npm - @caupulican/pi-adaptative - Versions diffs - 0.81.40 → 0.81.42 - Mend

@caupulican/pi-adaptative 0.81.40 → 0.81.42

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (599) hide show

package/dist/core/autonomy/lane-tool-surface.js CHANGED Viewed

@@ -1,6 +1,7 @@
 import path from "node:path";
 import { Type } from "typebox";
-import { CapabilityGateway, CapabilityGatewayDeniedError } from "../orchestration/capability-gateway.js";
+import { CapabilityGateway, CapabilityGatewayDeniedError, } from "../orchestration/capability-gateway.js";
+import { wrapToolWithCredentialExposureGuard } from "../secrets/credential-exposure-guard.js";
 import { matchesResourceProfilePattern } from "../settings-manager.js";
 import { createEditTool } from "../tools/edit.js";
 import { createFindTool } from "../tools/find.js";
@@ -14,8 +15,12 @@ const READ_ONLY_LANE_TOOL_NAMES = ["read", "grep", "find", "ls"];
 const MEMORY_LANE_TOOL_NAME = "memory";
 const WRITE_LANE_TOOL_NAMES = ["write", "edit"];
 const PROCESS_LANE_TOOL_NAME = "run_process";
+const MAX_LANE_MEMORY_QUERY_CHARS = 4_096;
 const laneMemorySchema = Type.Object({
-    query: Type.String({ description: "What relevant standing memory or prior evidence to retrieve" }),
+    query: Type.String({
+        maxLength: MAX_LANE_MEMORY_QUERY_CHARS,
+        description: "What relevant standing memory or prior evidence to retrieve",
+    }),
 });
 const WRITE_LANE_TOOL_NAME_SET = new Set(WRITE_LANE_TOOL_NAMES);
 function strictLaneProfilePatterns(profile) {
@@ -51,7 +56,10 @@ function createLaneTools(cwd, names, readMemory, executionPolicy, processMaxWall
             description: "Retrieve bounded, source-labeled standing memory relevant to this delegated task. Read-only: no memory writes or lifecycle actions are available.",
             parameters: laneMemorySchema,
             execute: async (_toolCallId, params) => {
-                const { query } = params;
+                const query = params.query?.trim();
+                if (!query || query.length > MAX_LANE_MEMORY_QUERY_CHARS) {
+                    throw new Error(`memory_query_invalid: query must contain from 1 through ${MAX_LANE_MEMORY_QUERY_CHARS} characters.`);
+                }
                 return {
                     content: [{ type: "text", text: await readMemory(query) }],
                     details: { readOnly: true },
@@ -61,7 +69,7 @@ function createLaneTools(cwd, names, readMemory, executionPolicy, processMaxWall
     }
     return names.flatMap((name) => {
         const factory = factories.get(name);
-        return factory ? [factory()] : [];
+        return factory ? [wrapToolWithCredentialExposureGuard(factory(), cwd)] : [];
     });
 }
 /**
@@ -95,7 +103,13 @@ export function createLaneToolSurface(options) {
     if (options.grant?.allowedTools.some((name) => !manifestsByName.has(name))) {
         throw new Error("Compiled lane grant references a tool without a capability manifest.");
     }
-    const gateway = options.grant ? new CapabilityGateway({ grant: options.grant, cwd: options.cwd }) : undefined;
+    const gateway = options.grant
+        ? new CapabilityGateway({
+            grant: options.grant,
+            cwd: options.cwd,
+            ...(options.initialUsage !== undefined ? { initialUsage: options.initialUsage } : {}),
+        })
+        : undefined;
     const deniedPaths = options.deniedPaths?.map((entry) => path.resolve(entry));
     const readEnvelope = {
         id: "isolated-lane-read-tools",

package/dist/core/autonomy/lane-tool-surface.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"lane-tool-surface.js","sourceRoot":"","sources":["../../../src/core/autonomy/lane-tool-surface.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAe,IAAI,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAOzG,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAU,CAAC;AAC1E,MAAM,qBAAqB,GAAG,QAAiB,CAAC;AAChD,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAU,CAAC;AACzD,MAAM,sBAAsB,GAAG,aAAsB,CAAC;AACtD,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,6DAA6D,EAAE,CAAC;CAClG,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAS,qBAAqB,CAAC,CAAC;AAmCxE,SAAS,yBAAyB,CAAC,OAAsC,EAGvE;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;IACvC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,6FAA6F;IAC7F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IACjF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAAA,CACxB;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,UAA6B,EAAY;IAChF,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAAA,CAC5G;AAED,SAAS,eAAe,CACvB,GAAW,EACX,KAAwB,EACxB,UAA+C,EAC/C,eAA8C,EAC9C,qBAAqB,GAAG,CAAC,EACX;IACd,MAAM,SAAS,GAAG,IAAI,GAAG,CAA0B;QAClD,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,eAAe,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAC1C,oBAAoB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,qBAAqB,EAAE,CAAC,CAC7F,CAAC;IACH,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QAChB,SAAS,CAAC,GAAG,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,IAAI,EAAE,qBAAqB;YAC3B,KAAK,EAAE,aAAa;YACpB,WAAW,EACV,mJAAmJ;YACpJ,UAAU,EAAE,gBAAgB;YAC5B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC;gBACvC,MAAM,EAAE,KAAK,EAAE,GAAG,MAA0B,CAAC;gBAC7C,OAAO;oBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC3B,CAAC;YAAA,CACF;SACD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAAA,CAClC,CAAC,CAAC;AAAA,CACH;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA+B,EAAmB;IACvF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5F,MAAM,cAAc,GAAG;QACtB,GAAG,yBAAyB;QAC5B,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;IACF,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAClD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAClG,CAAC;IACF,MAAM,oBAAoB,GAAG,OAAO,CAAC,KAAK;QACzC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CACrB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,6BAA6B,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAC3F,CAAC;IACJ,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK;QACjC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9D,CAAC,CAAC,cAAc,CAAC,MAAM,CACrB,CAAC,IAAI,EAAE,EAAE,CACR,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YACpF,CAAC,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CACrD,CAAC;IACJ,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,YAAY,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/G,IAAI,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9G,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAuB;QACxC,EAAE,EAAE,0BAA0B;QAC9B,YAAY,EAAE;YACb,iBAAiB;YACjB,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAE,CAAC,cAAc,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAE,CAAC,cAAc,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF;QACD,YAAY;QACZ,WAAW;QACX,YAAY,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzC,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IACF,MAAM,aAAa,GAAuB;QACzC,EAAE,EAAE,2BAA2B;QAC/B,YAAY,EAAE,CAAC,kBAAkB,CAAC;QAClC,YAAY;QACZ,WAAW;QACX,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QACtE,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IAEF,OAAO;QACN,KAAK,EAAE,eAAe,CACrB,OAAO,CAAC,GAAG,EACX,YAAY,EACZ,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,qBAAqB,CAC7B;QACD,YAAY;QACZ,WAAW;QACX,oBAAoB;QACpB,cAAc,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,QAAQ,CAAC,IAAI,4CAA4C,EAAE,CAAC;YACzG,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACf,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,QAAQ,CAAC,IAAI,wCAAwC,EAAE,CAAC;gBACrG,CAAC;gBACD,IAAI,CAAC;oBACJ,OAAO,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBACzD,OAAO,SAAS,CAAC;gBAClB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;wBACnD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,KAAK,CAAC,UAAU,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC7F,CAAC;oBACD,MAAM,KAAK,CAAC;gBACb,CAAC;YACF,CAAC;YACD,MAAM,OAAO,GAAG,gBAAgB,CAAC;gBAChC,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,IAAI;gBACJ,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,QAAQ,EAAE,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY;aACpF,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;gBAAE,OAAO,SAAS,CAAC;YAClD,OAAO;gBACN,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,sBAAsB,OAAO,CAAC,UAAU,MAAM,OAAO,CAAC,OAAO,IAAI,2BAA2B,EAAE;aACtG,CAAC;QAAA,CACF;QACD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/B,CAAC;AAAA,CACF","sourcesContent":["import path from \"node:path\";\nimport type { AgentLoopConfig, AgentTool } from \"@caupulican/pi-agent-core\";\nimport { type Static, Type } from \"typebox\";\nimport { CapabilityGateway, CapabilityGatewayDeniedError } from \"../orchestration/capability-gateway.ts\";\nimport type {\n\tExecutionGrant,\n\tOrchestrationExecutionPolicy,\n\tToolCapabilityManifest,\n} from \"../orchestration/contracts.ts\";\nimport type { NormalizedProfile } from \"../profile-registry.ts\";\nimport { matchesResourceProfilePattern } from \"../settings-manager.ts\";\nimport { createEditTool } from \"../tools/edit.ts\";\nimport { createFindTool } from \"../tools/find.ts\";\nimport { createGrepTool } from \"../tools/grep.ts\";\nimport { createLsTool } from \"../tools/ls.ts\";\nimport { createReadTool } from \"../tools/read.ts\";\nimport { createRunProcessTool } from \"../tools/run-process.ts\";\nimport { createWriteTool } from \"../tools/write.ts\";\nimport type { CapabilityEnvelope } from \"./contracts.ts\";\nimport { evaluateToolGate } from \"./gates.ts\";\n\nconst READ_ONLY_LANE_TOOL_NAMES = [\"read\", \"grep\", \"find\", \"ls\"] as const;\nconst MEMORY_LANE_TOOL_NAME = \"memory\" as const;\nconst WRITE_LANE_TOOL_NAMES = [\"write\", \"edit\"] as const;\nconst PROCESS_LANE_TOOL_NAME = \"run_process\" as const;\nconst laneMemorySchema = Type.Object({\n\tquery: Type.String({ description: \"What relevant standing memory or prior evidence to retrieve\" }),\n});\ntype LaneMemoryParams = Static<typeof laneMemorySchema>;\nconst WRITE_LANE_TOOL_NAME_SET = new Set<string>(WRITE_LANE_TOOL_NAMES);\n\nexport interface LaneToolSurface {\n\t/** Fresh tools owned by this lane only; no foreground tool instances or extension state leak in. /\n\ttools: AgentTool[];\n\t/* Exact names after profile globs are expanded. Safe to persist in a capability envelope. /\n\tallowedTools: string[];\n\t/* Exact safe-candidate names denied by the profile's block patterns. /\n\tdeniedTools: string[];\n\t/* Explicit grants that bind to no classified lane candidate (opaque tools stay fail-closed). /\n\tunboundAllowPatterns: string[];\n\t/* Per-call path and capability gate for the isolated child loop. /\n\tbeforeToolCall: NonNullable<AgentLoopConfig[\"beforeToolCall\"]>;\n\t/* Canonical cumulative authority/budget meter for a compiled worker grant. /\n\tgateway?: CapabilityGateway;\n}\n\nexport interface LaneToolSurfaceOptions {\n\tcwd: string;\n\tprofile?: NormalizedProfile;\n\t/* Private harness state that generic file tools must never traverse. /\n\tdeniedPaths?: readonly string[];\n\t/* Orchestrator-requested, policy-filtered read-only memory retrieval. Omitted means no memory tool. /\n\treadMemory?: (query: string) => Promise<string>;\n\t/* Research never sets this. Workers require both this flag and at least one write path. /\n\twriteEnabled?: boolean;\n\twritePaths?: readonly string[];\n\t/* Present only for process-capable owner profiles; absent means no process tool is materialized. /\n\texecutionPolicy?: OrchestrationExecutionPolicy;\n\tprocessMaxWallClockMs?: number;\n\t/* Compiled policy path. When present, it is the only authorization source for this surface. /\n\tgrant?: ExecutionGrant;\n\ttoolManifests?: readonly ToolCapabilityManifest[];\n}\n\nfunction strictLaneProfilePatterns(profile: NormalizedProfile \| undefined): {\n\tallow: string[];\n\tblock: string[];\n} {\n\tif (!profile) return { allow: [], block: [] };\n\tconst filter = profile.resources.tools;\n\tconst allow = [...(filter?.allow ?? [])];\n\tconst block = [...(filter?.block ?? [])];\n\t// Strict UAC: a shipped profile is the complete authority grant. Grant-all must be explicit.\n\tif (allow.length === 0 && block.length === 0) return { allow: [], block: [\"\"] };\n\treturn { allow, block };\n}\n\nfunction resolveWriteRoots(cwd: string, writePaths: readonly string[]): string[] {\n\treturn writePaths.map((entry) => (path.isAbsolute(entry) ? path.resolve(entry) : path.resolve(cwd, entry)));\n}\n\nfunction createLaneTools(\n\tcwd: string,\n\tnames: readonly string[],\n\treadMemory?: (query: string) => Promise<string>,\n\texecutionPolicy?: OrchestrationExecutionPolicy,\n\tprocessMaxWallClockMs = 0,\n): AgentTool[] {\n\tconst factories = new Map<string, () => AgentTool>([\n\t\t[\"read\", () => createReadTool(cwd)],\n\t\t[\"grep\", () => createGrepTool(cwd)],\n\t\t[\"find\", () => createFindTool(cwd)],\n\t\t[\"ls\", () => createLsTool(cwd)],\n\t\t[\"write\", () => createWriteTool(cwd)],\n\t\t[\"edit\", () => createEditTool(cwd)],\n\t]);\n\tif (executionPolicy) {\n\t\tfactories.set(PROCESS_LANE_TOOL_NAME, () =>\n\t\t\tcreateRunProcessTool(cwd, { policy: executionPolicy, maxWallClockMs: processMaxWallClockMs }),\n\t\t);\n\t}\n\tif (readMemory) {\n\t\tfactories.set(MEMORY_LANE_TOOL_NAME, () => ({\n\t\t\tname: MEMORY_LANE_TOOL_NAME,\n\t\t\tlabel: \"Read Memory\",\n\t\t\tdescription:\n\t\t\t\t\"Retrieve bounded, source-labeled standing memory relevant to this delegated task. Read-only: no memory writes or lifecycle actions are available.\",\n\t\t\tparameters: laneMemorySchema,\n\t\t\texecute: async (_toolCallId, params) => {\n\t\t\t\tconst { query } = params as LaneMemoryParams;\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ type: \"text\" as const, text: await readMemory(query) }],\n\t\t\t\t\tdetails: { readOnly: true },\n\t\t\t\t};\n\t\t\t},\n\t\t}));\n\t}\n\treturn names.flatMap((name) => {\n\t\tconst factory = factories.get(name);\n\t\treturn factory ? [factory()] : [];\n\t});\n}\n\n/*\n Materialize a fresh, fail-closed tool surface for one isolated lane.\n \n Profiles select only from classified built-ins. Opaque extension tools, shell, memory, goals,\n * and `delegate` are never candidates, so a wildcard cannot manufacture unknown authority or\n * recursively spawn more workers. Write/edit additionally require the explicit worker write switch\n * and a non-empty path scope; research therefore stays read-only regardless of profile contents.\n */\nexport function createLaneToolSurface(options: LaneToolSurfaceOptions): LaneToolSurface {\n\tconst writeCapable = options.writeEnabled === true && (options.writePaths?.length ?? 0) > 0;\n\tconst candidateNames = [\n\t\t...READ_ONLY_LANE_TOOL_NAMES,\n\t\t...(options.readMemory ? [MEMORY_LANE_TOOL_NAME] : []),\n\t\t...(writeCapable ? WRITE_LANE_TOOL_NAMES : []),\n\t\t...(options.executionPolicy ? [PROCESS_LANE_TOOL_NAME] : []),\n\t];\n\tconst patterns = strictLaneProfilePatterns(options.profile);\n\tconst compiledToolNames = new Set(options.grant?.allowedTools ?? []);\n\tconst deniedTools = candidateNames.filter((name) =>\n\t\toptions.grant ? !compiledToolNames.has(name) : matchesResourceProfilePattern(name, patterns.block),\n\t);\n\tconst unboundAllowPatterns = options.grant\n\t\t? []\n\t\t: patterns.allow.filter(\n\t\t\t\t(pattern) => !candidateNames.some((name) => matchesResourceProfilePattern(name, [pattern])),\n\t\t\t);\n\tconst allowedTools = options.grant\n\t\t? candidateNames.filter((name) => compiledToolNames.has(name))\n\t\t: candidateNames.filter(\n\t\t\t\t(name) =>\n\t\t\t\t\t(patterns.allow.length === 0 \|\| matchesResourceProfilePattern(name, patterns.allow)) &&\n\t\t\t\t\t!matchesResourceProfilePattern(name, patterns.block),\n\t\t\t);\n\tconst allowedToolSet = new Set<string>(allowedTools);\n\tconst manifestsByName = new Map(options.toolManifests?.map((manifest) => [manifest.toolName, manifest]) ?? []);\n\tif (options.grant?.allowedTools.some((name) => !manifestsByName.has(name))) {\n\t\tthrow new Error(\"Compiled lane grant references a tool without a capability manifest.\");\n\t}\n\tconst gateway = options.grant ? new CapabilityGateway({ grant: options.grant, cwd: options.cwd }) : undefined;\n\tconst deniedPaths = options.deniedPaths?.map((entry) => path.resolve(entry));\n\tconst readEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-read-tools\",\n\t\tcapabilities: [\n\t\t\t\"filesystem.read\",\n\t\t\t...(allowedToolSet.has(MEMORY_LANE_TOOL_NAME) ? ([\"memory.query\"] as const) : []),\n\t\t\t...(allowedToolSet.has(PROCESS_LANE_TOOL_NAME) ? ([\"process.exec\"] as const) : []),\n\t\t],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: [path.resolve(options.cwd)],\n\t\t...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),\n\t};\n\tconst writeEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-write-tools\",\n\t\tcapabilities: [\"filesystem.write\"],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: resolveWriteRoots(options.cwd, options.writePaths ?? []),\n\t\t...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),\n\t};\n\n\treturn {\n\t\ttools: createLaneTools(\n\t\t\toptions.cwd,\n\t\t\tallowedTools,\n\t\t\toptions.readMemory,\n\t\t\toptions.executionPolicy,\n\t\t\toptions.processMaxWallClockMs,\n\t\t),\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tunboundAllowPatterns,\n\t\tbeforeToolCall: async ({ toolCall, args }) => {\n\t\t\tif (!allowedToolSet.has(toolCall.name)) {\n\t\t\t\treturn { block: true, reason: `Lane tool '${toolCall.name}' is outside the materialized UAC surface.` };\n\t\t\t}\n\t\t\tif (gateway) {\n\t\t\t\tconst manifest = manifestsByName.get(toolCall.name);\n\t\t\t\tif (!manifest) {\n\t\t\t\t\treturn { block: true, reason: `Lane tool '${toolCall.name}' has no compiled capability manifest.` };\n\t\t\t\t}\n\t\t\t\ttry {\n\t\t\t\t\tgateway.authorizeToolCall(manifest, toolCall.name, args);\n\t\t\t\t\treturn undefined;\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (error instanceof CapabilityGatewayDeniedError) {\n\t\t\t\t\t\treturn { block: true, reason: `Lane tool blocked (${error.reasonCode}): ${error.message}` };\n\t\t\t\t\t}\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst outcome = evaluateToolGate({\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\targs,\n\t\t\t\tcwd: options.cwd,\n\t\t\t\tenvelope: WRITE_LANE_TOOL_NAME_SET.has(toolCall.name) ? writeEnvelope : readEnvelope,\n\t\t\t});\n\t\t\tif (outcome.outcome === \"allow\") return undefined;\n\t\t\treturn {\n\t\t\t\tblock: true,\n\t\t\t\treason: `Lane tool blocked (${outcome.reasonCode}): ${outcome.message ?? \"capability gate denied it\"}`,\n\t\t\t};\n\t\t},\n\t\t...(gateway ? { gateway } : {}),\n\t};\n}\n"]}
1	+ {"version":3,"file":"lane-tool-surface.js","sourceRoot":"","sources":["../../../src/core/autonomy/lane-tool-surface.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAe,IAAI,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EACN,iBAAiB,EACjB,4BAA4B,GAE5B,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EAAE,mCAAmC,EAAE,MAAM,yCAAyC,CAAC;AAC9F,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAU,CAAC;AAC1E,MAAM,qBAAqB,GAAG,QAAiB,CAAC;AAChD,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAU,CAAC;AACzD,MAAM,sBAAsB,GAAG,aAAsB,CAAC;AACtD,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAC1C,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;QAClB,SAAS,EAAE,2BAA2B;QACtC,WAAW,EAAE,6DAA6D;KAC1E,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAS,qBAAqB,CAAC,CAAC;AAqCxE,SAAS,yBAAyB,CAAC,OAAsC,EAGvE;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;IACvC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,6FAA6F;IAC7F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IACjF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAAA,CACxB;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,UAA6B,EAAY;IAChF,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAAA,CAC5G;AAED,SAAS,eAAe,CACvB,GAAW,EACX,KAAwB,EACxB,UAA+C,EAC/C,eAA8C,EAC9C,qBAAqB,GAAG,CAAC,EACX;IACd,MAAM,SAAS,GAAG,IAAI,GAAG,CAA0B;QAClD,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,eAAe,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAC1C,oBAAoB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,qBAAqB,EAAE,CAAC,CAC7F,CAAC;IACH,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QAChB,SAAS,CAAC,GAAG,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,IAAI,EAAE,qBAAqB;YAC3B,KAAK,EAAE,aAAa;YACpB,WAAW,EACV,mJAAmJ;YACpJ,UAAU,EAAE,gBAAgB;YAC5B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC;gBACvC,MAAM,KAAK,GAAI,MAA2B,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;gBACzD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;oBAC1D,MAAM,IAAI,KAAK,CACd,2DAA2D,2BAA2B,cAAc,CACpG,CAAC;gBACH,CAAC;gBACD,OAAO;oBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC3B,CAAC;YAAA,CACF;SACD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAAA,CAC5E,CAAC,CAAC;AAAA,CACH;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA+B,EAAmB;IACvF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5F,MAAM,cAAc,GAAG;QACtB,GAAG,yBAAyB;QAC5B,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;IACF,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAClD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAClG,CAAC;IACF,MAAM,oBAAoB,GAAG,OAAO,CAAC,KAAK;QACzC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CACrB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,6BAA6B,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAC3F,CAAC;IACJ,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK;QACjC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9D,CAAC,CAAC,cAAc,CAAC,MAAM,CACrB,CAAC,IAAI,EAAE,EAAE,CACR,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YACpF,CAAC,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CACrD,CAAC;IACJ,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,YAAY,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/G,IAAI,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK;QAC5B,CAAC,CAAC,IAAI,iBAAiB,CAAC;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrF,CAAC;QACH,CAAC,CAAC,SAAS,CAAC;IACb,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAuB;QACxC,EAAE,EAAE,0BAA0B;QAC9B,YAAY,EAAE;YACb,iBAAiB;YACjB,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAE,CAAC,cAAc,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAE,CAAC,cAAc,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF;QACD,YAAY;QACZ,WAAW;QACX,YAAY,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzC,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IACF,MAAM,aAAa,GAAuB;QACzC,EAAE,EAAE,2BAA2B;QAC/B,YAAY,EAAE,CAAC,kBAAkB,CAAC;QAClC,YAAY;QACZ,WAAW;QACX,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QACtE,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IAEF,OAAO;QACN,KAAK,EAAE,eAAe,CACrB,OAAO,CAAC,GAAG,EACX,YAAY,EACZ,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,qBAAqB,CAC7B;QACD,YAAY;QACZ,WAAW;QACX,oBAAoB;QACpB,cAAc,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,QAAQ,CAAC,IAAI,4CAA4C,EAAE,CAAC;YACzG,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACf,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,QAAQ,CAAC,IAAI,wCAAwC,EAAE,CAAC;gBACrG,CAAC;gBACD,IAAI,CAAC;oBACJ,OAAO,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBACzD,OAAO,SAAS,CAAC;gBAClB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;wBACnD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,KAAK,CAAC,UAAU,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC7F,CAAC;oBACD,MAAM,KAAK,CAAC;gBACb,CAAC;YACF,CAAC;YACD,MAAM,OAAO,GAAG,gBAAgB,CAAC;gBAChC,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,IAAI;gBACJ,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,QAAQ,EAAE,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY;aACpF,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;gBAAE,OAAO,SAAS,CAAC;YAClD,OAAO;gBACN,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,sBAAsB,OAAO,CAAC,UAAU,MAAM,OAAO,CAAC,OAAO,IAAI,2BAA2B,EAAE;aACtG,CAAC;QAAA,CACF;QACD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/B,CAAC;AAAA,CACF","sourcesContent":["import path from \"node:path\";\nimport type { AgentLoopConfig, AgentTool } from \"@caupulican/pi-agent-core\";\nimport { type Static, Type } from \"typebox\";\nimport {\n\tCapabilityGateway,\n\tCapabilityGatewayDeniedError,\n\ttype GatewayInitialUsage,\n} from \"../orchestration/capability-gateway.ts\";\nimport type {\n\tExecutionGrant,\n\tOrchestrationExecutionPolicy,\n\tToolCapabilityManifest,\n} from \"../orchestration/contracts.ts\";\nimport type { NormalizedProfile } from \"../profile-registry.ts\";\nimport { wrapToolWithCredentialExposureGuard } from \"../secrets/credential-exposure-guard.ts\";\nimport { matchesResourceProfilePattern } from \"../settings-manager.ts\";\nimport { createEditTool } from \"../tools/edit.ts\";\nimport { createFindTool } from \"../tools/find.ts\";\nimport { createGrepTool } from \"../tools/grep.ts\";\nimport { createLsTool } from \"../tools/ls.ts\";\nimport { createReadTool } from \"../tools/read.ts\";\nimport { createRunProcessTool } from \"../tools/run-process.ts\";\nimport { createWriteTool } from \"../tools/write.ts\";\nimport type { CapabilityEnvelope } from \"./contracts.ts\";\nimport { evaluateToolGate } from \"./gates.ts\";\n\nconst READ_ONLY_LANE_TOOL_NAMES = [\"read\", \"grep\", \"find\", \"ls\"] as const;\nconst MEMORY_LANE_TOOL_NAME = \"memory\" as const;\nconst WRITE_LANE_TOOL_NAMES = [\"write\", \"edit\"] as const;\nconst PROCESS_LANE_TOOL_NAME = \"run_process\" as const;\nconst MAX_LANE_MEMORY_QUERY_CHARS = 4_096;\nconst laneMemorySchema = Type.Object({\n\tquery: Type.String({\n\t\tmaxLength: MAX_LANE_MEMORY_QUERY_CHARS,\n\t\tdescription: \"What relevant standing memory or prior evidence to retrieve\",\n\t}),\n});\ntype LaneMemoryParams = Static<typeof laneMemorySchema>;\nconst WRITE_LANE_TOOL_NAME_SET = new Set<string>(WRITE_LANE_TOOL_NAMES);\n\nexport interface LaneToolSurface {\n\t/** Fresh tools owned by this lane only; no foreground tool instances or extension state leak in. /\n\ttools: AgentTool[];\n\t/* Exact names after profile globs are expanded. Safe to persist in a capability envelope. /\n\tallowedTools: string[];\n\t/* Exact safe-candidate names denied by the profile's block patterns. /\n\tdeniedTools: string[];\n\t/* Explicit grants that bind to no classified lane candidate (opaque tools stay fail-closed). /\n\tunboundAllowPatterns: string[];\n\t/* Per-call path and capability gate for the isolated child loop. /\n\tbeforeToolCall: NonNullable<AgentLoopConfig[\"beforeToolCall\"]>;\n\t/* Canonical cumulative authority/budget meter for a compiled worker grant. /\n\tgateway?: CapabilityGateway;\n}\n\nexport interface LaneToolSurfaceOptions {\n\tcwd: string;\n\tprofile?: NormalizedProfile;\n\t/* Private harness state that generic file tools must never traverse. /\n\tdeniedPaths?: readonly string[];\n\t/* Orchestrator-requested, policy-filtered read-only memory retrieval. Omitted means no memory tool. /\n\treadMemory?: (query: string) => Promise<string>;\n\t/* Research never sets this. Workers require both this flag and at least one write path. /\n\twriteEnabled?: boolean;\n\twritePaths?: readonly string[];\n\t/* Present only for process-capable owner profiles; absent means no process tool is materialized. /\n\texecutionPolicy?: OrchestrationExecutionPolicy;\n\tprocessMaxWallClockMs?: number;\n\t/* Compiled policy path. When present, it is the only authorization source for this surface. /\n\tgrant?: ExecutionGrant;\n\ttoolManifests?: readonly ToolCapabilityManifest[];\n\t/* Durable cumulative active usage to seed the compiled grant's gateway on resume. /\n\tinitialUsage?: GatewayInitialUsage;\n}\n\nfunction strictLaneProfilePatterns(profile: NormalizedProfile \| undefined): {\n\tallow: string[];\n\tblock: string[];\n} {\n\tif (!profile) return { allow: [], block: [] };\n\tconst filter = profile.resources.tools;\n\tconst allow = [...(filter?.allow ?? [])];\n\tconst block = [...(filter?.block ?? [])];\n\t// Strict UAC: a shipped profile is the complete authority grant. Grant-all must be explicit.\n\tif (allow.length === 0 && block.length === 0) return { allow: [], block: [\"\"] };\n\treturn { allow, block };\n}\n\nfunction resolveWriteRoots(cwd: string, writePaths: readonly string[]): string[] {\n\treturn writePaths.map((entry) => (path.isAbsolute(entry) ? path.resolve(entry) : path.resolve(cwd, entry)));\n}\n\nfunction createLaneTools(\n\tcwd: string,\n\tnames: readonly string[],\n\treadMemory?: (query: string) => Promise<string>,\n\texecutionPolicy?: OrchestrationExecutionPolicy,\n\tprocessMaxWallClockMs = 0,\n): AgentTool[] {\n\tconst factories = new Map<string, () => AgentTool>([\n\t\t[\"read\", () => createReadTool(cwd)],\n\t\t[\"grep\", () => createGrepTool(cwd)],\n\t\t[\"find\", () => createFindTool(cwd)],\n\t\t[\"ls\", () => createLsTool(cwd)],\n\t\t[\"write\", () => createWriteTool(cwd)],\n\t\t[\"edit\", () => createEditTool(cwd)],\n\t]);\n\tif (executionPolicy) {\n\t\tfactories.set(PROCESS_LANE_TOOL_NAME, () =>\n\t\t\tcreateRunProcessTool(cwd, { policy: executionPolicy, maxWallClockMs: processMaxWallClockMs }),\n\t\t);\n\t}\n\tif (readMemory) {\n\t\tfactories.set(MEMORY_LANE_TOOL_NAME, () => ({\n\t\t\tname: MEMORY_LANE_TOOL_NAME,\n\t\t\tlabel: \"Read Memory\",\n\t\t\tdescription:\n\t\t\t\t\"Retrieve bounded, source-labeled standing memory relevant to this delegated task. Read-only: no memory writes or lifecycle actions are available.\",\n\t\t\tparameters: laneMemorySchema,\n\t\t\texecute: async (_toolCallId, params) => {\n\t\t\t\tconst query = (params as LaneMemoryParams).query?.trim();\n\t\t\t\tif (!query \|\| query.length > MAX_LANE_MEMORY_QUERY_CHARS) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`memory_query_invalid: query must contain from 1 through ${MAX_LANE_MEMORY_QUERY_CHARS} characters.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ type: \"text\" as const, text: await readMemory(query) }],\n\t\t\t\t\tdetails: { readOnly: true },\n\t\t\t\t};\n\t\t\t},\n\t\t}));\n\t}\n\treturn names.flatMap((name) => {\n\t\tconst factory = factories.get(name);\n\t\treturn factory ? [wrapToolWithCredentialExposureGuard(factory(), cwd)] : [];\n\t});\n}\n\n/*\n Materialize a fresh, fail-closed tool surface for one isolated lane.\n \n Profiles select only from classified built-ins. Opaque extension tools, shell, memory, goals,\n * and `delegate` are never candidates, so a wildcard cannot manufacture unknown authority or\n * recursively spawn more workers. Write/edit additionally require the explicit worker write switch\n * and a non-empty path scope; research therefore stays read-only regardless of profile contents.\n */\nexport function createLaneToolSurface(options: LaneToolSurfaceOptions): LaneToolSurface {\n\tconst writeCapable = options.writeEnabled === true && (options.writePaths?.length ?? 0) > 0;\n\tconst candidateNames = [\n\t\t...READ_ONLY_LANE_TOOL_NAMES,\n\t\t...(options.readMemory ? [MEMORY_LANE_TOOL_NAME] : []),\n\t\t...(writeCapable ? WRITE_LANE_TOOL_NAMES : []),\n\t\t...(options.executionPolicy ? [PROCESS_LANE_TOOL_NAME] : []),\n\t];\n\tconst patterns = strictLaneProfilePatterns(options.profile);\n\tconst compiledToolNames = new Set(options.grant?.allowedTools ?? []);\n\tconst deniedTools = candidateNames.filter((name) =>\n\t\toptions.grant ? !compiledToolNames.has(name) : matchesResourceProfilePattern(name, patterns.block),\n\t);\n\tconst unboundAllowPatterns = options.grant\n\t\t? []\n\t\t: patterns.allow.filter(\n\t\t\t\t(pattern) => !candidateNames.some((name) => matchesResourceProfilePattern(name, [pattern])),\n\t\t\t);\n\tconst allowedTools = options.grant\n\t\t? candidateNames.filter((name) => compiledToolNames.has(name))\n\t\t: candidateNames.filter(\n\t\t\t\t(name) =>\n\t\t\t\t\t(patterns.allow.length === 0 \|\| matchesResourceProfilePattern(name, patterns.allow)) &&\n\t\t\t\t\t!matchesResourceProfilePattern(name, patterns.block),\n\t\t\t);\n\tconst allowedToolSet = new Set<string>(allowedTools);\n\tconst manifestsByName = new Map(options.toolManifests?.map((manifest) => [manifest.toolName, manifest]) ?? []);\n\tif (options.grant?.allowedTools.some((name) => !manifestsByName.has(name))) {\n\t\tthrow new Error(\"Compiled lane grant references a tool without a capability manifest.\");\n\t}\n\tconst gateway = options.grant\n\t\t? new CapabilityGateway({\n\t\t\t\tgrant: options.grant,\n\t\t\t\tcwd: options.cwd,\n\t\t\t\t...(options.initialUsage !== undefined ? { initialUsage: options.initialUsage } : {}),\n\t\t\t})\n\t\t: undefined;\n\tconst deniedPaths = options.deniedPaths?.map((entry) => path.resolve(entry));\n\tconst readEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-read-tools\",\n\t\tcapabilities: [\n\t\t\t\"filesystem.read\",\n\t\t\t...(allowedToolSet.has(MEMORY_LANE_TOOL_NAME) ? ([\"memory.query\"] as const) : []),\n\t\t\t...(allowedToolSet.has(PROCESS_LANE_TOOL_NAME) ? ([\"process.exec\"] as const) : []),\n\t\t],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: [path.resolve(options.cwd)],\n\t\t...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),\n\t};\n\tconst writeEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-write-tools\",\n\t\tcapabilities: [\"filesystem.write\"],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: resolveWriteRoots(options.cwd, options.writePaths ?? []),\n\t\t...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),\n\t};\n\n\treturn {\n\t\ttools: createLaneTools(\n\t\t\toptions.cwd,\n\t\t\tallowedTools,\n\t\t\toptions.readMemory,\n\t\t\toptions.executionPolicy,\n\t\t\toptions.processMaxWallClockMs,\n\t\t),\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tunboundAllowPatterns,\n\t\tbeforeToolCall: async ({ toolCall, args }) => {\n\t\t\tif (!allowedToolSet.has(toolCall.name)) {\n\t\t\t\treturn { block: true, reason: `Lane tool '${toolCall.name}' is outside the materialized UAC surface.` };\n\t\t\t}\n\t\t\tif (gateway) {\n\t\t\t\tconst manifest = manifestsByName.get(toolCall.name);\n\t\t\t\tif (!manifest) {\n\t\t\t\t\treturn { block: true, reason: `Lane tool '${toolCall.name}' has no compiled capability manifest.` };\n\t\t\t\t}\n\t\t\t\ttry {\n\t\t\t\t\tgateway.authorizeToolCall(manifest, toolCall.name, args);\n\t\t\t\t\treturn undefined;\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (error instanceof CapabilityGatewayDeniedError) {\n\t\t\t\t\t\treturn { block: true, reason: `Lane tool blocked (${error.reasonCode}): ${error.message}` };\n\t\t\t\t\t}\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst outcome = evaluateToolGate({\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\targs,\n\t\t\t\tcwd: options.cwd,\n\t\t\t\tenvelope: WRITE_LANE_TOOL_NAME_SET.has(toolCall.name) ? writeEnvelope : readEnvelope,\n\t\t\t});\n\t\t\tif (outcome.outcome === \"allow\") return undefined;\n\t\t\treturn {\n\t\t\t\tblock: true,\n\t\t\t\treason: `Lane tool blocked (${outcome.reasonCode}): ${outcome.message ?? \"capability gate denied it\"}`,\n\t\t\t};\n\t\t},\n\t\t...(gateway ? { gateway } : {}),\n\t};\n}\n"]}

package/dist/core/autonomy/path-scope.d.ts CHANGED Viewed

@@ -5,5 +5,19 @@ import type { PathScope, PathScopeDecision } from "./contracts.ts";
  * remainder, ensuring that any symlinks in the existing path prefix are expanded.
  */
 export declare function safeRealpathSync(targetPath: string): string;
+/**
+ * Stable lexical scope identity for durable planners. Windows drive and UNC paths are normalized
+ * case-insensitively even when a WSL process is only comparing them and cannot realpath them.
+ */
+export declare function canonicalPathScopeIdentity(value: string): string;
+/**
+ * Boundary-safe lexical containment for already-resolved paths and portable scope planning.
+ * Windows drive and UNC paths compare case-insensitively; native POSIX paths remain case-sensitive.
+ * This deliberately does not resolve symlinks — callers that authorize filesystem access must first
+ * use {@link safeRealpathSync}.
+ */
+export declare function isPathWithinScope(targetPath: string, scopeRoot: string): boolean;
+/** True when either scope contains the other, including an exact match. */
+export declare function pathScopesOverlap(firstScope: string, secondScope: string): boolean;
 export declare function checkPathScope(scope: PathScope, targetPath: string): PathScopeDecision;
 //# sourceMappingURL=path-scope.d.ts.map

package/dist/core/autonomy/path-scope.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"path-scope.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/path-scope.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAOnE;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3D;~~AAiDD~~,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,iBAAiB,CAqGtF","sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport type { PathScope, PathScopeDecision } from \"./contracts.ts\";\n\n// Bounds the symlink-following recursion in resolveSafely: a chain of dangling links is finite\n// in practice, and a genuine symlink cycle (a -> b -> a) must fail closed with a throw rather\n// than recurse forever.\nconst MAX_SYMLINK_HOPS = 32;\n\n/*\n Resolves the real path of a target. If the target does not exist, it recursively\n * resolves the deepest existing parent directory and then appends the non-existent\n * remainder, ensuring that any symlinks in the existing path prefix are expanded.\n */\nexport function safeRealpathSync(targetPath: string): string {\n\treturn resolveSafely(path.resolve(targetPath), 0);\n}\n\nfunction resolveSafely(absolutePath: string, hops: number): string {\n\tif (hops > MAX_SYMLINK_HOPS) {\n\t\tthrow new Error(`safeRealpathSync: exceeded ${MAX_SYMLINK_HOPS} symlink hops resolving \"${absolutePath}\"`);\n\t}\n\n\tif (fs.existsSync(absolutePath)) {\n\t\treturn fs.realpathSync(absolutePath);\n\t}\n\n\t// existsSync FOLLOWS symlinks, so it reports false for a DANGLING link (the link exists but\n\t// its target does not) — the same as a path that plain doesn't exist at all. Without this\n\t// lstat check, a dangling leaf would fall straight into the lexical parent-join below, never\n\t// dereferencing the link itself. That would let a dangling symlink placed inside an allowed\n\t// root smuggle writes to wherever it points, since the write itself (e.g. writeFileSync) DOES\n\t// follow the link. lstatSync throws ENOENT for a path that truly doesn't exist anywhere in\n\t// the chain — that case falls through to the parent-recursion branch below, unchanged.\n\tlet lstat: ReturnType<typeof fs.lstatSync> \| undefined;\n\ttry {\n\t\tlstat = fs.lstatSync(absolutePath);\n\t} catch {\n\t\tlstat = undefined;\n\t}\n\n\tif (lstat?.isSymbolicLink()) {\n\t\tconst linkTarget = fs.readlinkSync(absolutePath);\n\t\tconst resolvedParent = resolveSafely(path.dirname(absolutePath), hops + 1);\n\t\tconst resolvedTarget = path.isAbsolute(linkTarget)\n\t\t\t? path.resolve(linkTarget)\n\t\t\t: path.resolve(resolvedParent, linkTarget);\n\t\treturn resolveSafely(resolvedTarget, hops + 1);\n\t}\n\n\tconst parent = path.dirname(absolutePath);\n\t// Base case: if parent is the same as absolutePath, we've hit the root\n\tif (parent === absolutePath) {\n\t\treturn absolutePath;\n\t}\n\n\tconst resolvedParent = resolveSafely(parent, hops + 1);\n\treturn path.join(resolvedParent, path.basename(absolutePath));\n}\n\nfunction ~~isPathInside~~(~~target~~: string, ~~root~~: string): ~~boolean~~ {\n\tconst ~~rootWithSep~~ = ~~root~~.~~endsWith~~(path.~~sep)~~ ? ~~root~~ : `${~~root~~}${~~path.sep~~}~~`;\~~n\~~treturn~~ target ~~===~~ root \|\| target.startsWith(~~rootWithSep~~);\n}\n\nexport function checkPathScope(scope: PathScope, targetPath: string): PathScopeDecision {\n\tif (!targetPath) {\n\t\treturn {\n\t\t\tkind: \"missing\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"empty_path\",\n\t\t};\n\t}\n\n\tlet resolvedTarget: string;\n\ttry {\n\t\tresolvedTarget = safeRealpathSync(targetPath);\n\t} catch {\n\t\t// If we can't resolve the path at all (e.g. permission error), fail safely\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"unresolvable_target\",\n\t\t};\n\t}\n\n\tlet resolvedRoot: string;\n\ttry {\n\t\tresolvedRoot = safeRealpathSync(scope.root);\n\t} catch {\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"unresolvable_root\",\n\t\t};\n\t}\n\n\t// First, it must be inside the main root\n\tif (!~~isPathInside~~(resolvedTarget, resolvedRoot)) {\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\tresolvedPath: resolvedTarget,\n\t\t\treasonCode: \"outside_root\",\n\t\t};\n\t}\n\n\t// Check deniedPaths (overrides allowedPaths)\n\tif (scope.deniedPaths && scope.deniedPaths.length > 0) {\n\t\tfor (const denied of scope.deniedPaths) {\n\t\t\ttry {\n\t\t\t\tconst resolvedDenied = safeRealpathSync(denied);\n\t\t\t\tif (~~isPathInside~~(resolvedTarget, resolvedDenied)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tkind: \"denied\",\n\t\t\t\t\t\tpath: targetPath,\n\t\t\t\t\t\tresolvedPath: resolvedTarget,\n\t\t\t\t\t\tmatchedRule: denied,\n\t\t\t\t\t\treasonCode: \"matches_denied_path\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} catch {}\n\t\t}\n\t}\n\n\t// Check allowedPaths\n\tif (scope.allowedPaths && scope.allowedPaths.length > 0) {\n\t\tlet isAllowed = false;\n\t\tlet matchedAllowed: string \| undefined;\n\n\t\tfor (const allowed of scope.allowedPaths) {\n\t\t\ttry {\n\t\t\t\tconst resolvedAllowed = safeRealpathSync(allowed);\n\t\t\t\tif (~~isPathInside~~(resolvedTarget, resolvedAllowed)) {\n\t\t\t\t\tisAllowed = true;\n\t\t\t\t\tmatchedAllowed = allowed;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t} catch {}\n\t\t}\n\n\t\tif (!isAllowed) {\n\t\t\treturn {\n\t\t\t\tkind: \"outside\",\n\t\t\t\tpath: targetPath,\n\t\t\t\tresolvedPath: resolvedTarget,\n\t\t\t\treasonCode: \"outside_allowed_paths\",\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tkind: \"inside\",\n\t\t\tpath: targetPath,\n\t\t\tresolvedPath: resolvedTarget,\n\t\t\tmatchedRule: matchedAllowed,\n\t\t\treasonCode: \"inside_allowed_paths\",\n\t\t};\n\t}\n\n\treturn {\n\t\tkind: \"inside\",\n\t\tpath: targetPath,\n\t\tresolvedPath: resolvedTarget,\n\t\tmatchedRule: scope.root,\n\t\treasonCode: \"inside_root\",\n\t};\n}\n"]}
1	+ {"version":3,"file":"path-scope.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/path-scope.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAOnE;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3D;AAyDD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAShF;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAElF;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,iBAAiB,CAqGtF","sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport type { PathScope, PathScopeDecision } from \"./contracts.ts\";\n\n// Bounds the symlink-following recursion in resolveSafely: a chain of dangling links is finite\n// in practice, and a genuine symlink cycle (a -> b -> a) must fail closed with a throw rather\n// than recurse forever.\nconst MAX_SYMLINK_HOPS = 32;\n\n/*\n Resolves the real path of a target. If the target does not exist, it recursively\n * resolves the deepest existing parent directory and then appends the non-existent\n * remainder, ensuring that any symlinks in the existing path prefix are expanded.\n /\nexport function safeRealpathSync(targetPath: string): string {\n\treturn resolveSafely(path.resolve(targetPath), 0);\n}\n\nfunction resolveSafely(absolutePath: string, hops: number): string {\n\tif (hops > MAX_SYMLINK_HOPS) {\n\t\tthrow new Error(`safeRealpathSync: exceeded ${MAX_SYMLINK_HOPS} symlink hops resolving \"${absolutePath}\"`);\n\t}\n\n\tif (fs.existsSync(absolutePath)) {\n\t\treturn fs.realpathSync(absolutePath);\n\t}\n\n\t// existsSync FOLLOWS symlinks, so it reports false for a DANGLING link (the link exists but\n\t// its target does not) — the same as a path that plain doesn't exist at all. Without this\n\t// lstat check, a dangling leaf would fall straight into the lexical parent-join below, never\n\t// dereferencing the link itself. That would let a dangling symlink placed inside an allowed\n\t// root smuggle writes to wherever it points, since the write itself (e.g. writeFileSync) DOES\n\t// follow the link. lstatSync throws ENOENT for a path that truly doesn't exist anywhere in\n\t// the chain — that case falls through to the parent-recursion branch below, unchanged.\n\tlet lstat: ReturnType<typeof fs.lstatSync> \| undefined;\n\ttry {\n\t\tlstat = fs.lstatSync(absolutePath);\n\t} catch {\n\t\tlstat = undefined;\n\t}\n\n\tif (lstat?.isSymbolicLink()) {\n\t\tconst linkTarget = fs.readlinkSync(absolutePath);\n\t\tconst resolvedParent = resolveSafely(path.dirname(absolutePath), hops + 1);\n\t\tconst resolvedTarget = path.isAbsolute(linkTarget)\n\t\t\t? path.resolve(linkTarget)\n\t\t\t: path.resolve(resolvedParent, linkTarget);\n\t\treturn resolveSafely(resolvedTarget, hops + 1);\n\t}\n\n\tconst parent = path.dirname(absolutePath);\n\t// Base case: if parent is the same as absolutePath, we've hit the root\n\tif (parent === absolutePath) {\n\t\treturn absolutePath;\n\t}\n\n\tconst resolvedParent = resolveSafely(parent, hops + 1);\n\treturn path.join(resolvedParent, path.basename(absolutePath));\n}\n\nfunction usesWindowsPath(value: string): boolean {\n\treturn /^[a-zA-Z]:([\\\\/]\|$)/.test(value) \|\| value.startsWith(\"\\\\\\\\\") \|\| value.startsWith(\"//\");\n}\n\nfunction lexicalPathApi(...paths: readonly string[]): typeof path.posix \| typeof path.win32 {\n\treturn paths.some(usesWindowsPath) ? path.win32 : path.posix;\n}\n\nfunction canonicalPathScopeIdentityWithApi(value: string, pathApi: typeof path.posix \| typeof path.win32): string {\n\tconst resolved = pathApi.resolve(value);\n\treturn pathApi === path.win32 ? resolved.toLowerCase() : resolved;\n}\n\n/\n Stable lexical scope identity for durable planners. Windows drive and UNC paths are normalized\n * case-insensitively even when a WSL process is only comparing them and cannot realpath them.\n /\nexport function canonicalPathScopeIdentity(value: string): string {\n\treturn canonicalPathScopeIdentityWithApi(value, lexicalPathApi(value));\n}\n\n/\n Boundary-safe lexical containment for already-resolved paths and portable scope planning.\n * Windows drive and UNC paths compare case-insensitively; native POSIX paths remain case-sensitive.\n * This deliberately does not resolve symlinks — callers that authorize filesystem access must first\n * use {@link safeRealpathSync}.\n /\nexport function isPathWithinScope(targetPath: string, scopeRoot: string): boolean {\n\tconst pathApi = lexicalPathApi(targetPath, scopeRoot);\n\tconst target = canonicalPathScopeIdentityWithApi(targetPath, pathApi);\n\tconst root = canonicalPathScopeIdentityWithApi(scopeRoot, pathApi);\n\tconst relativePath = pathApi.relative(root, target);\n\treturn (\n\t\trelativePath === \"\" \|\|\n\t\t(!relativePath.startsWith(`..${pathApi.sep}`) && relativePath !== \"..\" && !pathApi.isAbsolute(relativePath))\n\t);\n}\n\n/* True when either scope contains the other, including an exact match. */\nexport function pathScopesOverlap(firstScope: string, secondScope: string): boolean {\n\treturn isPathWithinScope(firstScope, secondScope) \|\| isPathWithinScope(secondScope, firstScope);\n}\n\nexport function checkPathScope(scope: PathScope, targetPath: string): PathScopeDecision {\n\tif (!targetPath) {\n\t\treturn {\n\t\t\tkind: \"missing\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"empty_path\",\n\t\t};\n\t}\n\n\tlet resolvedTarget: string;\n\ttry {\n\t\tresolvedTarget = safeRealpathSync(targetPath);\n\t} catch {\n\t\t// If we can't resolve the path at all (e.g. permission error), fail safely\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"unresolvable_target\",\n\t\t};\n\t}\n\n\tlet resolvedRoot: string;\n\ttry {\n\t\tresolvedRoot = safeRealpathSync(scope.root);\n\t} catch {\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"unresolvable_root\",\n\t\t};\n\t}\n\n\t// First, it must be inside the main root\n\tif (!isPathWithinScope(resolvedTarget, resolvedRoot)) {\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\tresolvedPath: resolvedTarget,\n\t\t\treasonCode: \"outside_root\",\n\t\t};\n\t}\n\n\t// Check deniedPaths (overrides allowedPaths)\n\tif (scope.deniedPaths && scope.deniedPaths.length > 0) {\n\t\tfor (const denied of scope.deniedPaths) {\n\t\t\ttry {\n\t\t\t\tconst resolvedDenied = safeRealpathSync(denied);\n\t\t\t\tif (isPathWithinScope(resolvedTarget, resolvedDenied)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tkind: \"denied\",\n\t\t\t\t\t\tpath: targetPath,\n\t\t\t\t\t\tresolvedPath: resolvedTarget,\n\t\t\t\t\t\tmatchedRule: denied,\n\t\t\t\t\t\treasonCode: \"matches_denied_path\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} catch {}\n\t\t}\n\t}\n\n\t// Check allowedPaths\n\tif (scope.allowedPaths && scope.allowedPaths.length > 0) {\n\t\tlet isAllowed = false;\n\t\tlet matchedAllowed: string \| undefined;\n\n\t\tfor (const allowed of scope.allowedPaths) {\n\t\t\ttry {\n\t\t\t\tconst resolvedAllowed = safeRealpathSync(allowed);\n\t\t\t\tif (isPathWithinScope(resolvedTarget, resolvedAllowed)) {\n\t\t\t\t\tisAllowed = true;\n\t\t\t\t\tmatchedAllowed = allowed;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t} catch {}\n\t\t}\n\n\t\tif (!isAllowed) {\n\t\t\treturn {\n\t\t\t\tkind: \"outside\",\n\t\t\t\tpath: targetPath,\n\t\t\t\tresolvedPath: resolvedTarget,\n\t\t\t\treasonCode: \"outside_allowed_paths\",\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tkind: \"inside\",\n\t\t\tpath: targetPath,\n\t\t\tresolvedPath: resolvedTarget,\n\t\t\tmatchedRule: matchedAllowed,\n\t\t\treasonCode: \"inside_allowed_paths\",\n\t\t};\n\t}\n\n\treturn {\n\t\tkind: \"inside\",\n\t\tpath: targetPath,\n\t\tresolvedPath: resolvedTarget,\n\t\tmatchedRule: scope.root,\n\t\treasonCode: \"inside_root\",\n\t};\n}\n"]}

package/dist/core/autonomy/path-scope.js CHANGED Viewed

@@ -49,9 +49,40 @@ function resolveSafely(absolutePath, hops) {
     const resolvedParent = resolveSafely(parent, hops + 1);
     return path.join(resolvedParent, path.basename(absolutePath));
 }
-function isPathInside(target, root) {
-    const rootWithSep = root.endsWith(path.sep) ? root : `${root}${path.sep}`;
-    return target === root || target.startsWith(rootWithSep);
+function usesWindowsPath(value) {
+    return /^[a-zA-Z]:([\\/]|$)/.test(value) || value.startsWith("\\\\") || value.startsWith("//");
+}
+function lexicalPathApi(...paths) {
+    return paths.some(usesWindowsPath) ? path.win32 : path.posix;
+}
+function canonicalPathScopeIdentityWithApi(value, pathApi) {
+    const resolved = pathApi.resolve(value);
+    return pathApi === path.win32 ? resolved.toLowerCase() : resolved;
+}
+/**
+ * Stable lexical scope identity for durable planners. Windows drive and UNC paths are normalized
+ * case-insensitively even when a WSL process is only comparing them and cannot realpath them.
+ */
+export function canonicalPathScopeIdentity(value) {
+    return canonicalPathScopeIdentityWithApi(value, lexicalPathApi(value));
+}
+/**
+ * Boundary-safe lexical containment for already-resolved paths and portable scope planning.
+ * Windows drive and UNC paths compare case-insensitively; native POSIX paths remain case-sensitive.
+ * This deliberately does not resolve symlinks — callers that authorize filesystem access must first
+ * use {@link safeRealpathSync}.
+ */
+export function isPathWithinScope(targetPath, scopeRoot) {
+    const pathApi = lexicalPathApi(targetPath, scopeRoot);
+    const target = canonicalPathScopeIdentityWithApi(targetPath, pathApi);
+    const root = canonicalPathScopeIdentityWithApi(scopeRoot, pathApi);
+    const relativePath = pathApi.relative(root, target);
+    return (relativePath === "" ||
+        (!relativePath.startsWith(`..${pathApi.sep}`) && relativePath !== ".." && !pathApi.isAbsolute(relativePath)));
+}
+/** True when either scope contains the other, including an exact match. */
+export function pathScopesOverlap(firstScope, secondScope) {
+    return isPathWithinScope(firstScope, secondScope) || isPathWithinScope(secondScope, firstScope);
 }
 export function checkPathScope(scope, targetPath) {
     if (!targetPath) {
@@ -85,7 +116,7 @@ export function checkPathScope(scope, targetPath) {
         };
     }
     // First, it must be inside the main root
-    if (!isPathInside(resolvedTarget, resolvedRoot)) {
+    if (!isPathWithinScope(resolvedTarget, resolvedRoot)) {
         return {
             kind: "outside",
             path: targetPath,
@@ -98,7 +129,7 @@ export function checkPathScope(scope, targetPath) {
         for (const denied of scope.deniedPaths) {
             try {
                 const resolvedDenied = safeRealpathSync(denied);
-                if (isPathInside(resolvedTarget, resolvedDenied)) {
+                if (isPathWithinScope(resolvedTarget, resolvedDenied)) {
                     return {
                         kind: "denied",
                         path: targetPath,
@@ -118,7 +149,7 @@ export function checkPathScope(scope, targetPath) {
         for (const allowed of scope.allowedPaths) {
             try {
                 const resolvedAllowed = safeRealpathSync(allowed);
-                if (isPathInside(resolvedTarget, resolvedAllowed)) {
+                if (isPathWithinScope(resolvedTarget, resolvedAllowed)) {
                     isAllowed = true;
                     matchedAllowed = allowed;
                     break;

package/dist/core/autonomy/path-scope.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"path-scope.js","sourceRoot":"","sources":["../../../src/core/autonomy/path-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,+FAA+F;AAC/F,8FAA8F;AAC9F,wBAAwB;AACxB,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAU;IAC5D,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;AAAA,CAClD;AAED,SAAS,aAAa,CAAC,YAAoB,EAAE,IAAY,EAAU;IAClE,IAAI,IAAI,GAAG,gBAAgB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,8BAA8B,gBAAgB,4BAA4B,YAAY,GAAG,CAAC,CAAC;IAC5G,CAAC;IAED,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IAED,4FAA4F;IAC5F,4FAA0F;IAC1F,6FAA6F;IAC7F,4FAA4F;IAC5F,8FAA8F;IAC9F,2FAA2F;IAC3F,yFAAuF;IACvF,IAAI,KAAkD,CAAC;IACvD,IAAI,CAAC;QACJ,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACR,KAAK,GAAG,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;QAC3E,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;YAC1B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAC5C,OAAO,aAAa,CAAC,cAAc,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1C,uEAAuE;IACvE,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC7B,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;AAAA,CAC9D;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,IAAY,EAAW;IAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1E,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAAA,CACzD;AAED,MAAM,UAAU,cAAc,CAAC,KAAgB,EAAE,UAAkB,EAAqB;IACvF,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO;YACN,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,YAAY;SACxB,CAAC;IACH,CAAC;IAED,IAAI,cAAsB,CAAC;IAC3B,IAAI,CAAC;QACJ,cAAc,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACR,2EAA2E;QAC3E,OAAO;YACN,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,qBAAqB;SACjC,CAAC;IACH,CAAC;IAED,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACJ,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO;YACN,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,mBAAmB;SAC/B,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,YAAY,CAAC,EAAE,CAAC;QACjD,OAAO;YACN,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,UAAU;YAChB,YAAY,EAAE,cAAc;YAC5B,UAAU,EAAE,cAAc;SAC1B,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,CAAC;gBACJ,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBAChD,IAAI,YAAY,CAAC,cAAc,EAAE,cAAc,CAAC,EAAE,CAAC;oBAClD,OAAO;wBACN,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,UAAU;wBAChB,YAAY,EAAE,cAAc;wBAC5B,WAAW,EAAE,MAAM;wBACnB,UAAU,EAAE,qBAAqB;qBACjC,CAAC;gBACH,CAAC;YACF,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACX,CAAC;IACF,CAAC;IAED,qBAAqB;IACrB,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzD,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,cAAkC,CAAC;QAEvC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACJ,MAAM,eAAe,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,YAAY,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,CAAC;oBACnD,SAAS,GAAG,IAAI,CAAC;oBACjB,cAAc,GAAG,OAAO,CAAC;oBACzB,MAAM;gBACP,CAAC;YACF,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACX,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,OAAO;gBACN,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,UAAU;gBAChB,YAAY,EAAE,cAAc;gBAC5B,UAAU,EAAE,uBAAuB;aACnC,CAAC;QACH,CAAC;QAED,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,UAAU;YAChB,YAAY,EAAE,cAAc;YAC5B,WAAW,EAAE,cAAc;YAC3B,UAAU,EAAE,sBAAsB;SAClC,CAAC;IACH,CAAC;IAED,OAAO;QACN,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE,cAAc;QAC5B,WAAW,EAAE,KAAK,CAAC,IAAI;QACvB,UAAU,EAAE,aAAa;KACzB,CAAC;AAAA,CACF","sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport type { PathScope, PathScopeDecision } from \"./contracts.ts\";\n\n// Bounds the symlink-following recursion in resolveSafely: a chain of dangling links is finite\n// in practice, and a genuine symlink cycle (a -> b -> a) must fail closed with a throw rather\n// than recurse forever.\nconst MAX_SYMLINK_HOPS = 32;\n\n/*\n Resolves the real path of a target. If the target does not exist, it recursively\n * resolves the deepest existing parent directory and then appends the non-existent\n * remainder, ensuring that any symlinks in the existing path prefix are expanded.\n */\nexport function safeRealpathSync(targetPath: string): string {\n\treturn resolveSafely(path.resolve(targetPath), 0);\n}\n\nfunction resolveSafely(absolutePath: string, hops: number): string {\n\tif (hops > MAX_SYMLINK_HOPS) {\n\t\tthrow new Error(`safeRealpathSync: exceeded ${MAX_SYMLINK_HOPS} symlink hops resolving \"${absolutePath}\"`);\n\t}\n\n\tif (fs.existsSync(absolutePath)) {\n\t\treturn fs.realpathSync(absolutePath);\n\t}\n\n\t// existsSync FOLLOWS symlinks, so it reports false for a DANGLING link (the link exists but\n\t// its target does not) — the same as a path that plain doesn't exist at all. Without this\n\t// lstat check, a dangling leaf would fall straight into the lexical parent-join below, never\n\t// dereferencing the link itself. That would let a dangling symlink placed inside an allowed\n\t// root smuggle writes to wherever it points, since the write itself (e.g. writeFileSync) DOES\n\t// follow the link. lstatSync throws ENOENT for a path that truly doesn't exist anywhere in\n\t// the chain — that case falls through to the parent-recursion branch below, unchanged.\n\tlet lstat: ReturnType<typeof fs.lstatSync> \| undefined;\n\ttry {\n\t\tlstat = fs.lstatSync(absolutePath);\n\t} catch {\n\t\tlstat = undefined;\n\t}\n\n\tif (lstat?.isSymbolicLink()) {\n\t\tconst linkTarget = fs.readlinkSync(absolutePath);\n\t\tconst resolvedParent = resolveSafely(path.dirname(absolutePath), hops + 1);\n\t\tconst resolvedTarget = path.isAbsolute(linkTarget)\n\t\t\t? path.resolve(linkTarget)\n\t\t\t: path.resolve(resolvedParent, linkTarget);\n\t\treturn resolveSafely(resolvedTarget, hops + 1);\n\t}\n\n\tconst parent = path.dirname(absolutePath);\n\t// Base case: if parent is the same as absolutePath, we've hit the root\n\tif (parent === absolutePath) {\n\t\treturn absolutePath;\n\t}\n\n\tconst resolvedParent = resolveSafely(parent, hops + 1);\n\treturn path.join(resolvedParent, path.basename(absolutePath));\n}\n\nfunction isPathInside(target: string, root: string): boolean {\n\tconst rootWithSep = root.endsWith(path.sep) ? root : `${root}${path.sep}`;\n\treturn target === root \|\| target.startsWith(rootWithSep);\n}\n\nexport function checkPathScope(scope: PathScope, targetPath: string): PathScopeDecision {\n\tif (!targetPath) {\n\t\treturn {\n\t\t\tkind: \"missing\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"empty_path\",\n\t\t};\n\t}\n\n\tlet resolvedTarget: string;\n\ttry {\n\t\tresolvedTarget = safeRealpathSync(targetPath);\n\t} catch {\n\t\t// If we can't resolve the path at all (e.g. permission error), fail safely\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"unresolvable_target\",\n\t\t};\n\t}\n\n\tlet resolvedRoot: string;\n\ttry {\n\t\tresolvedRoot = safeRealpathSync(scope.root);\n\t} catch {\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"unresolvable_root\",\n\t\t};\n\t}\n\n\t// First, it must be inside the main root\n\tif (!isPathInside(resolvedTarget, resolvedRoot)) {\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\tresolvedPath: resolvedTarget,\n\t\t\treasonCode: \"outside_root\",\n\t\t};\n\t}\n\n\t// Check deniedPaths (overrides allowedPaths)\n\tif (scope.deniedPaths && scope.deniedPaths.length > 0) {\n\t\tfor (const denied of scope.deniedPaths) {\n\t\t\ttry {\n\t\t\t\tconst resolvedDenied = safeRealpathSync(denied);\n\t\t\t\tif (isPathInside(resolvedTarget, resolvedDenied)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tkind: \"denied\",\n\t\t\t\t\t\tpath: targetPath,\n\t\t\t\t\t\tresolvedPath: resolvedTarget,\n\t\t\t\t\t\tmatchedRule: denied,\n\t\t\t\t\t\treasonCode: \"matches_denied_path\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} catch {}\n\t\t}\n\t}\n\n\t// Check allowedPaths\n\tif (scope.allowedPaths && scope.allowedPaths.length > 0) {\n\t\tlet isAllowed = false;\n\t\tlet matchedAllowed: string \| undefined;\n\n\t\tfor (const allowed of scope.allowedPaths) {\n\t\t\ttry {\n\t\t\t\tconst resolvedAllowed = safeRealpathSync(allowed);\n\t\t\t\tif (isPathInside(resolvedTarget, resolvedAllowed)) {\n\t\t\t\t\tisAllowed = true;\n\t\t\t\t\tmatchedAllowed = allowed;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t} catch {}\n\t\t}\n\n\t\tif (!isAllowed) {\n\t\t\treturn {\n\t\t\t\tkind: \"outside\",\n\t\t\t\tpath: targetPath,\n\t\t\t\tresolvedPath: resolvedTarget,\n\t\t\t\treasonCode: \"outside_allowed_paths\",\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tkind: \"inside\",\n\t\t\tpath: targetPath,\n\t\t\tresolvedPath: resolvedTarget,\n\t\t\tmatchedRule: matchedAllowed,\n\t\t\treasonCode: \"inside_allowed_paths\",\n\t\t};\n\t}\n\n\treturn {\n\t\tkind: \"inside\",\n\t\tpath: targetPath,\n\t\tresolvedPath: resolvedTarget,\n\t\tmatchedRule: scope.root,\n\t\treasonCode: \"inside_root\",\n\t};\n}\n"]}
1	+ {"version":3,"file":"path-scope.js","sourceRoot":"","sources":["../../../src/core/autonomy/path-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,+FAA+F;AAC/F,8FAA8F;AAC9F,wBAAwB;AACxB,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAU;IAC5D,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;AAAA,CAClD;AAED,SAAS,aAAa,CAAC,YAAoB,EAAE,IAAY,EAAU;IAClE,IAAI,IAAI,GAAG,gBAAgB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,8BAA8B,gBAAgB,4BAA4B,YAAY,GAAG,CAAC,CAAC;IAC5G,CAAC;IAED,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IAED,4FAA4F;IAC5F,4FAA0F;IAC1F,6FAA6F;IAC7F,4FAA4F;IAC5F,8FAA8F;IAC9F,2FAA2F;IAC3F,yFAAuF;IACvF,IAAI,KAAkD,CAAC;IACvD,IAAI,CAAC;QACJ,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACR,KAAK,GAAG,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;QAC3E,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;YAC1B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAC5C,OAAO,aAAa,CAAC,cAAc,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1C,uEAAuE;IACvE,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC7B,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;AAAA,CAC9D;AAED,SAAS,eAAe,CAAC,KAAa,EAAW;IAChD,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAAA,CAC/F;AAED,SAAS,cAAc,CAAC,GAAG,KAAwB,EAAyC;IAC3F,OAAO,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;AAAA,CAC7D;AAED,SAAS,iCAAiC,CAAC,KAAa,EAAE,OAA8C,EAAU;IACjH,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAAA,CAClE;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAU;IACjE,OAAO,iCAAiC,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;AAAA,CACvE;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,SAAiB,EAAW;IACjF,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,iCAAiC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,iCAAiC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpD,OAAO,CACN,YAAY,KAAK,EAAE;QACnB,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAC5G,CAAC;AAAA,CACF;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,WAAmB,EAAW;IACnF,OAAO,iBAAiB,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,iBAAiB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;AAAA,CAChG;AAED,MAAM,UAAU,cAAc,CAAC,KAAgB,EAAE,UAAkB,EAAqB;IACvF,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO;YACN,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,YAAY;SACxB,CAAC;IACH,CAAC;IAED,IAAI,cAAsB,CAAC;IAC3B,IAAI,CAAC;QACJ,cAAc,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACR,2EAA2E;QAC3E,OAAO;YACN,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,qBAAqB;SACjC,CAAC;IACH,CAAC;IAED,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACJ,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO;YACN,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,mBAAmB;SAC/B,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,YAAY,CAAC,EAAE,CAAC;QACtD,OAAO;YACN,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,UAAU;YAChB,YAAY,EAAE,cAAc;YAC5B,UAAU,EAAE,cAAc;SAC1B,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,CAAC;gBACJ,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBAChD,IAAI,iBAAiB,CAAC,cAAc,EAAE,cAAc,CAAC,EAAE,CAAC;oBACvD,OAAO;wBACN,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,UAAU;wBAChB,YAAY,EAAE,cAAc;wBAC5B,WAAW,EAAE,MAAM;wBACnB,UAAU,EAAE,qBAAqB;qBACjC,CAAC;gBACH,CAAC;YACF,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACX,CAAC;IACF,CAAC;IAED,qBAAqB;IACrB,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzD,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,cAAkC,CAAC;QAEvC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACJ,MAAM,eAAe,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,iBAAiB,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,CAAC;oBACxD,SAAS,GAAG,IAAI,CAAC;oBACjB,cAAc,GAAG,OAAO,CAAC;oBACzB,MAAM;gBACP,CAAC;YACF,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACX,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,OAAO;gBACN,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,UAAU;gBAChB,YAAY,EAAE,cAAc;gBAC5B,UAAU,EAAE,uBAAuB;aACnC,CAAC;QACH,CAAC;QAED,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,UAAU;YAChB,YAAY,EAAE,cAAc;YAC5B,WAAW,EAAE,cAAc;YAC3B,UAAU,EAAE,sBAAsB;SAClC,CAAC;IACH,CAAC;IAED,OAAO;QACN,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE,cAAc;QAC5B,WAAW,EAAE,KAAK,CAAC,IAAI;QACvB,UAAU,EAAE,aAAa;KACzB,CAAC;AAAA,CACF","sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport type { PathScope, PathScopeDecision } from \"./contracts.ts\";\n\n// Bounds the symlink-following recursion in resolveSafely: a chain of dangling links is finite\n// in practice, and a genuine symlink cycle (a -> b -> a) must fail closed with a throw rather\n// than recurse forever.\nconst MAX_SYMLINK_HOPS = 32;\n\n/*\n Resolves the real path of a target. If the target does not exist, it recursively\n * resolves the deepest existing parent directory and then appends the non-existent\n * remainder, ensuring that any symlinks in the existing path prefix are expanded.\n /\nexport function safeRealpathSync(targetPath: string): string {\n\treturn resolveSafely(path.resolve(targetPath), 0);\n}\n\nfunction resolveSafely(absolutePath: string, hops: number): string {\n\tif (hops > MAX_SYMLINK_HOPS) {\n\t\tthrow new Error(`safeRealpathSync: exceeded ${MAX_SYMLINK_HOPS} symlink hops resolving \"${absolutePath}\"`);\n\t}\n\n\tif (fs.existsSync(absolutePath)) {\n\t\treturn fs.realpathSync(absolutePath);\n\t}\n\n\t// existsSync FOLLOWS symlinks, so it reports false for a DANGLING link (the link exists but\n\t// its target does not) — the same as a path that plain doesn't exist at all. Without this\n\t// lstat check, a dangling leaf would fall straight into the lexical parent-join below, never\n\t// dereferencing the link itself. That would let a dangling symlink placed inside an allowed\n\t// root smuggle writes to wherever it points, since the write itself (e.g. writeFileSync) DOES\n\t// follow the link. lstatSync throws ENOENT for a path that truly doesn't exist anywhere in\n\t// the chain — that case falls through to the parent-recursion branch below, unchanged.\n\tlet lstat: ReturnType<typeof fs.lstatSync> \| undefined;\n\ttry {\n\t\tlstat = fs.lstatSync(absolutePath);\n\t} catch {\n\t\tlstat = undefined;\n\t}\n\n\tif (lstat?.isSymbolicLink()) {\n\t\tconst linkTarget = fs.readlinkSync(absolutePath);\n\t\tconst resolvedParent = resolveSafely(path.dirname(absolutePath), hops + 1);\n\t\tconst resolvedTarget = path.isAbsolute(linkTarget)\n\t\t\t? path.resolve(linkTarget)\n\t\t\t: path.resolve(resolvedParent, linkTarget);\n\t\treturn resolveSafely(resolvedTarget, hops + 1);\n\t}\n\n\tconst parent = path.dirname(absolutePath);\n\t// Base case: if parent is the same as absolutePath, we've hit the root\n\tif (parent === absolutePath) {\n\t\treturn absolutePath;\n\t}\n\n\tconst resolvedParent = resolveSafely(parent, hops + 1);\n\treturn path.join(resolvedParent, path.basename(absolutePath));\n}\n\nfunction usesWindowsPath(value: string): boolean {\n\treturn /^[a-zA-Z]:([\\\\/]\|$)/.test(value) \|\| value.startsWith(\"\\\\\\\\\") \|\| value.startsWith(\"//\");\n}\n\nfunction lexicalPathApi(...paths: readonly string[]): typeof path.posix \| typeof path.win32 {\n\treturn paths.some(usesWindowsPath) ? path.win32 : path.posix;\n}\n\nfunction canonicalPathScopeIdentityWithApi(value: string, pathApi: typeof path.posix \| typeof path.win32): string {\n\tconst resolved = pathApi.resolve(value);\n\treturn pathApi === path.win32 ? resolved.toLowerCase() : resolved;\n}\n\n/\n Stable lexical scope identity for durable planners. Windows drive and UNC paths are normalized\n * case-insensitively even when a WSL process is only comparing them and cannot realpath them.\n /\nexport function canonicalPathScopeIdentity(value: string): string {\n\treturn canonicalPathScopeIdentityWithApi(value, lexicalPathApi(value));\n}\n\n/\n Boundary-safe lexical containment for already-resolved paths and portable scope planning.\n * Windows drive and UNC paths compare case-insensitively; native POSIX paths remain case-sensitive.\n * This deliberately does not resolve symlinks — callers that authorize filesystem access must first\n * use {@link safeRealpathSync}.\n /\nexport function isPathWithinScope(targetPath: string, scopeRoot: string): boolean {\n\tconst pathApi = lexicalPathApi(targetPath, scopeRoot);\n\tconst target = canonicalPathScopeIdentityWithApi(targetPath, pathApi);\n\tconst root = canonicalPathScopeIdentityWithApi(scopeRoot, pathApi);\n\tconst relativePath = pathApi.relative(root, target);\n\treturn (\n\t\trelativePath === \"\" \|\|\n\t\t(!relativePath.startsWith(`..${pathApi.sep}`) && relativePath !== \"..\" && !pathApi.isAbsolute(relativePath))\n\t);\n}\n\n/* True when either scope contains the other, including an exact match. */\nexport function pathScopesOverlap(firstScope: string, secondScope: string): boolean {\n\treturn isPathWithinScope(firstScope, secondScope) \|\| isPathWithinScope(secondScope, firstScope);\n}\n\nexport function checkPathScope(scope: PathScope, targetPath: string): PathScopeDecision {\n\tif (!targetPath) {\n\t\treturn {\n\t\t\tkind: \"missing\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"empty_path\",\n\t\t};\n\t}\n\n\tlet resolvedTarget: string;\n\ttry {\n\t\tresolvedTarget = safeRealpathSync(targetPath);\n\t} catch {\n\t\t// If we can't resolve the path at all (e.g. permission error), fail safely\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"unresolvable_target\",\n\t\t};\n\t}\n\n\tlet resolvedRoot: string;\n\ttry {\n\t\tresolvedRoot = safeRealpathSync(scope.root);\n\t} catch {\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"unresolvable_root\",\n\t\t};\n\t}\n\n\t// First, it must be inside the main root\n\tif (!isPathWithinScope(resolvedTarget, resolvedRoot)) {\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\tresolvedPath: resolvedTarget,\n\t\t\treasonCode: \"outside_root\",\n\t\t};\n\t}\n\n\t// Check deniedPaths (overrides allowedPaths)\n\tif (scope.deniedPaths && scope.deniedPaths.length > 0) {\n\t\tfor (const denied of scope.deniedPaths) {\n\t\t\ttry {\n\t\t\t\tconst resolvedDenied = safeRealpathSync(denied);\n\t\t\t\tif (isPathWithinScope(resolvedTarget, resolvedDenied)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tkind: \"denied\",\n\t\t\t\t\t\tpath: targetPath,\n\t\t\t\t\t\tresolvedPath: resolvedTarget,\n\t\t\t\t\t\tmatchedRule: denied,\n\t\t\t\t\t\treasonCode: \"matches_denied_path\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} catch {}\n\t\t}\n\t}\n\n\t// Check allowedPaths\n\tif (scope.allowedPaths && scope.allowedPaths.length > 0) {\n\t\tlet isAllowed = false;\n\t\tlet matchedAllowed: string \| undefined;\n\n\t\tfor (const allowed of scope.allowedPaths) {\n\t\t\ttry {\n\t\t\t\tconst resolvedAllowed = safeRealpathSync(allowed);\n\t\t\t\tif (isPathWithinScope(resolvedTarget, resolvedAllowed)) {\n\t\t\t\t\tisAllowed = true;\n\t\t\t\t\tmatchedAllowed = allowed;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t} catch {}\n\t\t}\n\n\t\tif (!isAllowed) {\n\t\t\treturn {\n\t\t\t\tkind: \"outside\",\n\t\t\t\tpath: targetPath,\n\t\t\t\tresolvedPath: resolvedTarget,\n\t\t\t\treasonCode: \"outside_allowed_paths\",\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tkind: \"inside\",\n\t\t\tpath: targetPath,\n\t\t\tresolvedPath: resolvedTarget,\n\t\t\tmatchedRule: matchedAllowed,\n\t\t\treasonCode: \"inside_allowed_paths\",\n\t\t};\n\t}\n\n\treturn {\n\t\tkind: \"inside\",\n\t\tpath: targetPath,\n\t\tresolvedPath: resolvedTarget,\n\t\tmatchedRule: scope.root,\n\t\treasonCode: \"inside_root\",\n\t};\n}\n"]}

package/dist/core/background-lane-controller.d.ts CHANGED Viewed

@@ -14,8 +14,9 @@
  * controller never touches `prompt()`, the last-assistant-message, retry, or streaming state.
  */
 import type { Api, Model } from "@caupulican/pi-ai";
-import type { GoalContinuationLoopOptions, GoalContinuationLoopResult, PromptOptions, ResearchLaneRunOutcome, WorkerDelegationRunOutcome } from "./agent-session.ts";
+import type { GoalContinuationLoopOptions, GoalContinuationLoopResult, PromptOptions, ResearchLaneRunOutcome, WorkerDelegationRunOutcome } from "./agent-session-contracts.ts";
 import { type LaneRecord } from "./autonomy/lane-tracker.ts";
+import type { WorkerAgentControlPort } from "./delegation/worker-agent-control.ts";
 import { type WorkerDelegationControllerDeps } from "./delegation/worker-delegation-controller.ts";
 import type { WorkerDelegationRequest } from "./delegation/worker-delegation-request.ts";
 import type { ManagedLaneEvent } from "./extensions/types.ts";
@@ -42,8 +43,10 @@ export interface BackgroundLaneControllerDeps extends WorkerDelegationController
     getGoalRuntimeSnapshot(settings: GoalRuntimeSnapshotSettings): GoalRuntimeSnapshot;
     /** Drive-loop boundary: the session's bounded goal-continuation loop (owns `prompt()`, not us). */
     continueGoalLoop(options: GoalContinuationLoopOptions): Promise<GoalContinuationLoopResult>;
+    /** Persist an explicit stopped state when the selected surface cannot drive the active goal. */
+    markGoalToolUnavailable(): void;
 }
-export declare class BackgroundLaneController {
+export declare class BackgroundLaneController implements WorkerAgentControlPort {
     /** Live lane registry — the real source for AutonomyStatusSnapshot.activeLaneCount. */
     private readonly _laneTracker;
     private readonly _laneModels;
@@ -139,6 +142,31 @@ export declare class BackgroundLaneController {
         started: true;
         record: LaneRecord;
     };
+    /** Durable logical-worker controls. Each checks UAC before materializing worker state. */
+    sendWorkerAgentMessage(agentId: string, message: string): {
+        messageId: string;
+        queued: true;
+    };
+    followUpWorkerAgent(agentId: string, message: string): {
+        started: boolean;
+        steering: boolean;
+        messageId: string;
+        record?: LaneRecord;
+        skipReason?: string;
+    };
+    interruptWorkerAgent(agentId: string): {
+        interrupted: boolean;
+        reason?: string;
+    };
+    resumeWorkerAgent(agentId: string): {
+        started: boolean;
+        record?: LaneRecord;
+        skipReason?: string;
+    };
+    cancelWorkerAgent(agentId: string, reasonCode?: string): LaneRecord | undefined;
+    waitForWorkerAgent(agentId: string, timeoutMs?: number): Promise<{
+        status: "active" | "suspended" | "idle" | "unknown";
+    }>;
     /** Run one worker immediately; used by focused integrations and tests. */
     runWorkerDelegationOnce(request: WorkerDelegationRequest, onStarted?: (record: LaneRecord) => void, existingRecord?: LaneRecord): Promise<WorkerDelegationRunOutcome>;
     /**

package/dist/core/background-lane-controller.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"background-lane-controller.d.ts","sourceRoot":"","sources":["../../src/core/background-lane-controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EACX,2BAA2B,EAC3B,0BAA0B,EAC1B,aAAa,EACb,sBAAsB,EACtB,0BAA0B,EAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,UAAU,EAAe,MAAM,4BAA4B,CAAC;AAG1E,OAAO,EAEN,KAAK,8BAA8B,EACnC,MAAM,8CAA8C,CAAC;AACtD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AAGzF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACzG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAqB,KAAK,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAA0B,KAAK,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AACjH,OAAO,EAA0B,KAAK,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AAGjH,OAAO,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEpE,MAAM,WAAW,4BAChB,SAAQ,8BAA8B,EACrC,0BAA0B,EAC1B,0BAA0B,EAC1B,qBAAqB;IACtB;;;sEAGkE;IAClE,gBAAgB,IAAI,OAAO,CAAC;IAC5B,qGAAqG;IACrG,yBAAyB,IAAI,sBAAsB,CAAC;IACpD,uEAAuE;IACvE,sBAAsB,CAAC,QAAQ,EAAE,2BAA2B,GAAG,mBAAmB,CAAC;IACnF,mGAAmG;IACnG,gBAAgB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAC5F;AAED,qBAAa,wBAAwB;IACpC,yFAAuF;IACvF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoB;IAChD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA6B;IAC/D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;IAClD,+EAA+E;IAC/E,OAAO,CAAC,aAAa,CAAoC;IACzD,iGAAiG;IACjG,OAAO,CAAC,QAAQ,CAAyC;IACzD,sEAAsE;IACtE,OAAO,CAAC,gBAAgB,CAA8B;IACtD,0FAA0F;IAC1F,OAAO,CAAC,oBAAoB,CAA4C;IACxE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+B;IAEpD;oGACgG;IAChG,OAAO,CAAC,SAAS;IAQjB,OAAO,CAAC,qBAAqB;IAI7B,YAAY,IAAI,EAAE,4BAA4B,EAe7C;IAED,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,iCAAiC;IAqBzC,OAAO,CAAC,yBAAyB;IASjC,OAAO,CAAC,oBAAoB;IAW5B,wEAAwE;IACxE,cAAc,IAAI,UAAU,EAAE,CAU7B;IAED,8EAA8E;IAC9E,sBAAsB,IAAI,qBAAqB,GAAG,SAAS,CAE1D;IAED,kGAAkG;IAClG,oBAAoB,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAE1C;IAED;;;OAGG;IACH,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE7D;IAED,iGAA+F;IAC/F,kBAAkB,IAAI,MAAM,CAE3B;IAED,yFAAyF;IACzF,OAAO,CAAC,uBAAuB;IAM/B,yFAAyF;IACzF,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,UAAU,GAAG,SAAS,CAEjE;IAED,qFAAqF;IACrF,6BAA6B,IAAI,MAAM,GAAG,SAAS,CAElD;IAED;;;;;;;;;;OAUG;IACH,kBAAkB,IAAI,IAAI,CAwBzB;IAED,0BAA0B,IAAI,IAAI,CAEjC;IAED,gCAAgC,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,IAAI,CAE9D;IAED;;;;;;;;OAQG;IACG,yBAAyB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAEzG;IAED,sBAAsB,IAAI,IAAI,CAE7B;IAED,4BAA4B,IAAI,IAAI,CAEnC;IAED,gBAAgB,CAAC,iBAAiB,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,CAE9E;IAED,8BAA8B,IAAI,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAEhG;IAED;;;;;OAKG;IACG,mBAAmB,CAAC,OAAO,CAAC,EAAE;QACnC,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAElC;IACD,wDAAwD;IACxD,qBAAqB,CACpB,OAAO,EAAE,uBAAuB,GAC9B;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAEhF;IAED,0EAA0E;IACpE,uBAAuB,CAC5B,OAAO,EAAE,uBAAuB,EAChC,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,EACxC,cAAc,CAAC,EAAE,UAAU,GACzB,OAAO,CAAC,0BAA0B,CAAC,CAErC;IACD;;;;;OAKG;IACG,eAAe,CAAC,IAAI,EAAE;QAC3B,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,+FAA6F;QAC7F,UAAU,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,kBAAkB,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAEjH;IAED,mGAAmG;IACnG,4BAA4B,IAAI,IAAI,CAEnC;IAED,mGAAmG;IACnG,uBAAuB,IAAI,mBAAmB,EAAE,CAE/C;CACD","sourcesContent":["/*\n Execution-plane coordinator for goal continuation, research, managed lanes, worker delegation,\n * and model fitness.\n \n Coordination state is owned by focused controllers. This coordinator retains one AgentSession\n * composition seam and a shared lane read model. Everything it needs\n * — the session manager, settings, model registry, live model, capability envelope, the goal\n * continuation LOOP, the isolated-completion primitive, spawned-usage accounting, and the telemetry\n * sink — is reached through narrow deps accessors rather than the whole AgentSession.\n \n Drive-loop boundary (deliberate): the idle triggers ({@link scheduleGoalAutoContinueFromIdle},\n * {@link scheduleResearchLaneFromIdle}) are invoked from the session's prompt tail as one-line\n * delegations; goal auto-continue itself only ever asks the session to `continueGoalLoop`, so this\n * controller never touches `prompt()`, the last-assistant-message, retry, or streaming state.\n /\n\nimport type { Api, Model } from \"@caupulican/pi-ai\";\nimport type {\n\tGoalContinuationLoopOptions,\n\tGoalContinuationLoopResult,\n\tPromptOptions,\n\tResearchLaneRunOutcome,\n\tWorkerDelegationRunOutcome,\n} from \"./agent-session.ts\";\nimport { type LaneRecord, LaneTracker } from \"./autonomy/lane-tracker.ts\";\nimport { appendLaneRecordSnapshot, getLatestLaneRecordSnapshots } from \"./autonomy/session-lane-record.ts\";\nimport { ManagedLaneController } from \"./delegation/managed-lane-controller.ts\";\nimport {\n\tWorkerDelegationController,\n\ttype WorkerDelegationControllerDeps,\n} from \"./delegation/worker-delegation-controller.ts\";\nimport type { WorkerDelegationRequest } from \"./delegation/worker-delegation-request.ts\";\nimport { WorkerLifecycle } from \"./delegation/worker-lifecycle.ts\";\nimport { WorkerNotificationCoordinator } from \"./delegation/worker-notification-coordinator.ts\";\nimport type { ManagedLaneEvent } from \"./extensions/types.ts\";\nimport { GoalAutoContinueController } from \"./goals/goal-auto-continue-controller.ts\";\nimport type { GoalRuntimeSnapshot, GoalRuntimeSnapshotSettings } from \"./goals/goal-runtime-snapshot.ts\";\nimport type { GoalState } from \"./goals/goal-state.ts\";\nimport type { ModelCapabilityProfile } from \"./model-capability.ts\";\nimport type { StoredFitnessReport } from \"./models/fitness-store.ts\";\nimport type { TaskRuntimeProjection } from \"./orchestration/task-runtime.ts\";\nimport { LaneModelResolver, type LaneModelResolverDeps } from \"./research/lane-model-resolver.ts\";\nimport type { ModelFitnessReport } from \"./research/model-fitness.ts\";\nimport { ModelFitnessController, type ModelFitnessControllerDeps } from \"./research/model-fitness-controller.ts\";\nimport { ResearchLaneController, type ResearchLaneControllerDeps } from \"./research/research-lane-controller.ts\";\nimport { getActiveSessionBranchEntries } from \"./session-snapshot.ts\";\n\nexport { isLocalExecutionModel } from \"./delegation/worker-delegation-controller.ts\";\nexport { clampLaneMaxUsd } from \"./research/lane-model-resolver.ts\";\n\nexport interface BackgroundLaneControllerDeps\n\textends WorkerDelegationControllerDeps,\n\t\tResearchLaneControllerDeps,\n\t\tModelFitnessControllerDeps,\n\t\tLaneModelResolverDeps {\n\t/* True iff the `goal` tool is in the session's ACTIVE surface -- the capability-adaptive gate\n\t * for every goal-continuation loop (see `continueGoalLoopExclusive`): a surface without the\n\t * goal tool (lean capability blocklist, worker role ceiling, --tools/profile exclusion) must\n\t * never be driven with continuation prompts it cannot execute. /\n\tisGoalToolActive(): boolean;\n\t/* Capability profile of the SESSION model (gates background lanes, scales continuation budgets). /\n\tgetModelCapabilityProfile(): ModelCapabilityProfile;\n\t/* Continuation gate + goal state for the idle autosteer scheduler. /\n\tgetGoalRuntimeSnapshot(settings: GoalRuntimeSnapshotSettings): GoalRuntimeSnapshot;\n\t/* Drive-loop boundary: the session's bounded goal-continuation loop (owns `prompt()`, not us). /\n\tcontinueGoalLoop(options: GoalContinuationLoopOptions): Promise<GoalContinuationLoopResult>;\n}\n\nexport class BackgroundLaneController {\n\t/* Live lane registry — the real source for AutonomyStatusSnapshot.activeLaneCount. /\n\tprivate readonly _laneTracker = new LaneTracker();\n\tprivate readonly _laneModels: LaneModelResolver;\n\tprivate readonly _goalAutoContinue: GoalAutoContinueController;\n\tprivate readonly _research: ResearchLaneController;\n\tprivate readonly _fitness: ModelFitnessController;\n\t/* Lazily materialized only when managed-lane state is queried or reported. /\n\tprivate _managedLanes: ManagedLaneController \| undefined;\n\t/* Lazily materialized so a UAC surface without `delegate` allocates no worker runtime state. /\n\tprivate _workers: WorkerDelegationController \| undefined;\n\t/* One durable lifecycle shared by every worker execution adapter. /\n\tprivate _workerLifecycle: WorkerLifecycle \| undefined;\n\t/* Shared terminal outbox for managed and in-process workers; lazy under UAC omission. /\n\tprivate _workerNotifications: WorkerNotificationCoordinator \| undefined;\n\tprivate readonly deps: BackgroundLaneControllerDeps;\n\n\t/* Emit a warning without ever throwing — used from disposal-adjacent persistence where a\n\t * listener failure (or a bare test double missing `emit`) must never block or crash cleanup. /\n\tprivate _safeWarn(message: string): void {\n\t\ttry {\n\t\t\tthis.deps.emit({ type: \"warning\", message });\n\t\t} catch {\n\t\t\t// Dispose must never throw.\n\t\t}\n\t}\n\n\tprivate _recordWorkerTerminal(record: LaneRecord, durableNotificationId: string): void {\n\t\tthis._getWorkerNotificationCoordinator().recordTerminal(record, durableNotificationId);\n\t}\n\n\tconstructor(deps: BackgroundLaneControllerDeps) {\n\t\tthis.deps = deps;\n\t\tthis._laneModels = new LaneModelResolver(deps);\n\t\tthis._research = new ResearchLaneController(deps, this._laneTracker, this._laneModels);\n\t\tthis._fitness = new ModelFitnessController(deps, this._laneModels);\n\t\tthis._goalAutoContinue = new GoalAutoContinueController({\n\t\t\tisDisposed: deps.isDisposed,\n\t\t\tisGoalToolActive: deps.isGoalToolActive,\n\t\t\tgetSettingsManager: deps.getSettingsManager,\n\t\t\tgetModelCapabilityProfile: deps.getModelCapabilityProfile,\n\t\t\tgetGoalRuntimeSnapshot: deps.getGoalRuntimeSnapshot,\n\t\t\thasInFlightLaneForGoal: (goalId) => this._hasInFlightLaneForGoal(goalId),\n\t\t\tcontinueGoalLoop: deps.continueGoalLoop,\n\t\t\temit: deps.emit,\n\t\t});\n\t}\n\n\tprivate _getWorkerController(): WorkerDelegationController {\n\t\tthis._workers ??= new WorkerDelegationController(\n\t\t\tthis.deps,\n\t\t\tthis._getWorkerNotificationCoordinator(),\n\t\t\tthis._getWorkerLifecycle(),\n\t\t);\n\t\treturn this._workers;\n\t}\n\n\tprivate _getWorkerLifecycle(): WorkerLifecycle {\n\t\tif (this._workerLifecycle) return this._workerLifecycle;\n\t\tconst lifecycle = new WorkerLifecycle({\n\t\t\tagentDir: this.deps.getAgentDir(),\n\t\t\tsessionId: this.deps.getSessionId(),\n\t\t});\n\t\tthis._workerLifecycle = lifecycle;\n\t\tfor (const notification of lifecycle.getPendingTerminalNotifications()) {\n\t\t\tthis._getWorkerNotificationCoordinator().recordTerminal(notification.record, notification.notificationId);\n\t\t}\n\t\treturn lifecycle;\n\t}\n\n\tprivate _getWorkerNotificationCoordinator(): WorkerNotificationCoordinator {\n\t\tthis._workerNotifications ??= new WorkerNotificationCoordinator({\n\t\t\tgetWorkerRecords: () => this._workerLifecycle?.getAllRecords() ?? [],\n\t\t\temitStatus: (status) => {\n\t\t\t\ttry {\n\t\t\t\t\tthis.deps.emit({\n\t\t\t\t\t\ttype: \"delegate_workers\",\n\t\t\t\t\t\t...status,\n\t\t\t\t\t\tterminalSinceFlush: [...status.terminalSinceFlush],\n\t\t\t\t\t});\n\t\t\t\t} catch {\n\t\t\t\t\t// A partial integration must not crash the event-driven terminal outbox.\n\t\t\t\t}\n\t\t\t},\n\t\t\tnotify: (records) => this.deps.notifyWorkerTerminalHandoff(records),\n\t\t\twarn: (message) => this._safeWarn(message),\n\t\t\tmarkDurableDelivered: (notificationIds) => this._workerLifecycle?.markNotificationsDelivered(notificationIds),\n\t\t});\n\t\treturn this._workerNotifications;\n\t}\n\n\tprivate _getManagedLaneController(): ManagedLaneController {\n\t\tthis._managedLanes ??= new ManagedLaneController(\n\t\t\tthis.deps,\n\t\t\tthis._getWorkerLifecycle(),\n\t\t\t(record, notificationId) => this._recordWorkerTerminal(record, notificationId),\n\t\t);\n\t\treturn this._managedLanes;\n\t}\n\n\tprivate _hydrateManagedLanes(): void {\n\t\tif (this._managedLanes) {\n\t\t\tthis._managedLanes.ensureHydrated();\n\t\t\treturn;\n\t\t}\n\t\tconst hasPersistedActiveManagedLane = getLatestLaneRecordSnapshots(\n\t\t\tgetActiveSessionBranchEntries(this.deps.getSessionManager()),\n\t\t).some((record) => record.type === \"tmux-worker\" && (record.status === \"queued\" \|\| record.status === \"running\"));\n\t\tif (hasPersistedActiveManagedLane) this._getManagedLaneController().ensureHydrated();\n\t}\n\n\t/* Live lane records tracked by this process (running and terminal). /\n\tgetLaneRecords(): LaneRecord[] {\n\t\tthis._hydrateManagedLanes();\n\t\tconst workerRecords =\n\t\t\tthis._workers?.getRecords() ??\n\t\t\t(this.deps.isDelegateToolActive?.() ? this._getWorkerController().getRecords() : []);\n\t\treturn [\n\t\t\t...this._laneTracker.getRecords(),\n\t\t\t...workerRecords,\n\t\t\t...(this._workerLifecycle?.getManagedRecords() ?? []),\n\t\t];\n\t}\n\n\t/* Does not materialize the worker controller when UAC omitted delegation. /\n\tgetTaskRuntimeSnapshot(): TaskRuntimeProjection \| undefined {\n\t\treturn this._workerLifecycle?.getTaskRuntimeSnapshot();\n\t}\n\n\t/* Reconcile only when delegation has already been materialized; UAC omission stays zero-load. /\n\tsynchronizeGoalState(goal: GoalState): void {\n\t\tthis._workers?.synchronizeGoalState(goal);\n\t}\n\n\t/\n\t Resolve a tracked managed-lane dispatch. The caller's stable id is also the canonical durable\n\t * lane id, so this is an existence check rather than an id translation.\n\t /\n\tresolveManagedLaneId(callerLaneId: string): string \| undefined {\n\t\treturn this._getManagedLaneController().resolve(callerLaneId);\n\t}\n\n\t/* Live count of active lanes — the real source for AutonomyStatusSnapshot.activeLaneCount. /\n\tgetActiveLaneCount(): number {\n\t\treturn this.getLaneRecords().filter((record) => record.status === \"queued\" \|\| record.status === \"running\").length;\n\t}\n\n\t/* Belt-and-braces guard: whether ANY queued/running lane is tagged with this goalId. /\n\tprivate _hasInFlightLaneForGoal(goalId: string): boolean {\n\t\treturn this.getLaneRecords().some(\n\t\t\t(record) => record.goalId === goalId && (record.status === \"queued\" \|\| record.status === \"running\"),\n\t\t);\n\t}\n\n\t/* Delegate the out-of-process dispatch/terminal claim to its single lifecycle owner. /\n\trecordManagedLane(event: ManagedLaneEvent): LaneRecord \| undefined {\n\t\treturn this._getManagedLaneController().record(event);\n\t}\n\n\t/* Why the last idle research-lane evaluation skipped, for /autonomy diagnostics. /\n\tgetLastResearchLaneSkipReason(): string \| undefined {\n\t\treturn this._research.getLastSkipReason();\n\t}\n\n\t/\n\t Abort in-flight research and delegate worker disposal to its single owning controller.\n\t \n\t This synchronous body is the LAST provably-safe write window for canceled/in-flight work.\n\t * `dispose()` (agent-session.ts) has already set the session's own disposed flag but has not yet\n\t * returned — no successor session (e.g. a `/reload` adoption) can exist yet, so an append here\n\t * cannot interleave with one; a post-await continuation resuming AFTER this method returns must\n\t * not append (see the disposed branch in `runWorkerDelegationOnce`). Persist FIRST, then\n\t * complete-in-memory, so a throw from one lane's persist cannot skip another's; each persist gets\n\t * its own try/catch — dispose must never throw.\n\t /\n\tabortInFlightLanes(): void {\n\t\tthis._goalAutoContinue.clearTimer();\n\t\tthis._research.abort();\n\t\tthis._fitness.abort();\n\t\tfor (const record of this._laneTracker.getRecords()) {\n\t\t\tif (record.status !== \"queued\" && record.status !== \"running\") continue;\n\t\t\tif (record.type === \"tmux-worker\") continue;\n\t\t\tconst canceled = this._laneTracker.complete(record.laneId, {\n\t\t\t\tstatus: \"canceled\",\n\t\t\t\treasonCode: \"session_disposed\",\n\t\t\t});\n\t\t\tif (!canceled) continue;\n\t\t\ttry {\n\t\t\t\tappendLaneRecordSnapshot(this.deps.getSessionManager(), canceled);\n\t\t\t} catch (error) {\n\t\t\t\tthis._safeWarn(\n\t\t\t\t\t`Failed to persist canceled lane record ${canceled.laneId}: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t\tthis._managedLanes?.release();\n\n\t\tthis._workers?.abort();\n\t\tthis._workerNotifications?.dispose();\n\t}\n\n\tclearGoalAutoContinueTimer(): void {\n\t\tthis._goalAutoContinue.clearTimer();\n\t}\n\n\tscheduleGoalAutoContinueFromIdle(options?: PromptOptions): void {\n\t\tthis._goalAutoContinue.scheduleFromIdle(options);\n\t}\n\n\t/\n\t Single-flight entry point for EVERY goal-continuation loop invocation — idle autosteer\n\t * ({@link _runScheduledGoalAutoContinue}) AND the manual `/goal start` / `/goal-continue`\n\t * commands (reached through `AgentSession.continueGoalLoop`). Both paths ultimately submit\n\t * continuation prompts through the session's single `prompt()` path, so two loops racing throws\n\t * \"Agent is already processing\" from whichever submits second. `_isGoalAutoContinuing` is the\n\t * ONE owner of that mutex; `deps.continueGoalLoop` (the raw {@link GoalLoopController} loop)\n\t * must never be called directly outside this method, or the guard is bypassed.\n\t /\n\tasync continueGoalLoopExclusive(options: GoalContinuationLoopOptions): Promise<GoalContinuationLoopResult> {\n\t\treturn this._goalAutoContinue.continueExclusive(options);\n\t}\n\n\tclearResearchLaneTimer(): void {\n\t\tthis._research.clearTimer();\n\t}\n\n\tscheduleResearchLaneFromIdle(): void {\n\t\tthis._research.scheduleFromIdle();\n\t}\n\n\tresolveLaneModel(configuredPattern: string \| undefined): Model<Api> \| undefined {\n\t\treturn this._laneModels.resolveModel(configuredPattern);\n\t}\n\n\tgetOrchestrationProfileCatalog(): Array<{ profileId: string; role: string; description: string }> {\n\t\treturn this._getWorkerController().getProfileCatalog();\n\t}\n\n\t/\n\t Run one bounded, read-only research pass and persist its results: evidence bundle snapshot,\n\t * terminal lane record, and spawned-usage cost report (single-hop invariant, idempotent on the\n\t * lane's reportId). Explicit calls (e.g. `/autonomy research`) express user intent and bypass the\n\t * enabled/mode/dedupe gates the idle scheduler enforces; budget and capability gates always apply.\n\t /\n\tasync runResearchLaneOnce(request?: {\n\t\tquery?: string;\n\t\tcontext?: string;\n\t\tgoalId?: string;\n\t}): Promise<ResearchLaneRunOutcome> {\n\t\treturn this._research.runOnce(request);\n\t}\n\t/* Start a durable, profile-bound worker delegation. /\n\tstartWorkerDelegation(\n\t\trequest: WorkerDelegationRequest,\n\t): { started: false; skipReason: string } \| { started: true; record: LaneRecord } {\n\t\treturn this._getWorkerController().start(request);\n\t}\n\n\t/* Run one worker immediately; used by focused integrations and tests. /\n\tasync runWorkerDelegationOnce(\n\t\trequest: WorkerDelegationRequest,\n\t\tonStarted?: (record: LaneRecord) => void,\n\t\texistingRecord?: LaneRecord,\n\t): Promise<WorkerDelegationRunOutcome> {\n\t\treturn this._getWorkerController().runOnce(request, onStarted, existingRecord);\n\t}\n\t/\n\t Probe a candidate model against the subagent contracts (research/worker/judge/search/\n\t * tool-call surfaces) via {@link runModelFitnessProbe}. The model must resolve and\n\t * authenticate; every probe call runs as an isolated completion on that model, and probe\n\t * spend is reported through spawned-usage accounting.\n\t /\n\tasync runModelFitness(args: {\n\t\tmodel: string;\n\t\ttrials?: number;\n\t\t/* LLM tool-call id, present only via the model_fitness tool path — see model-fitness.ts. /\n\t\ttoolCallId?: string;\n\t}): Promise<{ started: true; model: string; report: ModelFitnessReport } \| { started: false; skipReason: string }> {\n\t\treturn this._fitness.run(args);\n\t}\n\n\t/* Start every capacity-eligible queued worker at the owner session's foreground-idle boundary. /\n\tdrainQueuedWorkerDelegations(): void {\n\t\tif (this.deps.isDelegateToolActive?.()) this._getWorkerController().drain();\n\t}\n\n\t/* Fitness reports persisted for THIS host (measured evidence for architect/profile decisions). */\n\tgetStoredFitnessReports(): StoredFitnessReport[] {\n\t\treturn this._fitness.getStoredReports();\n\t}\n}\n"]}
1	+ {"version":3,"file":"background-lane-controller.d.ts","sourceRoot":"","sources":["../../src/core/background-lane-controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EACX,2BAA2B,EAC3B,0BAA0B,EAC1B,aAAa,EACb,sBAAsB,EACtB,0BAA0B,EAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,KAAK,UAAU,EAAe,MAAM,4BAA4B,CAAC;AAG1E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAEN,KAAK,8BAA8B,EACnC,MAAM,8CAA8C,CAAC;AACtD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AAGzF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACzG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAqB,KAAK,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAA0B,KAAK,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AACjH,OAAO,EAA0B,KAAK,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AAGjH,OAAO,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEpE,MAAM,WAAW,4BAChB,SAAQ,8BAA8B,EACrC,0BAA0B,EAC1B,0BAA0B,EAC1B,qBAAqB;IACtB;;;sEAGkE;IAClE,gBAAgB,IAAI,OAAO,CAAC;IAC5B,qGAAqG;IACrG,yBAAyB,IAAI,sBAAsB,CAAC;IACpD,uEAAuE;IACvE,sBAAsB,CAAC,QAAQ,EAAE,2BAA2B,GAAG,mBAAmB,CAAC;IACnF,mGAAmG;IACnG,gBAAgB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC5F,gGAAgG;IAChG,uBAAuB,IAAI,IAAI,CAAC;CAChC;AAED,qBAAa,wBAAyB,YAAW,sBAAsB;IACtE,yFAAuF;IACvF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoB;IAChD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA6B;IAC/D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;IAClD,+EAA+E;IAC/E,OAAO,CAAC,aAAa,CAAoC;IACzD,iGAAiG;IACjG,OAAO,CAAC,QAAQ,CAAyC;IACzD,sEAAsE;IACtE,OAAO,CAAC,gBAAgB,CAA8B;IACtD,0FAA0F;IAC1F,OAAO,CAAC,oBAAoB,CAA4C;IACxE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+B;IAEpD;oGACgG;IAChG,OAAO,CAAC,SAAS;IAQjB,OAAO,CAAC,qBAAqB;IAI7B,YAAY,IAAI,EAAE,4BAA4B,EAgB7C;IAED,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,iCAAiC;IAqBzC,OAAO,CAAC,yBAAyB;IAUjC,OAAO,CAAC,oBAAoB;IAW5B,wEAAwE;IACxE,cAAc,IAAI,UAAU,EAAE,CAU7B;IAED,8EAA8E;IAC9E,sBAAsB,IAAI,qBAAqB,GAAG,SAAS,CAE1D;IAED,kGAAkG;IAClG,oBAAoB,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAE1C;IAED;;;OAGG;IACH,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE7D;IAED,iGAA+F;IAC/F,kBAAkB,IAAI,MAAM,CAE3B;IAED,yFAAyF;IACzF,OAAO,CAAC,uBAAuB;IAM/B,yFAAyF;IACzF,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,UAAU,GAAG,SAAS,CAEjE;IAED,qFAAqF;IACrF,6BAA6B,IAAI,MAAM,GAAG,SAAS,CAElD;IAED;;;;;;;;;;OAUG;IACH,kBAAkB,IAAI,IAAI,CAwBzB;IAED,0BAA0B,IAAI,IAAI,CAEjC;IAED,gCAAgC,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,IAAI,CAE9D;IAED;;;;;;;;OAQG;IACG,yBAAyB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAEzG;IAED,sBAAsB,IAAI,IAAI,CAE7B;IAED,4BAA4B,IAAI,IAAI,CAEnC;IAED,gBAAgB,CAAC,iBAAiB,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,CAE9E;IAED,8BAA8B,IAAI,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAEhG;IAED;;;;;OAKG;IACG,mBAAmB,CAAC,OAAO,CAAC,EAAE;QACnC,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAElC;IACD,wDAAwD;IACxD,qBAAqB,CACpB,OAAO,EAAE,uBAAuB,GAC9B;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAEhF;IAED,0FAA0F;IAC1F,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,IAAI,CAAA;KAAE,CAI5F;IAED,mBAAmB,CAClB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACb;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,UAAU,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAItG;IAED,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG;QAAE,WAAW,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAI/E;IAED,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,UAAU,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAIjG;IAED,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAI9E;IAED,kBAAkB,CACjB,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,MAAM,EAAE,QAAQ,GAAG,WAAW,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC,CAIlE;IAED,0EAA0E;IACpE,uBAAuB,CAC5B,OAAO,EAAE,uBAAuB,EAChC,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,EACxC,cAAc,CAAC,EAAE,UAAU,GACzB,OAAO,CAAC,0BAA0B,CAAC,CAErC;IACD;;;;;OAKG;IACG,eAAe,CAAC,IAAI,EAAE;QAC3B,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,+FAA6F;QAC7F,UAAU,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,kBAAkB,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAEjH;IAED,mGAAmG;IACnG,4BAA4B,IAAI,IAAI,CAEnC;IAED,mGAAmG;IACnG,uBAAuB,IAAI,mBAAmB,EAAE,CAE/C;CACD","sourcesContent":["/*\n Execution-plane coordinator for goal continuation, research, managed lanes, worker delegation,\n * and model fitness.\n \n Coordination state is owned by focused controllers. This coordinator retains one AgentSession\n * composition seam and a shared lane read model. Everything it needs\n * — the session manager, settings, model registry, live model, capability envelope, the goal\n * continuation LOOP, the isolated-completion primitive, spawned-usage accounting, and the telemetry\n * sink — is reached through narrow deps accessors rather than the whole AgentSession.\n \n Drive-loop boundary (deliberate): the idle triggers ({@link scheduleGoalAutoContinueFromIdle},\n * {@link scheduleResearchLaneFromIdle}) are invoked from the session's prompt tail as one-line\n * delegations; goal auto-continue itself only ever asks the session to `continueGoalLoop`, so this\n * controller never touches `prompt()`, the last-assistant-message, retry, or streaming state.\n /\n\nimport type { Api, Model } from \"@caupulican/pi-ai\";\nimport type {\n\tGoalContinuationLoopOptions,\n\tGoalContinuationLoopResult,\n\tPromptOptions,\n\tResearchLaneRunOutcome,\n\tWorkerDelegationRunOutcome,\n} from \"./agent-session-contracts.ts\";\nimport { type LaneRecord, LaneTracker } from \"./autonomy/lane-tracker.ts\";\nimport { appendLaneRecordSnapshot, getLatestLaneRecordSnapshots } from \"./autonomy/session-lane-record.ts\";\nimport { ManagedLaneController } from \"./delegation/managed-lane-controller.ts\";\nimport type { WorkerAgentControlPort } from \"./delegation/worker-agent-control.ts\";\nimport {\n\tWorkerDelegationController,\n\ttype WorkerDelegationControllerDeps,\n} from \"./delegation/worker-delegation-controller.ts\";\nimport type { WorkerDelegationRequest } from \"./delegation/worker-delegation-request.ts\";\nimport { WorkerLifecycle } from \"./delegation/worker-lifecycle.ts\";\nimport { WorkerNotificationCoordinator } from \"./delegation/worker-notification-coordinator.ts\";\nimport type { ManagedLaneEvent } from \"./extensions/types.ts\";\nimport { GoalAutoContinueController } from \"./goals/goal-auto-continue-controller.ts\";\nimport type { GoalRuntimeSnapshot, GoalRuntimeSnapshotSettings } from \"./goals/goal-runtime-snapshot.ts\";\nimport type { GoalState } from \"./goals/goal-state.ts\";\nimport type { ModelCapabilityProfile } from \"./model-capability.ts\";\nimport type { StoredFitnessReport } from \"./models/fitness-store.ts\";\nimport type { TaskRuntimeProjection } from \"./orchestration/task-runtime.ts\";\nimport { LaneModelResolver, type LaneModelResolverDeps } from \"./research/lane-model-resolver.ts\";\nimport type { ModelFitnessReport } from \"./research/model-fitness.ts\";\nimport { ModelFitnessController, type ModelFitnessControllerDeps } from \"./research/model-fitness-controller.ts\";\nimport { ResearchLaneController, type ResearchLaneControllerDeps } from \"./research/research-lane-controller.ts\";\nimport { getActiveSessionBranchEntries } from \"./session-snapshot.ts\";\n\nexport { isLocalExecutionModel } from \"./delegation/worker-delegation-controller.ts\";\nexport { clampLaneMaxUsd } from \"./research/lane-model-resolver.ts\";\n\nexport interface BackgroundLaneControllerDeps\n\textends WorkerDelegationControllerDeps,\n\t\tResearchLaneControllerDeps,\n\t\tModelFitnessControllerDeps,\n\t\tLaneModelResolverDeps {\n\t/* True iff the `goal` tool is in the session's ACTIVE surface -- the capability-adaptive gate\n\t * for every goal-continuation loop (see `continueGoalLoopExclusive`): a surface without the\n\t * goal tool (lean capability blocklist, worker role ceiling, --tools/profile exclusion) must\n\t * never be driven with continuation prompts it cannot execute. /\n\tisGoalToolActive(): boolean;\n\t/* Capability profile of the SESSION model (gates background lanes, scales continuation budgets). /\n\tgetModelCapabilityProfile(): ModelCapabilityProfile;\n\t/* Continuation gate + goal state for the idle autosteer scheduler. /\n\tgetGoalRuntimeSnapshot(settings: GoalRuntimeSnapshotSettings): GoalRuntimeSnapshot;\n\t/* Drive-loop boundary: the session's bounded goal-continuation loop (owns `prompt()`, not us). /\n\tcontinueGoalLoop(options: GoalContinuationLoopOptions): Promise<GoalContinuationLoopResult>;\n\t/* Persist an explicit stopped state when the selected surface cannot drive the active goal. /\n\tmarkGoalToolUnavailable(): void;\n}\n\nexport class BackgroundLaneController implements WorkerAgentControlPort {\n\t/* Live lane registry — the real source for AutonomyStatusSnapshot.activeLaneCount. /\n\tprivate readonly _laneTracker = new LaneTracker();\n\tprivate readonly _laneModels: LaneModelResolver;\n\tprivate readonly _goalAutoContinue: GoalAutoContinueController;\n\tprivate readonly _research: ResearchLaneController;\n\tprivate readonly _fitness: ModelFitnessController;\n\t/* Lazily materialized only when managed-lane state is queried or reported. /\n\tprivate _managedLanes: ManagedLaneController \| undefined;\n\t/* Lazily materialized so a UAC surface without `delegate` allocates no worker runtime state. /\n\tprivate _workers: WorkerDelegationController \| undefined;\n\t/* One durable lifecycle shared by every worker execution adapter. /\n\tprivate _workerLifecycle: WorkerLifecycle \| undefined;\n\t/* Shared terminal outbox for managed and in-process workers; lazy under UAC omission. /\n\tprivate _workerNotifications: WorkerNotificationCoordinator \| undefined;\n\tprivate readonly deps: BackgroundLaneControllerDeps;\n\n\t/* Emit a warning without ever throwing — used from disposal-adjacent persistence where a\n\t * listener failure (or a bare test double missing `emit`) must never block or crash cleanup. /\n\tprivate _safeWarn(message: string): void {\n\t\ttry {\n\t\t\tthis.deps.emit({ type: \"warning\", message });\n\t\t} catch {\n\t\t\t// Dispose must never throw.\n\t\t}\n\t}\n\n\tprivate _recordWorkerTerminal(record: LaneRecord, durableNotificationId: string): void {\n\t\tthis._getWorkerNotificationCoordinator().recordTerminal(record, durableNotificationId);\n\t}\n\n\tconstructor(deps: BackgroundLaneControllerDeps) {\n\t\tthis.deps = deps;\n\t\tthis._laneModels = new LaneModelResolver(deps);\n\t\tthis._research = new ResearchLaneController(deps, this._laneTracker, this._laneModels);\n\t\tthis._fitness = new ModelFitnessController(deps, this._laneModels);\n\t\tthis._goalAutoContinue = new GoalAutoContinueController({\n\t\t\tisDisposed: deps.isDisposed,\n\t\t\tisGoalToolActive: deps.isGoalToolActive,\n\t\t\tgetSettingsManager: deps.getSettingsManager,\n\t\t\tgetModelCapabilityProfile: deps.getModelCapabilityProfile,\n\t\t\tgetGoalRuntimeSnapshot: deps.getGoalRuntimeSnapshot,\n\t\t\thasInFlightLaneForGoal: (goalId) => this._hasInFlightLaneForGoal(goalId),\n\t\t\tcontinueGoalLoop: deps.continueGoalLoop,\n\t\t\tmarkGoalToolUnavailable: deps.markGoalToolUnavailable,\n\t\t\temit: deps.emit,\n\t\t});\n\t}\n\n\tprivate _getWorkerController(): WorkerDelegationController {\n\t\tthis._workers ??= new WorkerDelegationController(\n\t\t\tthis.deps,\n\t\t\tthis._getWorkerNotificationCoordinator(),\n\t\t\tthis._getWorkerLifecycle(),\n\t\t);\n\t\treturn this._workers;\n\t}\n\n\tprivate _getWorkerLifecycle(): WorkerLifecycle {\n\t\tif (this._workerLifecycle) return this._workerLifecycle;\n\t\tconst lifecycle = new WorkerLifecycle({\n\t\t\tagentDir: this.deps.getAgentDir(),\n\t\t\tsessionId: this.deps.getSessionId(),\n\t\t});\n\t\tthis._workerLifecycle = lifecycle;\n\t\tfor (const notification of lifecycle.getPendingTerminalNotifications()) {\n\t\t\tthis._getWorkerNotificationCoordinator().recordTerminal(notification.record, notification.notificationId);\n\t\t}\n\t\treturn lifecycle;\n\t}\n\n\tprivate _getWorkerNotificationCoordinator(): WorkerNotificationCoordinator {\n\t\tthis._workerNotifications ??= new WorkerNotificationCoordinator({\n\t\t\tgetWorkerRecords: () => this._workerLifecycle?.getAllRecords() ?? [],\n\t\t\temitStatus: (status) => {\n\t\t\t\ttry {\n\t\t\t\t\tthis.deps.emit({\n\t\t\t\t\t\ttype: \"delegate_workers\",\n\t\t\t\t\t\t...status,\n\t\t\t\t\t\tterminalSinceFlush: [...status.terminalSinceFlush],\n\t\t\t\t\t});\n\t\t\t\t} catch {\n\t\t\t\t\t// A partial integration must not crash the event-driven terminal outbox.\n\t\t\t\t}\n\t\t\t},\n\t\t\tnotify: (records) => this.deps.notifyWorkerTerminalHandoff(records),\n\t\t\twarn: (message) => this._safeWarn(message),\n\t\t\tmarkDurableDelivered: (notificationIds) => this._workerLifecycle?.markNotificationsDelivered(notificationIds),\n\t\t});\n\t\treturn this._workerNotifications;\n\t}\n\n\tprivate _getManagedLaneController(): ManagedLaneController {\n\t\tthis._managedLanes ??= new ManagedLaneController(\n\t\t\tthis.deps,\n\t\t\tthis._getWorkerLifecycle(),\n\t\t\t(record, notificationId) => this._recordWorkerTerminal(record, notificationId),\n\t\t\t(message) => this._safeWarn(message),\n\t\t);\n\t\treturn this._managedLanes;\n\t}\n\n\tprivate _hydrateManagedLanes(): void {\n\t\tif (this._managedLanes) {\n\t\t\tthis._managedLanes.ensureHydrated();\n\t\t\treturn;\n\t\t}\n\t\tconst hasPersistedActiveManagedLane = getLatestLaneRecordSnapshots(\n\t\t\tgetActiveSessionBranchEntries(this.deps.getSessionManager()),\n\t\t).some((record) => record.type === \"tmux-worker\" && (record.status === \"queued\" \|\| record.status === \"running\"));\n\t\tif (hasPersistedActiveManagedLane) this._getManagedLaneController().ensureHydrated();\n\t}\n\n\t/* Live lane records tracked by this process (running and terminal). /\n\tgetLaneRecords(): LaneRecord[] {\n\t\tthis._hydrateManagedLanes();\n\t\tconst workerRecords =\n\t\t\tthis._workers?.getRecords() ??\n\t\t\t(this.deps.isDelegateToolActive?.() ? this._getWorkerController().getRecords() : []);\n\t\treturn [\n\t\t\t...this._laneTracker.getRecords(),\n\t\t\t...workerRecords,\n\t\t\t...(this._workerLifecycle?.getManagedRecords() ?? []),\n\t\t];\n\t}\n\n\t/* Does not materialize the worker controller when UAC omitted delegation. /\n\tgetTaskRuntimeSnapshot(): TaskRuntimeProjection \| undefined {\n\t\treturn this._workerLifecycle?.getTaskRuntimeSnapshot();\n\t}\n\n\t/* Reconcile only when delegation has already been materialized; UAC omission stays zero-load. /\n\tsynchronizeGoalState(goal: GoalState): void {\n\t\tthis._workers?.synchronizeGoalState(goal);\n\t}\n\n\t/\n\t Resolve a tracked managed-lane dispatch. The caller's stable id is also the canonical durable\n\t * lane id, so this is an existence check rather than an id translation.\n\t /\n\tresolveManagedLaneId(callerLaneId: string): string \| undefined {\n\t\treturn this._getManagedLaneController().resolve(callerLaneId);\n\t}\n\n\t/* Live count of active lanes — the real source for AutonomyStatusSnapshot.activeLaneCount. /\n\tgetActiveLaneCount(): number {\n\t\treturn this.getLaneRecords().filter((record) => record.status === \"queued\" \|\| record.status === \"running\").length;\n\t}\n\n\t/* Belt-and-braces guard: whether ANY queued/running lane is tagged with this goalId. /\n\tprivate _hasInFlightLaneForGoal(goalId: string): boolean {\n\t\treturn this.getLaneRecords().some(\n\t\t\t(record) => record.goalId === goalId && (record.status === \"queued\" \|\| record.status === \"running\"),\n\t\t);\n\t}\n\n\t/* Delegate the out-of-process dispatch/terminal claim to its single lifecycle owner. /\n\trecordManagedLane(event: ManagedLaneEvent): LaneRecord \| undefined {\n\t\treturn this._getManagedLaneController().record(event);\n\t}\n\n\t/* Why the last idle research-lane evaluation skipped, for /autonomy diagnostics. /\n\tgetLastResearchLaneSkipReason(): string \| undefined {\n\t\treturn this._research.getLastSkipReason();\n\t}\n\n\t/\n\t Abort in-flight research and delegate worker disposal to its single owning controller.\n\t \n\t This synchronous body is the LAST provably-safe write window for canceled/in-flight work.\n\t * `dispose()` (agent-session.ts) has already set the session's own disposed flag but has not yet\n\t * returned — no successor session (e.g. a `/reload` adoption) can exist yet, so an append here\n\t * cannot interleave with one; a post-await continuation resuming AFTER this method returns must\n\t * not append (see the disposed branch in `runWorkerDelegationOnce`). Persist FIRST, then\n\t * complete-in-memory, so a throw from one lane's persist cannot skip another's; each persist gets\n\t * its own try/catch — dispose must never throw.\n\t /\n\tabortInFlightLanes(): void {\n\t\tthis._goalAutoContinue.clearTimer();\n\t\tthis._research.abort();\n\t\tthis._fitness.abort();\n\t\tfor (const record of this._laneTracker.getRecords()) {\n\t\t\tif (record.status !== \"queued\" && record.status !== \"running\") continue;\n\t\t\tif (record.type === \"tmux-worker\") continue;\n\t\t\tconst canceled = this._laneTracker.complete(record.laneId, {\n\t\t\t\tstatus: \"canceled\",\n\t\t\t\treasonCode: \"session_disposed\",\n\t\t\t});\n\t\t\tif (!canceled) continue;\n\t\t\ttry {\n\t\t\t\tappendLaneRecordSnapshot(this.deps.getSessionManager(), canceled);\n\t\t\t} catch (error) {\n\t\t\t\tthis._safeWarn(\n\t\t\t\t\t`Failed to persist canceled lane record ${canceled.laneId}: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t\tthis._managedLanes?.release();\n\n\t\tthis._workers?.abort();\n\t\tthis._workerNotifications?.dispose();\n\t}\n\n\tclearGoalAutoContinueTimer(): void {\n\t\tthis._goalAutoContinue.clearTimer();\n\t}\n\n\tscheduleGoalAutoContinueFromIdle(options?: PromptOptions): void {\n\t\tthis._goalAutoContinue.scheduleFromIdle(options);\n\t}\n\n\t/\n\t Single-flight entry point for EVERY goal-continuation loop invocation — idle autosteer\n\t * ({@link _runScheduledGoalAutoContinue}) AND the manual `/goal start` / `/goal-continue`\n\t * commands (reached through `AgentSession.continueGoalLoop`). Both paths ultimately submit\n\t * continuation prompts through the session's single `prompt()` path, so two loops racing throws\n\t * \"Agent is already processing\" from whichever submits second. `_isGoalAutoContinuing` is the\n\t * ONE owner of that mutex; `deps.continueGoalLoop` (the raw {@link GoalLoopController} loop)\n\t * must never be called directly outside this method, or the guard is bypassed.\n\t /\n\tasync continueGoalLoopExclusive(options: GoalContinuationLoopOptions): Promise<GoalContinuationLoopResult> {\n\t\treturn this._goalAutoContinue.continueExclusive(options);\n\t}\n\n\tclearResearchLaneTimer(): void {\n\t\tthis._research.clearTimer();\n\t}\n\n\tscheduleResearchLaneFromIdle(): void {\n\t\tthis._research.scheduleFromIdle();\n\t}\n\n\tresolveLaneModel(configuredPattern: string \| undefined): Model<Api> \| undefined {\n\t\treturn this._laneModels.resolveModel(configuredPattern);\n\t}\n\n\tgetOrchestrationProfileCatalog(): Array<{ profileId: string; role: string; description: string }> {\n\t\treturn this._getWorkerController().getProfileCatalog();\n\t}\n\n\t/\n\t Run one bounded, read-only research pass and persist its results: evidence bundle snapshot,\n\t * terminal lane record, and spawned-usage cost report (single-hop invariant, idempotent on the\n\t * lane's reportId). Explicit calls (e.g. `/autonomy research`) express user intent and bypass the\n\t * enabled/mode/dedupe gates the idle scheduler enforces; budget and capability gates always apply.\n\t /\n\tasync runResearchLaneOnce(request?: {\n\t\tquery?: string;\n\t\tcontext?: string;\n\t\tgoalId?: string;\n\t}): Promise<ResearchLaneRunOutcome> {\n\t\treturn this._research.runOnce(request);\n\t}\n\t/* Start a durable, profile-bound worker delegation. /\n\tstartWorkerDelegation(\n\t\trequest: WorkerDelegationRequest,\n\t): { started: false; skipReason: string } \| { started: true; record: LaneRecord } {\n\t\treturn this._getWorkerController().start(request);\n\t}\n\n\t/* Durable logical-worker controls. Each checks UAC before materializing worker state. /\n\tsendWorkerAgentMessage(agentId: string, message: string): { messageId: string; queued: true } {\n\t\tif (!this.deps.isDelegateToolActive())\n\t\t\tthrow new Error(\"Worker delegation control is unavailable in this UAC surface.\");\n\t\treturn this._getWorkerController().getAgentControl().sendWorkerAgentMessage(agentId, message);\n\t}\n\n\tfollowUpWorkerAgent(\n\t\tagentId: string,\n\t\tmessage: string,\n\t): { started: boolean; steering: boolean; messageId: string; record?: LaneRecord; skipReason?: string } {\n\t\tif (!this.deps.isDelegateToolActive())\n\t\t\tthrow new Error(\"Worker delegation control is unavailable in this UAC surface.\");\n\t\treturn this._getWorkerController().getAgentControl().followUpWorkerAgent(agentId, message);\n\t}\n\n\tinterruptWorkerAgent(agentId: string): { interrupted: boolean; reason?: string } {\n\t\tif (!this.deps.isDelegateToolActive())\n\t\t\tthrow new Error(\"Worker delegation control is unavailable in this UAC surface.\");\n\t\treturn this._getWorkerController().getAgentControl().interruptWorkerAgent(agentId);\n\t}\n\n\tresumeWorkerAgent(agentId: string): { started: boolean; record?: LaneRecord; skipReason?: string } {\n\t\tif (!this.deps.isDelegateToolActive())\n\t\t\tthrow new Error(\"Worker delegation control is unavailable in this UAC surface.\");\n\t\treturn this._getWorkerController().getAgentControl().resumeWorkerAgent(agentId);\n\t}\n\n\tcancelWorkerAgent(agentId: string, reasonCode?: string): LaneRecord \| undefined {\n\t\tif (!this.deps.isDelegateToolActive())\n\t\t\tthrow new Error(\"Worker delegation control is unavailable in this UAC surface.\");\n\t\treturn this._getWorkerController().getAgentControl().cancelWorkerAgent(agentId, reasonCode);\n\t}\n\n\twaitForWorkerAgent(\n\t\tagentId: string,\n\t\ttimeoutMs?: number,\n\t): Promise<{ status: \"active\" \| \"suspended\" \| \"idle\" \| \"unknown\" }> {\n\t\tif (!this.deps.isDelegateToolActive())\n\t\t\tthrow new Error(\"Worker delegation control is unavailable in this UAC surface.\");\n\t\treturn this._getWorkerController().getAgentControl().waitForWorkerAgent(agentId, timeoutMs);\n\t}\n\n\t/* Run one worker immediately; used by focused integrations and tests. /\n\tasync runWorkerDelegationOnce(\n\t\trequest: WorkerDelegationRequest,\n\t\tonStarted?: (record: LaneRecord) => void,\n\t\texistingRecord?: LaneRecord,\n\t): Promise<WorkerDelegationRunOutcome> {\n\t\treturn this._getWorkerController().runOnce(request, onStarted, existingRecord);\n\t}\n\t/\n\t Probe a candidate model against the subagent contracts (research/worker/judge/search/\n\t * tool-call surfaces) via {@link runModelFitnessProbe}. The model must resolve and\n\t * authenticate; every probe call runs as an isolated completion on that model, and probe\n\t * spend is reported through spawned-usage accounting.\n\t /\n\tasync runModelFitness(args: {\n\t\tmodel: string;\n\t\ttrials?: number;\n\t\t/* LLM tool-call id, present only via the model_fitness tool path — see model-fitness.ts. /\n\t\ttoolCallId?: string;\n\t}): Promise<{ started: true; model: string; report: ModelFitnessReport } \| { started: false; skipReason: string }> {\n\t\treturn this._fitness.run(args);\n\t}\n\n\t/* Start every capacity-eligible queued worker at the owner session's foreground-idle boundary. /\n\tdrainQueuedWorkerDelegations(): void {\n\t\tif (this.deps.isDelegateToolActive?.()) this._getWorkerController().drain();\n\t}\n\n\t/* Fitness reports persisted for THIS host (measured evidence for architect/profile decisions). */\n\tgetStoredFitnessReports(): StoredFitnessReport[] {\n\t\treturn this._fitness.getStoredReports();\n\t}\n}\n"]}

package/dist/core/background-lane-controller.js CHANGED Viewed

@@ -68,6 +68,7 @@ export class BackgroundLaneController {
             getGoalRuntimeSnapshot: deps.getGoalRuntimeSnapshot,
             hasInFlightLaneForGoal: (goalId) => this._hasInFlightLaneForGoal(goalId),
             continueGoalLoop: deps.continueGoalLoop,
+            markGoalToolUnavailable: deps.markGoalToolUnavailable,
             emit: deps.emit,
         });
     }
@@ -110,7 +111,7 @@ export class BackgroundLaneController {
         return this._workerNotifications;
     }
     _getManagedLaneController() {
-        this._managedLanes ??= new ManagedLaneController(this.deps, this._getWorkerLifecycle(), (record, notificationId) => this._recordWorkerTerminal(record, notificationId));
+        this._managedLanes ??= new ManagedLaneController(this.deps, this._getWorkerLifecycle(), (record, notificationId) => this._recordWorkerTerminal(record, notificationId), (message) => this._safeWarn(message));
         return this._managedLanes;
     }
     _hydrateManagedLanes() {
@@ -244,6 +245,37 @@ export class BackgroundLaneController {
     startWorkerDelegation(request) {
         return this._getWorkerController().start(request);
     }
+    /** Durable logical-worker controls. Each checks UAC before materializing worker state. */
+    sendWorkerAgentMessage(agentId, message) {
+        if (!this.deps.isDelegateToolActive())
+            throw new Error("Worker delegation control is unavailable in this UAC surface.");
+        return this._getWorkerController().getAgentControl().sendWorkerAgentMessage(agentId, message);
+    }
+    followUpWorkerAgent(agentId, message) {
+        if (!this.deps.isDelegateToolActive())
+            throw new Error("Worker delegation control is unavailable in this UAC surface.");
+        return this._getWorkerController().getAgentControl().followUpWorkerAgent(agentId, message);
+    }
+    interruptWorkerAgent(agentId) {
+        if (!this.deps.isDelegateToolActive())
+            throw new Error("Worker delegation control is unavailable in this UAC surface.");
+        return this._getWorkerController().getAgentControl().interruptWorkerAgent(agentId);
+    }
+    resumeWorkerAgent(agentId) {
+        if (!this.deps.isDelegateToolActive())
+            throw new Error("Worker delegation control is unavailable in this UAC surface.");
+        return this._getWorkerController().getAgentControl().resumeWorkerAgent(agentId);
+    }
+    cancelWorkerAgent(agentId, reasonCode) {
+        if (!this.deps.isDelegateToolActive())
+            throw new Error("Worker delegation control is unavailable in this UAC surface.");
+        return this._getWorkerController().getAgentControl().cancelWorkerAgent(agentId, reasonCode);
+    }
+    waitForWorkerAgent(agentId, timeoutMs) {
+        if (!this.deps.isDelegateToolActive())
+            throw new Error("Worker delegation control is unavailable in this UAC surface.");
+        return this._getWorkerController().getAgentControl().waitForWorkerAgent(agentId, timeoutMs);
+    }
     /** Run one worker immediately; used by focused integrations and tests. */
     async runWorkerDelegationOnce(request, onStarted, existingRecord) {
         return this._getWorkerController().runOnce(request, onStarted, existingRecord);