, base, options.signal);
+    const agent = context.plan.agents.find(a => a.id === task.agentId), copied = new Map();
+    for (const input of [...agent.inputs, ...task.inputs])
+        if (input.kind === 'artifact') {
+            const artifact = state.artifacts[input.value];
+            if (!artifact)
+                throw new OrchestrationError('unavailable', 'Dependency artifact is missing.');
+            const path = context.plan.tasks.find(t => t.id === artifact.taskId).outputs.find(o => o.id === artifact.id).path;
+            if (!path)
+                continue;
+            if (copied.has(path) && copied.get(path) !== artifact.sha256)
+                throw new OrchestrationError('conflict', 'Dependency artifacts disagree on the same workspace path.');
+            const content = await readCollectedArtifact(store, artifact, options);
+            throwIfCancelled(options.signal);
+            workspace.assertIdentity();
+            const file = resolve(workspace.filesRoot, path);
+            if (path.split('/').some(p => p.toLowerCase() === '.git') || canonicalPath(file) !== file)
+                throw new OrchestrationError('conflict', 'Dependency path aliases workspace metadata.');
+            fs.mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+            fs.writeFileSync(file, content, { mode: 0o600 });
+            copied.set(path, artifact.sha256);
+        }
+    options.runlog?.policyEvent({ tool: 'orchestration_workspace', source: 'isolation', decision: 'allow', reason: canonicalJson({ taskId: task.id, base, root, inputs: [...copied] }), durationMs: 0 });
+    return workspace;
+}
+export async function verifyInWorktree(store, task, workspace, guard, options) {
+    const context = store.context(), image = context.plan.workspace.isolation.image;
+    const agent = context.plan.agents.find(a => a.id === task.agentId), outputs = new Map();
+    for (const command of task.isolation.commands) {
+        guard.assertActive(options.signal);
+        const rendered = command.argv.map(arg => "'" + arg.replace(/'/g, "'\\''") + "'").join(' ');
+        const operation = `Verify in worktree ${workspace.filesRoot}\nImage: ${image}\nRead-only paths: ${agent.allowedPaths.map(p => p.path).join(', ')}\nNetwork: disabled; timeout: ${command.timeoutMs} ms`;
+        await authorizeSessionAction(store.manifest.project.root, 'shell', { command: rendered, operation, argv: command.argv, runId: store.manifest.id, taskId: task.id, image, network: 'none', mounts: agent.allowedPaths.map(p => ({ ...p, access: 'read' })), timeoutMs: command.timeoutMs }, { ...options, confirmation: 'mutating' });
+        guard.assertActive(options.signal);
+        const mounts = workspace.mounts(agent.allowedPaths, options.signal), before = workspace.snapshot(agent.allowedPaths, options.signal), callId = randomUUID();
+        if (options.expectedWorkspaceHash && before !== options.expectedWorkspaceHash)
+            throw new OrchestrationError('conflict', 'Retained workspace changed before recovery verification.');
+        await store.append({ type: 'tool', taskId: task.id, callId, name: 'shell', path: null, stage: 'started', mutating: true, success: false }, options.signal);
+        const receipt = await runIsolatedCommand(image, { ...command, timeoutMs: Math.min(command.timeoutMs, Math.max(1, guard.deadline - Date.now())) }, mounts, options.signal);
+        let after = null;
+        try {
+            after = workspace.snapshot(agent.allowedPaths);
+        }
+        catch { /* Preserve the process result even if its input workspace was replaced. */ }
+        const result = { ...receipt, workspace: { before, after }, outcome: receipt.outcome === 'passed' && before !== after ? 'failed' : receipt.outcome };
+        await store.append({ type: 'tool', taskId: task.id, callId, name: 'shell', path: null, stage: 'finished', mutating: true, success: result.outcome === 'passed' });
+        await recordExecutorArtifact(store, task, command.artifactId, canonicalJson(result));
+        options.runlog?.policyEvent({ tool: 'shell', source: 'isolated-command', decision: result.outcome === 'passed' ? 'allow' : 'deny', reason: canonicalJson({ artifactId: command.artifactId, outcome: result.outcome, exitCode: result.exitCode, container: result.container, cleanupConfirmed: result.cleanupConfirmed }), durationMs: result.durationMs });
+        guard.assertActive(options.signal);
+        if (!result.cleanupConfirmed || result.outcome === 'unavailable')
+            throw new OrchestrationError('unavailable', 'Required container execution or cleanup failed; inspect the recorded container before retrying.');
+        if (result.outcome !== 'passed')
+            break;
+        workspace.rememberVerification(agent.allowedPaths, before);
+    }
+    guard.assertActive(options.signal);
+    const patch = await workspace.patch(options.signal);
+    outputs.set(task.isolation.patchArtifactId, patch);
+    return outputs;
+}
+//# sourceMappingURL=coordinator.js.map

package/dist/isolation/coordinator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordinator.js","sourceRoot":"","sources":["../../src/isolation/coordinator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AACjG,OAAO,EAAE,kBAAkB,EAAoB,MAAM,2BAA2B,CAAC;AAIjF,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAuB,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAqB,EAAE,IAAiB,EAAE,OAAyB;IACpG,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;IAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACzF,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5C,MAAM,sBAAsB,CAAC,OAAO,EAAE,yBAAyB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;IAChM,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7H,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,IAAI,CAAC,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjH,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,OAAO,CAAE,EAAE,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxG,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAAE,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACrF,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAAC,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,kBAAkB,CAAC,aAAa,EAAE,iCAAiC,CAAC,CAAC;YAC7I,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,MAAM,CAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAE,CAAC,IAAI,CAAC;YACnH,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,MAAM;gBAAE,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,2DAA2D,CAAC,CAAC;YACpK,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAAC,SAAS,CAAC,cAAc,EAAE,CAAC;YACpI,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAChD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,WAAW,EAAE,KAAG,MAAM,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,IAAI;gBAAE,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,6CAA6C,CAAC,CAAC;YAC/K,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrJ,CAAC;IACD,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IACrM,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAqB,EAAE,IAAiB,EAAE,SAAyB,EAAE,KAAqB,EAAE,OAAyD;IAC1L,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,SAAU,CAAC,KAAK,CAAC;IACjF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,OAAO,CAAE,EAAE,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzG,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAU,CAAC,QAAQ,EAAE,CAAC;QAC/C,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3F,MAAM,SAAS,GAAC,sBAAsB,SAAS,CAAC,SAAS,YAAY,KAAK,sBAAsB,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC,OAAO,CAAC,SAAS,KAAK,CAAC;QACpM,MAAM,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;QACrU,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,CAAC;QAC7L,IAAG,OAAO,CAAC,qBAAqB,IAAE,MAAM,KAAG,OAAO,CAAC,qBAAqB;YAAC,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAC,0DAA0D,CAAC,CAAC;QAC7K,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3J,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1K,IAAI,KAAK,GAAa,IAAI,CAAC;QAAA,IAAG,CAAC;YAAA,KAAK,GAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAAA,CAAC;QAAA,MAAK,CAAC,CAAA,2EAA2E,CAAA,CAAC;QAC/J,MAAM,MAAM,GAAC,EAAC,GAAG,OAAO,EAAC,SAAS,EAAC,EAAC,MAAM,EAAC,KAAK,EAAC,EAAC,OAAO,EAAC,OAAO,CAAC,OAAO,KAAG,QAAQ,IAAE,MAAM,KAAG,KAAK,CAAA,CAAC,CAAA,QAAiB,CAAA,CAAC,CAAA,OAAO,CAAC,OAAO,EAAC,CAAC;QACxI,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC,CAAC;QAClK,MAAM,sBAAsB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QACrF,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3V,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,OAAO,KAAK,aAAa;YAAE,MAAM,IAAI,kBAAkB,CAAC,aAAa,EAAE,iGAAiG,CAAC,CAAC;QACjN,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ;YAAE,MAAM;QACvC,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,YAAY,EAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IACD,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAU,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAAC,OAAO,OAAO,CAAC;AACtE,CAAC"}

package/dist/isolation/index.d.ts

@@ -0,0 +1,5 @@
+export * from './contracts.js';
+export * from './process.js';
+export * from './worktree.js';
+export * from './coordinator.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/isolation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/isolation/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC"}

package/dist/isolation/index.js

@@ -0,0 +1,5 @@
+export * from './contracts.js';
+export * from './process.js';
+export * from './worktree.js';
+export * from './coordinator.js';
+//# sourceMappingURL=index.js.map

package/dist/isolation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/isolation/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC"}

package/dist/isolation/process.d.ts

@@ -0,0 +1,11 @@
+import type { CommandEvidence, VerificationCommand } from './contracts.js';
+export interface ReadMount {
+    source: string;
+    target: string;
+}
+/** Read-only admission check; never pull, create or run an image while planning. */
+export declare function assertLocalIsolationImage(image: string, signal?: AbortSignal): Promise<void>;
+export declare function containerArguments(image: string, name: string, argv: string[], mounts: ReadMount[]): string[];
+/** Only the local daemon is used; the container receives no host environment or writable host mount. */
+export declare function runIsolatedCommand(image: string, command: VerificationCommand, mounts: ReadMount[], signal?: AbortSignal): Promise<CommandEvidence>;
+//# sourceMappingURL=process.d.ts.map

package/dist/isolation/process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../src/isolation/process.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG3E,MAAM,WAAW,SAAS;IAAG,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAE7D,oFAAoF;AACpF,wBAAsB,yBAAyB,CAAC,KAAK,EAAC,MAAM,EAAC,MAAM,CAAC,EAAC,WAAW,GAAE,OAAO,CAAC,IAAI,CAAC,CAc9F;AACD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAS7G;AAED,wGAAwG;AACxG,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CA2DzJ"}

package/dist/isolation/process.js

@@ -0,0 +1,131 @@
+import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { bindProcessCancellation, detachedProcess } from '../process-cancellation.js';
+import { throwIfCancelled } from '../cancellation.js';
+import { redactSecrets } from '../runlog.js';
+import { approvalDisplayText } from '../approvals/index.js';
+const OUTPUT_BYTES = 65536;
+/** Read-only admission check; never pull, create or run an image while planning. */
+export async function assertLocalIsolationImage(image, signal) {
+    throwIfCancelled(signal);
+    if (!/^sha256:[a-f0-9]{64}$/.test(image))
+        throw new Error('Verification requires a pinned local image ID.');
+    const controller = new AbortController(), abort = () => controller.abort();
+    signal?.addEventListener('abort', abort, { once: true });
+    if (signal?.aborted)
+        abort();
+    const timer = setTimeout(abort, 5000);
+    try {
+        const child = spawn('docker', ['--host', 'unix:///var/run/docker.sock', 'image', 'inspect', '--format', '{{.Id}} {{.Os}}', image], { env: { PATH: process.env.PATH ?? '/usr/local/bin:/usr/bin:/bin' }, stdio: ['ignore', 'pipe', 'pipe'], detached: detachedProcess });
+        const stopped = bindProcessCancellation(child, controller.signal);
+        let bytes = Buffer.alloc(0);
+        child.stderr.resume();
+        child.stdout.on('data', chunk => { if (bytes.length + chunk.length > 512)
+            controller.abort();
+        else
+            bytes = Buffer.concat([bytes, chunk]); });
+        const code = await new Promise(resolve => { child.once('error', () => resolve(null)); child.once('close', resolve); });
+        await stopped;
+        throwIfCancelled(signal);
+        if (code !== 0 || controller.signal.aborted || bytes.toString().trim() !== `${image} linux`)
+            throw new Error('The pinned verification image is unavailable from the local Docker daemon or is not Linux. Prepare that exact image before resuming; Calliope will not pull it.');
+    }
+    finally {
+        clearTimeout(timer);
+        signal?.removeEventListener('abort', abort);
+    }
+}
+export function containerArguments(image, name, argv, mounts) {
+    if (!/^sha256:[a-f0-9]{64}$/.test(image) || !/^calliope-check-[a-f0-9-]{36}$/.test(name) || !argv.length || argv.length > 64 || argv.some(a => typeof a !== 'string' || !a.length || a.length > 8192 || /[\x00-\x1f\x7f]/.test(a)) ||
+        mounts.some(m => !m.source.startsWith('/') || /[,\x00-\x1f]/.test(m.source) || !/^\/project(?:\/[^,\x00-\x1f]*)?$/.test(m.target) || m.target.split('/').includes('..')))
+        throw new Error('Invalid isolated command identity or mount.');
+    return ['create', '--pull=never', '--name', name, '--network=none', '--read-only', '--cap-drop=ALL',
+        '--security-opt=no-new-privileges', '--pids-limit=64', '--memory=256m', '--memory-swap=256m', '--cpus=1',
+        `--user=${process.getuid?.() ?? 65534}:${process.getgid?.() ?? 65534}`, '--workdir=/project', '--tmpfs=/tmp:rw,nosuid,nodev,size=64m,mode=1777',
+        ...mounts.flatMap(m => ['--mount', `type=bind,source=${m.source},target=${m.target},readonly`]),
+        '--entrypoint', argv[0], image, ...argv.slice(1)];
+}
+/** Only the local daemon is used; the container receives no host environment or writable host mount. */
+export async function runIsolatedCommand(image, command, mounts, signal) {
+    throwIfCancelled(signal);
+    if (!Number.isSafeInteger(command.timeoutMs) || command.timeoutMs < 1 || command.timeoutMs > 60000)
+        throw new Error('Invalid verification deadline.');
+    const container = `calliope-check-${randomUUID()}`, start = Date.now();
+    const args = containerArguments(image, container, command.argv, mounts);
+    const env = { PATH: process.env.PATH ?? '/usr/local/bin:/usr/bin:/bin' };
+    const docker = (argv) => spawn('docker', ['--host', 'unix:///var/run/docker.sock', ...argv], { env, stdio: ['ignore', 'pipe', 'pipe'], detached: detachedProcess });
+    const controller = new AbortController();
+    let timedOut = false, truncated = false;
+    const abort = () => controller.abort();
+    signal?.addEventListener('abort', abort, { once: true });
+    if (signal?.aborted)
+        abort();
+    const timer = setTimeout(() => { timedOut = true; controller.abort(); }, command.timeoutMs);
+    const output = { stdout: Buffer.alloc(0), stderr: Buffer.alloc(0) };
+    const capture = (key, data) => {
+        const remaining = OUTPUT_BYTES - output[key].length;
+        if (data.length > remaining)
+            truncated = true;
+        if (remaining > 0)
+            output[key] = Buffer.concat([output[key], data.subarray(0, remaining)]);
+    };
+    const cleanupRequest = async (argv, timeoutMs) => {
+        const child = docker(argv), bounded = new AbortController(), stop = setTimeout(() => bounded.abort(), timeoutMs);
+        const stopped = bindProcessCancellation(child, bounded.signal), buffers = { stdout: Buffer.alloc(0), stderr: Buffer.alloc(0) };
+        let overflow = false;
+        for (const key of ['stdout', 'stderr'])
+            child[key].on('data', chunk => { if (buffers[key].length + chunk.length > 4096)
+                overflow = true; if (buffers[key].length < 4096)
+                buffers[key] = Buffer.concat([buffers[key], chunk]).subarray(0, 4096); });
+        const code = await new Promise(resolve => { child.once('error', () => resolve(null)); child.once('close', resolve); });
+        clearTimeout(stop);
+        await stopped;
+        const absent = !overflow && code === 1 && !buffers.stdout.toString().trim() && ['container', 'object'].some(kind => buffers.stderr.toString().trim() === `Error response from daemon: No such ${kind}: ${container}`);
+        return { code, absent, timedOut: bounded.signal.aborted, present: code === 0 && /^[a-f0-9]{64}$/.test(buffers.stdout.toString().trim()) };
+    };
+    const remove = async () => {
+        const result = await cleanupRequest(['rm', '--force', container], 5000);
+        return { outcome: result.timedOut ? 'timeout' : result.code === 0 ? 'removed' : result.absent ? 'absent' : 'error', exitCode: result.code };
+    };
+    let earlyRemoval;
+    try {
+        const execute = async (argv, creating = false) => {
+            const child = docker(argv), stopped = bindProcessCancellation(child, controller.signal, () => { earlyRemoval ??= remove(); });
+            if (creating)
+                child.stdout.resume();
+            else
+                child.stdout.on('data', data => capture('stdout', data));
+            child.stderr.on('data', data => capture('stderr', data));
+            const code = await new Promise(resolve => { child.once('error', () => resolve(125)); child.once('close', value => resolve(value ?? 125)); });
+            await stopped;
+            return code;
+        };
+        // Creation cannot execute the entrypoint. Once its response arrives, cancellation
+        // can remove this known container without a late start request recreating it.
+        const created = await execute(args, true);
+        const code = created === 0 && !controller.signal.aborted ? await execute(['start', '--attach', container]) : 125;
+        clearTimeout(timer);
+        if (earlyRemoval)
+            await earlyRemoval;
+        const cleanup = { version: 1, removal: await remove() };
+        let removed = cleanup.removal.outcome === 'removed' || cleanup.removal.outcome === 'absent';
+        // An acknowledged create cannot arrive later and recreate an absent container.
+        // Inspect once after a lost removal response; never infer absence from a daemon error.
+        if (!removed && created === 0) {
+            const result = await cleanupRequest(['container', 'inspect', '--format', '{{.Id}}', container], 3000);
+            cleanup.verification = { outcome: result.timedOut ? 'timeout' : result.absent ? 'absent' : result.present ? 'present' : 'error', exitCode: result.code };
+            removed = cleanup.verification.outcome === 'absent';
+        }
+        const cleanupConfirmed = removed && created === 0;
+        const outcome = signal?.aborted ? 'cancelled' : timedOut ? 'timeout' : code === 125 || !cleanupConfirmed ? 'unavailable' : code === 0 ? 'passed' : 'failed';
+        const clean = (bytes) => approvalDisplayText(String(redactSecrets(bytes.toString('utf8'))));
+        return { version: 1, kind: 'isolated-command', argv: [...command.argv], image, container, cleanupConfirmed, cleanup,
+            outcome, exitCode: outcome === 'cancelled' ? 130 : outcome === 'timeout' ? 124 : code,
+            stdout: clean(output.stdout), stderr: clean(output.stderr), truncated, durationMs: Date.now() - start };
+    }
+    finally {
+        clearTimeout(timer);
+        signal?.removeEventListener('abort', abort);
+    }
+}
+//# sourceMappingURL=process.js.map

package/dist/isolation/process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/isolation/process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAG5D,MAAM,YAAY,GAAG,KAAK,CAAC;AAG3B,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAAY,EAAC,MAAmB;IAC9E,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,IAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC1G,MAAM,UAAU,GAAC,IAAI,eAAe,EAAE,EAAC,KAAK,GAAC,GAAE,EAAE,CAAA,UAAU,CAAC,KAAK,EAAE,CAAC;IACpE,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAC,KAAK,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,CAAC,CAAC;IAAA,IAAG,MAAM,EAAE,OAAO;QAAC,KAAK,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAC,UAAU,CAAC,KAAK,EAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,KAAK,GAAC,KAAK,CAAC,QAAQ,EAAC,CAAC,QAAQ,EAAC,6BAA6B,EAAC,OAAO,EAAC,SAAS,EAAC,UAAU,EAAC,iBAAiB,EAAC,KAAK,CAAC,EAAC,EAAC,GAAG,EAAC,EAAC,IAAI,EAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAE,8BAA8B,EAAC,EAAC,KAAK,EAAC,CAAC,QAAQ,EAAC,MAAM,EAAC,MAAM,CAAC,EAAC,QAAQ,EAAC,eAAe,EAAC,CAAC,CAAC;QAChP,MAAM,OAAO,GAAC,uBAAuB,CAAC,KAAK,EAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAAA,IAAI,KAAK,GAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzF,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAAA,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAC,KAAK,CAAA,EAAE,GAAC,IAAG,KAAK,CAAC,MAAM,GAAC,KAAK,CAAC,MAAM,GAAC,GAAG;YAAC,UAAU,CAAC,KAAK,EAAE,CAAC;;YAAK,KAAK,GAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAC,KAAK,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;QACpJ,MAAM,IAAI,GAAC,MAAM,IAAI,OAAO,CAAc,OAAO,CAAA,EAAE,GAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAC,GAAE,EAAE,CAAA,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,KAAK,CAAC,IAAI,CAAC,OAAO,EAAC,OAAO,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;QACzH,MAAM,OAAO,CAAC;QAAA,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACvC,IAAG,IAAI,KAAG,CAAC,IAAE,UAAU,CAAC,MAAM,CAAC,OAAO,IAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,KAAG,GAAG,KAAK,QAAQ;YAAC,MAAM,IAAI,KAAK,CAAC,iKAAiK,CAAC,CAAC;IACxQ,CAAC;YAAS,CAAC;QAAA,YAAY,CAAC,KAAK,CAAC,CAAC;QAAA,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAC,KAAK,CAAC,CAAC;IAAA,CAAC;AAC7E,CAAC;AACD,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,IAAY,EAAE,IAAc,EAAE,MAAmB;IACjG,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,GAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,OAAO,CAAC,KAAG,QAAQ,IAAE,CAAC,CAAC,CAAC,MAAM,IAAE,CAAC,CAAC,MAAM,GAAC,IAAI,IAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChN,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxK,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,OAAO,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,gBAAgB;QACjG,kCAAkC,EAAE,iBAAiB,EAAE,eAAe,EAAE,oBAAoB,EAAE,UAAU;QACxG,UAAU,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,KAAK,EAAE,EAAE,oBAAoB,EAAE,iDAAiD;QAC/I,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC;QAC/F,cAAc,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAa,EAAE,OAA4B,EAAE,MAAmB,EAAE,MAAoB;IAC7H,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,IAAG,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,IAAE,OAAO,CAAC,SAAS,GAAC,CAAC,IAAE,OAAO,CAAC,SAAS,GAAC,KAAK;QAAC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC5I,MAAM,SAAS,GAAG,kBAAkB,UAAU,EAAE,EAAE,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvE,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,8BAA8B,EAAE,CAAC;IACzE,MAAM,MAAM,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,6BAA6B,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;IAC9K,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAAC,IAAI,QAAQ,GAAG,KAAK,EAAE,SAAS,GAAG,KAAK,CAAC;IAClF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,IAAI,MAAM,EAAE,OAAO;QAAE,KAAK,EAAE,CAAC;IAC/H,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,OAAO,GAAG,CAAC,GAAwB,EAAE,IAAY,EAAE,EAAE;QACzD,MAAM,SAAS,GAAG,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACpD,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS;YAAE,SAAS,GAAG,IAAI,CAAC;QAC9C,IAAI,SAAS,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC,CAAC;IACF,MAAM,cAAc,GAAG,KAAK,EAAC,IAAa,EAAC,SAAgB,EAAE,EAAE;QAC7D,MAAM,KAAK,GAAC,MAAM,CAAC,IAAI,CAAC,EAAC,OAAO,GAAC,IAAI,eAAe,EAAE,EAAC,IAAI,GAAC,UAAU,CAAC,GAAE,EAAE,CAAA,OAAO,CAAC,KAAK,EAAE,EAAC,SAAS,CAAC,CAAC;QACtG,MAAM,OAAO,GAAC,uBAAuB,CAAC,KAAK,EAAC,OAAO,CAAC,MAAM,CAAC,EAAC,OAAO,GAAC,EAAC,MAAM,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAC,MAAM,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAC,CAAC;QAAA,IAAI,QAAQ,GAAC,KAAK,CAAC;QACvI,KAAI,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAC,QAAQ,CAAU;YAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,EAAC,KAAK,CAAA,EAAE,GAAC,IAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,GAAC,KAAK,CAAC,MAAM,GAAC,IAAI;gBAAC,QAAQ,GAAC,IAAI,CAAC,CAAA,IAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,GAAC,IAAI;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAC,IAAI,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;QACnO,MAAM,IAAI,GAAC,MAAM,IAAI,OAAO,CAAc,OAAO,CAAA,EAAE,GAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAC,GAAE,EAAE,CAAA,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,KAAK,CAAC,IAAI,CAAC,OAAO,EAAC,OAAO,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;QACzH,YAAY,CAAC,IAAI,CAAC,CAAC;QAAA,MAAM,OAAO,CAAC;QACjC,MAAM,MAAM,GAAC,CAAC,QAAQ,IAAE,IAAI,KAAG,CAAC,IAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAE,CAAC,WAAW,EAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA,EAAE,CAAA,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,KAAG,uCAAuC,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC;QACvM,OAAM,EAAC,IAAI,EAAC,MAAM,EAAC,QAAQ,EAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAC,OAAO,EAAC,IAAI,KAAG,CAAC,IAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,EAAC,CAAC;IAChI,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,IAA+D,EAAE;QACnF,MAAM,MAAM,GAAC,MAAM,cAAc,CAAC,CAAC,IAAI,EAAC,SAAS,EAAC,SAAS,CAAC,EAAC,IAAI,CAAC,CAAC;QACnE,OAAM,EAAC,OAAO,EAAC,MAAM,CAAC,QAAQ,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,MAAM,CAAC,IAAI,KAAG,CAAC,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,MAAM,CAAC,MAAM,CAAA,CAAC,CAAA,QAAQ,CAAA,CAAC,CAAA,OAAO,EAAC,QAAQ,EAAC,MAAM,CAAC,IAAI,EAAC,CAAC;IAC1H,CAAC,CAAC;IACF,IAAI,YAAmD,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,EAAC,IAAa,EAAC,QAAQ,GAAC,KAAK,EAAiB,EAAE;YACnE,MAAM,KAAK,GAAC,MAAM,CAAC,IAAI,CAAC,EAAC,OAAO,GAAC,uBAAuB,CAAC,KAAK,EAAC,UAAU,CAAC,MAAM,EAAC,GAAE,EAAE,GAAC,YAAY,KAAG,MAAM,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC;YACjH,IAAG,QAAQ;gBAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;;gBAAK,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAC,IAAI,CAAA,EAAE,CAAA,OAAO,CAAC,QAAQ,EAAC,IAAI,CAAC,CAAC,CAAC;YAC5F,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAC,IAAI,CAAA,EAAE,CAAA,OAAO,CAAC,QAAQ,EAAC,IAAI,CAAC,CAAC,CAAC;YACrD,MAAM,IAAI,GAAC,MAAM,IAAI,OAAO,CAAS,OAAO,CAAA,EAAE,GAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAC,GAAE,EAAE,CAAA,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA,KAAK,CAAC,IAAI,CAAC,OAAO,EAAC,KAAK,CAAA,EAAE,CAAA,OAAO,CAAC,KAAK,IAAE,GAAG,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;YACtI,MAAM,OAAO,CAAC;YAAA,OAAO,IAAI,CAAC;QAC5B,CAAC,CAAC;QACF,kFAAkF;QAClF,8EAA8E;QAC9E,MAAM,OAAO,GAAC,MAAM,OAAO,CAAC,IAAI,EAAC,IAAI,CAAC,CAAC;QACvC,MAAM,IAAI,GAAC,OAAO,KAAG,CAAC,IAAE,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAA,CAAC,CAAA,MAAM,OAAO,CAAC,CAAC,OAAO,EAAC,UAAU,EAAC,SAAS,CAAC,CAAC,CAAA,CAAC,CAAA,GAAG,CAAC;QACrG,YAAY,CAAC,KAAK,CAAC,CAAC;QAAA,IAAG,YAAY;YAAC,MAAM,YAAY,CAAC;QACvD,MAAM,OAAO,GAAyC,EAAC,OAAO,EAAC,CAAC,EAAC,OAAO,EAAC,MAAM,MAAM,EAAE,EAAC,CAAC;QACzF,IAAI,OAAO,GAAC,OAAO,CAAC,OAAO,CAAC,OAAO,KAAG,SAAS,IAAE,OAAO,CAAC,OAAO,CAAC,OAAO,KAAG,QAAQ,CAAC;QACpF,+EAA+E;QAC/E,uFAAuF;QACvF,IAAG,CAAC,OAAO,IAAE,OAAO,KAAG,CAAC,EAAC,CAAC;YACxB,MAAM,MAAM,GAAC,MAAM,cAAc,CAAC,CAAC,WAAW,EAAC,SAAS,EAAC,UAAU,EAAC,SAAS,EAAC,SAAS,CAAC,EAAC,IAAI,CAAC,CAAC;YAC/F,OAAO,CAAC,YAAY,GAAC,EAAC,OAAO,EAAC,MAAM,CAAC,QAAQ,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,MAAM,CAAC,MAAM,CAAA,CAAC,CAAA,QAAQ,CAAA,CAAC,CAAA,MAAM,CAAC,OAAO,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,OAAO,EAAC,QAAQ,EAAC,MAAM,CAAC,IAAI,EAAC,CAAC;YACtI,OAAO,GAAC,OAAO,CAAC,YAAY,CAAC,OAAO,KAAG,QAAQ,CAAC;QAClD,CAAC;QACD,MAAM,gBAAgB,GAAC,OAAO,IAAE,OAAO,KAAG,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5J,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACpG,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO;YACjH,OAAO,EAAE,QAAQ,EAAE,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YACrF,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IAC5G,CAAC;YAAS,CAAC;QAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;AACjF,CAAC"}

package/dist/isolation/worktree.d.ts

@@ -0,0 +1,25 @@
+import { type PathGrant } from '../orchestration/types.js';
+import type { ReadMount } from './process.js';
+export declare function worktreeGit(cwd: string, args: string[], signal?: AbortSignal, accepted?: number[]): Promise<string>;
+/** Recovery must read the original baseline and may never create a replacement. */
+export declare function readPinnedWorktreeBase(root: string, project: string, planHash: string): string;
+/** One pinned source revision per run; ignored credentials and untracked source are never copied. */
+export declare function pinWorktreeBase(root: string, project: string, sourcePlan: string, planHash: string, signal?: AbortSignal): Promise<string>;
+export declare class WorkerWorktree {
+    readonly root: string;
+    readonly project: string;
+    readonly base: string;
+    readonly filesRoot: string;
+    private readonly identity;
+    private verified?;
+    constructor(root: string, project: string, base: string);
+    assertIdentity: () => void;
+    snapshot(grants: PathGrant[], signal?: AbortSignal): string;
+    rememberVerification(grants: PathGrant[], hash: string): void;
+    assertVerified(signal?: AbortSignal): void;
+    patch(signal?: AbortSignal): Promise<string>;
+    /** Read-only mounts enforce the task's read grants; no command can alter a host file. */
+    mounts(grants: PathGrant[], signal?: AbortSignal): ReadMount[];
+}
+export declare function createWorkerWorktree(root: string, project: string, base: string, signal?: AbortSignal): Promise<WorkerWorktree>;
+//# sourceMappingURL=worktree.d.ts.map

package/dist/isolation/worktree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree.d.ts","sourceRoot":"","sources":["../../src/isolation/worktree.ts"],"names":[],"mappings":"AAOA,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAG/E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAG9C,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,QAAQ,WAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBpH;AAaD,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,IAAI,EAAC,MAAM,EAAC,OAAO,EAAC,MAAM,EAAC,QAAQ,EAAC,MAAM,GAAE,MAAM,CAIxF;AACD,qGAAqG;AACrG,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBhJ;AAED,qBAAa,cAAc;IAIb,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHlF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4C;IACrE,OAAO,CAAC,QAAQ,CAAC,CAAkC;IACnD,YAAqB,IAAI,EAAE,MAAM,EAAW,OAAO,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,EAKjF;IACD,cAAc,QAAO,IAAI,CAIvB;IACF,QAAQ,CAAC,MAAM,EAAC,SAAS,EAAE,EAAC,MAAM,CAAC,EAAC,WAAW,GAAE,MAAM,CAWtD;IACD,oBAAoB,CAAC,MAAM,EAAC,SAAS,EAAE,EAAC,IAAI,EAAC,MAAM,GAAE,IAAI,CAAsD;IAC/G,cAAc,CAAC,MAAM,CAAC,EAAC,WAAW,GAAE,IAAI,CAAwN;IAC1P,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAMjD;IACD,yFAAyF;IACzF,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,EAAE,CAgC7D;CACF;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,CAerI"}

package/dist/isolation/worktree.js

@@ -0,0 +1,282 @@
+import * as fs from 'node:fs';
+import { dirname, join, relative, resolve, isAbsolute } from 'node:path';
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { canonicalJson, canonicalPath, digest } from '../approvals/index.js';
+import { bindProcessCancellation, detachedProcess } from '../process-cancellation.js';
+import { throwIfCancelled } from '../cancellation.js';
+import { OrchestrationError } from '../orchestration/types.js';
+import { pathName, shape } from '../orchestration/validation.js';
+import { privateDirectory, readArtifactBytes } from '../orchestration/execution-store.js';
+const unavailable = (message) => { throw new OrchestrationError('unavailable', message); };
+export async function worktreeGit(cwd, args, signal, accepted = [0]) {
+    throwIfCancelled(signal);
+    const controller = new AbortController(), abort = () => controller.abort();
+    signal?.addEventListener('abort', abort, { once: true });
+    if (signal?.aborted)
+        abort();
+    const timer = setTimeout(abort, 30000);
+    try {
+        const proc = spawn('git', ['-c', 'core.hooksPath=/dev/null', '-c', 'core.fsmonitor=false', '-c', 'checkout.workers=1', ...args], {
+            cwd, detached: detachedProcess, stdio: ['ignore', 'pipe', 'pipe'],
+            env: { PATH: process.env.PATH, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null', GIT_TERMINAL_PROMPT: '0', GIT_LFS_SKIP_SMUDGE: '1', GIT_NO_LAZY_FETCH: '1' },
+        });
+        const stopped = bindProcessCancellation(proc, controller.signal);
+        let bytes = Buffer.alloc(0);
+        proc.stdout.on('data', data => { if (bytes.length + data.length > 1024 * 1024)
+            controller.abort();
+        else
+            bytes = Buffer.concat([bytes, data]); });
+        proc.stderr.resume();
+        const code = await new Promise(resolve => { proc.once('error', () => resolve(-1)); proc.once('close', code => resolve(code ?? -1)); });
+        await stopped;
+        throwIfCancelled(signal);
+        if (controller.signal.aborted || !accepted.includes(code))
+            unavailable('Git workspace operation failed or exceeded its time/output bound; preserve the workspace for inspection.');
+        return bytes.toString('utf8');
+    }
+    finally {
+        clearTimeout(timer);
+        signal?.removeEventListener('abort', abort);
+    }
+}
+function writeNew(file, value) {
+    const fd = fs.openSync(file, 'wx', 0o600);
+    try {
+        fs.writeFileSync(fd, value);
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+function readJson(file) {
+    try {
+        return JSON.parse(readArtifactBytes(file, 16384, true).toString());
+    }
+    catch {
+        return unavailable('Workspace identity is missing or damaged; preserve it before recovery.');
+    }
+}
+async function disabledFilters(project, signal) {
+    const keys = (await worktreeGit(project, ['config', '--name-only', '--get-regexp', '^filter\\..*\\.(clean|smudge|process)$'], signal, [0, 1])).trim().split('\n').filter(Boolean);
+    if (keys.length > 256 || keys.some(k => /[\x00-\x1f=]/.test(k)))
+        unavailable('Git filter configuration exceeds safe workspace preparation bounds.');
+    return keys.flatMap(key => ['-c', key + '=', '-c', key.replace(/\.(clean|smudge|process)$/, '.required') + '=false']);
+}
+/** Recovery must read the original baseline and may never create a replacement. */
+export function readPinnedWorktreeBase(root, project, planHash) {
+    privateDirectory(root);
+    const v = readJson(join(root, 'workspace-base.json'));
+    shape(v, ['version', 'project', 'planHash', 'commit', 'hash']);
+    const { hash, ...body } = v;
+    if (v.version !== 1 || v.project !== project || v.planHash !== planHash || typeof v.commit !== 'string' || !/^[a-f0-9]{40,64}$/.test(v.commit) || hash !== digest(canonicalJson(body)))
+        unavailable('Workspace source differs from this reviewed run.');
+    return v.commit;
+}
+/** One pinned source revision per run; ignored credentials and untracked source are never copied. */
+export async function pinWorktreeBase(root, project, sourcePlan, planHash, signal) {
+    privateDirectory(root);
+    const file = join(root, 'workspace-base.json');
+    if (fs.existsSync(file)) {
+        return readPinnedWorktreeBase(root, project, planHash);
+    }
+    const top = (await worktreeGit(project, ['rev-parse', '--show-toplevel'], signal)).trim();
+    if (canonicalPath(top) !== project)
+        unavailable('Isolated execution requires the canonical Git repository root.');
+    if ((await worktreeGit(project, ['config', '--name-only', '--get-regexp', '^(extensions\\.partialclone|remote\\..*\\.promisor)$'], signal, [0, 1])).trim())
+        unavailable('Isolated execution requires a complete local clone without lazy-fetch configuration.');
+    const filters = await disabledFilters(project, signal);
+    const status = await worktreeGit(project, [...filters, 'status', '--porcelain=v1', '-z', '--untracked-files=all'], signal);
+    if (status.split('\0').filter(Boolean).some(line => line !== '?? ' + sourcePlan))
+        unavailable('Commit or preserve pending source changes before isolated execution; only the untracked plan is excluded.');
+    const commit = (await worktreeGit(project, ['rev-parse', '--verify', 'HEAD^{commit}'], signal)).trim();
+    if (!/^[a-f0-9]{40,64}$/.test(commit))
+        unavailable('Workspace needs a committed Git revision.');
+    const tree = await worktreeGit(project, ['ls-tree', '-r', '-l', '-z', commit], signal);
+    let count = 0, bytes = 0;
+    for (const entry of tree.split('\0').filter(Boolean)) {
+        const match = /^(100644|100755) blob [a-f0-9]+\s+(\d+)\t([\s\S]+)$/.exec(entry);
+        if (!match)
+            unavailable('Isolated source cannot contain symlinks or submodules.');
+        pathName(match[3]);
+        if (match[3].split('/').some(p => p.toLowerCase() === '.git'))
+            unavailable('Source contains a Git metadata alias.');
+        bytes += Number(match[2]);
+        if (++count > 10000 || bytes > 50 * 1024 * 1024 || Number(match[2]) > 10 * 1024 * 1024)
+            unavailable('Isolated source exceeds 10,000 files, 50 MiB total or 10 MiB per file.');
+    }
+    throwIfCancelled(signal);
+    const body = { version: 1, project, planHash, commit };
+    const record = canonicalJson({ ...body, hash: digest(canonicalJson(body)) });
+    try {
+        writeNew(file, record);
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST' || canonicalJson(readJson(file)) !== record)
+            throw error;
+    }
+    return commit;
+}
+export class WorkerWorktree {
+    root;
+    project;
+    base;
+    filesRoot;
+    identity;
+    verified;
+    constructor(root, project, base) {
+        this.root = root;
+        this.project = project;
+        this.base = base;
+        privateDirectory(root);
+        this.filesRoot = join(root, 'files');
+        const v = readJson(join(root, 'identity.json'));
+        shape(v, ['version', 'project', 'base', 'ino', 'dev', 'git', 'hash']);
+        const { hash, ...body } = v;
+        if (v.version !== 1 || v.project !== project || v.base !== base || hash !== digest(canonicalJson(body)))
+            unavailable('Worker workspace identity changed.');
+        this.identity = v;
+        this.assertIdentity();
+    }
+    assertIdentity = () => {
+        privateDirectory(this.root);
+        const stat = fs.lstatSync(this.filesRoot);
+        if (!stat.isDirectory() || canonicalPath(this.filesRoot) !== this.filesRoot || stat.ino !== this.identity.ino || stat.dev !== this.identity.dev ||
+            digest(readArtifactBytes(join(this.filesRoot, '.git'), 4096).toString()) !== this.identity.git)
+            unavailable('Worker workspace was replaced or its Git identity changed.');
+    };
+    snapshot(grants, signal) {
+        this.assertIdentity();
+        const hash = createHash('sha256'), seen = new Set();
+        let bytes = 0;
+        const visit = (path) => {
+            throwIfCancelled(signal);
+            if (seen.has(path))
+                return;
+            seen.add(path);
+            if (seen.size > 10000)
+                unavailable('Workspace snapshot exceeds 10,000 entries.');
+            const file = resolve(this.filesRoot, path);
+            if (!fs.existsSync(file)) {
+                hash.update(canonicalJson({ path, missing: true }));
+                return;
+            }
+            if (canonicalPath(file) !== file)
+                unavailable('Workspace snapshot contains an alias.');
+            const s = fs.lstatSync(file);
+            if (s.isDirectory()) {
+                hash.update(canonicalJson({ path, mode: s.mode & 0o777 }));
+                for (const name of fs.readdirSync(file).sort())
+                    visit(path === '.' ? name : path + '/' + name);
+            }
+            else {
+                const content = readArtifactBytes(file, 10 * 1024 * 1024);
+                bytes += content.length;
+                if (bytes > 50 * 1024 * 1024)
+                    unavailable('Workspace snapshot exceeds 50 MiB.');
+                hash.update(canonicalJson({ path, mode: s.mode & 0o777, bytes: content.length }));
+                hash.update(content);
+            }
+        };
+        for (const grant of [...grants].sort((a, b) => a.path.localeCompare(b.path))) {
+            pathName(grant.path);
+            visit(grant.path);
+        }
+        return hash.digest('hex');
+    }
+    rememberVerification(grants, hash) { this.verified = { grants: structuredClone(grants), hash }; }
+    assertVerified(signal) { if (this.verified && this.snapshot(this.verified.grants, signal) !== this.verified.hash)
+        throw new OrchestrationError('conflict', 'Workspace changed after verification; its test result cannot certify the changed files.'); }
+    async patch(signal) {
+        this.assertIdentity();
+        // An isolated index belongs only to this worktree; no source index/ref is changed.
+        const filters = await disabledFilters(this.filesRoot, signal);
+        await worktreeGit(this.filesRoot, ['--work-tree', this.filesRoot, ...filters, 'add', '--all', '--force', '--', '.'], signal);
+        this.assertIdentity();
+        return worktreeGit(this.filesRoot, ['--work-tree', this.filesRoot, 'diff', '--cached', '--binary', '--no-ext-diff', '--no-textconv', this.base, '--'], signal);
+    }
+    /** Read-only mounts enforce the task's read grants; no command can alter a host file. */
+    mounts(grants, signal) {
+        this.assertIdentity();
+        const view = join(this.root, 'view');
+        if (!fs.existsSync(view))
+            fs.mkdirSync(view, { mode: 0o700 });
+        const paths = grants.map(g => g.path).filter((p, i, all) => !all.some((q, j) => i !== j && (q === '.' || p.startsWith(q + '/'))));
+        const mounts = [{ source: view, target: '/project' }];
+        let count = 0;
+        const scan = (file) => {
+            throwIfCancelled(signal);
+            if (++count > 10000)
+                unavailable('Command read scope exceeds 10,000 entries.');
+            const s = fs.lstatSync(file);
+            if (s.isSymbolicLink() || !s.isDirectory() && (!s.isFile() || s.nlink !== 1) || canonicalPath(file) !== file)
+                unavailable('Command scope contains an alias or special file.');
+            if (s.isDirectory())
+                for (const entry of fs.readdirSync(file))
+                    scan(join(file, entry));
+        };
+        for (const path of paths) {
+            pathName(path);
+            if (path.split('/').some(p => p.toLowerCase() === '.git'))
+                unavailable('Git metadata is outside worker scope.');
+            const target = path === '.' ? '/project' : '/project/' + path;
+            const file = resolve(this.filesRoot, path);
+            // A creation task may legitimately have no output yet. Give the
+            // verifier an empty read-only placeholder so its declared command
+            // records a failed check instead of aborting setup with ENOENT.
+            if (!fs.existsSync(file)) {
+                if (path === '.')
+                    unavailable('The project workspace root is missing.');
+                const placeholder = join(view, path);
+                fs.mkdirSync(dirname(placeholder), { recursive: true, mode: 0o700 });
+                if (!fs.existsSync(placeholder))
+                    writeNew(placeholder, '');
+                mounts.push({ source: placeholder, target });
+                continue;
+            }
+            scan(file);
+            if (path === '.')
+                mounts[0] = { source: file, target };
+            else {
+                const placeholder = join(view, path);
+                fs.mkdirSync(dirname(placeholder), { recursive: true, mode: 0o700 });
+                if (!fs.existsSync(placeholder)) {
+                    if (fs.statSync(file).isDirectory())
+                        fs.mkdirSync(placeholder, { mode: 0o700 });
+                    else
+                        writeNew(placeholder, '');
+                }
+                mounts.push({ source: file, target });
+            }
+        }
+        if (paths.includes('.')) {
+            const mask = join(this.root, 'git-mask');
+            if (!fs.existsSync(mask))
+                writeNew(mask, 'Git metadata is unavailable to worker commands.\n');
+            mounts.push({ source: mask, target: '/project/.git' });
+        }
+        return mounts;
+    }
+}
+export async function createWorkerWorktree(root, project, base, signal) {
+    const rel = relative(project, root);
+    if (canonicalPath(root) !== root || !(rel === '..' || rel.startsWith('../') || isAbsolute(rel)))
+        unavailable('Worker workspace must be outside the source project without aliases.');
+    privateDirectory(dirname(root));
+    throwIfCancelled(signal);
+    // Every explicit attempt gets a new directory. Partial creation is never silently adopted.
+    fs.mkdirSync(root, { mode: 0o700 });
+    const files = join(root, 'files');
+    const filters = await disabledFilters(project, signal);
+    await worktreeGit(project, [...filters, 'worktree', 'add', '--no-checkout', '--detach', '--', files, base], signal);
+    const checkoutFilters = await disabledFilters(files, signal);
+    await worktreeGit(files, ['--work-tree', files, ...checkoutFilters, 'read-tree', '--reset', base], signal);
+    await worktreeGit(files, ['--work-tree', files, ...checkoutFilters, 'checkout-index', '--all', '--force'], signal);
+    fs.chmodSync(files, 0o700);
+    const stat = fs.lstatSync(files), git = digest(readArtifactBytes(join(files, '.git'), 4096).toString());
+    const body = { version: 1, project, base, ino: stat.ino, dev: stat.dev, git };
+    writeNew(join(root, 'identity.json'), canonicalJson({ ...body, hash: digest(canonicalJson(body)) }));
+    return new WorkerWorktree(root, project, base);
+}
+//# sourceMappingURL=worktree.js.map