@caupulican/pi-adaptative 0.81.37 → 0.81.39

package/dist/core/delegation/session-worker-result.js

@@ -1,14 +1,27 @@
-import { cloneWorkerResultForStorage, isWorkerResult } from "./worker-result.js";
+import { cloneWorkerResultForStorage, isParentReviewRequired, isWorkerResult } from "./worker-result.js";
 export const WORKER_RESULT_CUSTOM_TYPE = "worker_result";
-export function appendWorkerResultSnapshot(sessionManager, result, request) {
+export function appendWorkerResultSnapshot(sessionManager, result, request, 
+/** Baseline for relative changedFiles when re-deriving the review marker; forwarded to
+ * `isParentReviewRequired`/`validateWorkerResult`. Defaults to `process.cwd()`, matching the
+ * validator's own documented default for single-cwd-per-process callers. */
+options) {
+    const stored = cloneWorkerResultForStorage(result);
+    // Stamp the parent-review marker here by re-running the SAME gate
+    // (validateWorkerResult, via isParentReviewRequired) that originally decided
+    // ask-user/parent_review_required, so the marker can never drift from the gate's own verdict.
+    // Only computable when `request` is available; callers that omit it (legacy callers) leave the
+    // field unset — "unknown", never falsely "false".
+    if (request) {
+        stored.parentReviewRequired = isParentReviewRequired({ request, result, cwd: options?.cwd });
+    }
     const payload = {
         version: 1,
-        result: cloneWorkerResultForStorage(result),
+        result: stored,
         ...(request ? { request: structuredClone(request) } : {}),
     };
     return sessionManager.appendCustomEntry(WORKER_RESULT_CUSTOM_TYPE, payload);
 }
-/** Requests persisted alongside results (absent for pre-G2 entries). */
+/** Requests persisted alongside results (absent for entries recorded before this field existed). */
 export function getWorkerRequestSnapshots(entries) {
     const requests = [];
     for (const entry of entries) {
@@ -50,4 +63,51 @@ export function getWorkerResultSnapshots(entries) {
     }
     return results;
 }
+/**
+ * Latest persisted snapshot (result + originating request, when available) for one worker
+ * requestId — "latest wins" over the append-only entries, the same collapse `delegate_status`
+ * already performs when it maps results by requestId. Used to read, and durably update, the
+ * parent-review marker.
+ */
+export function getLatestWorkerResultSnapshot(entries, requestId) {
+    let latest;
+    for (const entry of entries) {
+        if (entry.type !== "custom" || entry.customType !== WORKER_RESULT_CUSTOM_TYPE)
+            continue;
+        const payload = entry.data;
+        if (!isPlainRecord(payload) || payload.version !== 1 || !("result" in payload))
+            continue;
+        const result = payload.result;
+        if (!isWorkerResult(result) || result.requestId !== requestId)
+            continue;
+        const request = payload.request;
+        latest = {
+            version: 1,
+            result: cloneWorkerResultForStorage(result),
+            ...(isPlainRecord(request) && typeof request.id === "string"
+                ? { request: structuredClone(request) }
+                : {}),
+        };
+    }
+    return latest;
+}
+/**
+ * Durably acknowledge an unreviewed worker mutation. Re-appends the latest snapshot for
+ * `requestId` with `parentReviewedAt` set, so the ack is a first-class entry in the same
+ * append-only audit trail as the original result — it survives reload and any future re-read of
+ * `getWorkerResultSnapshots`/`getLatestWorkerResultSnapshot` (both are "latest wins"). Never
+ * write-blocking: this only marks the mutation reviewed, it does not touch the worker's files.
+ */
+export function acknowledgeWorkerResultReview(sessionManager, requestId, now = () => new Date().toISOString()) {
+    const latest = getLatestWorkerResultSnapshot(sessionManager.getEntries(), requestId);
+    if (!latest)
+        return { ok: false, reason: "unknown_worker_result" };
+    if (!latest.result.parentReviewRequired)
+        return { ok: false, reason: "not_flagged" };
+    if (latest.result.parentReviewedAt)
+        return { ok: false, reason: "already_reviewed" };
+    const reviewedAt = now();
+    appendWorkerResultSnapshot(sessionManager, { ...latest.result, parentReviewedAt: reviewedAt }, latest.request);
+    return { ok: true, requestId, reviewedAt };
+}
 //# sourceMappingURL=session-worker-result.js.map

package/dist/core/delegation/session-worker-result.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-worker-result.js","sourceRoot":"","sources":["../../../src/core/delegation/session-worker-result.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,2BAA2B,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEjF,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AAWzD,MAAM,UAAU,0BAA0B,CACzC,cAAyD,EACzD,MAAoB,EACpB,OAAuB,EACd;IACT,MAAM,OAAO,GAAgC;QAC5C,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,2BAA2B,CAAC,MAAM,CAAC;QAC3C,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;IACF,OAAO,cAAc,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;AAAA,CAC5E;AAED,wEAAwE;AACxE,MAAM,UAAU,yBAAyB,CAAC,OAAgC,EAAmB;IAC5F,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,yBAAyB;YAAE,SAAS;QACxF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;QAC3B,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC;YAAE,SAAS;QAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC9D,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAA6B,CAAC,CAAC;QACrE,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,SAAS,aAAa,CAAC,KAAc,EAAoC;IACxE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAAA,CAC5D;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAgC,EAAkB;IAC1F,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,yBAAyB,EAAE,CAAC;YAC/E,SAAS;QACV,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;QAC3B,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC;YAAE,SAAS;QACpC,IAAI,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC;YAAE,SAAS;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,CAAC;IACF,CAAC;IAED,OAAO,OAAO,CAAC;AAAA,CACf","sourcesContent":["import type { SessionEntry, SessionManager } from \"@caupulican/pi-agent-core/node\";\nimport type { WorkerRequest, WorkerResult } from \"../autonomy/contracts.ts\";\nimport { cloneWorkerResultForStorage, isWorkerResult } from \"./worker-result.ts\";\n\nexport const WORKER_RESULT_CUSTOM_TYPE = \"worker_result\";\n\nexport interface WorkerResultSnapshotPayload {\n\tversion: 1;\n\tresult: WorkerResult;\n\t/** The originating request (G2): persisted so a result is auditable against exactly what was\n\t * asked — instructions, route, and the capability envelope that bounded it. Optional for\n\t * backward compatibility with pre-G2 entries. */\n\trequest?: WorkerRequest;\n}\n\nexport function appendWorkerResultSnapshot(\n\tsessionManager: Pick<SessionManager, \"appendCustomEntry\">,\n\tresult: WorkerResult,\n\trequest?: WorkerRequest,\n): string {\n\tconst payload: WorkerResultSnapshotPayload = {\n\t\tversion: 1,\n\t\tresult: cloneWorkerResultForStorage(result),\n\t\t...(request ? { request: structuredClone(request) } : {}),\n\t};\n\treturn sessionManager.appendCustomEntry(WORKER_RESULT_CUSTOM_TYPE, payload);\n}\n\n/** Requests persisted alongside results (absent for pre-G2 entries). */\nexport function getWorkerRequestSnapshots(entries: readonly SessionEntry[]): WorkerRequest[] {\n\tconst requests: WorkerRequest[] = [];\n\tfor (const entry of entries) {\n\t\tif (entry.type !== \"custom\" || entry.customType !== WORKER_RESULT_CUSTOM_TYPE) continue;\n\t\tconst payload = entry.data;\n\t\tif (!isPlainRecord(payload) || payload.version !== 1) continue;\n\t\tconst request = payload.request;\n\t\tif (isPlainRecord(request) && typeof request.id === \"string\") {\n\t\t\trequests.push(structuredClone(request) as unknown as WorkerRequest);\n\t\t}\n\t}\n\treturn requests;\n}\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) return false;\n\tconst prototype = Object.getPrototypeOf(value);\n\treturn prototype === Object.prototype || prototype === null;\n}\n\nexport function getWorkerResultSnapshots(entries: readonly SessionEntry[]): WorkerResult[] {\n\tconst results: WorkerResult[] = [];\n\n\tfor (const entry of entries) {\n\t\tif (entry.type !== \"custom\" || entry.customType !== WORKER_RESULT_CUSTOM_TYPE) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst payload = entry.data;\n\t\tif (!isPlainRecord(payload)) continue;\n\t\tif (payload.version !== 1) continue;\n\t\tif (!(\"result\" in payload)) continue;\n\t\tconst result = payload.result;\n\t\tif (isWorkerResult(result)) {\n\t\t\tresults.push(cloneWorkerResultForStorage(result));\n\t\t}\n\t}\n\n\treturn results;\n}\n"]}
+{"version":3,"file":"session-worker-result.js","sourceRoot":"","sources":["../../../src/core/delegation/session-worker-result.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzG,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AAWzD,MAAM,UAAU,0BAA0B,CACzC,cAAyD,EACzD,MAAoB,EACpB,OAAuB;AACvB;;4EAE4E;AAC5E,OAA0B,EACjB;IACT,MAAM,MAAM,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACnD,kEAAkE;IAClE,6EAA6E;IAC7E,8FAA8F;IAC9F,+FAA+F;IAC/F,oDAAkD;IAClD,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,oBAAoB,GAAG,sBAAsB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,OAAO,GAAgC;QAC5C,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,MAAM;QACd,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;IACF,OAAO,cAAc,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;AAAA,CAC5E;AAED,oGAAoG;AACpG,MAAM,UAAU,yBAAyB,CAAC,OAAgC,EAAmB;IAC5F,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,yBAAyB;YAAE,SAAS;QACxF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;QAC3B,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC;YAAE,SAAS;QAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC9D,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAA6B,CAAC,CAAC;QACrE,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,SAAS,aAAa,CAAC,KAAc,EAAoC;IACxE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAAA,CAC5D;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAgC,EAAkB;IAC1F,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,yBAAyB,EAAE,CAAC;YAC/E,SAAS;QACV,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;QAC3B,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC;YAAE,SAAS;QACpC,IAAI,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC;YAAE,SAAS;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,CAAC;IACF,CAAC;IAED,OAAO,OAAO,CAAC;AAAA,CACf;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC5C,OAAgC,EAChC,SAAiB,EACyB;IAC1C,IAAI,MAA+C,CAAC;IACpD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,yBAAyB;YAAE,SAAS;QACxF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;QAC3B,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC;YAAE,SAAS;QACzF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;YAAE,SAAS;QACxE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,MAAM,GAAG;YACR,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,2BAA2B,CAAC,MAAM,CAAC;YAC3C,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ;gBAC3D,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAA6B,EAAE;gBACnE,CAAC,CAAC,EAAE,CAAC;SACN,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAQD;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAC5C,cAAwE,EACxE,SAAiB,EACjB,GAAG,GAAiB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAClB;IAChC,MAAM,MAAM,GAAG,6BAA6B,CAAC,cAAc,CAAC,UAAU,EAAE,EAAE,SAAS,CAAC,CAAC;IACrF,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACrF,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACrF,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC;IACzB,0BAA0B,CAAC,cAAc,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAAA,CAC3C","sourcesContent":["import type { SessionEntry, SessionManager } from \"@caupulican/pi-agent-core/node\";\nimport type { WorkerRequest, WorkerResult } from \"../autonomy/contracts.ts\";\nimport { cloneWorkerResultForStorage, isParentReviewRequired, isWorkerResult } from \"./worker-result.ts\";\n\nexport const WORKER_RESULT_CUSTOM_TYPE = \"worker_result\";\n\nexport interface WorkerResultSnapshotPayload {\n\tversion: 1;\n\tresult: WorkerResult;\n\t/** The originating request: persisted so a result is auditable against exactly what was\n\t * asked — instructions, route, and the capability envelope that bounded it. Optional for\n\t * backward compatibility with entries recorded before this field existed. */\n\trequest?: WorkerRequest;\n}\n\nexport function appendWorkerResultSnapshot(\n\tsessionManager: Pick<SessionManager, \"appendCustomEntry\">,\n\tresult: WorkerResult,\n\trequest?: WorkerRequest,\n\t/** Baseline for relative changedFiles when re-deriving the review marker; forwarded to\n\t * `isParentReviewRequired`/`validateWorkerResult`. Defaults to `process.cwd()`, matching the\n\t * validator's own documented default for single-cwd-per-process callers. */\n\toptions?: { cwd?: string },\n): string {\n\tconst stored = cloneWorkerResultForStorage(result);\n\t// Stamp the parent-review marker here by re-running the SAME gate\n\t// (validateWorkerResult, via isParentReviewRequired) that originally decided\n\t// ask-user/parent_review_required, so the marker can never drift from the gate's own verdict.\n\t// Only computable when `request` is available; callers that omit it (legacy callers) leave the\n\t// field unset — \"unknown\", never falsely \"false\".\n\tif (request) {\n\t\tstored.parentReviewRequired = isParentReviewRequired({ request, result, cwd: options?.cwd });\n\t}\n\tconst payload: WorkerResultSnapshotPayload = {\n\t\tversion: 1,\n\t\tresult: stored,\n\t\t...(request ? { request: structuredClone(request) } : {}),\n\t};\n\treturn sessionManager.appendCustomEntry(WORKER_RESULT_CUSTOM_TYPE, payload);\n}\n\n/** Requests persisted alongside results (absent for entries recorded before this field existed). */\nexport function getWorkerRequestSnapshots(entries: readonly SessionEntry[]): WorkerRequest[] {\n\tconst requests: WorkerRequest[] = [];\n\tfor (const entry of entries) {\n\t\tif (entry.type !== \"custom\" || entry.customType !== WORKER_RESULT_CUSTOM_TYPE) continue;\n\t\tconst payload = entry.data;\n\t\tif (!isPlainRecord(payload) || payload.version !== 1) continue;\n\t\tconst request = payload.request;\n\t\tif (isPlainRecord(request) && typeof request.id === \"string\") {\n\t\t\trequests.push(structuredClone(request) as unknown as WorkerRequest);\n\t\t}\n\t}\n\treturn requests;\n}\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) return false;\n\tconst prototype = Object.getPrototypeOf(value);\n\treturn prototype === Object.prototype || prototype === null;\n}\n\nexport function getWorkerResultSnapshots(entries: readonly SessionEntry[]): WorkerResult[] {\n\tconst results: WorkerResult[] = [];\n\n\tfor (const entry of entries) {\n\t\tif (entry.type !== \"custom\" || entry.customType !== WORKER_RESULT_CUSTOM_TYPE) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst payload = entry.data;\n\t\tif (!isPlainRecord(payload)) continue;\n\t\tif (payload.version !== 1) continue;\n\t\tif (!(\"result\" in payload)) continue;\n\t\tconst result = payload.result;\n\t\tif (isWorkerResult(result)) {\n\t\t\tresults.push(cloneWorkerResultForStorage(result));\n\t\t}\n\t}\n\n\treturn results;\n}\n\n/**\n * Latest persisted snapshot (result + originating request, when available) for one worker\n * requestId — \"latest wins\" over the append-only entries, the same collapse `delegate_status`\n * already performs when it maps results by requestId. Used to read, and durably update, the\n * parent-review marker.\n */\nexport function getLatestWorkerResultSnapshot(\n\tentries: readonly SessionEntry[],\n\trequestId: string,\n): WorkerResultSnapshotPayload | undefined {\n\tlet latest: WorkerResultSnapshotPayload | undefined;\n\tfor (const entry of entries) {\n\t\tif (entry.type !== \"custom\" || entry.customType !== WORKER_RESULT_CUSTOM_TYPE) continue;\n\t\tconst payload = entry.data;\n\t\tif (!isPlainRecord(payload) || payload.version !== 1 || !(\"result\" in payload)) continue;\n\t\tconst result = payload.result;\n\t\tif (!isWorkerResult(result) || result.requestId !== requestId) continue;\n\t\tconst request = payload.request;\n\t\tlatest = {\n\t\t\tversion: 1,\n\t\t\tresult: cloneWorkerResultForStorage(result),\n\t\t\t...(isPlainRecord(request) && typeof request.id === \"string\"\n\t\t\t\t? { request: structuredClone(request) as unknown as WorkerRequest }\n\t\t\t\t: {}),\n\t\t};\n\t}\n\treturn latest;\n}\n\nexport type AcknowledgeWorkerReviewReason = \"unknown_worker_result\" | \"not_flagged\" | \"already_reviewed\";\n\nexport type AcknowledgeWorkerReviewResult =\n\t| { ok: true; requestId: string; reviewedAt: string }\n\t| { ok: false; reason: AcknowledgeWorkerReviewReason };\n\n/**\n * Durably acknowledge an unreviewed worker mutation. Re-appends the latest snapshot for\n * `requestId` with `parentReviewedAt` set, so the ack is a first-class entry in the same\n * append-only audit trail as the original result — it survives reload and any future re-read of\n * `getWorkerResultSnapshots`/`getLatestWorkerResultSnapshot` (both are \"latest wins\"). Never\n * write-blocking: this only marks the mutation reviewed, it does not touch the worker's files.\n */\nexport function acknowledgeWorkerResultReview(\n\tsessionManager: Pick<SessionManager, \"appendCustomEntry\" | \"getEntries\">,\n\trequestId: string,\n\tnow: () => string = () => new Date().toISOString(),\n): AcknowledgeWorkerReviewResult {\n\tconst latest = getLatestWorkerResultSnapshot(sessionManager.getEntries(), requestId);\n\tif (!latest) return { ok: false, reason: \"unknown_worker_result\" };\n\tif (!latest.result.parentReviewRequired) return { ok: false, reason: \"not_flagged\" };\n\tif (latest.result.parentReviewedAt) return { ok: false, reason: \"already_reviewed\" };\n\tconst reviewedAt = now();\n\tappendWorkerResultSnapshot(sessionManager, { ...latest.result, parentReviewedAt: reviewedAt }, latest.request);\n\treturn { ok: true, requestId, reviewedAt };\n}\n"]}

package/dist/core/delegation/worker-actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker-actions.d.ts","sourceRoot":"","sources":["../../../src/core/delegation/worker-actions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAQ,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAG7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE;;;;;;;GAOG;AAEH,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,OAAO,GAAG,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAyDD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,6BAA6B,GAAG,YAAY,EAAE,CAG3G;AAED,MAAM,WAAW,oBAAoB;IACpC,4CAA4C;IAC5C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uFAAqF;IACrF,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,8FAA8F;IAC9F,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACxC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IACjC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;CACZ,GAAG,oBAAoB,CAmCvB","sourcesContent":["import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { dirname, relative, resolve } from \"node:path\";\nimport type { Tool, ToolArgumentValidationOptions } from \"@caupulican/pi-ai\";\nimport { validateToolArguments } from \"@caupulican/pi-ai\";\nimport { Type } from \"typebox\";\nimport type { CapabilityEnvelope } from \"../autonomy/contracts.ts\";\nimport { isPathWithinEnvelope } from \"../autonomy/envelope-enforcement.ts\";\n\n/**\n * Code-writing workers (G2): the worker MODEL never touches the filesystem — it emits strict-JSON\n * actions, and this RUNNER-side module applies them deterministically through the capability\n * envelope's path scope. That keeps the structural-contract philosophy (a local model without\n * tool-calling templates can still write code) and makes enforcement execution-time, not\n * validation-only: an out-of-scope action is REFUSED with a reason, never silently dropped, and\n * refusals surface as blockers on the result.\n */\n\nexport interface WorkerAction {\n\top: \"write\" | \"edit\";\n\tpath: string;\n\t/** write: full file content. */\n\tcontent?: string;\n\t/** edit: exact string to replace (must occur in the file). */\n\told?: string;\n\t/** edit: replacement text. */\n\tnew?: string;\n}\n\nconst MAX_ACTIONS = 20;\nconst MAX_CONTENT_CHARS = 512 * 1024;\n\nconst workerActionSchema = Type.Union([\n\tType.Object({\n\t\top: Type.Literal(\"write\"),\n\t\tpath: Type.String({ minLength: 1 }),\n\t\tcontent: Type.String({ maxLength: MAX_CONTENT_CHARS }),\n\t}),\n\tType.Object({\n\t\top: Type.Literal(\"edit\"),\n\t\tpath: Type.String({ minLength: 1 }),\n\t\told: Type.String({ minLength: 1 }),\n\t\tnew: Type.String({ maxLength: MAX_CONTENT_CHARS }),\n\t}),\n]);\n\nconst workerActionsTool: Tool = {\n\tname: \"worker_actions\",\n\tdescription: \"Worker filesystem action list\",\n\tparameters: Type.Object({ actions: Type.Array(workerActionSchema) }),\n};\n\nfunction validateWorkerActions(raw: unknown, validation?: ToolArgumentValidationOptions): unknown[] {\n\ttry {\n\t\tconst validated = validateToolArguments(\n\t\t\tworkerActionsTool,\n\t\t\t{ type: \"toolCall\", id: \"worker-actions\", name: \"worker_actions\", arguments: { actions: raw } },\n\t\t\tvalidation,\n\t\t).actions;\n\t\treturn Array.isArray(validated) ? validated : [];\n\t} catch {\n\t\treturn [];\n\t}\n}\n\nfunction sanitizeWorkerActions(raw: readonly unknown[]): WorkerAction[] {\n\tconst actions: WorkerAction[] = [];\n\tfor (const entry of raw.slice(0, MAX_ACTIONS)) {\n\t\tif (!entry || typeof entry !== \"object\") continue;\n\t\tconst record = entry as Record<string, unknown>;\n\t\tif (record.op !== \"write\" && record.op !== \"edit\") continue;\n\t\tif (typeof record.path !== \"string\" || record.path.length === 0) continue;\n\t\tif (record.op === \"write\") {\n\t\t\tif (typeof record.content !== \"string\" || record.content.length > MAX_CONTENT_CHARS) continue;\n\t\t\tactions.push({ op: \"write\", path: record.path, content: record.content });\n\t\t} else {\n\t\t\tif (typeof record.old !== \"string\" || record.old.length === 0) continue;\n\t\t\tif (typeof record.new !== \"string\" || record.new.length > MAX_CONTENT_CHARS) continue;\n\t\t\tactions.push({ op: \"edit\", path: record.path, old: record.old, new: record.new });\n\t\t}\n\t}\n\treturn actions;\n}\n\nexport function parseWorkerActions(raw: unknown, validation?: ToolArgumentValidationOptions): WorkerAction[] {\n\tif (Array.isArray(raw)) return sanitizeWorkerActions(validateWorkerActions(sanitizeWorkerActions(raw), validation));\n\treturn sanitizeWorkerActions(validateWorkerActions(raw, validation));\n}\n\nexport interface AppliedActionsReport {\n\t/** Repo-relative paths actually changed. */\n\tchangedFiles: string[];\n\t/** Envelope-scope refusals (execution-time enforcement) — surfaced, never silent. */\n\trefused: Array<{ path: string; reason: string }>;\n\t/** Actions that were in scope but could not be applied (missing file, old-text not found). */\n\tfailed: Array<{ path: string; reason: string }>;\n}\n\nexport function applyWorkerActions(args: {\n\tactions: readonly WorkerAction[];\n\tenvelope: CapabilityEnvelope;\n\tcwd: string;\n}): AppliedActionsReport {\n\tconst report: AppliedActionsReport = { changedFiles: [], refused: [], failed: [] };\n\tfor (const action of args.actions) {\n\t\tif (!isPathWithinEnvelope(args.envelope, action.path, args.cwd)) {\n\t\t\treport.refused.push({ path: action.path, reason: `outside envelope ${args.envelope.id} path scope` });\n\t\t\tcontinue;\n\t\t}\n\t\tconst target = resolve(args.cwd, action.path);\n\t\tconst relativePath = relative(args.cwd, target);\n\t\ttry {\n\t\t\tif (action.op === \"write\") {\n\t\t\t\tmkdirSync(dirname(target), { recursive: true });\n\t\t\t\twriteFileSync(target, action.content ?? \"\", \"utf-8\");\n\t\t\t} else {\n\t\t\t\tif (!existsSync(target)) {\n\t\t\t\t\treport.failed.push({ path: action.path, reason: \"file does not exist\" });\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tconst current = readFileSync(target, \"utf-8\");\n\t\t\t\tif (!action.old || !current.includes(action.old)) {\n\t\t\t\t\treport.failed.push({ path: action.path, reason: \"edit old-text not found in file\" });\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\twriteFileSync(\n\t\t\t\t\ttarget,\n\t\t\t\t\tcurrent.replace(action.old, () => action.new ?? \"\"),\n\t\t\t\t\t\"utf-8\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (!report.changedFiles.includes(relativePath)) report.changedFiles.push(relativePath);\n\t\t} catch (error) {\n\t\t\treport.failed.push({ path: action.path, reason: error instanceof Error ? error.message : String(error) });\n\t\t}\n\t}\n\treturn report;\n}\n"]}
+{"version":3,"file":"worker-actions.d.ts","sourceRoot":"","sources":["../../../src/core/delegation/worker-actions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAQ,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAG7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE;;;;;;;GAOG;AAEH,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,OAAO,GAAG,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAyDD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,6BAA6B,GAAG,YAAY,EAAE,CAG3G;AAED,MAAM,WAAW,oBAAoB;IACpC,4CAA4C;IAC5C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uFAAqF;IACrF,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,8FAA8F;IAC9F,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACxC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IACjC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;CACZ,GAAG,oBAAoB,CAmCvB","sourcesContent":["import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { dirname, relative, resolve } from \"node:path\";\nimport type { Tool, ToolArgumentValidationOptions } from \"@caupulican/pi-ai\";\nimport { validateToolArguments } from \"@caupulican/pi-ai\";\nimport { Type } from \"typebox\";\nimport type { CapabilityEnvelope } from \"../autonomy/contracts.ts\";\nimport { isPathWithinEnvelope } from \"../autonomy/envelope-enforcement.ts\";\n\n/**\n * Code-writing workers (G2): the worker MODEL never touches the filesystem — it emits strict-JSON\n * actions, and this RUNNER-side module applies them deterministically through the capability\n * envelope's path scope. That keeps the structural-contract philosophy (a local model without\n * tool-calling templates can still write code) and makes enforcement execution-time, not\n * validation-only: an out-of-scope action is REFUSED with a reason, never silently dropped, and\n * refusals surface as blockers on the result.\n */\n\nexport interface WorkerAction {\n\top: \"write\" | \"edit\";\n\tpath: string;\n\t/** write: full file content. */\n\tcontent?: string;\n\t/** edit: exact string to replace (must occur in the file). */\n\told?: string;\n\t/** edit: replacement text. */\n\tnew?: string;\n}\n\nconst MAX_ACTIONS = 20;\nconst MAX_CONTENT_CHARS = 512 * 1024;\n\nconst workerActionSchema = Type.Union([\n\tType.Object({\n\t\top: Type.Literal(\"write\"),\n\t\tpath: Type.String({ minLength: 1 }),\n\t\tcontent: Type.String({ maxLength: MAX_CONTENT_CHARS }),\n\t}),\n\tType.Object({\n\t\top: Type.Literal(\"edit\"),\n\t\tpath: Type.String({ minLength: 1 }),\n\t\told: Type.String({ minLength: 1 }),\n\t\tnew: Type.String({ maxLength: MAX_CONTENT_CHARS }),\n\t}),\n]);\n\nconst workerActionsTool: Tool = {\n\tname: \"worker_actions\",\n\tdescription: \"Worker filesystem action list\",\n\tparameters: Type.Object({ actions: Type.Array(workerActionSchema) }),\n};\n\nfunction validateWorkerActions(raw: unknown, validation?: ToolArgumentValidationOptions): unknown[] {\n\ttry {\n\t\tconst validated = validateToolArguments(\n\t\t\tworkerActionsTool,\n\t\t\t{ type: \"toolCall\", id: \"worker-actions\", name: \"worker_actions\", arguments: { actions: raw } },\n\t\t\tvalidation,\n\t\t).actions;\n\t\treturn Array.isArray(validated) ? validated : [];\n\t} catch {\n\t\treturn [];\n\t}\n}\n\nfunction sanitizeWorkerActions(raw: readonly unknown[]): WorkerAction[] {\n\tconst actions: WorkerAction[] = [];\n\tfor (const entry of raw.slice(0, MAX_ACTIONS)) {\n\t\tif (!entry || typeof entry !== \"object\") continue;\n\t\tconst record = entry as Record<string, unknown>;\n\t\tif (record.op !== \"write\" && record.op !== \"edit\") continue;\n\t\tif (typeof record.path !== \"string\" || record.path.length === 0) continue;\n\t\tif (record.op === \"write\") {\n\t\t\tif (typeof record.content !== \"string\" || record.content.length > MAX_CONTENT_CHARS) continue;\n\t\t\tactions.push({ op: \"write\", path: record.path, content: record.content });\n\t\t} else {\n\t\t\tif (typeof record.old !== \"string\" || record.old.length === 0) continue;\n\t\t\tif (typeof record.new !== \"string\" || record.new.length > MAX_CONTENT_CHARS) continue;\n\t\t\tactions.push({ op: \"edit\", path: record.path, old: record.old, new: record.new });\n\t\t}\n\t}\n\treturn actions;\n}\n\nexport function parseWorkerActions(raw: unknown, validation?: ToolArgumentValidationOptions): WorkerAction[] {\n\tif (Array.isArray(raw)) return sanitizeWorkerActions(validateWorkerActions(sanitizeWorkerActions(raw), validation));\n\treturn sanitizeWorkerActions(validateWorkerActions(raw, validation));\n}\n\nexport interface AppliedActionsReport {\n\t/** Repo-relative paths actually changed. */\n\tchangedFiles: string[];\n\t/** Envelope-scope refusals (execution-time enforcement) — surfaced, never silent. */\n\trefused: Array<{ path: string; reason: string }>;\n\t/** Actions that were in scope but could not be applied (missing file, old-text not found). */\n\tfailed: Array<{ path: string; reason: string }>;\n}\n\nexport function applyWorkerActions(args: {\n\tactions: readonly WorkerAction[];\n\tenvelope: CapabilityEnvelope;\n\tcwd: string;\n}): AppliedActionsReport {\n\tconst report: AppliedActionsReport = { changedFiles: [], refused: [], failed: [] };\n\tfor (const action of args.actions) {\n\t\tif (!isPathWithinEnvelope(args.envelope, action.path, args.cwd)) {\n\t\t\treport.refused.push({ path: action.path, reason: `outside envelope ${args.envelope.id} path scope` });\n\t\t\tcontinue;\n\t\t}\n\t\tconst target = resolve(args.cwd, action.path);\n\t\tconst relativePath = relative(args.cwd, target).replaceAll(\"\\\\\", \"/\");\n\t\ttry {\n\t\t\tif (action.op === \"write\") {\n\t\t\t\tmkdirSync(dirname(target), { recursive: true });\n\t\t\t\twriteFileSync(target, action.content ?? \"\", \"utf-8\");\n\t\t\t} else {\n\t\t\t\tif (!existsSync(target)) {\n\t\t\t\t\treport.failed.push({ path: action.path, reason: \"file does not exist\" });\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tconst current = readFileSync(target, \"utf-8\");\n\t\t\t\tif (!action.old || !current.includes(action.old)) {\n\t\t\t\t\treport.failed.push({ path: action.path, reason: \"edit old-text not found in file\" });\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\twriteFileSync(\n\t\t\t\t\ttarget,\n\t\t\t\t\tcurrent.replace(action.old, () => action.new ?? \"\"),\n\t\t\t\t\t\"utf-8\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (!report.changedFiles.includes(relativePath)) report.changedFiles.push(relativePath);\n\t\t} catch (error) {\n\t\t\treport.failed.push({ path: action.path, reason: error instanceof Error ? error.message : String(error) });\n\t\t}\n\t}\n\treturn report;\n}\n"]}

package/dist/core/delegation/worker-actions.js

@@ -70,7 +70,7 @@ export function applyWorkerActions(args) {
             continue;
         }
         const target = resolve(args.cwd, action.path);
-        const relativePath = relative(args.cwd, target);
+        const relativePath = relative(args.cwd, target).replaceAll("\\", "/");
         try {
             if (action.op === "write") {
                 mkdirSync(dirname(target), { recursive: true });

package/dist/core/delegation/worker-actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"worker-actions.js","sourceRoot":"","sources":["../../../src/core/delegation/worker-actions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAsB3E,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,CAAC;AAErC,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC;QACX,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QACzB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;KACtD,CAAC;IACF,IAAI,CAAC,MAAM,CAAC;QACX,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACxB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACnC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QAClC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;KAClD,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAS;IAC/B,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,+BAA+B;IAC5C,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;CACpE,CAAC;AAEF,SAAS,qBAAqB,CAAC,GAAY,EAAE,UAA0C,EAAa;IACnG,IAAI,CAAC;QACJ,MAAM,SAAS,GAAG,qBAAqB,CACtC,iBAAiB,EACjB,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAC/F,UAAU,CACV,CAAC,OAAO,CAAC;QACV,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;AAAA,CACD;AAED,SAAS,qBAAqB,CAAC,GAAuB,EAAkB;IACvE,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,IAAI,MAAM,CAAC,EAAE,KAAK,OAAO,IAAI,MAAM,CAAC,EAAE,KAAK,MAAM;YAAE,SAAS;QAC5D,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC1E,IAAI,MAAM,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;YAC3B,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,iBAAiB;gBAAE,SAAS;YAC9F,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACP,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACxE,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,iBAAiB;gBAAE,SAAS;YACtF,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACnF,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,UAA0C,EAAkB;IAC5G,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,qBAAqB,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IACpH,OAAO,qBAAqB,CAAC,qBAAqB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;AAAA,CACrE;AAWD,MAAM,UAAU,kBAAkB,CAAC,IAIlC,EAAwB;IACxB,MAAM,MAAM,GAAyB,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACnF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,oBAAoB,IAAI,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;YACtG,SAAS;QACV,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC;YACJ,IAAI,MAAM,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;gBAC3B,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChD,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACP,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;oBACzE,SAAS;gBACV,CAAC;gBACD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC9C,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;oBAClD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC,CAAC;oBACrF,SAAS;gBACV,CAAC;gBACD,aAAa,CACZ,MAAM,EACN,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EACnD,OAAO,CACP,CAAC;YACH,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3G,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd","sourcesContent":["import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { dirname, relative, resolve } from \"node:path\";\nimport type { Tool, ToolArgumentValidationOptions } from \"@caupulican/pi-ai\";\nimport { validateToolArguments } from \"@caupulican/pi-ai\";\nimport { Type } from \"typebox\";\nimport type { CapabilityEnvelope } from \"../autonomy/contracts.ts\";\nimport { isPathWithinEnvelope } from \"../autonomy/envelope-enforcement.ts\";\n\n/**\n * Code-writing workers (G2): the worker MODEL never touches the filesystem — it emits strict-JSON\n * actions, and this RUNNER-side module applies them deterministically through the capability\n * envelope's path scope. That keeps the structural-contract philosophy (a local model without\n * tool-calling templates can still write code) and makes enforcement execution-time, not\n * validation-only: an out-of-scope action is REFUSED with a reason, never silently dropped, and\n * refusals surface as blockers on the result.\n */\n\nexport interface WorkerAction {\n\top: \"write\" | \"edit\";\n\tpath: string;\n\t/** write: full file content. */\n\tcontent?: string;\n\t/** edit: exact string to replace (must occur in the file). */\n\told?: string;\n\t/** edit: replacement text. */\n\tnew?: string;\n}\n\nconst MAX_ACTIONS = 20;\nconst MAX_CONTENT_CHARS = 512 * 1024;\n\nconst workerActionSchema = Type.Union([\n\tType.Object({\n\t\top: Type.Literal(\"write\"),\n\t\tpath: Type.String({ minLength: 1 }),\n\t\tcontent: Type.String({ maxLength: MAX_CONTENT_CHARS }),\n\t}),\n\tType.Object({\n\t\top: Type.Literal(\"edit\"),\n\t\tpath: Type.String({ minLength: 1 }),\n\t\told: Type.String({ minLength: 1 }),\n\t\tnew: Type.String({ maxLength: MAX_CONTENT_CHARS }),\n\t}),\n]);\n\nconst workerActionsTool: Tool = {\n\tname: \"worker_actions\",\n\tdescription: \"Worker filesystem action list\",\n\tparameters: Type.Object({ actions: Type.Array(workerActionSchema) }),\n};\n\nfunction validateWorkerActions(raw: unknown, validation?: ToolArgumentValidationOptions): unknown[] {\n\ttry {\n\t\tconst validated = validateToolArguments(\n\t\t\tworkerActionsTool,\n\t\t\t{ type: \"toolCall\", id: \"worker-actions\", name: \"worker_actions\", arguments: { actions: raw } },\n\t\t\tvalidation,\n\t\t).actions;\n\t\treturn Array.isArray(validated) ? validated : [];\n\t} catch {\n\t\treturn [];\n\t}\n}\n\nfunction sanitizeWorkerActions(raw: readonly unknown[]): WorkerAction[] {\n\tconst actions: WorkerAction[] = [];\n\tfor (const entry of raw.slice(0, MAX_ACTIONS)) {\n\t\tif (!entry || typeof entry !== \"object\") continue;\n\t\tconst record = entry as Record<string, unknown>;\n\t\tif (record.op !== \"write\" && record.op !== \"edit\") continue;\n\t\tif (typeof record.path !== \"string\" || record.path.length === 0) continue;\n\t\tif (record.op === \"write\") {\n\t\t\tif (typeof record.content !== \"string\" || record.content.length > MAX_CONTENT_CHARS) continue;\n\t\t\tactions.push({ op: \"write\", path: record.path, content: record.content });\n\t\t} else {\n\t\t\tif (typeof record.old !== \"string\" || record.old.length === 0) continue;\n\t\t\tif (typeof record.new !== \"string\" || record.new.length > MAX_CONTENT_CHARS) continue;\n\t\t\tactions.push({ op: \"edit\", path: record.path, old: record.old, new: record.new });\n\t\t}\n\t}\n\treturn actions;\n}\n\nexport function parseWorkerActions(raw: unknown, validation?: ToolArgumentValidationOptions): WorkerAction[] {\n\tif (Array.isArray(raw)) return sanitizeWorkerActions(validateWorkerActions(sanitizeWorkerActions(raw), validation));\n\treturn sanitizeWorkerActions(validateWorkerActions(raw, validation));\n}\n\nexport interface AppliedActionsReport {\n\t/** Repo-relative paths actually changed. */\n\tchangedFiles: string[];\n\t/** Envelope-scope refusals (execution-time enforcement) — surfaced, never silent. */\n\trefused: Array<{ path: string; reason: string }>;\n\t/** Actions that were in scope but could not be applied (missing file, old-text not found). */\n\tfailed: Array<{ path: string; reason: string }>;\n}\n\nexport function applyWorkerActions(args: {\n\tactions: readonly WorkerAction[];\n\tenvelope: CapabilityEnvelope;\n\tcwd: string;\n}): AppliedActionsReport {\n\tconst report: AppliedActionsReport = { changedFiles: [], refused: [], failed: [] };\n\tfor (const action of args.actions) {\n\t\tif (!isPathWithinEnvelope(args.envelope, action.path, args.cwd)) {\n\t\t\treport.refused.push({ path: action.path, reason: `outside envelope ${args.envelope.id} path scope` });\n\t\t\tcontinue;\n\t\t}\n\t\tconst target = resolve(args.cwd, action.path);\n\t\tconst relativePath = relative(args.cwd, target);\n\t\ttry {\n\t\t\tif (action.op === \"write\") {\n\t\t\t\tmkdirSync(dirname(target), { recursive: true });\n\t\t\t\twriteFileSync(target, action.content ?? \"\", \"utf-8\");\n\t\t\t} else {\n\t\t\t\tif (!existsSync(target)) {\n\t\t\t\t\treport.failed.push({ path: action.path, reason: \"file does not exist\" });\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tconst current = readFileSync(target, \"utf-8\");\n\t\t\t\tif (!action.old || !current.includes(action.old)) {\n\t\t\t\t\treport.failed.push({ path: action.path, reason: \"edit old-text not found in file\" });\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\twriteFileSync(\n\t\t\t\t\ttarget,\n\t\t\t\t\tcurrent.replace(action.old, () => action.new ?? \"\"),\n\t\t\t\t\t\"utf-8\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (!report.changedFiles.includes(relativePath)) report.changedFiles.push(relativePath);\n\t\t} catch (error) {\n\t\t\treport.failed.push({ path: action.path, reason: error instanceof Error ? error.message : String(error) });\n\t\t}\n\t}\n\treturn report;\n}\n"]}
+{"version":3,"file":"worker-actions.js","sourceRoot":"","sources":["../../../src/core/delegation/worker-actions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAsB3E,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,CAAC;AAErC,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC;QACX,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QACzB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;KACtD,CAAC;IACF,IAAI,CAAC,MAAM,CAAC;QACX,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACxB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACnC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QAClC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;KAClD,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAS;IAC/B,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,+BAA+B;IAC5C,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;CACpE,CAAC;AAEF,SAAS,qBAAqB,CAAC,GAAY,EAAE,UAA0C,EAAa;IACnG,IAAI,CAAC;QACJ,MAAM,SAAS,GAAG,qBAAqB,CACtC,iBAAiB,EACjB,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAC/F,UAAU,CACV,CAAC,OAAO,CAAC;QACV,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;AAAA,CACD;AAED,SAAS,qBAAqB,CAAC,GAAuB,EAAkB;IACvE,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,IAAI,MAAM,CAAC,EAAE,KAAK,OAAO,IAAI,MAAM,CAAC,EAAE,KAAK,MAAM;YAAE,SAAS;QAC5D,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC1E,IAAI,MAAM,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;YAC3B,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,iBAAiB;gBAAE,SAAS;YAC9F,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACP,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACxE,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,iBAAiB;gBAAE,SAAS;YACtF,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACnF,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,UAA0C,EAAkB;IAC5G,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,qBAAqB,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IACpH,OAAO,qBAAqB,CAAC,qBAAqB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;AAAA,CACrE;AAWD,MAAM,UAAU,kBAAkB,CAAC,IAIlC,EAAwB;IACxB,MAAM,MAAM,GAAyB,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACnF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,oBAAoB,IAAI,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;YACtG,SAAS;QACV,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtE,IAAI,CAAC;YACJ,IAAI,MAAM,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;gBAC3B,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChD,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACP,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;oBACzE,SAAS;gBACV,CAAC;gBACD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC9C,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;oBAClD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC,CAAC;oBACrF,SAAS;gBACV,CAAC;gBACD,aAAa,CACZ,MAAM,EACN,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EACnD,OAAO,CACP,CAAC;YACH,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3G,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd","sourcesContent":["import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { dirname, relative, resolve } from \"node:path\";\nimport type { Tool, ToolArgumentValidationOptions } from \"@caupulican/pi-ai\";\nimport { validateToolArguments } from \"@caupulican/pi-ai\";\nimport { Type } from \"typebox\";\nimport type { CapabilityEnvelope } from \"../autonomy/contracts.ts\";\nimport { isPathWithinEnvelope } from \"../autonomy/envelope-enforcement.ts\";\n\n/**\n * Code-writing workers (G2): the worker MODEL never touches the filesystem — it emits strict-JSON\n * actions, and this RUNNER-side module applies them deterministically through the capability\n * envelope's path scope. That keeps the structural-contract philosophy (a local model without\n * tool-calling templates can still write code) and makes enforcement execution-time, not\n * validation-only: an out-of-scope action is REFUSED with a reason, never silently dropped, and\n * refusals surface as blockers on the result.\n */\n\nexport interface WorkerAction {\n\top: \"write\" | \"edit\";\n\tpath: string;\n\t/** write: full file content. */\n\tcontent?: string;\n\t/** edit: exact string to replace (must occur in the file). */\n\told?: string;\n\t/** edit: replacement text. */\n\tnew?: string;\n}\n\nconst MAX_ACTIONS = 20;\nconst MAX_CONTENT_CHARS = 512 * 1024;\n\nconst workerActionSchema = Type.Union([\n\tType.Object({\n\t\top: Type.Literal(\"write\"),\n\t\tpath: Type.String({ minLength: 1 }),\n\t\tcontent: Type.String({ maxLength: MAX_CONTENT_CHARS }),\n\t}),\n\tType.Object({\n\t\top: Type.Literal(\"edit\"),\n\t\tpath: Type.String({ minLength: 1 }),\n\t\told: Type.String({ minLength: 1 }),\n\t\tnew: Type.String({ maxLength: MAX_CONTENT_CHARS }),\n\t}),\n]);\n\nconst workerActionsTool: Tool = {\n\tname: \"worker_actions\",\n\tdescription: \"Worker filesystem action list\",\n\tparameters: Type.Object({ actions: Type.Array(workerActionSchema) }),\n};\n\nfunction validateWorkerActions(raw: unknown, validation?: ToolArgumentValidationOptions): unknown[] {\n\ttry {\n\t\tconst validated = validateToolArguments(\n\t\t\tworkerActionsTool,\n\t\t\t{ type: \"toolCall\", id: \"worker-actions\", name: \"worker_actions\", arguments: { actions: raw } },\n\t\t\tvalidation,\n\t\t).actions;\n\t\treturn Array.isArray(validated) ? validated : [];\n\t} catch {\n\t\treturn [];\n\t}\n}\n\nfunction sanitizeWorkerActions(raw: readonly unknown[]): WorkerAction[] {\n\tconst actions: WorkerAction[] = [];\n\tfor (const entry of raw.slice(0, MAX_ACTIONS)) {\n\t\tif (!entry || typeof entry !== \"object\") continue;\n\t\tconst record = entry as Record<string, unknown>;\n\t\tif (record.op !== \"write\" && record.op !== \"edit\") continue;\n\t\tif (typeof record.path !== \"string\" || record.path.length === 0) continue;\n\t\tif (record.op === \"write\") {\n\t\t\tif (typeof record.content !== \"string\" || record.content.length > MAX_CONTENT_CHARS) continue;\n\t\t\tactions.push({ op: \"write\", path: record.path, content: record.content });\n\t\t} else {\n\t\t\tif (typeof record.old !== \"string\" || record.old.length === 0) continue;\n\t\t\tif (typeof record.new !== \"string\" || record.new.length > MAX_CONTENT_CHARS) continue;\n\t\t\tactions.push({ op: \"edit\", path: record.path, old: record.old, new: record.new });\n\t\t}\n\t}\n\treturn actions;\n}\n\nexport function parseWorkerActions(raw: unknown, validation?: ToolArgumentValidationOptions): WorkerAction[] {\n\tif (Array.isArray(raw)) return sanitizeWorkerActions(validateWorkerActions(sanitizeWorkerActions(raw), validation));\n\treturn sanitizeWorkerActions(validateWorkerActions(raw, validation));\n}\n\nexport interface AppliedActionsReport {\n\t/** Repo-relative paths actually changed. */\n\tchangedFiles: string[];\n\t/** Envelope-scope refusals (execution-time enforcement) — surfaced, never silent. */\n\trefused: Array<{ path: string; reason: string }>;\n\t/** Actions that were in scope but could not be applied (missing file, old-text not found). */\n\tfailed: Array<{ path: string; reason: string }>;\n}\n\nexport function applyWorkerActions(args: {\n\tactions: readonly WorkerAction[];\n\tenvelope: CapabilityEnvelope;\n\tcwd: string;\n}): AppliedActionsReport {\n\tconst report: AppliedActionsReport = { changedFiles: [], refused: [], failed: [] };\n\tfor (const action of args.actions) {\n\t\tif (!isPathWithinEnvelope(args.envelope, action.path, args.cwd)) {\n\t\t\treport.refused.push({ path: action.path, reason: `outside envelope ${args.envelope.id} path scope` });\n\t\t\tcontinue;\n\t\t}\n\t\tconst target = resolve(args.cwd, action.path);\n\t\tconst relativePath = relative(args.cwd, target).replaceAll(\"\\\\\", \"/\");\n\t\ttry {\n\t\t\tif (action.op === \"write\") {\n\t\t\t\tmkdirSync(dirname(target), { recursive: true });\n\t\t\t\twriteFileSync(target, action.content ?? \"\", \"utf-8\");\n\t\t\t} else {\n\t\t\t\tif (!existsSync(target)) {\n\t\t\t\t\treport.failed.push({ path: action.path, reason: \"file does not exist\" });\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tconst current = readFileSync(target, \"utf-8\");\n\t\t\t\tif (!action.old || !current.includes(action.old)) {\n\t\t\t\t\treport.failed.push({ path: action.path, reason: \"edit old-text not found in file\" });\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\twriteFileSync(\n\t\t\t\t\ttarget,\n\t\t\t\t\tcurrent.replace(action.old, () => action.new ?? \"\"),\n\t\t\t\t\t\"utf-8\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (!report.changedFiles.includes(relativePath)) report.changedFiles.push(relativePath);\n\t\t} catch (error) {\n\t\t\treport.failed.push({ path: action.path, reason: error instanceof Error ? error.message : String(error) });\n\t\t}\n\t}\n\treturn report;\n}\n"]}

package/dist/core/delegation/worker-result.d.ts

@@ -1,7 +1,20 @@
-import type { GateOutcome, WorkerRequest, WorkerResult } from "../autonomy/contracts.ts";
+import type { CapabilityEnvelope, GateOutcome, WorkerRequest, WorkerResult } from "../autonomy/contracts.ts";
 export declare function cloneWorkerResultForStorage(result: WorkerResult): WorkerResult;
 export declare function isWorkerResult(value: unknown): value is WorkerResult;
 export declare function requiresParentReview(result: WorkerResult): boolean;
+/**
+ * True iff {@link validateWorkerResult}'s gate would flag this result "ask-user" /
+ * "parent_review_required" (the two branches at :110 and :178 below) — an otherwise-completed
+ * result the parent must explicitly look at because it reports blockers, or reports file mutations
+ * that passed path-scope validation. Reuses `validateWorkerResult` itself rather than a
+ * separately-maintained heuristic, so a persisted review marker can never drift from the
+ * gate's actual verdict.
+ */
+export declare function isParentReviewRequired(args: {
+    request: WorkerRequest;
+    result: WorkerResult;
+    cwd?: string;
+}): boolean;
 export declare function validateWorkerResult(args: {
     request: WorkerRequest;
     result: WorkerResult;
@@ -12,4 +25,32 @@ export declare function validateWorkerResult(args: {
      */
     cwd?: string;
 }): GateOutcome;
+/**
+ * Path-scope-only re-review for a SELF-REPORTED (out-of-process) worker's claimed `changedFiles`
+ * -- e.g. a tmux worker's own completion report, which (unlike an in-process worker's) never
+ * passed through this process's `applyWorkerActions` envelope enforcement before the write
+ * happened; the tmux worker's tool loop runs in a separate process this session does not gate.
+ * Reuses {@link validateWorkerResult}'s exact symlink-safe scope check verbatim -- never
+ * reimplement path resolution: synthesizes a minimal, always-"completed" request/result pair
+ * carrying only the reported `changedFiles` and the scope's `allowedPaths`/`deniedPaths`, so the
+ * ONLY thing that can vary the verdict is the path-scope branch.
+ *
+ * Deliberately broader than {@link isParentReviewRequired}: that helper only flags the gate's
+ * "ask-user" branch, which is correct for an in-process worker (a write that would have been
+ * "block"-worthy was already refused before it could happen, by the SAME envelope, via
+ * `applyWorkerActions`). A self-reported claim has no such backstop -- an out-of-scope or denied
+ * path already happened on the real filesystem whether or not this gate would allow it, so here
+ * ANY non-"allow" verdict (in scope, out of scope, or no scope configured at all) means a human
+ * must look, not "the write didn't happen".
+ */
+export declare function reviewManagedLaneChangedFiles(args: {
+    changedFiles: readonly string[];
+    /** The scope to validate against -- e.g. the session's active `CapabilityEnvelope`, until a
+     * per-launch tmux standing grant envelope lands in a later wave (documented follow-up). */
+    envelope: Pick<CapabilityEnvelope, "allowedPaths" | "deniedPaths">;
+    cwd?: string;
+}): {
+    reviewRequired: boolean;
+    reasonCode: string;
+};
 //# sourceMappingURL=worker-result.d.ts.map

package/dist/core/delegation/worker-result.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker-result.d.ts","sourceRoot":"","sources":["../../../src/core/delegation/worker-result.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAIzF,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAQ9E;AAQD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CA4BpE;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAWlE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IAC1C,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,WAAW,CAmHd","sourcesContent":["import path from \"node:path\";\nimport type { GateOutcome, WorkerRequest, WorkerResult } from \"../autonomy/contracts.ts\";\nimport { checkPathScope } from \"../autonomy/path-scope.ts\";\nimport { cloneEvidenceBundleForStorage, isEvidenceBundle } from \"../research/evidence-bundle.ts\";\n\nexport function cloneWorkerResultForStorage(result: WorkerResult): WorkerResult {\n\treturn {\n\t\t...result,\n\t\t...(result.outputFormat ? { outputFormat: result.outputFormat } : {}),\n\t\tchangedFiles: [...result.changedFiles],\n\t\tblockers: result.blockers ? [...result.blockers] : undefined,\n\t\tevidence: result.evidence ? cloneEvidenceBundleForStorage(result.evidence) : undefined,\n\t};\n}\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) return false;\n\tconst prototype = Object.getPrototypeOf(value);\n\treturn prototype === Object.prototype || prototype === null;\n}\n\nexport function isWorkerResult(value: unknown): value is WorkerResult {\n\tif (!isPlainRecord(value)) return false;\n\tconst obj = value as Record<string, unknown>;\n\n\tif (typeof obj.requestId !== \"string\") return false;\n\tif (typeof obj.status !== \"string\" || ![\"completed\", \"blocked\", \"failed\", \"cancelled\"].includes(obj.status)) {\n\t\treturn false;\n\t}\n\tif (typeof obj.summary !== \"string\") return false;\n\tif (obj.outputFormat !== undefined && obj.outputFormat !== \"structured\" && obj.outputFormat !== \"plain_text\")\n\t\treturn false;\n\n\tif (!Array.isArray(obj.changedFiles) || !obj.changedFiles.every((f) => typeof f === \"string\")) {\n\t\treturn false;\n\t}\n\n\tif (obj.blockers !== undefined) {\n\t\tif (!Array.isArray(obj.blockers) || !obj.blockers.every((b) => typeof b === \"string\")) {\n\t\t\treturn false;\n\t\t}\n\t}\n\n\tif (obj.usageReportId !== undefined && typeof obj.usageReportId !== \"string\") return false;\n\tif (obj.createdAt !== undefined && typeof obj.createdAt !== \"string\") return false;\n\n\tif (obj.evidence !== undefined && !isEvidenceBundle(obj.evidence)) return false;\n\n\treturn true;\n}\n\nexport function requiresParentReview(result: WorkerResult): boolean {\n\tif (result.status !== \"completed\") {\n\t\treturn true;\n\t}\n\tif (result.blockers && result.blockers.length > 0) {\n\t\treturn true;\n\t}\n\tif (result.changedFiles.length > 0) {\n\t\treturn true;\n\t}\n\treturn false;\n}\n\nexport function validateWorkerResult(args: {\n\trequest: WorkerRequest;\n\tresult: WorkerResult;\n\t/**\n\t * Baseline for relative paths — BOTH the runner's cwd-relative `changedFiles` and the\n\t * envelope's possibly-relative path scopes resolve against this. Defaults to process.cwd()\n\t * for callers whose session cwd is the process cwd.\n\t */\n\tcwd?: string;\n}): GateOutcome {\n\tconst { request, result } = args;\n\tconst baseDir = args.cwd ?? process.cwd();\n\n\tif (result.requestId !== request.id) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"request_id_mismatch\",\n\t\t\tmessage: `Result requestId '${result.requestId}' does not match request id '${request.id}'.`,\n\t\t};\n\t}\n\n\tif (result.status !== \"completed\") {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"worker_not_completed\",\n\t\t\tmessage: `Worker finished with status '${result.status}'.`,\n\t\t\tdetails: result.blockers && result.blockers.length > 0 ? { blockers: [...result.blockers] } : undefined,\n\t\t};\n\t}\n\n\tif (!result.usageReportId) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"missing_usage_report\",\n\t\t\tmessage: \"Completed worker result is missing usageReportId.\",\n\t\t};\n\t}\n\n\tif (result.blockers && result.blockers.length > 0) {\n\t\treturn {\n\t\t\toutcome: \"ask-user\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"parent_review_required\",\n\t\t\tmessage: \"Completed worker result includes blockers and requires parent review.\",\n\t\t\tdetails: { blockers: [...result.blockers] },\n\t\t};\n\t}\n\n\tif (result.changedFiles.length > 0) {\n\t\tif (!request.envelope.allowedPaths || request.envelope.allowedPaths.length === 0) {\n\t\t\treturn {\n\t\t\t\toutcome: \"block\",\n\t\t\t\tgate: \"worker_result\",\n\t\t\t\treasonCode: \"missing_path_scope\",\n\t\t\t\tmessage: \"Worker changed files but no allowedPaths are configured in the envelope.\",\n\t\t\t};\n\t\t}\n\n\t\t// The runner reports changed files relative to the session cwd — resolve file and scope\n\t\t// roots against the SAME baseline. Resolving per-root double-prefixed nested names and\n\t\t// let a denied subtree slip past the deny rule.\n\t\tconst resolvedAllowed = request.envelope.allowedPaths.map((p) => path.resolve(baseDir, p));\n\t\tconst resolvedDenied = request.envelope.deniedPaths?.map((p) => path.resolve(baseDir, p));\n\t\tfor (const changedFile of result.changedFiles) {\n\t\t\tlet isInsideAny = false;\n\t\t\tlet isDenied = false;\n\n\t\t\tconst scopedChangedFile = path.resolve(baseDir, changedFile);\n\t\t\tfor (const root of resolvedAllowed) {\n\t\t\t\tconst decision = checkPathScope(\n\t\t\t\t\t{\n\t\t\t\t\t\troot,\n\t\t\t\t\t\tallowedPaths: resolvedAllowed,\n\t\t\t\t\t\tdeniedPaths: resolvedDenied,\n\t\t\t\t\t},\n\t\t\t\t\tscopedChangedFile,\n\t\t\t\t);\n\n\t\t\t\tif (decision.kind === \"denied\") {\n\t\t\t\t\tisDenied = true;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t\tif (decision.kind === \"inside\") {\n\t\t\t\t\tisInsideAny = true;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (isDenied) {\n\t\t\t\treturn {\n\t\t\t\t\toutcome: \"block\",\n\t\t\t\t\tgate: \"worker_result\",\n\t\t\t\t\treasonCode: \"changed_file_denied\",\n\t\t\t\t\tmessage: `Worker changed file '${changedFile}' which matches a denied path.`,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (!isInsideAny) {\n\t\t\t\treturn {\n\t\t\t\t\toutcome: \"block\",\n\t\t\t\t\tgate: \"worker_result\",\n\t\t\t\t\treasonCode: \"changed_file_outside_scope\",\n\t\t\t\t\tmessage: `Worker changed file '${changedFile}' outside allowed scope.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Files are inside scope, but worker output is untrusted\n\t\treturn {\n\t\t\toutcome: \"ask-user\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"parent_review_required\",\n\t\t\tmessage: \"Worker changed files require parent review.\",\n\t\t};\n\t}\n\n\treturn {\n\t\toutcome: \"allow\",\n\t\tgate: \"worker_result\",\n\t\treasonCode: \"allowed\",\n\t\tmessage: \"Worker result is read-only and allowed.\",\n\t};\n}\n"]}
+{"version":3,"file":"worker-result.d.ts","sourceRoot":"","sources":["../../../src/core/delegation/worker-result.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAI7G,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAQ9E;AAQD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CA8BpE;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAWlE;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAGpH;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IAC1C,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,WAAW,CAmHd;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IACnD,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;+FAC2F;IAC3F,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,cAAc,GAAG,aAAa,CAAC,CAAC;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG;IAAE,cAAc,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAiClD","sourcesContent":["import path from \"node:path\";\nimport type { CapabilityEnvelope, GateOutcome, WorkerRequest, WorkerResult } from \"../autonomy/contracts.ts\";\nimport { checkPathScope } from \"../autonomy/path-scope.ts\";\nimport { cloneEvidenceBundleForStorage, isEvidenceBundle } from \"../research/evidence-bundle.ts\";\n\nexport function cloneWorkerResultForStorage(result: WorkerResult): WorkerResult {\n\treturn {\n\t\t...result,\n\t\t...(result.outputFormat ? { outputFormat: result.outputFormat } : {}),\n\t\tchangedFiles: [...result.changedFiles],\n\t\tblockers: result.blockers ? [...result.blockers] : undefined,\n\t\tevidence: result.evidence ? cloneEvidenceBundleForStorage(result.evidence) : undefined,\n\t};\n}\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) return false;\n\tconst prototype = Object.getPrototypeOf(value);\n\treturn prototype === Object.prototype || prototype === null;\n}\n\nexport function isWorkerResult(value: unknown): value is WorkerResult {\n\tif (!isPlainRecord(value)) return false;\n\tconst obj = value as Record<string, unknown>;\n\n\tif (typeof obj.requestId !== \"string\") return false;\n\tif (typeof obj.status !== \"string\" || ![\"completed\", \"blocked\", \"failed\", \"cancelled\"].includes(obj.status)) {\n\t\treturn false;\n\t}\n\tif (typeof obj.summary !== \"string\") return false;\n\tif (obj.outputFormat !== undefined && obj.outputFormat !== \"structured\" && obj.outputFormat !== \"plain_text\")\n\t\treturn false;\n\n\tif (!Array.isArray(obj.changedFiles) || !obj.changedFiles.every((f) => typeof f === \"string\")) {\n\t\treturn false;\n\t}\n\n\tif (obj.blockers !== undefined) {\n\t\tif (!Array.isArray(obj.blockers) || !obj.blockers.every((b) => typeof b === \"string\")) {\n\t\t\treturn false;\n\t\t}\n\t}\n\n\tif (obj.usageReportId !== undefined && typeof obj.usageReportId !== \"string\") return false;\n\tif (obj.createdAt !== undefined && typeof obj.createdAt !== \"string\") return false;\n\tif (obj.parentReviewRequired !== undefined && typeof obj.parentReviewRequired !== \"boolean\") return false;\n\tif (obj.parentReviewedAt !== undefined && typeof obj.parentReviewedAt !== \"string\") return false;\n\n\tif (obj.evidence !== undefined && !isEvidenceBundle(obj.evidence)) return false;\n\n\treturn true;\n}\n\nexport function requiresParentReview(result: WorkerResult): boolean {\n\tif (result.status !== \"completed\") {\n\t\treturn true;\n\t}\n\tif (result.blockers && result.blockers.length > 0) {\n\t\treturn true;\n\t}\n\tif (result.changedFiles.length > 0) {\n\t\treturn true;\n\t}\n\treturn false;\n}\n\n/**\n * True iff {@link validateWorkerResult}'s gate would flag this result \"ask-user\" /\n * \"parent_review_required\" (the two branches at :110 and :178 below) — an otherwise-completed\n * result the parent must explicitly look at because it reports blockers, or reports file mutations\n * that passed path-scope validation. Reuses `validateWorkerResult` itself rather than a\n * separately-maintained heuristic, so a persisted review marker can never drift from the\n * gate's actual verdict.\n */\nexport function isParentReviewRequired(args: { request: WorkerRequest; result: WorkerResult; cwd?: string }): boolean {\n\tconst acceptance = validateWorkerResult(args);\n\treturn acceptance.outcome === \"ask-user\" && acceptance.reasonCode === \"parent_review_required\";\n}\n\nexport function validateWorkerResult(args: {\n\trequest: WorkerRequest;\n\tresult: WorkerResult;\n\t/**\n\t * Baseline for relative paths — BOTH the runner's cwd-relative `changedFiles` and the\n\t * envelope's possibly-relative path scopes resolve against this. Defaults to process.cwd()\n\t * for callers whose session cwd is the process cwd.\n\t */\n\tcwd?: string;\n}): GateOutcome {\n\tconst { request, result } = args;\n\tconst baseDir = args.cwd ?? process.cwd();\n\n\tif (result.requestId !== request.id) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"request_id_mismatch\",\n\t\t\tmessage: `Result requestId '${result.requestId}' does not match request id '${request.id}'.`,\n\t\t};\n\t}\n\n\tif (result.status !== \"completed\") {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"worker_not_completed\",\n\t\t\tmessage: `Worker finished with status '${result.status}'.`,\n\t\t\tdetails: result.blockers && result.blockers.length > 0 ? { blockers: [...result.blockers] } : undefined,\n\t\t};\n\t}\n\n\tif (!result.usageReportId) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"missing_usage_report\",\n\t\t\tmessage: \"Completed worker result is missing usageReportId.\",\n\t\t};\n\t}\n\n\tif (result.blockers && result.blockers.length > 0) {\n\t\treturn {\n\t\t\toutcome: \"ask-user\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"parent_review_required\",\n\t\t\tmessage: \"Completed worker result includes blockers and requires parent review.\",\n\t\t\tdetails: { blockers: [...result.blockers] },\n\t\t};\n\t}\n\n\tif (result.changedFiles.length > 0) {\n\t\tif (!request.envelope.allowedPaths || request.envelope.allowedPaths.length === 0) {\n\t\t\treturn {\n\t\t\t\toutcome: \"block\",\n\t\t\t\tgate: \"worker_result\",\n\t\t\t\treasonCode: \"missing_path_scope\",\n\t\t\t\tmessage: \"Worker changed files but no allowedPaths are configured in the envelope.\",\n\t\t\t};\n\t\t}\n\n\t\t// The runner reports changed files relative to the session cwd — resolve file and scope\n\t\t// roots against the SAME baseline. Resolving per-root double-prefixed nested names and\n\t\t// let a denied subtree slip past the deny rule.\n\t\tconst resolvedAllowed = request.envelope.allowedPaths.map((p) => path.resolve(baseDir, p));\n\t\tconst resolvedDenied = request.envelope.deniedPaths?.map((p) => path.resolve(baseDir, p));\n\t\tfor (const changedFile of result.changedFiles) {\n\t\t\tlet isInsideAny = false;\n\t\t\tlet isDenied = false;\n\n\t\t\tconst scopedChangedFile = path.resolve(baseDir, changedFile);\n\t\t\tfor (const root of resolvedAllowed) {\n\t\t\t\tconst decision = checkPathScope(\n\t\t\t\t\t{\n\t\t\t\t\t\troot,\n\t\t\t\t\t\tallowedPaths: resolvedAllowed,\n\t\t\t\t\t\tdeniedPaths: resolvedDenied,\n\t\t\t\t\t},\n\t\t\t\t\tscopedChangedFile,\n\t\t\t\t);\n\n\t\t\t\tif (decision.kind === \"denied\") {\n\t\t\t\t\tisDenied = true;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t\tif (decision.kind === \"inside\") {\n\t\t\t\t\tisInsideAny = true;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (isDenied) {\n\t\t\t\treturn {\n\t\t\t\t\toutcome: \"block\",\n\t\t\t\t\tgate: \"worker_result\",\n\t\t\t\t\treasonCode: \"changed_file_denied\",\n\t\t\t\t\tmessage: `Worker changed file '${changedFile}' which matches a denied path.`,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (!isInsideAny) {\n\t\t\t\treturn {\n\t\t\t\t\toutcome: \"block\",\n\t\t\t\t\tgate: \"worker_result\",\n\t\t\t\t\treasonCode: \"changed_file_outside_scope\",\n\t\t\t\t\tmessage: `Worker changed file '${changedFile}' outside allowed scope.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Files are inside scope, but worker output is untrusted\n\t\treturn {\n\t\t\toutcome: \"ask-user\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"parent_review_required\",\n\t\t\tmessage: \"Worker changed files require parent review.\",\n\t\t};\n\t}\n\n\treturn {\n\t\toutcome: \"allow\",\n\t\tgate: \"worker_result\",\n\t\treasonCode: \"allowed\",\n\t\tmessage: \"Worker result is read-only and allowed.\",\n\t};\n}\n\n/**\n * Path-scope-only re-review for a SELF-REPORTED (out-of-process) worker's claimed `changedFiles`\n * -- e.g. a tmux worker's own completion report, which (unlike an in-process worker's) never\n * passed through this process's `applyWorkerActions` envelope enforcement before the write\n * happened; the tmux worker's tool loop runs in a separate process this session does not gate.\n * Reuses {@link validateWorkerResult}'s exact symlink-safe scope check verbatim -- never\n * reimplement path resolution: synthesizes a minimal, always-\"completed\" request/result pair\n * carrying only the reported `changedFiles` and the scope's `allowedPaths`/`deniedPaths`, so the\n * ONLY thing that can vary the verdict is the path-scope branch.\n *\n * Deliberately broader than {@link isParentReviewRequired}: that helper only flags the gate's\n * \"ask-user\" branch, which is correct for an in-process worker (a write that would have been\n * \"block\"-worthy was already refused before it could happen, by the SAME envelope, via\n * `applyWorkerActions`). A self-reported claim has no such backstop -- an out-of-scope or denied\n * path already happened on the real filesystem whether or not this gate would allow it, so here\n * ANY non-\"allow\" verdict (in scope, out of scope, or no scope configured at all) means a human\n * must look, not \"the write didn't happen\".\n */\nexport function reviewManagedLaneChangedFiles(args: {\n\tchangedFiles: readonly string[];\n\t/** The scope to validate against -- e.g. the session's active `CapabilityEnvelope`, until a\n\t * per-launch tmux standing grant envelope lands in a later wave (documented follow-up). */\n\tenvelope: Pick<CapabilityEnvelope, \"allowedPaths\" | \"deniedPaths\">;\n\tcwd?: string;\n}): { reviewRequired: boolean; reasonCode: string } {\n\tif (args.changedFiles.length === 0) {\n\t\treturn { reviewRequired: false, reasonCode: \"no_changed_files\" };\n\t}\n\tconst syntheticId = \"managed-lane-review\";\n\tconst acceptance = validateWorkerResult({\n\t\trequest: {\n\t\t\tid: syntheticId,\n\t\t\tinstructions: \"\",\n\t\t\troute: {\n\t\t\t\ttier: \"cheap\",\n\t\t\t\trisk: \"scoped-write\",\n\t\t\t\tconfidence: 1,\n\t\t\t\treasonCode: \"managed_lane_review\",\n\t\t\t\treasons: [],\n\t\t\t},\n\t\t\tenvelope: {\n\t\t\t\tid: syntheticId,\n\t\t\t\tcapabilities: [\"write_files\"],\n\t\t\t\tallowedPaths: args.envelope.allowedPaths,\n\t\t\t\tdeniedPaths: args.envelope.deniedPaths,\n\t\t\t},\n\t\t},\n\t\tresult: {\n\t\t\trequestId: syntheticId,\n\t\t\tstatus: \"completed\",\n\t\t\tsummary: \"\",\n\t\t\tchangedFiles: [...args.changedFiles],\n\t\t\tusageReportId: syntheticId,\n\t\t},\n\t\tcwd: args.cwd,\n\t});\n\treturn { reviewRequired: acceptance.outcome !== \"allow\", reasonCode: acceptance.reasonCode };\n}\n"]}

package/dist/core/delegation/worker-result.js

@@ -41,6 +41,10 @@ export function isWorkerResult(value) {
         return false;
     if (obj.createdAt !== undefined && typeof obj.createdAt !== "string")
         return false;
+    if (obj.parentReviewRequired !== undefined && typeof obj.parentReviewRequired !== "boolean")
+        return false;
+    if (obj.parentReviewedAt !== undefined && typeof obj.parentReviewedAt !== "string")
+        return false;
     if (obj.evidence !== undefined && !isEvidenceBundle(obj.evidence))
         return false;
     return true;
@@ -57,6 +61,18 @@ export function requiresParentReview(result) {
     }
     return false;
 }
+/**
+ * True iff {@link validateWorkerResult}'s gate would flag this result "ask-user" /
+ * "parent_review_required" (the two branches at :110 and :178 below) — an otherwise-completed
+ * result the parent must explicitly look at because it reports blockers, or reports file mutations
+ * that passed path-scope validation. Reuses `validateWorkerResult` itself rather than a
+ * separately-maintained heuristic, so a persisted review marker can never drift from the
+ * gate's actual verdict.
+ */
+export function isParentReviewRequired(args) {
+    const acceptance = validateWorkerResult(args);
+    return acceptance.outcome === "ask-user" && acceptance.reasonCode === "parent_review_required";
+}
 export function validateWorkerResult(args) {
     const { request, result } = args;
     const baseDir = args.cwd ?? process.cwd();
@@ -158,4 +174,56 @@ export function validateWorkerResult(args) {
         message: "Worker result is read-only and allowed.",
     };
 }
+/**
+ * Path-scope-only re-review for a SELF-REPORTED (out-of-process) worker's claimed `changedFiles`
+ * -- e.g. a tmux worker's own completion report, which (unlike an in-process worker's) never
+ * passed through this process's `applyWorkerActions` envelope enforcement before the write
+ * happened; the tmux worker's tool loop runs in a separate process this session does not gate.
+ * Reuses {@link validateWorkerResult}'s exact symlink-safe scope check verbatim -- never
+ * reimplement path resolution: synthesizes a minimal, always-"completed" request/result pair
+ * carrying only the reported `changedFiles` and the scope's `allowedPaths`/`deniedPaths`, so the
+ * ONLY thing that can vary the verdict is the path-scope branch.
+ *
+ * Deliberately broader than {@link isParentReviewRequired}: that helper only flags the gate's
+ * "ask-user" branch, which is correct for an in-process worker (a write that would have been
+ * "block"-worthy was already refused before it could happen, by the SAME envelope, via
+ * `applyWorkerActions`). A self-reported claim has no such backstop -- an out-of-scope or denied
+ * path already happened on the real filesystem whether or not this gate would allow it, so here
+ * ANY non-"allow" verdict (in scope, out of scope, or no scope configured at all) means a human
+ * must look, not "the write didn't happen".
+ */
+export function reviewManagedLaneChangedFiles(args) {
+    if (args.changedFiles.length === 0) {
+        return { reviewRequired: false, reasonCode: "no_changed_files" };
+    }
+    const syntheticId = "managed-lane-review";
+    const acceptance = validateWorkerResult({
+        request: {
+            id: syntheticId,
+            instructions: "",
+            route: {
+                tier: "cheap",
+                risk: "scoped-write",
+                confidence: 1,
+                reasonCode: "managed_lane_review",
+                reasons: [],
+            },
+            envelope: {
+                id: syntheticId,
+                capabilities: ["write_files"],
+                allowedPaths: args.envelope.allowedPaths,
+                deniedPaths: args.envelope.deniedPaths,
+            },
+        },
+        result: {
+            requestId: syntheticId,
+            status: "completed",
+            summary: "",
+            changedFiles: [...args.changedFiles],
+            usageReportId: syntheticId,
+        },
+        cwd: args.cwd,
+    });
+    return { reviewRequired: acceptance.outcome !== "allow", reasonCode: acceptance.reasonCode };
+}
 //# sourceMappingURL=worker-result.js.map

package/dist/core/delegation/worker-result.js.map

@@ -1 +1 @@
-{"version":3,"file":"worker-result.js","sourceRoot":"","sources":["../../../src/core/delegation/worker-result.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAEjG,MAAM,UAAU,2BAA2B,CAAC,MAAoB,EAAgB;IAC/E,OAAO;QACN,GAAG,MAAM;QACT,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;QACtC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5D,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,6BAA6B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KACtF,CAAC;AAAA,CACF;AAED,SAAS,aAAa,CAAC,KAAc,EAAoC;IACxE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAAA,CAC5D;AAED,MAAM,UAAU,cAAc,CAAC,KAAc,EAAyB;IACrE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,KAAgC,CAAC;IAE7C,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7G,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,KAAK,YAAY,IAAI,GAAG,CAAC,YAAY,KAAK,YAAY;QAC3G,OAAO,KAAK,CAAC;IAEd,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC/F,OAAO,KAAK,CAAC;IACd,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACvF,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IAED,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3F,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEnF,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAEhF,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAoB,EAAW;IACnE,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,MAAM,UAAU,oBAAoB,CAAC,IASpC,EAAe;IACf,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAE1C,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACrC,OAAO;YACN,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,qBAAqB,MAAM,CAAC,SAAS,gCAAgC,OAAO,CAAC,EAAE,IAAI;SAC5F,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO;YACN,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,sBAAsB;YAClC,OAAO,EAAE,gCAAgC,MAAM,CAAC,MAAM,IAAI;YAC1D,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;SACvG,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC3B,OAAO;YACN,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,sBAAsB;YAClC,OAAO,EAAE,mDAAmD;SAC5D,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO;YACN,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,wBAAwB;YACpC,OAAO,EAAE,uEAAuE;YAChF,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE;SAC3C,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClF,OAAO;gBACN,OAAO,EAAE,OAAO;gBAChB,IAAI,EAAE,eAAe;gBACrB,UAAU,EAAE,oBAAoB;gBAChC,OAAO,EAAE,0EAA0E;aACnF,CAAC;QACH,CAAC;QAED,0FAAwF;QACxF,uFAAuF;QACvF,gDAAgD;QAChD,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3F,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1F,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC/C,IAAI,WAAW,GAAG,KAAK,CAAC;YACxB,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC7D,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;gBACpC,MAAM,QAAQ,GAAG,cAAc,CAC9B;oBACC,IAAI;oBACJ,YAAY,EAAE,eAAe;oBAC7B,WAAW,EAAE,cAAc;iBAC3B,EACD,iBAAiB,CACjB,CAAC;gBAEF,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAChC,QAAQ,GAAG,IAAI,CAAC;oBAChB,MAAM;gBACP,CAAC;gBACD,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAChC,WAAW,GAAG,IAAI,CAAC;gBACpB,CAAC;YACF,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACN,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,eAAe;oBACrB,UAAU,EAAE,qBAAqB;oBACjC,OAAO,EAAE,wBAAwB,WAAW,gCAAgC;iBAC5E,CAAC;YACH,CAAC;YAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClB,OAAO;oBACN,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,eAAe;oBACrB,UAAU,EAAE,4BAA4B;oBACxC,OAAO,EAAE,wBAAwB,WAAW,0BAA0B;iBACtE,CAAC;YACH,CAAC;QACF,CAAC;QAED,yDAAyD;QACzD,OAAO;YACN,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,wBAAwB;YACpC,OAAO,EAAE,6CAA6C;SACtD,CAAC;IACH,CAAC;IAED,OAAO;QACN,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,yCAAyC;KAClD,CAAC;AAAA,CACF","sourcesContent":["import path from \"node:path\";\nimport type { GateOutcome, WorkerRequest, WorkerResult } from \"../autonomy/contracts.ts\";\nimport { checkPathScope } from \"../autonomy/path-scope.ts\";\nimport { cloneEvidenceBundleForStorage, isEvidenceBundle } from \"../research/evidence-bundle.ts\";\n\nexport function cloneWorkerResultForStorage(result: WorkerResult): WorkerResult {\n\treturn {\n\t\t...result,\n\t\t...(result.outputFormat ? { outputFormat: result.outputFormat } : {}),\n\t\tchangedFiles: [...result.changedFiles],\n\t\tblockers: result.blockers ? [...result.blockers] : undefined,\n\t\tevidence: result.evidence ? cloneEvidenceBundleForStorage(result.evidence) : undefined,\n\t};\n}\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) return false;\n\tconst prototype = Object.getPrototypeOf(value);\n\treturn prototype === Object.prototype || prototype === null;\n}\n\nexport function isWorkerResult(value: unknown): value is WorkerResult {\n\tif (!isPlainRecord(value)) return false;\n\tconst obj = value as Record<string, unknown>;\n\n\tif (typeof obj.requestId !== \"string\") return false;\n\tif (typeof obj.status !== \"string\" || ![\"completed\", \"blocked\", \"failed\", \"cancelled\"].includes(obj.status)) {\n\t\treturn false;\n\t}\n\tif (typeof obj.summary !== \"string\") return false;\n\tif (obj.outputFormat !== undefined && obj.outputFormat !== \"structured\" && obj.outputFormat !== \"plain_text\")\n\t\treturn false;\n\n\tif (!Array.isArray(obj.changedFiles) || !obj.changedFiles.every((f) => typeof f === \"string\")) {\n\t\treturn false;\n\t}\n\n\tif (obj.blockers !== undefined) {\n\t\tif (!Array.isArray(obj.blockers) || !obj.blockers.every((b) => typeof b === \"string\")) {\n\t\t\treturn false;\n\t\t}\n\t}\n\n\tif (obj.usageReportId !== undefined && typeof obj.usageReportId !== \"string\") return false;\n\tif (obj.createdAt !== undefined && typeof obj.createdAt !== \"string\") return false;\n\n\tif (obj.evidence !== undefined && !isEvidenceBundle(obj.evidence)) return false;\n\n\treturn true;\n}\n\nexport function requiresParentReview(result: WorkerResult): boolean {\n\tif (result.status !== \"completed\") {\n\t\treturn true;\n\t}\n\tif (result.blockers && result.blockers.length > 0) {\n\t\treturn true;\n\t}\n\tif (result.changedFiles.length > 0) {\n\t\treturn true;\n\t}\n\treturn false;\n}\n\nexport function validateWorkerResult(args: {\n\trequest: WorkerRequest;\n\tresult: WorkerResult;\n\t/**\n\t * Baseline for relative paths — BOTH the runner's cwd-relative `changedFiles` and the\n\t * envelope's possibly-relative path scopes resolve against this. Defaults to process.cwd()\n\t * for callers whose session cwd is the process cwd.\n\t */\n\tcwd?: string;\n}): GateOutcome {\n\tconst { request, result } = args;\n\tconst baseDir = args.cwd ?? process.cwd();\n\n\tif (result.requestId !== request.id) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"request_id_mismatch\",\n\t\t\tmessage: `Result requestId '${result.requestId}' does not match request id '${request.id}'.`,\n\t\t};\n\t}\n\n\tif (result.status !== \"completed\") {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"worker_not_completed\",\n\t\t\tmessage: `Worker finished with status '${result.status}'.`,\n\t\t\tdetails: result.blockers && result.blockers.length > 0 ? { blockers: [...result.blockers] } : undefined,\n\t\t};\n\t}\n\n\tif (!result.usageReportId) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"missing_usage_report\",\n\t\t\tmessage: \"Completed worker result is missing usageReportId.\",\n\t\t};\n\t}\n\n\tif (result.blockers && result.blockers.length > 0) {\n\t\treturn {\n\t\t\toutcome: \"ask-user\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"parent_review_required\",\n\t\t\tmessage: \"Completed worker result includes blockers and requires parent review.\",\n\t\t\tdetails: { blockers: [...result.blockers] },\n\t\t};\n\t}\n\n\tif (result.changedFiles.length > 0) {\n\t\tif (!request.envelope.allowedPaths || request.envelope.allowedPaths.length === 0) {\n\t\t\treturn {\n\t\t\t\toutcome: \"block\",\n\t\t\t\tgate: \"worker_result\",\n\t\t\t\treasonCode: \"missing_path_scope\",\n\t\t\t\tmessage: \"Worker changed files but no allowedPaths are configured in the envelope.\",\n\t\t\t};\n\t\t}\n\n\t\t// The runner reports changed files relative to the session cwd — resolve file and scope\n\t\t// roots against the SAME baseline. Resolving per-root double-prefixed nested names and\n\t\t// let a denied subtree slip past the deny rule.\n\t\tconst resolvedAllowed = request.envelope.allowedPaths.map((p) => path.resolve(baseDir, p));\n\t\tconst resolvedDenied = request.envelope.deniedPaths?.map((p) => path.resolve(baseDir, p));\n\t\tfor (const changedFile of result.changedFiles) {\n\t\t\tlet isInsideAny = false;\n\t\t\tlet isDenied = false;\n\n\t\t\tconst scopedChangedFile = path.resolve(baseDir, changedFile);\n\t\t\tfor (const root of resolvedAllowed) {\n\t\t\t\tconst decision = checkPathScope(\n\t\t\t\t\t{\n\t\t\t\t\t\troot,\n\t\t\t\t\t\tallowedPaths: resolvedAllowed,\n\t\t\t\t\t\tdeniedPaths: resolvedDenied,\n\t\t\t\t\t},\n\t\t\t\t\tscopedChangedFile,\n\t\t\t\t);\n\n\t\t\t\tif (decision.kind === \"denied\") {\n\t\t\t\t\tisDenied = true;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t\tif (decision.kind === \"inside\") {\n\t\t\t\t\tisInsideAny = true;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (isDenied) {\n\t\t\t\treturn {\n\t\t\t\t\toutcome: \"block\",\n\t\t\t\t\tgate: \"worker_result\",\n\t\t\t\t\treasonCode: \"changed_file_denied\",\n\t\t\t\t\tmessage: `Worker changed file '${changedFile}' which matches a denied path.`,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (!isInsideAny) {\n\t\t\t\treturn {\n\t\t\t\t\toutcome: \"block\",\n\t\t\t\t\tgate: \"worker_result\",\n\t\t\t\t\treasonCode: \"changed_file_outside_scope\",\n\t\t\t\t\tmessage: `Worker changed file '${changedFile}' outside allowed scope.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Files are inside scope, but worker output is untrusted\n\t\treturn {\n\t\t\toutcome: \"ask-user\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"parent_review_required\",\n\t\t\tmessage: \"Worker changed files require parent review.\",\n\t\t};\n\t}\n\n\treturn {\n\t\toutcome: \"allow\",\n\t\tgate: \"worker_result\",\n\t\treasonCode: \"allowed\",\n\t\tmessage: \"Worker result is read-only and allowed.\",\n\t};\n}\n"]}
+{"version":3,"file":"worker-result.js","sourceRoot":"","sources":["../../../src/core/delegation/worker-result.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAEjG,MAAM,UAAU,2BAA2B,CAAC,MAAoB,EAAgB;IAC/E,OAAO;QACN,GAAG,MAAM;QACT,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;QACtC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5D,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,6BAA6B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KACtF,CAAC;AAAA,CACF;AAED,SAAS,aAAa,CAAC,KAAc,EAAoC;IACxE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAAA,CAC5D;AAED,MAAM,UAAU,cAAc,CAAC,KAAc,EAAyB;IACrE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,KAAgC,CAAC;IAE7C,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7G,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,KAAK,YAAY,IAAI,GAAG,CAAC,YAAY,KAAK,YAAY;QAC3G,OAAO,KAAK,CAAC;IAEd,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC/F,OAAO,KAAK,CAAC;IACd,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACvF,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IAED,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3F,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,GAAG,CAAC,oBAAoB,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,oBAAoB,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1G,IAAI,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEjG,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAEhF,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAoB,EAAW;IACnE,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAoE,EAAW;IACrH,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,UAAU,CAAC,OAAO,KAAK,UAAU,IAAI,UAAU,CAAC,UAAU,KAAK,wBAAwB,CAAC;AAAA,CAC/F;AAED,MAAM,UAAU,oBAAoB,CAAC,IASpC,EAAe;IACf,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAE1C,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACrC,OAAO;YACN,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,qBAAqB,MAAM,CAAC,SAAS,gCAAgC,OAAO,CAAC,EAAE,IAAI;SAC5F,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO;YACN,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,sBAAsB;YAClC,OAAO,EAAE,gCAAgC,MAAM,CAAC,MAAM,IAAI;YAC1D,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;SACvG,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC3B,OAAO;YACN,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,sBAAsB;YAClC,OAAO,EAAE,mDAAmD;SAC5D,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO;YACN,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,wBAAwB;YACpC,OAAO,EAAE,uEAAuE;YAChF,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE;SAC3C,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClF,OAAO;gBACN,OAAO,EAAE,OAAO;gBAChB,IAAI,EAAE,eAAe;gBACrB,UAAU,EAAE,oBAAoB;gBAChC,OAAO,EAAE,0EAA0E;aACnF,CAAC;QACH,CAAC;QAED,0FAAwF;QACxF,uFAAuF;QACvF,gDAAgD;QAChD,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3F,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1F,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC/C,IAAI,WAAW,GAAG,KAAK,CAAC;YACxB,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC7D,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;gBACpC,MAAM,QAAQ,GAAG,cAAc,CAC9B;oBACC,IAAI;oBACJ,YAAY,EAAE,eAAe;oBAC7B,WAAW,EAAE,cAAc;iBAC3B,EACD,iBAAiB,CACjB,CAAC;gBAEF,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAChC,QAAQ,GAAG,IAAI,CAAC;oBAChB,MAAM;gBACP,CAAC;gBACD,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAChC,WAAW,GAAG,IAAI,CAAC;gBACpB,CAAC;YACF,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACN,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,eAAe;oBACrB,UAAU,EAAE,qBAAqB;oBACjC,OAAO,EAAE,wBAAwB,WAAW,gCAAgC;iBAC5E,CAAC;YACH,CAAC;YAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClB,OAAO;oBACN,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,eAAe;oBACrB,UAAU,EAAE,4BAA4B;oBACxC,OAAO,EAAE,wBAAwB,WAAW,0BAA0B;iBACtE,CAAC;YACH,CAAC;QACF,CAAC;QAED,yDAAyD;QACzD,OAAO;YACN,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,wBAAwB;YACpC,OAAO,EAAE,6CAA6C;SACtD,CAAC;IACH,CAAC;IAED,OAAO;QACN,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,yCAAyC;KAClD,CAAC;AAAA,CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAM7C,EAAmD;IACnD,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,WAAW,GAAG,qBAAqB,CAAC;IAC1C,MAAM,UAAU,GAAG,oBAAoB,CAAC;QACvC,OAAO,EAAE;YACR,EAAE,EAAE,WAAW;YACf,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE;gBACN,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,cAAc;gBACpB,UAAU,EAAE,CAAC;gBACb,UAAU,EAAE,qBAAqB;gBACjC,OAAO,EAAE,EAAE;aACX;YACD,QAAQ,EAAE;gBACT,EAAE,EAAE,WAAW;gBACf,YAAY,EAAE,CAAC,aAAa,CAAC;gBAC7B,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY;gBACxC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;aACtC;SACD;QACD,MAAM,EAAE;YACP,SAAS,EAAE,WAAW;YACtB,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,EAAE;YACX,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;YACpC,aAAa,EAAE,WAAW;SAC1B;QACD,GAAG,EAAE,IAAI,CAAC,GAAG;KACb,CAAC,CAAC;IACH,OAAO,EAAE,cAAc,EAAE,UAAU,CAAC,OAAO,KAAK,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC;AAAA,CAC7F","sourcesContent":["import path from \"node:path\";\nimport type { CapabilityEnvelope, GateOutcome, WorkerRequest, WorkerResult } from \"../autonomy/contracts.ts\";\nimport { checkPathScope } from \"../autonomy/path-scope.ts\";\nimport { cloneEvidenceBundleForStorage, isEvidenceBundle } from \"../research/evidence-bundle.ts\";\n\nexport function cloneWorkerResultForStorage(result: WorkerResult): WorkerResult {\n\treturn {\n\t\t...result,\n\t\t...(result.outputFormat ? { outputFormat: result.outputFormat } : {}),\n\t\tchangedFiles: [...result.changedFiles],\n\t\tblockers: result.blockers ? [...result.blockers] : undefined,\n\t\tevidence: result.evidence ? cloneEvidenceBundleForStorage(result.evidence) : undefined,\n\t};\n}\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) return false;\n\tconst prototype = Object.getPrototypeOf(value);\n\treturn prototype === Object.prototype || prototype === null;\n}\n\nexport function isWorkerResult(value: unknown): value is WorkerResult {\n\tif (!isPlainRecord(value)) return false;\n\tconst obj = value as Record<string, unknown>;\n\n\tif (typeof obj.requestId !== \"string\") return false;\n\tif (typeof obj.status !== \"string\" || ![\"completed\", \"blocked\", \"failed\", \"cancelled\"].includes(obj.status)) {\n\t\treturn false;\n\t}\n\tif (typeof obj.summary !== \"string\") return false;\n\tif (obj.outputFormat !== undefined && obj.outputFormat !== \"structured\" && obj.outputFormat !== \"plain_text\")\n\t\treturn false;\n\n\tif (!Array.isArray(obj.changedFiles) || !obj.changedFiles.every((f) => typeof f === \"string\")) {\n\t\treturn false;\n\t}\n\n\tif (obj.blockers !== undefined) {\n\t\tif (!Array.isArray(obj.blockers) || !obj.blockers.every((b) => typeof b === \"string\")) {\n\t\t\treturn false;\n\t\t}\n\t}\n\n\tif (obj.usageReportId !== undefined && typeof obj.usageReportId !== \"string\") return false;\n\tif (obj.createdAt !== undefined && typeof obj.createdAt !== \"string\") return false;\n\tif (obj.parentReviewRequired !== undefined && typeof obj.parentReviewRequired !== \"boolean\") return false;\n\tif (obj.parentReviewedAt !== undefined && typeof obj.parentReviewedAt !== \"string\") return false;\n\n\tif (obj.evidence !== undefined && !isEvidenceBundle(obj.evidence)) return false;\n\n\treturn true;\n}\n\nexport function requiresParentReview(result: WorkerResult): boolean {\n\tif (result.status !== \"completed\") {\n\t\treturn true;\n\t}\n\tif (result.blockers && result.blockers.length > 0) {\n\t\treturn true;\n\t}\n\tif (result.changedFiles.length > 0) {\n\t\treturn true;\n\t}\n\treturn false;\n}\n\n/**\n * True iff {@link validateWorkerResult}'s gate would flag this result \"ask-user\" /\n * \"parent_review_required\" (the two branches at :110 and :178 below) — an otherwise-completed\n * result the parent must explicitly look at because it reports blockers, or reports file mutations\n * that passed path-scope validation. Reuses `validateWorkerResult` itself rather than a\n * separately-maintained heuristic, so a persisted review marker can never drift from the\n * gate's actual verdict.\n */\nexport function isParentReviewRequired(args: { request: WorkerRequest; result: WorkerResult; cwd?: string }): boolean {\n\tconst acceptance = validateWorkerResult(args);\n\treturn acceptance.outcome === \"ask-user\" && acceptance.reasonCode === \"parent_review_required\";\n}\n\nexport function validateWorkerResult(args: {\n\trequest: WorkerRequest;\n\tresult: WorkerResult;\n\t/**\n\t * Baseline for relative paths — BOTH the runner's cwd-relative `changedFiles` and the\n\t * envelope's possibly-relative path scopes resolve against this. Defaults to process.cwd()\n\t * for callers whose session cwd is the process cwd.\n\t */\n\tcwd?: string;\n}): GateOutcome {\n\tconst { request, result } = args;\n\tconst baseDir = args.cwd ?? process.cwd();\n\n\tif (result.requestId !== request.id) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"request_id_mismatch\",\n\t\t\tmessage: `Result requestId '${result.requestId}' does not match request id '${request.id}'.`,\n\t\t};\n\t}\n\n\tif (result.status !== \"completed\") {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"worker_not_completed\",\n\t\t\tmessage: `Worker finished with status '${result.status}'.`,\n\t\t\tdetails: result.blockers && result.blockers.length > 0 ? { blockers: [...result.blockers] } : undefined,\n\t\t};\n\t}\n\n\tif (!result.usageReportId) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"missing_usage_report\",\n\t\t\tmessage: \"Completed worker result is missing usageReportId.\",\n\t\t};\n\t}\n\n\tif (result.blockers && result.blockers.length > 0) {\n\t\treturn {\n\t\t\toutcome: \"ask-user\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"parent_review_required\",\n\t\t\tmessage: \"Completed worker result includes blockers and requires parent review.\",\n\t\t\tdetails: { blockers: [...result.blockers] },\n\t\t};\n\t}\n\n\tif (result.changedFiles.length > 0) {\n\t\tif (!request.envelope.allowedPaths || request.envelope.allowedPaths.length === 0) {\n\t\t\treturn {\n\t\t\t\toutcome: \"block\",\n\t\t\t\tgate: \"worker_result\",\n\t\t\t\treasonCode: \"missing_path_scope\",\n\t\t\t\tmessage: \"Worker changed files but no allowedPaths are configured in the envelope.\",\n\t\t\t};\n\t\t}\n\n\t\t// The runner reports changed files relative to the session cwd — resolve file and scope\n\t\t// roots against the SAME baseline. Resolving per-root double-prefixed nested names and\n\t\t// let a denied subtree slip past the deny rule.\n\t\tconst resolvedAllowed = request.envelope.allowedPaths.map((p) => path.resolve(baseDir, p));\n\t\tconst resolvedDenied = request.envelope.deniedPaths?.map((p) => path.resolve(baseDir, p));\n\t\tfor (const changedFile of result.changedFiles) {\n\t\t\tlet isInsideAny = false;\n\t\t\tlet isDenied = false;\n\n\t\t\tconst scopedChangedFile = path.resolve(baseDir, changedFile);\n\t\t\tfor (const root of resolvedAllowed) {\n\t\t\t\tconst decision = checkPathScope(\n\t\t\t\t\t{\n\t\t\t\t\t\troot,\n\t\t\t\t\t\tallowedPaths: resolvedAllowed,\n\t\t\t\t\t\tdeniedPaths: resolvedDenied,\n\t\t\t\t\t},\n\t\t\t\t\tscopedChangedFile,\n\t\t\t\t);\n\n\t\t\t\tif (decision.kind === \"denied\") {\n\t\t\t\t\tisDenied = true;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t\tif (decision.kind === \"inside\") {\n\t\t\t\t\tisInsideAny = true;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (isDenied) {\n\t\t\t\treturn {\n\t\t\t\t\toutcome: \"block\",\n\t\t\t\t\tgate: \"worker_result\",\n\t\t\t\t\treasonCode: \"changed_file_denied\",\n\t\t\t\t\tmessage: `Worker changed file '${changedFile}' which matches a denied path.`,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (!isInsideAny) {\n\t\t\t\treturn {\n\t\t\t\t\toutcome: \"block\",\n\t\t\t\t\tgate: \"worker_result\",\n\t\t\t\t\treasonCode: \"changed_file_outside_scope\",\n\t\t\t\t\tmessage: `Worker changed file '${changedFile}' outside allowed scope.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Files are inside scope, but worker output is untrusted\n\t\treturn {\n\t\t\toutcome: \"ask-user\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"parent_review_required\",\n\t\t\tmessage: \"Worker changed files require parent review.\",\n\t\t};\n\t}\n\n\treturn {\n\t\toutcome: \"allow\",\n\t\tgate: \"worker_result\",\n\t\treasonCode: \"allowed\",\n\t\tmessage: \"Worker result is read-only and allowed.\",\n\t};\n}\n\n/**\n * Path-scope-only re-review for a SELF-REPORTED (out-of-process) worker's claimed `changedFiles`\n * -- e.g. a tmux worker's own completion report, which (unlike an in-process worker's) never\n * passed through this process's `applyWorkerActions` envelope enforcement before the write\n * happened; the tmux worker's tool loop runs in a separate process this session does not gate.\n * Reuses {@link validateWorkerResult}'s exact symlink-safe scope check verbatim -- never\n * reimplement path resolution: synthesizes a minimal, always-\"completed\" request/result pair\n * carrying only the reported `changedFiles` and the scope's `allowedPaths`/`deniedPaths`, so the\n * ONLY thing that can vary the verdict is the path-scope branch.\n *\n * Deliberately broader than {@link isParentReviewRequired}: that helper only flags the gate's\n * \"ask-user\" branch, which is correct for an in-process worker (a write that would have been\n * \"block\"-worthy was already refused before it could happen, by the SAME envelope, via\n * `applyWorkerActions`). A self-reported claim has no such backstop -- an out-of-scope or denied\n * path already happened on the real filesystem whether or not this gate would allow it, so here\n * ANY non-\"allow\" verdict (in scope, out of scope, or no scope configured at all) means a human\n * must look, not \"the write didn't happen\".\n */\nexport function reviewManagedLaneChangedFiles(args: {\n\tchangedFiles: readonly string[];\n\t/** The scope to validate against -- e.g. the session's active `CapabilityEnvelope`, until a\n\t * per-launch tmux standing grant envelope lands in a later wave (documented follow-up). */\n\tenvelope: Pick<CapabilityEnvelope, \"allowedPaths\" | \"deniedPaths\">;\n\tcwd?: string;\n}): { reviewRequired: boolean; reasonCode: string } {\n\tif (args.changedFiles.length === 0) {\n\t\treturn { reviewRequired: false, reasonCode: \"no_changed_files\" };\n\t}\n\tconst syntheticId = \"managed-lane-review\";\n\tconst acceptance = validateWorkerResult({\n\t\trequest: {\n\t\t\tid: syntheticId,\n\t\t\tinstructions: \"\",\n\t\t\troute: {\n\t\t\t\ttier: \"cheap\",\n\t\t\t\trisk: \"scoped-write\",\n\t\t\t\tconfidence: 1,\n\t\t\t\treasonCode: \"managed_lane_review\",\n\t\t\t\treasons: [],\n\t\t\t},\n\t\t\tenvelope: {\n\t\t\t\tid: syntheticId,\n\t\t\t\tcapabilities: [\"write_files\"],\n\t\t\t\tallowedPaths: args.envelope.allowedPaths,\n\t\t\t\tdeniedPaths: args.envelope.deniedPaths,\n\t\t\t},\n\t\t},\n\t\tresult: {\n\t\t\trequestId: syntheticId,\n\t\t\tstatus: \"completed\",\n\t\t\tsummary: \"\",\n\t\t\tchangedFiles: [...args.changedFiles],\n\t\t\tusageReportId: syntheticId,\n\t\t},\n\t\tcwd: args.cwd,\n\t});\n\treturn { reviewRequired: acceptance.outcome !== \"allow\", reasonCode: acceptance.reasonCode };\n}\n"]}