@caupulican/pi-adaptative 0.81.39 → 0.81.41

package/dist/core/delegation/session-worker-result.js

@@ -1,113 +0,0 @@
-import { cloneWorkerResultForStorage, isParentReviewRequired, isWorkerResult } from "./worker-result.js";
-export const WORKER_RESULT_CUSTOM_TYPE = "worker_result";
-export function appendWorkerResultSnapshot(sessionManager, result, request, 
-/** Baseline for relative changedFiles when re-deriving the review marker; forwarded to
- * `isParentReviewRequired`/`validateWorkerResult`. Defaults to `process.cwd()`, matching the
- * validator's own documented default for single-cwd-per-process callers. */
-options) {
-    const stored = cloneWorkerResultForStorage(result);
-    // Stamp the parent-review marker here by re-running the SAME gate
-    // (validateWorkerResult, via isParentReviewRequired) that originally decided
-    // ask-user/parent_review_required, so the marker can never drift from the gate's own verdict.
-    // Only computable when `request` is available; callers that omit it (legacy callers) leave the
-    // field unset — "unknown", never falsely "false".
-    if (request) {
-        stored.parentReviewRequired = isParentReviewRequired({ request, result, cwd: options?.cwd });
-    }
-    const payload = {
-        version: 1,
-        result: stored,
-        ...(request ? { request: structuredClone(request) } : {}),
-    };
-    return sessionManager.appendCustomEntry(WORKER_RESULT_CUSTOM_TYPE, payload);
-}
-/** Requests persisted alongside results (absent for entries recorded before this field existed). */
-export function getWorkerRequestSnapshots(entries) {
-    const requests = [];
-    for (const entry of entries) {
-        if (entry.type !== "custom" || entry.customType !== WORKER_RESULT_CUSTOM_TYPE)
-            continue;
-        const payload = entry.data;
-        if (!isPlainRecord(payload) || payload.version !== 1)
-            continue;
-        const request = payload.request;
-        if (isPlainRecord(request) && typeof request.id === "string") {
-            requests.push(structuredClone(request));
-        }
-    }
-    return requests;
-}
-function isPlainRecord(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        return false;
-    const prototype = Object.getPrototypeOf(value);
-    return prototype === Object.prototype || prototype === null;
-}
-export function getWorkerResultSnapshots(entries) {
-    const results = [];
-    for (const entry of entries) {
-        if (entry.type !== "custom" || entry.customType !== WORKER_RESULT_CUSTOM_TYPE) {
-            continue;
-        }
-        const payload = entry.data;
-        if (!isPlainRecord(payload))
-            continue;
-        if (payload.version !== 1)
-            continue;
-        if (!("result" in payload))
-            continue;
-        const result = payload.result;
-        if (isWorkerResult(result)) {
-            results.push(cloneWorkerResultForStorage(result));
-        }
-    }
-    return results;
-}
-/**
- * Latest persisted snapshot (result + originating request, when available) for one worker
- * requestId — "latest wins" over the append-only entries, the same collapse `delegate_status`
- * already performs when it maps results by requestId. Used to read, and durably update, the
- * parent-review marker.
- */
-export function getLatestWorkerResultSnapshot(entries, requestId) {
-    let latest;
-    for (const entry of entries) {
-        if (entry.type !== "custom" || entry.customType !== WORKER_RESULT_CUSTOM_TYPE)
-            continue;
-        const payload = entry.data;
-        if (!isPlainRecord(payload) || payload.version !== 1 || !("result" in payload))
-            continue;
-        const result = payload.result;
-        if (!isWorkerResult(result) || result.requestId !== requestId)
-            continue;
-        const request = payload.request;
-        latest = {
-            version: 1,
-            result: cloneWorkerResultForStorage(result),
-            ...(isPlainRecord(request) && typeof request.id === "string"
-                ? { request: structuredClone(request) }
-                : {}),
-        };
-    }
-    return latest;
-}
-/**
- * Durably acknowledge an unreviewed worker mutation. Re-appends the latest snapshot for
- * `requestId` with `parentReviewedAt` set, so the ack is a first-class entry in the same
- * append-only audit trail as the original result — it survives reload and any future re-read of
- * `getWorkerResultSnapshots`/`getLatestWorkerResultSnapshot` (both are "latest wins"). Never
- * write-blocking: this only marks the mutation reviewed, it does not touch the worker's files.
- */
-export function acknowledgeWorkerResultReview(sessionManager, requestId, now = () => new Date().toISOString()) {
-    const latest = getLatestWorkerResultSnapshot(sessionManager.getEntries(), requestId);
-    if (!latest)
-        return { ok: false, reason: "unknown_worker_result" };
-    if (!latest.result.parentReviewRequired)
-        return { ok: false, reason: "not_flagged" };
-    if (latest.result.parentReviewedAt)
-        return { ok: false, reason: "already_reviewed" };
-    const reviewedAt = now();
-    appendWorkerResultSnapshot(sessionManager, { ...latest.result, parentReviewedAt: reviewedAt }, latest.request);
-    return { ok: true, requestId, reviewedAt };
-}
-//# sourceMappingURL=session-worker-result.js.map

package/dist/core/delegation/session-worker-result.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-worker-result.js","sourceRoot":"","sources":["../../../src/core/delegation/session-worker-result.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzG,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AAWzD,MAAM,UAAU,0BAA0B,CACzC,cAAyD,EACzD,MAAoB,EACpB,OAAuB;AACvB;;4EAE4E;AAC5E,OAA0B,EACjB;IACT,MAAM,MAAM,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACnD,kEAAkE;IAClE,6EAA6E;IAC7E,8FAA8F;IAC9F,+FAA+F;IAC/F,oDAAkD;IAClD,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,oBAAoB,GAAG,sBAAsB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,OAAO,GAAgC;QAC5C,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,MAAM;QACd,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;IACF,OAAO,cAAc,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;AAAA,CAC5E;AAED,oGAAoG;AACpG,MAAM,UAAU,yBAAyB,CAAC,OAAgC,EAAmB;IAC5F,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,yBAAyB;YAAE,SAAS;QACxF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;QAC3B,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC;YAAE,SAAS;QAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC9D,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAA6B,CAAC,CAAC;QACrE,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,SAAS,aAAa,CAAC,KAAc,EAAoC;IACxE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAAA,CAC5D;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAgC,EAAkB;IAC1F,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,yBAAyB,EAAE,CAAC;YAC/E,SAAS;QACV,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;QAC3B,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC;YAAE,SAAS;QACpC,IAAI,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC;YAAE,SAAS;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,CAAC;IACF,CAAC;IAED,OAAO,OAAO,CAAC;AAAA,CACf;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC5C,OAAgC,EAChC,SAAiB,EACyB;IAC1C,IAAI,MAA+C,CAAC;IACpD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,yBAAyB;YAAE,SAAS;QACxF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;QAC3B,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC;YAAE,SAAS;QACzF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;YAAE,SAAS;QACxE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,MAAM,GAAG;YACR,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,2BAA2B,CAAC,MAAM,CAAC;YAC3C,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ;gBAC3D,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAA6B,EAAE;gBACnE,CAAC,CAAC,EAAE,CAAC;SACN,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAQD;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAC5C,cAAwE,EACxE,SAAiB,EACjB,GAAG,GAAiB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAClB;IAChC,MAAM,MAAM,GAAG,6BAA6B,CAAC,cAAc,CAAC,UAAU,EAAE,EAAE,SAAS,CAAC,CAAC;IACrF,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACrF,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACrF,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC;IACzB,0BAA0B,CAAC,cAAc,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAAA,CAC3C","sourcesContent":["import type { SessionEntry, SessionManager } from \"@caupulican/pi-agent-core/node\";\nimport type { WorkerRequest, WorkerResult } from \"../autonomy/contracts.ts\";\nimport { cloneWorkerResultForStorage, isParentReviewRequired, isWorkerResult } from \"./worker-result.ts\";\n\nexport const WORKER_RESULT_CUSTOM_TYPE = \"worker_result\";\n\nexport interface WorkerResultSnapshotPayload {\n\tversion: 1;\n\tresult: WorkerResult;\n\t/** The originating request: persisted so a result is auditable against exactly what was\n\t * asked — instructions, route, and the capability envelope that bounded it. Optional for\n\t * backward compatibility with entries recorded before this field existed. */\n\trequest?: WorkerRequest;\n}\n\nexport function appendWorkerResultSnapshot(\n\tsessionManager: Pick<SessionManager, \"appendCustomEntry\">,\n\tresult: WorkerResult,\n\trequest?: WorkerRequest,\n\t/** Baseline for relative changedFiles when re-deriving the review marker; forwarded to\n\t * `isParentReviewRequired`/`validateWorkerResult`. Defaults to `process.cwd()`, matching the\n\t * validator's own documented default for single-cwd-per-process callers. */\n\toptions?: { cwd?: string },\n): string {\n\tconst stored = cloneWorkerResultForStorage(result);\n\t// Stamp the parent-review marker here by re-running the SAME gate\n\t// (validateWorkerResult, via isParentReviewRequired) that originally decided\n\t// ask-user/parent_review_required, so the marker can never drift from the gate's own verdict.\n\t// Only computable when `request` is available; callers that omit it (legacy callers) leave the\n\t// field unset — \"unknown\", never falsely \"false\".\n\tif (request) {\n\t\tstored.parentReviewRequired = isParentReviewRequired({ request, result, cwd: options?.cwd });\n\t}\n\tconst payload: WorkerResultSnapshotPayload = {\n\t\tversion: 1,\n\t\tresult: stored,\n\t\t...(request ? { request: structuredClone(request) } : {}),\n\t};\n\treturn sessionManager.appendCustomEntry(WORKER_RESULT_CUSTOM_TYPE, payload);\n}\n\n/** Requests persisted alongside results (absent for entries recorded before this field existed). */\nexport function getWorkerRequestSnapshots(entries: readonly SessionEntry[]): WorkerRequest[] {\n\tconst requests: WorkerRequest[] = [];\n\tfor (const entry of entries) {\n\t\tif (entry.type !== \"custom\" || entry.customType !== WORKER_RESULT_CUSTOM_TYPE) continue;\n\t\tconst payload = entry.data;\n\t\tif (!isPlainRecord(payload) || payload.version !== 1) continue;\n\t\tconst request = payload.request;\n\t\tif (isPlainRecord(request) && typeof request.id === \"string\") {\n\t\t\trequests.push(structuredClone(request) as unknown as WorkerRequest);\n\t\t}\n\t}\n\treturn requests;\n}\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) return false;\n\tconst prototype = Object.getPrototypeOf(value);\n\treturn prototype === Object.prototype || prototype === null;\n}\n\nexport function getWorkerResultSnapshots(entries: readonly SessionEntry[]): WorkerResult[] {\n\tconst results: WorkerResult[] = [];\n\n\tfor (const entry of entries) {\n\t\tif (entry.type !== \"custom\" || entry.customType !== WORKER_RESULT_CUSTOM_TYPE) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst payload = entry.data;\n\t\tif (!isPlainRecord(payload)) continue;\n\t\tif (payload.version !== 1) continue;\n\t\tif (!(\"result\" in payload)) continue;\n\t\tconst result = payload.result;\n\t\tif (isWorkerResult(result)) {\n\t\t\tresults.push(cloneWorkerResultForStorage(result));\n\t\t}\n\t}\n\n\treturn results;\n}\n\n/**\n * Latest persisted snapshot (result + originating request, when available) for one worker\n * requestId — \"latest wins\" over the append-only entries, the same collapse `delegate_status`\n * already performs when it maps results by requestId. Used to read, and durably update, the\n * parent-review marker.\n */\nexport function getLatestWorkerResultSnapshot(\n\tentries: readonly SessionEntry[],\n\trequestId: string,\n): WorkerResultSnapshotPayload | undefined {\n\tlet latest: WorkerResultSnapshotPayload | undefined;\n\tfor (const entry of entries) {\n\t\tif (entry.type !== \"custom\" || entry.customType !== WORKER_RESULT_CUSTOM_TYPE) continue;\n\t\tconst payload = entry.data;\n\t\tif (!isPlainRecord(payload) || payload.version !== 1 || !(\"result\" in payload)) continue;\n\t\tconst result = payload.result;\n\t\tif (!isWorkerResult(result) || result.requestId !== requestId) continue;\n\t\tconst request = payload.request;\n\t\tlatest = {\n\t\t\tversion: 1,\n\t\t\tresult: cloneWorkerResultForStorage(result),\n\t\t\t...(isPlainRecord(request) && typeof request.id === \"string\"\n\t\t\t\t? { request: structuredClone(request) as unknown as WorkerRequest }\n\t\t\t\t: {}),\n\t\t};\n\t}\n\treturn latest;\n}\n\nexport type AcknowledgeWorkerReviewReason = \"unknown_worker_result\" | \"not_flagged\" | \"already_reviewed\";\n\nexport type AcknowledgeWorkerReviewResult =\n\t| { ok: true; requestId: string; reviewedAt: string }\n\t| { ok: false; reason: AcknowledgeWorkerReviewReason };\n\n/**\n * Durably acknowledge an unreviewed worker mutation. Re-appends the latest snapshot for\n * `requestId` with `parentReviewedAt` set, so the ack is a first-class entry in the same\n * append-only audit trail as the original result — it survives reload and any future re-read of\n * `getWorkerResultSnapshots`/`getLatestWorkerResultSnapshot` (both are \"latest wins\"). Never\n * write-blocking: this only marks the mutation reviewed, it does not touch the worker's files.\n */\nexport function acknowledgeWorkerResultReview(\n\tsessionManager: Pick<SessionManager, \"appendCustomEntry\" | \"getEntries\">,\n\trequestId: string,\n\tnow: () => string = () => new Date().toISOString(),\n): AcknowledgeWorkerReviewResult {\n\tconst latest = getLatestWorkerResultSnapshot(sessionManager.getEntries(), requestId);\n\tif (!latest) return { ok: false, reason: \"unknown_worker_result\" };\n\tif (!latest.result.parentReviewRequired) return { ok: false, reason: \"not_flagged\" };\n\tif (latest.result.parentReviewedAt) return { ok: false, reason: \"already_reviewed\" };\n\tconst reviewedAt = now();\n\tappendWorkerResultSnapshot(sessionManager, { ...latest.result, parentReviewedAt: reviewedAt }, latest.request);\n\treturn { ok: true, requestId, reviewedAt };\n}\n"]}

package/dist/core/delegation/worker-result.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"worker-result.d.ts","sourceRoot":"","sources":["../../../src/core/delegation/worker-result.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAI7G,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAQ9E;AAQD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CA8BpE;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAWlE;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAGpH;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IAC1C,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,WAAW,CAmHd;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IACnD,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;+FAC2F;IAC3F,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,cAAc,GAAG,aAAa,CAAC,CAAC;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG;IAAE,cAAc,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAiClD","sourcesContent":["import path from \"node:path\";\nimport type { CapabilityEnvelope, GateOutcome, WorkerRequest, WorkerResult } from \"../autonomy/contracts.ts\";\nimport { checkPathScope } from \"../autonomy/path-scope.ts\";\nimport { cloneEvidenceBundleForStorage, isEvidenceBundle } from \"../research/evidence-bundle.ts\";\n\nexport function cloneWorkerResultForStorage(result: WorkerResult): WorkerResult {\n\treturn {\n\t\t...result,\n\t\t...(result.outputFormat ? { outputFormat: result.outputFormat } : {}),\n\t\tchangedFiles: [...result.changedFiles],\n\t\tblockers: result.blockers ? [...result.blockers] : undefined,\n\t\tevidence: result.evidence ? cloneEvidenceBundleForStorage(result.evidence) : undefined,\n\t};\n}\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) return false;\n\tconst prototype = Object.getPrototypeOf(value);\n\treturn prototype === Object.prototype || prototype === null;\n}\n\nexport function isWorkerResult(value: unknown): value is WorkerResult {\n\tif (!isPlainRecord(value)) return false;\n\tconst obj = value as Record<string, unknown>;\n\n\tif (typeof obj.requestId !== \"string\") return false;\n\tif (typeof obj.status !== \"string\" || ![\"completed\", \"blocked\", \"failed\", \"cancelled\"].includes(obj.status)) {\n\t\treturn false;\n\t}\n\tif (typeof obj.summary !== \"string\") return false;\n\tif (obj.outputFormat !== undefined && obj.outputFormat !== \"structured\" && obj.outputFormat !== \"plain_text\")\n\t\treturn false;\n\n\tif (!Array.isArray(obj.changedFiles) || !obj.changedFiles.every((f) => typeof f === \"string\")) {\n\t\treturn false;\n\t}\n\n\tif (obj.blockers !== undefined) {\n\t\tif (!Array.isArray(obj.blockers) || !obj.blockers.every((b) => typeof b === \"string\")) {\n\t\t\treturn false;\n\t\t}\n\t}\n\n\tif (obj.usageReportId !== undefined && typeof obj.usageReportId !== \"string\") return false;\n\tif (obj.createdAt !== undefined && typeof obj.createdAt !== \"string\") return false;\n\tif (obj.parentReviewRequired !== undefined && typeof obj.parentReviewRequired !== \"boolean\") return false;\n\tif (obj.parentReviewedAt !== undefined && typeof obj.parentReviewedAt !== \"string\") return false;\n\n\tif (obj.evidence !== undefined && !isEvidenceBundle(obj.evidence)) return false;\n\n\treturn true;\n}\n\nexport function requiresParentReview(result: WorkerResult): boolean {\n\tif (result.status !== \"completed\") {\n\t\treturn true;\n\t}\n\tif (result.blockers && result.blockers.length > 0) {\n\t\treturn true;\n\t}\n\tif (result.changedFiles.length > 0) {\n\t\treturn true;\n\t}\n\treturn false;\n}\n\n/**\n * True iff {@link validateWorkerResult}'s gate would flag this result \"ask-user\" /\n * \"parent_review_required\" (the two branches at :110 and :178 below) — an otherwise-completed\n * result the parent must explicitly look at because it reports blockers, or reports file mutations\n * that passed path-scope validation. Reuses `validateWorkerResult` itself rather than a\n * separately-maintained heuristic, so a persisted review marker can never drift from the\n * gate's actual verdict.\n */\nexport function isParentReviewRequired(args: { request: WorkerRequest; result: WorkerResult; cwd?: string }): boolean {\n\tconst acceptance = validateWorkerResult(args);\n\treturn acceptance.outcome === \"ask-user\" && acceptance.reasonCode === \"parent_review_required\";\n}\n\nexport function validateWorkerResult(args: {\n\trequest: WorkerRequest;\n\tresult: WorkerResult;\n\t/**\n\t * Baseline for relative paths — BOTH the runner's cwd-relative `changedFiles` and the\n\t * envelope's possibly-relative path scopes resolve against this. Defaults to process.cwd()\n\t * for callers whose session cwd is the process cwd.\n\t */\n\tcwd?: string;\n}): GateOutcome {\n\tconst { request, result } = args;\n\tconst baseDir = args.cwd ?? process.cwd();\n\n\tif (result.requestId !== request.id) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"request_id_mismatch\",\n\t\t\tmessage: `Result requestId '${result.requestId}' does not match request id '${request.id}'.`,\n\t\t};\n\t}\n\n\tif (result.status !== \"completed\") {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"worker_not_completed\",\n\t\t\tmessage: `Worker finished with status '${result.status}'.`,\n\t\t\tdetails: result.blockers && result.blockers.length > 0 ? { blockers: [...result.blockers] } : undefined,\n\t\t};\n\t}\n\n\tif (!result.usageReportId) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"missing_usage_report\",\n\t\t\tmessage: \"Completed worker result is missing usageReportId.\",\n\t\t};\n\t}\n\n\tif (result.blockers && result.blockers.length > 0) {\n\t\treturn {\n\t\t\toutcome: \"ask-user\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"parent_review_required\",\n\t\t\tmessage: \"Completed worker result includes blockers and requires parent review.\",\n\t\t\tdetails: { blockers: [...result.blockers] },\n\t\t};\n\t}\n\n\tif (result.changedFiles.length > 0) {\n\t\tif (!request.envelope.allowedPaths || request.envelope.allowedPaths.length === 0) {\n\t\t\treturn {\n\t\t\t\toutcome: \"block\",\n\t\t\t\tgate: \"worker_result\",\n\t\t\t\treasonCode: \"missing_path_scope\",\n\t\t\t\tmessage: \"Worker changed files but no allowedPaths are configured in the envelope.\",\n\t\t\t};\n\t\t}\n\n\t\t// The runner reports changed files relative to the session cwd — resolve file and scope\n\t\t// roots against the SAME baseline. Resolving per-root double-prefixed nested names and\n\t\t// let a denied subtree slip past the deny rule.\n\t\tconst resolvedAllowed = request.envelope.allowedPaths.map((p) => path.resolve(baseDir, p));\n\t\tconst resolvedDenied = request.envelope.deniedPaths?.map((p) => path.resolve(baseDir, p));\n\t\tfor (const changedFile of result.changedFiles) {\n\t\t\tlet isInsideAny = false;\n\t\t\tlet isDenied = false;\n\n\t\t\tconst scopedChangedFile = path.resolve(baseDir, changedFile);\n\t\t\tfor (const root of resolvedAllowed) {\n\t\t\t\tconst decision = checkPathScope(\n\t\t\t\t\t{\n\t\t\t\t\t\troot,\n\t\t\t\t\t\tallowedPaths: resolvedAllowed,\n\t\t\t\t\t\tdeniedPaths: resolvedDenied,\n\t\t\t\t\t},\n\t\t\t\t\tscopedChangedFile,\n\t\t\t\t);\n\n\t\t\t\tif (decision.kind === \"denied\") {\n\t\t\t\t\tisDenied = true;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t\tif (decision.kind === \"inside\") {\n\t\t\t\t\tisInsideAny = true;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (isDenied) {\n\t\t\t\treturn {\n\t\t\t\t\toutcome: \"block\",\n\t\t\t\t\tgate: \"worker_result\",\n\t\t\t\t\treasonCode: \"changed_file_denied\",\n\t\t\t\t\tmessage: `Worker changed file '${changedFile}' which matches a denied path.`,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (!isInsideAny) {\n\t\t\t\treturn {\n\t\t\t\t\toutcome: \"block\",\n\t\t\t\t\tgate: \"worker_result\",\n\t\t\t\t\treasonCode: \"changed_file_outside_scope\",\n\t\t\t\t\tmessage: `Worker changed file '${changedFile}' outside allowed scope.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Files are inside scope, but worker output is untrusted\n\t\treturn {\n\t\t\toutcome: \"ask-user\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"parent_review_required\",\n\t\t\tmessage: \"Worker changed files require parent review.\",\n\t\t};\n\t}\n\n\treturn {\n\t\toutcome: \"allow\",\n\t\tgate: \"worker_result\",\n\t\treasonCode: \"allowed\",\n\t\tmessage: \"Worker result is read-only and allowed.\",\n\t};\n}\n\n/**\n * Path-scope-only re-review for a SELF-REPORTED (out-of-process) worker's claimed `changedFiles`\n * -- e.g. a tmux worker's own completion report, which (unlike an in-process worker's) never\n * passed through this process's `applyWorkerActions` envelope enforcement before the write\n * happened; the tmux worker's tool loop runs in a separate process this session does not gate.\n * Reuses {@link validateWorkerResult}'s exact symlink-safe scope check verbatim -- never\n * reimplement path resolution: synthesizes a minimal, always-\"completed\" request/result pair\n * carrying only the reported `changedFiles` and the scope's `allowedPaths`/`deniedPaths`, so the\n * ONLY thing that can vary the verdict is the path-scope branch.\n *\n * Deliberately broader than {@link isParentReviewRequired}: that helper only flags the gate's\n * \"ask-user\" branch, which is correct for an in-process worker (a write that would have been\n * \"block\"-worthy was already refused before it could happen, by the SAME envelope, via\n * `applyWorkerActions`). A self-reported claim has no such backstop -- an out-of-scope or denied\n * path already happened on the real filesystem whether or not this gate would allow it, so here\n * ANY non-\"allow\" verdict (in scope, out of scope, or no scope configured at all) means a human\n * must look, not \"the write didn't happen\".\n */\nexport function reviewManagedLaneChangedFiles(args: {\n\tchangedFiles: readonly string[];\n\t/** The scope to validate against -- e.g. the session's active `CapabilityEnvelope`, until a\n\t * per-launch tmux standing grant envelope lands in a later wave (documented follow-up). */\n\tenvelope: Pick<CapabilityEnvelope, \"allowedPaths\" | \"deniedPaths\">;\n\tcwd?: string;\n}): { reviewRequired: boolean; reasonCode: string } {\n\tif (args.changedFiles.length === 0) {\n\t\treturn { reviewRequired: false, reasonCode: \"no_changed_files\" };\n\t}\n\tconst syntheticId = \"managed-lane-review\";\n\tconst acceptance = validateWorkerResult({\n\t\trequest: {\n\t\t\tid: syntheticId,\n\t\t\tinstructions: \"\",\n\t\t\troute: {\n\t\t\t\ttier: \"cheap\",\n\t\t\t\trisk: \"scoped-write\",\n\t\t\t\tconfidence: 1,\n\t\t\t\treasonCode: \"managed_lane_review\",\n\t\t\t\treasons: [],\n\t\t\t},\n\t\t\tenvelope: {\n\t\t\t\tid: syntheticId,\n\t\t\t\tcapabilities: [\"write_files\"],\n\t\t\t\tallowedPaths: args.envelope.allowedPaths,\n\t\t\t\tdeniedPaths: args.envelope.deniedPaths,\n\t\t\t},\n\t\t},\n\t\tresult: {\n\t\t\trequestId: syntheticId,\n\t\t\tstatus: \"completed\",\n\t\t\tsummary: \"\",\n\t\t\tchangedFiles: [...args.changedFiles],\n\t\t\tusageReportId: syntheticId,\n\t\t},\n\t\tcwd: args.cwd,\n\t});\n\treturn { reviewRequired: acceptance.outcome !== \"allow\", reasonCode: acceptance.reasonCode };\n}\n"]}

package/dist/core/delegation/worker-result.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"worker-result.js","sourceRoot":"","sources":["../../../src/core/delegation/worker-result.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAEjG,MAAM,UAAU,2BAA2B,CAAC,MAAoB,EAAgB;IAC/E,OAAO;QACN,GAAG,MAAM;QACT,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;QACtC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5D,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,6BAA6B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KACtF,CAAC;AAAA,CACF;AAED,SAAS,aAAa,CAAC,KAAc,EAAoC;IACxE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAAA,CAC5D;AAED,MAAM,UAAU,cAAc,CAAC,KAAc,EAAyB;IACrE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,KAAgC,CAAC;IAE7C,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7G,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,KAAK,YAAY,IAAI,GAAG,CAAC,YAAY,KAAK,YAAY;QAC3G,OAAO,KAAK,CAAC;IAEd,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC/F,OAAO,KAAK,CAAC;IACd,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACvF,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IAED,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3F,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,GAAG,CAAC,oBAAoB,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,oBAAoB,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1G,IAAI,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEjG,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAEhF,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAoB,EAAW;IACnE,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAoE,EAAW;IACrH,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,UAAU,CAAC,OAAO,KAAK,UAAU,IAAI,UAAU,CAAC,UAAU,KAAK,wBAAwB,CAAC;AAAA,CAC/F;AAED,MAAM,UAAU,oBAAoB,CAAC,IASpC,EAAe;IACf,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAE1C,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACrC,OAAO;YACN,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,qBAAqB,MAAM,CAAC,SAAS,gCAAgC,OAAO,CAAC,EAAE,IAAI;SAC5F,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO;YACN,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,sBAAsB;YAClC,OAAO,EAAE,gCAAgC,MAAM,CAAC,MAAM,IAAI;YAC1D,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;SACvG,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC3B,OAAO;YACN,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,sBAAsB;YAClC,OAAO,EAAE,mDAAmD;SAC5D,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO;YACN,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,wBAAwB;YACpC,OAAO,EAAE,uEAAuE;YAChF,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE;SAC3C,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClF,OAAO;gBACN,OAAO,EAAE,OAAO;gBAChB,IAAI,EAAE,eAAe;gBACrB,UAAU,EAAE,oBAAoB;gBAChC,OAAO,EAAE,0EAA0E;aACnF,CAAC;QACH,CAAC;QAED,0FAAwF;QACxF,uFAAuF;QACvF,gDAAgD;QAChD,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3F,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1F,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC/C,IAAI,WAAW,GAAG,KAAK,CAAC;YACxB,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC7D,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;gBACpC,MAAM,QAAQ,GAAG,cAAc,CAC9B;oBACC,IAAI;oBACJ,YAAY,EAAE,eAAe;oBAC7B,WAAW,EAAE,cAAc;iBAC3B,EACD,iBAAiB,CACjB,CAAC;gBAEF,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAChC,QAAQ,GAAG,IAAI,CAAC;oBAChB,MAAM;gBACP,CAAC;gBACD,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAChC,WAAW,GAAG,IAAI,CAAC;gBACpB,CAAC;YACF,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACN,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,eAAe;oBACrB,UAAU,EAAE,qBAAqB;oBACjC,OAAO,EAAE,wBAAwB,WAAW,gCAAgC;iBAC5E,CAAC;YACH,CAAC;YAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClB,OAAO;oBACN,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,eAAe;oBACrB,UAAU,EAAE,4BAA4B;oBACxC,OAAO,EAAE,wBAAwB,WAAW,0BAA0B;iBACtE,CAAC;YACH,CAAC;QACF,CAAC;QAED,yDAAyD;QACzD,OAAO;YACN,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,wBAAwB;YACpC,OAAO,EAAE,6CAA6C;SACtD,CAAC;IACH,CAAC;IAED,OAAO;QACN,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,yCAAyC;KAClD,CAAC;AAAA,CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAM7C,EAAmD;IACnD,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,WAAW,GAAG,qBAAqB,CAAC;IAC1C,MAAM,UAAU,GAAG,oBAAoB,CAAC;QACvC,OAAO,EAAE;YACR,EAAE,EAAE,WAAW;YACf,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE;gBACN,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,cAAc;gBACpB,UAAU,EAAE,CAAC;gBACb,UAAU,EAAE,qBAAqB;gBACjC,OAAO,EAAE,EAAE;aACX;YACD,QAAQ,EAAE;gBACT,EAAE,EAAE,WAAW;gBACf,YAAY,EAAE,CAAC,aAAa,CAAC;gBAC7B,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY;gBACxC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;aACtC;SACD;QACD,MAAM,EAAE;YACP,SAAS,EAAE,WAAW;YACtB,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,EAAE;YACX,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;YACpC,aAAa,EAAE,WAAW;SAC1B;QACD,GAAG,EAAE,IAAI,CAAC,GAAG;KACb,CAAC,CAAC;IACH,OAAO,EAAE,cAAc,EAAE,UAAU,CAAC,OAAO,KAAK,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC;AAAA,CAC7F","sourcesContent":["import path from \"node:path\";\nimport type { CapabilityEnvelope, GateOutcome, WorkerRequest, WorkerResult } from \"../autonomy/contracts.ts\";\nimport { checkPathScope } from \"../autonomy/path-scope.ts\";\nimport { cloneEvidenceBundleForStorage, isEvidenceBundle } from \"../research/evidence-bundle.ts\";\n\nexport function cloneWorkerResultForStorage(result: WorkerResult): WorkerResult {\n\treturn {\n\t\t...result,\n\t\t...(result.outputFormat ? { outputFormat: result.outputFormat } : {}),\n\t\tchangedFiles: [...result.changedFiles],\n\t\tblockers: result.blockers ? [...result.blockers] : undefined,\n\t\tevidence: result.evidence ? cloneEvidenceBundleForStorage(result.evidence) : undefined,\n\t};\n}\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) return false;\n\tconst prototype = Object.getPrototypeOf(value);\n\treturn prototype === Object.prototype || prototype === null;\n}\n\nexport function isWorkerResult(value: unknown): value is WorkerResult {\n\tif (!isPlainRecord(value)) return false;\n\tconst obj = value as Record<string, unknown>;\n\n\tif (typeof obj.requestId !== \"string\") return false;\n\tif (typeof obj.status !== \"string\" || ![\"completed\", \"blocked\", \"failed\", \"cancelled\"].includes(obj.status)) {\n\t\treturn false;\n\t}\n\tif (typeof obj.summary !== \"string\") return false;\n\tif (obj.outputFormat !== undefined && obj.outputFormat !== \"structured\" && obj.outputFormat !== \"plain_text\")\n\t\treturn false;\n\n\tif (!Array.isArray(obj.changedFiles) || !obj.changedFiles.every((f) => typeof f === \"string\")) {\n\t\treturn false;\n\t}\n\n\tif (obj.blockers !== undefined) {\n\t\tif (!Array.isArray(obj.blockers) || !obj.blockers.every((b) => typeof b === \"string\")) {\n\t\t\treturn false;\n\t\t}\n\t}\n\n\tif (obj.usageReportId !== undefined && typeof obj.usageReportId !== \"string\") return false;\n\tif (obj.createdAt !== undefined && typeof obj.createdAt !== \"string\") return false;\n\tif (obj.parentReviewRequired !== undefined && typeof obj.parentReviewRequired !== \"boolean\") return false;\n\tif (obj.parentReviewedAt !== undefined && typeof obj.parentReviewedAt !== \"string\") return false;\n\n\tif (obj.evidence !== undefined && !isEvidenceBundle(obj.evidence)) return false;\n\n\treturn true;\n}\n\nexport function requiresParentReview(result: WorkerResult): boolean {\n\tif (result.status !== \"completed\") {\n\t\treturn true;\n\t}\n\tif (result.blockers && result.blockers.length > 0) {\n\t\treturn true;\n\t}\n\tif (result.changedFiles.length > 0) {\n\t\treturn true;\n\t}\n\treturn false;\n}\n\n/**\n * True iff {@link validateWorkerResult}'s gate would flag this result \"ask-user\" /\n * \"parent_review_required\" (the two branches at :110 and :178 below) — an otherwise-completed\n * result the parent must explicitly look at because it reports blockers, or reports file mutations\n * that passed path-scope validation. Reuses `validateWorkerResult` itself rather than a\n * separately-maintained heuristic, so a persisted review marker can never drift from the\n * gate's actual verdict.\n */\nexport function isParentReviewRequired(args: { request: WorkerRequest; result: WorkerResult; cwd?: string }): boolean {\n\tconst acceptance = validateWorkerResult(args);\n\treturn acceptance.outcome === \"ask-user\" && acceptance.reasonCode === \"parent_review_required\";\n}\n\nexport function validateWorkerResult(args: {\n\trequest: WorkerRequest;\n\tresult: WorkerResult;\n\t/**\n\t * Baseline for relative paths — BOTH the runner's cwd-relative `changedFiles` and the\n\t * envelope's possibly-relative path scopes resolve against this. Defaults to process.cwd()\n\t * for callers whose session cwd is the process cwd.\n\t */\n\tcwd?: string;\n}): GateOutcome {\n\tconst { request, result } = args;\n\tconst baseDir = args.cwd ?? process.cwd();\n\n\tif (result.requestId !== request.id) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"request_id_mismatch\",\n\t\t\tmessage: `Result requestId '${result.requestId}' does not match request id '${request.id}'.`,\n\t\t};\n\t}\n\n\tif (result.status !== \"completed\") {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"worker_not_completed\",\n\t\t\tmessage: `Worker finished with status '${result.status}'.`,\n\t\t\tdetails: result.blockers && result.blockers.length > 0 ? { blockers: [...result.blockers] } : undefined,\n\t\t};\n\t}\n\n\tif (!result.usageReportId) {\n\t\treturn {\n\t\t\toutcome: \"block\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"missing_usage_report\",\n\t\t\tmessage: \"Completed worker result is missing usageReportId.\",\n\t\t};\n\t}\n\n\tif (result.blockers && result.blockers.length > 0) {\n\t\treturn {\n\t\t\toutcome: \"ask-user\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"parent_review_required\",\n\t\t\tmessage: \"Completed worker result includes blockers and requires parent review.\",\n\t\t\tdetails: { blockers: [...result.blockers] },\n\t\t};\n\t}\n\n\tif (result.changedFiles.length > 0) {\n\t\tif (!request.envelope.allowedPaths || request.envelope.allowedPaths.length === 0) {\n\t\t\treturn {\n\t\t\t\toutcome: \"block\",\n\t\t\t\tgate: \"worker_result\",\n\t\t\t\treasonCode: \"missing_path_scope\",\n\t\t\t\tmessage: \"Worker changed files but no allowedPaths are configured in the envelope.\",\n\t\t\t};\n\t\t}\n\n\t\t// The runner reports changed files relative to the session cwd — resolve file and scope\n\t\t// roots against the SAME baseline. Resolving per-root double-prefixed nested names and\n\t\t// let a denied subtree slip past the deny rule.\n\t\tconst resolvedAllowed = request.envelope.allowedPaths.map((p) => path.resolve(baseDir, p));\n\t\tconst resolvedDenied = request.envelope.deniedPaths?.map((p) => path.resolve(baseDir, p));\n\t\tfor (const changedFile of result.changedFiles) {\n\t\t\tlet isInsideAny = false;\n\t\t\tlet isDenied = false;\n\n\t\t\tconst scopedChangedFile = path.resolve(baseDir, changedFile);\n\t\t\tfor (const root of resolvedAllowed) {\n\t\t\t\tconst decision = checkPathScope(\n\t\t\t\t\t{\n\t\t\t\t\t\troot,\n\t\t\t\t\t\tallowedPaths: resolvedAllowed,\n\t\t\t\t\t\tdeniedPaths: resolvedDenied,\n\t\t\t\t\t},\n\t\t\t\t\tscopedChangedFile,\n\t\t\t\t);\n\n\t\t\t\tif (decision.kind === \"denied\") {\n\t\t\t\t\tisDenied = true;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t\tif (decision.kind === \"inside\") {\n\t\t\t\t\tisInsideAny = true;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (isDenied) {\n\t\t\t\treturn {\n\t\t\t\t\toutcome: \"block\",\n\t\t\t\t\tgate: \"worker_result\",\n\t\t\t\t\treasonCode: \"changed_file_denied\",\n\t\t\t\t\tmessage: `Worker changed file '${changedFile}' which matches a denied path.`,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (!isInsideAny) {\n\t\t\t\treturn {\n\t\t\t\t\toutcome: \"block\",\n\t\t\t\t\tgate: \"worker_result\",\n\t\t\t\t\treasonCode: \"changed_file_outside_scope\",\n\t\t\t\t\tmessage: `Worker changed file '${changedFile}' outside allowed scope.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Files are inside scope, but worker output is untrusted\n\t\treturn {\n\t\t\toutcome: \"ask-user\",\n\t\t\tgate: \"worker_result\",\n\t\t\treasonCode: \"parent_review_required\",\n\t\t\tmessage: \"Worker changed files require parent review.\",\n\t\t};\n\t}\n\n\treturn {\n\t\toutcome: \"allow\",\n\t\tgate: \"worker_result\",\n\t\treasonCode: \"allowed\",\n\t\tmessage: \"Worker result is read-only and allowed.\",\n\t};\n}\n\n/**\n * Path-scope-only re-review for a SELF-REPORTED (out-of-process) worker's claimed `changedFiles`\n * -- e.g. a tmux worker's own completion report, which (unlike an in-process worker's) never\n * passed through this process's `applyWorkerActions` envelope enforcement before the write\n * happened; the tmux worker's tool loop runs in a separate process this session does not gate.\n * Reuses {@link validateWorkerResult}'s exact symlink-safe scope check verbatim -- never\n * reimplement path resolution: synthesizes a minimal, always-\"completed\" request/result pair\n * carrying only the reported `changedFiles` and the scope's `allowedPaths`/`deniedPaths`, so the\n * ONLY thing that can vary the verdict is the path-scope branch.\n *\n * Deliberately broader than {@link isParentReviewRequired}: that helper only flags the gate's\n * \"ask-user\" branch, which is correct for an in-process worker (a write that would have been\n * \"block\"-worthy was already refused before it could happen, by the SAME envelope, via\n * `applyWorkerActions`). A self-reported claim has no such backstop -- an out-of-scope or denied\n * path already happened on the real filesystem whether or not this gate would allow it, so here\n * ANY non-\"allow\" verdict (in scope, out of scope, or no scope configured at all) means a human\n * must look, not \"the write didn't happen\".\n */\nexport function reviewManagedLaneChangedFiles(args: {\n\tchangedFiles: readonly string[];\n\t/** The scope to validate against -- e.g. the session's active `CapabilityEnvelope`, until a\n\t * per-launch tmux standing grant envelope lands in a later wave (documented follow-up). */\n\tenvelope: Pick<CapabilityEnvelope, \"allowedPaths\" | \"deniedPaths\">;\n\tcwd?: string;\n}): { reviewRequired: boolean; reasonCode: string } {\n\tif (args.changedFiles.length === 0) {\n\t\treturn { reviewRequired: false, reasonCode: \"no_changed_files\" };\n\t}\n\tconst syntheticId = \"managed-lane-review\";\n\tconst acceptance = validateWorkerResult({\n\t\trequest: {\n\t\t\tid: syntheticId,\n\t\t\tinstructions: \"\",\n\t\t\troute: {\n\t\t\t\ttier: \"cheap\",\n\t\t\t\trisk: \"scoped-write\",\n\t\t\t\tconfidence: 1,\n\t\t\t\treasonCode: \"managed_lane_review\",\n\t\t\t\treasons: [],\n\t\t\t},\n\t\t\tenvelope: {\n\t\t\t\tid: syntheticId,\n\t\t\t\tcapabilities: [\"write_files\"],\n\t\t\t\tallowedPaths: args.envelope.allowedPaths,\n\t\t\t\tdeniedPaths: args.envelope.deniedPaths,\n\t\t\t},\n\t\t},\n\t\tresult: {\n\t\t\trequestId: syntheticId,\n\t\t\tstatus: \"completed\",\n\t\t\tsummary: \"\",\n\t\t\tchangedFiles: [...args.changedFiles],\n\t\t\tusageReportId: syntheticId,\n\t\t},\n\t\tcwd: args.cwd,\n\t});\n\treturn { reviewRequired: acceptance.outcome !== \"allow\", reasonCode: acceptance.reasonCode };\n}\n"]}

package/dist/core/telemetry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../../src/core/telemetry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAO7D,wBAAgB,yBAAyB,CACxC,eAAe,EAAE,eAAe,EAChC,YAAY,GAAE,MAAM,GAAG,SAAoC,GACzD,OAAO,CAET","sourcesContent":["import type { SettingsManager } from \"./settings-manager.ts\";\n\nfunction isTruthyEnvFlag(value: string | undefined): boolean {\n\tif (!value) return false;\n\treturn value === \"1\" || value.toLowerCase() === \"true\" || value.toLowerCase() === \"yes\";\n}\n\nexport function isInstallTelemetryEnabled(\n\tsettingsManager: SettingsManager,\n\ttelemetryEnv: string | undefined = process.env.PI_TELEMETRY,\n): boolean {\n\treturn telemetryEnv !== undefined ? isTruthyEnvFlag(telemetryEnv) : settingsManager.getEnableInstallTelemetry();\n}\n"]}

package/dist/core/telemetry.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../../src/core/telemetry.ts"],"names":[],"mappings":"AAEA,SAAS,eAAe,CAAC,KAAyB,EAAW;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;AAAA,CACxF;AAED,MAAM,UAAU,yBAAyB,CACxC,eAAgC,EAChC,YAAY,GAAuB,OAAO,CAAC,GAAG,CAAC,YAAY,EACjD;IACV,OAAO,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,yBAAyB,EAAE,CAAC;AAAA,CAChH","sourcesContent":["import type { SettingsManager } from \"./settings-manager.ts\";\n\nfunction isTruthyEnvFlag(value: string | undefined): boolean {\n\tif (!value) return false;\n\treturn value === \"1\" || value.toLowerCase() === \"true\" || value.toLowerCase() === \"yes\";\n}\n\nexport function isInstallTelemetryEnabled(\n\tsettingsManager: SettingsManager,\n\ttelemetryEnv: string | undefined = process.env.PI_TELEMETRY,\n): boolean {\n\treturn telemetryEnv !== undefined ? isTruthyEnvFlag(telemetryEnv) : settingsManager.getEnableInstallTelemetry();\n}\n"]}