npm - @caupulican/pi-adaptative - Versions diffs - 0.81.41 → 0.81.42 - Mend

@caupulican/pi-adaptative 0.81.41 → 0.81.42

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (237) hide show

package/dist/core/autonomy/contracts.d.ts CHANGED Viewed

@@ -116,6 +116,8 @@ export interface WorkerClaimVerificationDecision {
 /** Untrusted worker-authored report. Only host adjudication can turn this into a durable result. */
 export interface WorkerClaim {
     requestId: string;
+    /** Host-stamped durable attempt identity for replay-safe claim persistence. */
+    terminalAttemptId?: string;
     status: WorkerClaimStatus;
     summary: string;
     outputFormat?: WorkerClaimOutputFormat;

package/dist/core/autonomy/contracts.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AAC7D,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,SAAS,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AACnF,MAAM,WAAW,UAAU;IAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACzB;AAED,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,UAAU,CAAC;AAEtE,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,cAAc,GAAG,aAAa,GAAG,mBAAmB,CAAC;AAE3F,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,cAAc,GAAG,aAAa,GAAG,mBAAmB,CAAC;AAE/F,MAAM,WAAW,mBAAmB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,gBAAgB,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEhF,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,cAAc,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,SAAS,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC3C,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;AAExF,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE,eAAe,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,YAAY,GAAG,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnG,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,UAAU,CAAC;CACtB;AAED,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IAChC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEjF,MAAM,MAAM,uBAAuB,GAAG,YAAY,GAAG,YAAY,CAAC;AAElE,MAAM,WAAW,+BAA+B;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,UAAU,GAAG,UAAU,CAAC;IACjC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B;AAED,oGAAoG;AACpG,MAAM,WAAW,WAAW;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;4EAGwE;IACxE,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;wGAEkG;IAClG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wEAAwE;IACxE,YAAY,CAAC,EAAE,+BAA+B,CAAC;CAC/C;AAED,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;AAElE,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB","sourcesContent":["import type { HarnessCapability } from \"../capability-contract.ts\";\n\nexport type JsonPrimitive = string \| number \| boolean \| null;\nexport type JsonValue = JsonPrimitive \| JsonValue[] \| { [key: string]: JsonValue };\nexport interface JsonObject {\n\t[key: string]: JsonValue;\n}\n\nexport type ModelTier = \"cheap\" \| \"medium\" \| \"expensive\" \| \"learning\";\n\nexport type RouteRisk = \"read-only\" \| \"scoped-write\" \| \"high-impact\" \| \"approval-required\";\n\nexport type OperationRisk = \"read-only\" \| \"scoped-write\" \| \"high-impact\" \| \"approval-required\";\n\nexport interface RiskAssessmentInput {\n\toperation: string;\n\ttoolName?: string;\n\tcommand?: string;\n\tpaths?: readonly string[];\n\tcapabilities?: readonly HarnessCapability[];\n}\n\nexport interface RiskAssessment {\n\trisk: OperationRisk;\n\treasonCode: string;\n\treasons: readonly string[];\n\trequiresApproval: boolean;\n}\n\nexport type PathScopeDecisionKind = \"inside\" \| \"outside\" \| \"denied\" \| \"missing\";\n\nexport interface PathScope {\n\troot: string;\n\tallowedPaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\tfollowSymlinks?: boolean;\n}\n\nexport interface PathScopeDecision {\n\tkind: PathScopeDecisionKind;\n\tpath: string;\n\tresolvedPath?: string;\n\tmatchedRule?: string;\n\treasonCode: string;\n}\n\nexport interface RouteDecision {\n\ttier: ModelTier;\n\tmodel?: string;\n\trisk: RouteRisk;\n\tconfidence: number;\n\treasonCode: string;\n\treasons: readonly string[];\n\tfallbackFrom?: ModelTier;\n\tcreatedAt?: string;\n}\n\nexport interface CapabilityEnvelope {\n\tid: string;\n\tprofileId?: string;\n\tcapabilities: readonly HarnessCapability[];\n\tallowedTools?: readonly string[];\n\tdeniedTools?: readonly string[];\n\tallowedPaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\tmaxEstimatedUsd?: number;\n\tcreatedAt?: string;\n}\n\nexport type GateOutcomeKind = \"allow\" \| \"downgrade\" \| \"escalate\" \| \"ask-user\" \| \"block\";\n\nexport interface GateOutcome {\n\toutcome: GateOutcomeKind;\n\tgate: string;\n\treasonCode: string;\n\tmessage?: string;\n\treversible?: boolean;\n\tdetails?: JsonObject;\n}\n\nexport interface ApprovalRequest {\n\tid: string;\n\toperation: string;\n\ttarget: string;\n\treversible: boolean;\n\tcapabilities: readonly HarnessCapability[];\n\treasonCode: string;\n\tcreatedAt?: string;\n}\n\nexport type EvidenceSourceKind = \"workspace\" \| \"transcript\" \| \"automata\" \| \"web\" \| \"user\" \| \"tool\";\n\nexport interface EvidenceRef {\n\tid: string;\n\tkind: EvidenceSourceKind;\n\ttitle?: string;\n\turi?: string;\n\ttrusted: boolean;\n\texcerpt?: string;\n\tmetadata?: JsonObject;\n}\n\nexport interface Finding {\n\tid: string;\n\tsummary: string;\n\tevidenceIds: readonly string[];\n\tconfidence?: number;\n}\n\nexport interface EvidenceBundle {\n\tquery: string;\n\tsources: readonly EvidenceRef[];\n\tfindings: readonly Finding[];\n\tcreatedAt?: string;\n}\n\nexport interface WorkerRequest {\n\tid: string;\n\tinstructions: string;\n\troute: RouteDecision;\n\tenvelope: CapabilityEnvelope;\n\tevidence?: EvidenceBundle;\n\tmaxEstimatedUsd?: number;\n\tcreatedAt?: string;\n}\n\nexport type WorkerClaimStatus = \"completed\" \| \"blocked\" \| \"failed\" \| \"cancelled\";\n\nexport type WorkerClaimOutputFormat = \"structured\" \| \"plain_text\";\n\nexport interface WorkerClaimVerificationDecision {\n\tsubjectTaskId: string;\n\tverdict: \"accepted\" \| \"rejected\";\n\treasonCodes: readonly string[];\n}\n\n/** Untrusted worker-authored report. Only host adjudication can turn this into a durable result. /\nexport interface WorkerClaim {\n\trequestId: string;\n\tstatus: WorkerClaimStatus;\n\tsummary: string;\n\toutputFormat?: WorkerClaimOutputFormat;\n\tevidence?: EvidenceBundle;\n\tchangedFiles: readonly string[];\n\tblockers?: readonly string[];\n\tusageReportId?: string;\n\tcreatedAt?: string;\n\t/* Stamped at persistence time when validateWorkerClaim's gate flagged this claim\n\t * \"ask-user\"/\"parent_review_required\" (mutated files or blockers on an otherwise-completed run).\n\t * Undefined when not computable because an externally managed lane had no WorkerRequest —\n\t * distinct from `false`, which means the gate explicitly cleared it. /\n\tparentReviewRequired?: boolean;\n\t/* ISO 8601 timestamp set once the parent explicitly acknowledges an unreviewed mutation via\n\t * delegate_status's \"review\" action. Presence means reviewed; absence keeps the notice sticky.\n\t * The ack is durable — re-derived from the latest persisted snapshot, not session-local state. /\n\tparentReviewedAt?: string;\n\t/* Typed semantic verdict emitted only by a verifier-profile worker. */\n\tverification?: WorkerClaimVerificationDecision;\n}\n\nexport type LearningDecisionKind = \"no-op\" \| \"proposal\" \| \"apply\";\n\nexport interface LearningDecision {\n\tkind: LearningDecisionKind;\n\treasonCode: string;\n\tconfidence: number;\n\tsummary: string;\n\trequiresApproval: boolean;\n\tcreatedAt?: string;\n}\n"]}
1	+ {"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AAC7D,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,SAAS,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AACnF,MAAM,WAAW,UAAU;IAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACzB;AAED,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,UAAU,CAAC;AAEtE,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,cAAc,GAAG,aAAa,GAAG,mBAAmB,CAAC;AAE3F,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,cAAc,GAAG,aAAa,GAAG,mBAAmB,CAAC;AAE/F,MAAM,WAAW,mBAAmB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,gBAAgB,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEhF,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,cAAc,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,SAAS,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC3C,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;AAExF,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE,eAAe,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,YAAY,GAAG,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnG,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,UAAU,CAAC;CACtB;AAED,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IAChC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEjF,MAAM,MAAM,uBAAuB,GAAG,YAAY,GAAG,YAAY,CAAC;AAElE,MAAM,WAAW,+BAA+B;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,UAAU,GAAG,UAAU,CAAC;IACjC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B;AAED,oGAAoG;AACpG,MAAM,WAAW,WAAW;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;4EAGwE;IACxE,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;wGAEkG;IAClG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wEAAwE;IACxE,YAAY,CAAC,EAAE,+BAA+B,CAAC;CAC/C;AAED,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;AAElE,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB","sourcesContent":["import type { HarnessCapability } from \"../capability-contract.ts\";\n\nexport type JsonPrimitive = string \| number \| boolean \| null;\nexport type JsonValue = JsonPrimitive \| JsonValue[] \| { [key: string]: JsonValue };\nexport interface JsonObject {\n\t[key: string]: JsonValue;\n}\n\nexport type ModelTier = \"cheap\" \| \"medium\" \| \"expensive\" \| \"learning\";\n\nexport type RouteRisk = \"read-only\" \| \"scoped-write\" \| \"high-impact\" \| \"approval-required\";\n\nexport type OperationRisk = \"read-only\" \| \"scoped-write\" \| \"high-impact\" \| \"approval-required\";\n\nexport interface RiskAssessmentInput {\n\toperation: string;\n\ttoolName?: string;\n\tcommand?: string;\n\tpaths?: readonly string[];\n\tcapabilities?: readonly HarnessCapability[];\n}\n\nexport interface RiskAssessment {\n\trisk: OperationRisk;\n\treasonCode: string;\n\treasons: readonly string[];\n\trequiresApproval: boolean;\n}\n\nexport type PathScopeDecisionKind = \"inside\" \| \"outside\" \| \"denied\" \| \"missing\";\n\nexport interface PathScope {\n\troot: string;\n\tallowedPaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\tfollowSymlinks?: boolean;\n}\n\nexport interface PathScopeDecision {\n\tkind: PathScopeDecisionKind;\n\tpath: string;\n\tresolvedPath?: string;\n\tmatchedRule?: string;\n\treasonCode: string;\n}\n\nexport interface RouteDecision {\n\ttier: ModelTier;\n\tmodel?: string;\n\trisk: RouteRisk;\n\tconfidence: number;\n\treasonCode: string;\n\treasons: readonly string[];\n\tfallbackFrom?: ModelTier;\n\tcreatedAt?: string;\n}\n\nexport interface CapabilityEnvelope {\n\tid: string;\n\tprofileId?: string;\n\tcapabilities: readonly HarnessCapability[];\n\tallowedTools?: readonly string[];\n\tdeniedTools?: readonly string[];\n\tallowedPaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\tmaxEstimatedUsd?: number;\n\tcreatedAt?: string;\n}\n\nexport type GateOutcomeKind = \"allow\" \| \"downgrade\" \| \"escalate\" \| \"ask-user\" \| \"block\";\n\nexport interface GateOutcome {\n\toutcome: GateOutcomeKind;\n\tgate: string;\n\treasonCode: string;\n\tmessage?: string;\n\treversible?: boolean;\n\tdetails?: JsonObject;\n}\n\nexport interface ApprovalRequest {\n\tid: string;\n\toperation: string;\n\ttarget: string;\n\treversible: boolean;\n\tcapabilities: readonly HarnessCapability[];\n\treasonCode: string;\n\tcreatedAt?: string;\n}\n\nexport type EvidenceSourceKind = \"workspace\" \| \"transcript\" \| \"automata\" \| \"web\" \| \"user\" \| \"tool\";\n\nexport interface EvidenceRef {\n\tid: string;\n\tkind: EvidenceSourceKind;\n\ttitle?: string;\n\turi?: string;\n\ttrusted: boolean;\n\texcerpt?: string;\n\tmetadata?: JsonObject;\n}\n\nexport interface Finding {\n\tid: string;\n\tsummary: string;\n\tevidenceIds: readonly string[];\n\tconfidence?: number;\n}\n\nexport interface EvidenceBundle {\n\tquery: string;\n\tsources: readonly EvidenceRef[];\n\tfindings: readonly Finding[];\n\tcreatedAt?: string;\n}\n\nexport interface WorkerRequest {\n\tid: string;\n\tinstructions: string;\n\troute: RouteDecision;\n\tenvelope: CapabilityEnvelope;\n\tevidence?: EvidenceBundle;\n\tmaxEstimatedUsd?: number;\n\tcreatedAt?: string;\n}\n\nexport type WorkerClaimStatus = \"completed\" \| \"blocked\" \| \"failed\" \| \"cancelled\";\n\nexport type WorkerClaimOutputFormat = \"structured\" \| \"plain_text\";\n\nexport interface WorkerClaimVerificationDecision {\n\tsubjectTaskId: string;\n\tverdict: \"accepted\" \| \"rejected\";\n\treasonCodes: readonly string[];\n}\n\n/** Untrusted worker-authored report. Only host adjudication can turn this into a durable result. /\nexport interface WorkerClaim {\n\trequestId: string;\n\t/* Host-stamped durable attempt identity for replay-safe claim persistence. /\n\tterminalAttemptId?: string;\n\tstatus: WorkerClaimStatus;\n\tsummary: string;\n\toutputFormat?: WorkerClaimOutputFormat;\n\tevidence?: EvidenceBundle;\n\tchangedFiles: readonly string[];\n\tblockers?: readonly string[];\n\tusageReportId?: string;\n\tcreatedAt?: string;\n\t/* Stamped at persistence time when validateWorkerClaim's gate flagged this claim\n\t * \"ask-user\"/\"parent_review_required\" (mutated files or blockers on an otherwise-completed run).\n\t * Undefined when not computable because an externally managed lane had no WorkerRequest —\n\t * distinct from `false`, which means the gate explicitly cleared it. /\n\tparentReviewRequired?: boolean;\n\t/* ISO 8601 timestamp set once the parent explicitly acknowledges an unreviewed mutation via\n\t * delegate_status's \"review\" action. Presence means reviewed; absence keeps the notice sticky.\n\t * The ack is durable — re-derived from the latest persisted snapshot, not session-local state. /\n\tparentReviewedAt?: string;\n\t/* Typed semantic verdict emitted only by a verifier-profile worker. */\n\tverification?: WorkerClaimVerificationDecision;\n}\n\nexport type LearningDecisionKind = \"no-op\" \| \"proposal\" \| \"apply\";\n\nexport interface LearningDecision {\n\tkind: LearningDecisionKind;\n\treasonCode: string;\n\tconfidence: number;\n\tsummary: string;\n\trequiresApproval: boolean;\n\tcreatedAt?: string;\n}\n"]}

package/dist/core/autonomy/contracts.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../../src/core/autonomy/contracts.ts"],"names":[],"mappings":"","sourcesContent":["import type { HarnessCapability } from \"../capability-contract.ts\";\n\nexport type JsonPrimitive = string \| number \| boolean \| null;\nexport type JsonValue = JsonPrimitive \| JsonValue[] \| { [key: string]: JsonValue };\nexport interface JsonObject {\n\t[key: string]: JsonValue;\n}\n\nexport type ModelTier = \"cheap\" \| \"medium\" \| \"expensive\" \| \"learning\";\n\nexport type RouteRisk = \"read-only\" \| \"scoped-write\" \| \"high-impact\" \| \"approval-required\";\n\nexport type OperationRisk = \"read-only\" \| \"scoped-write\" \| \"high-impact\" \| \"approval-required\";\n\nexport interface RiskAssessmentInput {\n\toperation: string;\n\ttoolName?: string;\n\tcommand?: string;\n\tpaths?: readonly string[];\n\tcapabilities?: readonly HarnessCapability[];\n}\n\nexport interface RiskAssessment {\n\trisk: OperationRisk;\n\treasonCode: string;\n\treasons: readonly string[];\n\trequiresApproval: boolean;\n}\n\nexport type PathScopeDecisionKind = \"inside\" \| \"outside\" \| \"denied\" \| \"missing\";\n\nexport interface PathScope {\n\troot: string;\n\tallowedPaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\tfollowSymlinks?: boolean;\n}\n\nexport interface PathScopeDecision {\n\tkind: PathScopeDecisionKind;\n\tpath: string;\n\tresolvedPath?: string;\n\tmatchedRule?: string;\n\treasonCode: string;\n}\n\nexport interface RouteDecision {\n\ttier: ModelTier;\n\tmodel?: string;\n\trisk: RouteRisk;\n\tconfidence: number;\n\treasonCode: string;\n\treasons: readonly string[];\n\tfallbackFrom?: ModelTier;\n\tcreatedAt?: string;\n}\n\nexport interface CapabilityEnvelope {\n\tid: string;\n\tprofileId?: string;\n\tcapabilities: readonly HarnessCapability[];\n\tallowedTools?: readonly string[];\n\tdeniedTools?: readonly string[];\n\tallowedPaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\tmaxEstimatedUsd?: number;\n\tcreatedAt?: string;\n}\n\nexport type GateOutcomeKind = \"allow\" \| \"downgrade\" \| \"escalate\" \| \"ask-user\" \| \"block\";\n\nexport interface GateOutcome {\n\toutcome: GateOutcomeKind;\n\tgate: string;\n\treasonCode: string;\n\tmessage?: string;\n\treversible?: boolean;\n\tdetails?: JsonObject;\n}\n\nexport interface ApprovalRequest {\n\tid: string;\n\toperation: string;\n\ttarget: string;\n\treversible: boolean;\n\tcapabilities: readonly HarnessCapability[];\n\treasonCode: string;\n\tcreatedAt?: string;\n}\n\nexport type EvidenceSourceKind = \"workspace\" \| \"transcript\" \| \"automata\" \| \"web\" \| \"user\" \| \"tool\";\n\nexport interface EvidenceRef {\n\tid: string;\n\tkind: EvidenceSourceKind;\n\ttitle?: string;\n\turi?: string;\n\ttrusted: boolean;\n\texcerpt?: string;\n\tmetadata?: JsonObject;\n}\n\nexport interface Finding {\n\tid: string;\n\tsummary: string;\n\tevidenceIds: readonly string[];\n\tconfidence?: number;\n}\n\nexport interface EvidenceBundle {\n\tquery: string;\n\tsources: readonly EvidenceRef[];\n\tfindings: readonly Finding[];\n\tcreatedAt?: string;\n}\n\nexport interface WorkerRequest {\n\tid: string;\n\tinstructions: string;\n\troute: RouteDecision;\n\tenvelope: CapabilityEnvelope;\n\tevidence?: EvidenceBundle;\n\tmaxEstimatedUsd?: number;\n\tcreatedAt?: string;\n}\n\nexport type WorkerClaimStatus = \"completed\" \| \"blocked\" \| \"failed\" \| \"cancelled\";\n\nexport type WorkerClaimOutputFormat = \"structured\" \| \"plain_text\";\n\nexport interface WorkerClaimVerificationDecision {\n\tsubjectTaskId: string;\n\tverdict: \"accepted\" \| \"rejected\";\n\treasonCodes: readonly string[];\n}\n\n/** Untrusted worker-authored report. Only host adjudication can turn this into a durable result. /\nexport interface WorkerClaim {\n\trequestId: string;\n\tstatus: WorkerClaimStatus;\n\tsummary: string;\n\toutputFormat?: WorkerClaimOutputFormat;\n\tevidence?: EvidenceBundle;\n\tchangedFiles: readonly string[];\n\tblockers?: readonly string[];\n\tusageReportId?: string;\n\tcreatedAt?: string;\n\t/* Stamped at persistence time when validateWorkerClaim's gate flagged this claim\n\t * \"ask-user\"/\"parent_review_required\" (mutated files or blockers on an otherwise-completed run).\n\t * Undefined when not computable because an externally managed lane had no WorkerRequest —\n\t * distinct from `false`, which means the gate explicitly cleared it. /\n\tparentReviewRequired?: boolean;\n\t/* ISO 8601 timestamp set once the parent explicitly acknowledges an unreviewed mutation via\n\t * delegate_status's \"review\" action. Presence means reviewed; absence keeps the notice sticky.\n\t * The ack is durable — re-derived from the latest persisted snapshot, not session-local state. /\n\tparentReviewedAt?: string;\n\t/* Typed semantic verdict emitted only by a verifier-profile worker. */\n\tverification?: WorkerClaimVerificationDecision;\n}\n\nexport type LearningDecisionKind = \"no-op\" \| \"proposal\" \| \"apply\";\n\nexport interface LearningDecision {\n\tkind: LearningDecisionKind;\n\treasonCode: string;\n\tconfidence: number;\n\tsummary: string;\n\trequiresApproval: boolean;\n\tcreatedAt?: string;\n}\n"]}
1	+ {"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../../src/core/autonomy/contracts.ts"],"names":[],"mappings":"","sourcesContent":["import type { HarnessCapability } from \"../capability-contract.ts\";\n\nexport type JsonPrimitive = string \| number \| boolean \| null;\nexport type JsonValue = JsonPrimitive \| JsonValue[] \| { [key: string]: JsonValue };\nexport interface JsonObject {\n\t[key: string]: JsonValue;\n}\n\nexport type ModelTier = \"cheap\" \| \"medium\" \| \"expensive\" \| \"learning\";\n\nexport type RouteRisk = \"read-only\" \| \"scoped-write\" \| \"high-impact\" \| \"approval-required\";\n\nexport type OperationRisk = \"read-only\" \| \"scoped-write\" \| \"high-impact\" \| \"approval-required\";\n\nexport interface RiskAssessmentInput {\n\toperation: string;\n\ttoolName?: string;\n\tcommand?: string;\n\tpaths?: readonly string[];\n\tcapabilities?: readonly HarnessCapability[];\n}\n\nexport interface RiskAssessment {\n\trisk: OperationRisk;\n\treasonCode: string;\n\treasons: readonly string[];\n\trequiresApproval: boolean;\n}\n\nexport type PathScopeDecisionKind = \"inside\" \| \"outside\" \| \"denied\" \| \"missing\";\n\nexport interface PathScope {\n\troot: string;\n\tallowedPaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\tfollowSymlinks?: boolean;\n}\n\nexport interface PathScopeDecision {\n\tkind: PathScopeDecisionKind;\n\tpath: string;\n\tresolvedPath?: string;\n\tmatchedRule?: string;\n\treasonCode: string;\n}\n\nexport interface RouteDecision {\n\ttier: ModelTier;\n\tmodel?: string;\n\trisk: RouteRisk;\n\tconfidence: number;\n\treasonCode: string;\n\treasons: readonly string[];\n\tfallbackFrom?: ModelTier;\n\tcreatedAt?: string;\n}\n\nexport interface CapabilityEnvelope {\n\tid: string;\n\tprofileId?: string;\n\tcapabilities: readonly HarnessCapability[];\n\tallowedTools?: readonly string[];\n\tdeniedTools?: readonly string[];\n\tallowedPaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\tmaxEstimatedUsd?: number;\n\tcreatedAt?: string;\n}\n\nexport type GateOutcomeKind = \"allow\" \| \"downgrade\" \| \"escalate\" \| \"ask-user\" \| \"block\";\n\nexport interface GateOutcome {\n\toutcome: GateOutcomeKind;\n\tgate: string;\n\treasonCode: string;\n\tmessage?: string;\n\treversible?: boolean;\n\tdetails?: JsonObject;\n}\n\nexport interface ApprovalRequest {\n\tid: string;\n\toperation: string;\n\ttarget: string;\n\treversible: boolean;\n\tcapabilities: readonly HarnessCapability[];\n\treasonCode: string;\n\tcreatedAt?: string;\n}\n\nexport type EvidenceSourceKind = \"workspace\" \| \"transcript\" \| \"automata\" \| \"web\" \| \"user\" \| \"tool\";\n\nexport interface EvidenceRef {\n\tid: string;\n\tkind: EvidenceSourceKind;\n\ttitle?: string;\n\turi?: string;\n\ttrusted: boolean;\n\texcerpt?: string;\n\tmetadata?: JsonObject;\n}\n\nexport interface Finding {\n\tid: string;\n\tsummary: string;\n\tevidenceIds: readonly string[];\n\tconfidence?: number;\n}\n\nexport interface EvidenceBundle {\n\tquery: string;\n\tsources: readonly EvidenceRef[];\n\tfindings: readonly Finding[];\n\tcreatedAt?: string;\n}\n\nexport interface WorkerRequest {\n\tid: string;\n\tinstructions: string;\n\troute: RouteDecision;\n\tenvelope: CapabilityEnvelope;\n\tevidence?: EvidenceBundle;\n\tmaxEstimatedUsd?: number;\n\tcreatedAt?: string;\n}\n\nexport type WorkerClaimStatus = \"completed\" \| \"blocked\" \| \"failed\" \| \"cancelled\";\n\nexport type WorkerClaimOutputFormat = \"structured\" \| \"plain_text\";\n\nexport interface WorkerClaimVerificationDecision {\n\tsubjectTaskId: string;\n\tverdict: \"accepted\" \| \"rejected\";\n\treasonCodes: readonly string[];\n}\n\n/** Untrusted worker-authored report. Only host adjudication can turn this into a durable result. /\nexport interface WorkerClaim {\n\trequestId: string;\n\t/* Host-stamped durable attempt identity for replay-safe claim persistence. /\n\tterminalAttemptId?: string;\n\tstatus: WorkerClaimStatus;\n\tsummary: string;\n\toutputFormat?: WorkerClaimOutputFormat;\n\tevidence?: EvidenceBundle;\n\tchangedFiles: readonly string[];\n\tblockers?: readonly string[];\n\tusageReportId?: string;\n\tcreatedAt?: string;\n\t/* Stamped at persistence time when validateWorkerClaim's gate flagged this claim\n\t * \"ask-user\"/\"parent_review_required\" (mutated files or blockers on an otherwise-completed run).\n\t * Undefined when not computable because an externally managed lane had no WorkerRequest —\n\t * distinct from `false`, which means the gate explicitly cleared it. /\n\tparentReviewRequired?: boolean;\n\t/* ISO 8601 timestamp set once the parent explicitly acknowledges an unreviewed mutation via\n\t * delegate_status's \"review\" action. Presence means reviewed; absence keeps the notice sticky.\n\t * The ack is durable — re-derived from the latest persisted snapshot, not session-local state. /\n\tparentReviewedAt?: string;\n\t/* Typed semantic verdict emitted only by a verifier-profile worker. */\n\tverification?: WorkerClaimVerificationDecision;\n}\n\nexport type LearningDecisionKind = \"no-op\" \| \"proposal\" \| \"apply\";\n\nexport interface LearningDecision {\n\tkind: LearningDecisionKind;\n\treasonCode: string;\n\tconfidence: number;\n\tsummary: string;\n\trequiresApproval: boolean;\n\tcreatedAt?: string;\n}\n"]}

package/dist/core/autonomy/envelope-enforcement.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"envelope-enforcement.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/envelope-enforcement.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAezD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAiB9D;~~AAUD~~;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAuBxG;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;CACzC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,kBAAkB,EACrE,IAAI,EAAE,CAAC,EACP,QAAQ,EAAE,kBAAkB,EAC5B,GAAG,EAAE,MAAM,GACT,CAAC,CAsBH","sourcesContent":["import { ~~isAbsolute, relative,~~ resolve, ~~sep~~ } from \"node:path\";\nimport type { CapabilityEnvelope } from \"./contracts.ts\";\nimport { safeRealpathSync } from \"./path-scope.ts\";\n\n/*\n Tool-level envelope enforcement (G2 prerequisite for code-writing workers): the capability\n * envelope's `allowedPaths`/`deniedPaths` were previously VALIDATION-ONLY — recorded on the\n * envelope but never checked when a tool actually ran. This module wraps tools so path-bearing\n * arguments are checked AT EXECUTION TIME, structurally refusing out-of-scope paths the same way\n * a failed script can never look like success: the refusal is an isError result with a stable\n * outcome code, never a silent no-op.\n /\n\nconst PATH_ARGUMENT_KEYS = [\"path\", \"file_path\", \"filePath\", \"cwd\", \"directory\", \"dir\", \"target\"] as const;\nconst PATH_LIST_ARGUMENT_KEYS = [\"paths\", \"files\"] as const;\n\nexport function extractPathArguments(params: unknown): string[] {\n\tif (!params \|\| typeof params !== \"object\") return [];\n\tconst record = params as Record<string, unknown>;\n\tconst found: string[] = [];\n\tfor (const key of PATH_ARGUMENT_KEYS) {\n\t\tconst value = record[key];\n\t\tif (typeof value === \"string\" && value.length > 0) found.push(value);\n\t}\n\tfor (const key of PATH_LIST_ARGUMENT_KEYS) {\n\t\tconst value = record[key];\n\t\tif (Array.isArray(value)) {\n\t\t\tfor (const entry of value) {\n\t\t\t\tif (typeof entry === \"string\" && entry.length > 0) found.push(entry);\n\t\t\t}\n\t\t}\n\t}\n\treturn found;\n}\n\~~nfunction isWithinRoot(target: string, root: string): boolean {\~~n\tconst relativePath = relative(root, target);\n\treturn (\n\t\trelativePath === \"\" \|\|\n\t\t(!relativePath.startsWith(`..${sep}`) && relativePath !== \"..\" && !isAbsolute(relativePath))\n\t);\n}\n\n/\n Deny wins over allow; an empty/absent allow list means \"no positive scope restriction\"\n * (only denies apply) — mirroring the resource-profile filter semantics.\n \n Both the target and every scope root are resolved through the real filesystem\n * (symlinks expanded in the existing prefix) before comparison: a pre-existing symlink\n * under an allowed root cannot smuggle a write outside the scope, and a shortcut into a\n * denied subtree is still denied. An unresolvable target fails closed.\n /\nexport function isPathWithinEnvelope(envelope: CapabilityEnvelope, rawPath: string, cwd: string): boolean {\n\tlet target: string;\n\ttry {\n\t\ttarget = safeRealpathSync(resolve(cwd, rawPath));\n\t} catch {\n\t\treturn false;\n\t}\n\tfor (const denied of envelope.deniedPaths ?? []) {\n\t\ttry {\n\t\t\tif (~~isWithinRoot~~(target, safeRealpathSync(resolve(cwd, denied)))) return false;\n\t\t} catch {\n\t\t\t// Mirror checkPathScope: an unresolvable deny root cannot match anything.\n\t\t}\n\t}\n\tconst allowed = envelope.allowedPaths ?? [];\n\tif (allowed.length === 0) return true;\n\treturn allowed.some((root) => {\n\t\ttry {\n\t\t\treturn ~~isWithinRoot~~(target, safeRealpathSync(resolve(cwd, root)));\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t});\n}\n\nexport interface EnvelopeScopedTool {\n\tname: string;\n\texecute: (...args: unknown[]) => unknown;\n}\n\n/\n Wrap a tool so every path-bearing argument is scope-checked when it RUNS. The wrapped tool is\n * shape-identical; params are conventionally the second execute argument (toolCallId, params, …).\n */\nexport function wrapToolWithEnvelopeScope<T extends EnvelopeScopedTool>(\n\ttool: T,\n\tenvelope: CapabilityEnvelope,\n\tcwd: string,\n): T {\n\treturn {\n\t\t...tool,\n\t\texecute: (...args: unknown[]) => {\n\t\t\tconst params = args[1];\n\t\t\tfor (const rawPath of extractPathArguments(params)) {\n\t\t\t\tif (!isPathWithinEnvelope(envelope, rawPath, cwd)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\ttext: `envelope_path_denied: \"${rawPath}\" is outside envelope ${envelope.id}'s path scope. The tool was NOT run.`,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t\tdetails: { outcome: \"envelope_path_denied\", tool: tool.name, path: rawPath, envelopeId: envelope.id },\n\t\t\t\t\t\tisError: true,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn tool.execute(...args);\n\t\t},\n\t};\n}\n"]}
1	+ {"version":3,"file":"envelope-enforcement.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/envelope-enforcement.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAezD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAiB9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAuBxG;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;CACzC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,kBAAkB,EACrE,IAAI,EAAE,CAAC,EACP,QAAQ,EAAE,kBAAkB,EAC5B,GAAG,EAAE,MAAM,GACT,CAAC,CAsBH","sourcesContent":["import { resolve } from \"node:path\";\nimport type { CapabilityEnvelope } from \"./contracts.ts\";\nimport { isPathWithinScope, safeRealpathSync } from \"./path-scope.ts\";\n\n/*\n Tool-level envelope enforcement (G2 prerequisite for code-writing workers): the capability\n * envelope's `allowedPaths`/`deniedPaths` were previously VALIDATION-ONLY — recorded on the\n * envelope but never checked when a tool actually ran. This module wraps tools so path-bearing\n * arguments are checked AT EXECUTION TIME, structurally refusing out-of-scope paths the same way\n * a failed script can never look like success: the refusal is an isError result with a stable\n * outcome code, never a silent no-op.\n /\n\nconst PATH_ARGUMENT_KEYS = [\"path\", \"file_path\", \"filePath\", \"cwd\", \"directory\", \"dir\", \"target\"] as const;\nconst PATH_LIST_ARGUMENT_KEYS = [\"paths\", \"files\"] as const;\n\nexport function extractPathArguments(params: unknown): string[] {\n\tif (!params \|\| typeof params !== \"object\") return [];\n\tconst record = params as Record<string, unknown>;\n\tconst found: string[] = [];\n\tfor (const key of PATH_ARGUMENT_KEYS) {\n\t\tconst value = record[key];\n\t\tif (typeof value === \"string\" && value.length > 0) found.push(value);\n\t}\n\tfor (const key of PATH_LIST_ARGUMENT_KEYS) {\n\t\tconst value = record[key];\n\t\tif (Array.isArray(value)) {\n\t\t\tfor (const entry of value) {\n\t\t\t\tif (typeof entry === \"string\" && entry.length > 0) found.push(entry);\n\t\t\t}\n\t\t}\n\t}\n\treturn found;\n}\n\n/\n Deny wins over allow; an empty/absent allow list means \"no positive scope restriction\"\n * (only denies apply) — mirroring the resource-profile filter semantics.\n \n Both the target and every scope root are resolved through the real filesystem\n * (symlinks expanded in the existing prefix) before comparison: a pre-existing symlink\n * under an allowed root cannot smuggle a write outside the scope, and a shortcut into a\n * denied subtree is still denied. An unresolvable target fails closed.\n /\nexport function isPathWithinEnvelope(envelope: CapabilityEnvelope, rawPath: string, cwd: string): boolean {\n\tlet target: string;\n\ttry {\n\t\ttarget = safeRealpathSync(resolve(cwd, rawPath));\n\t} catch {\n\t\treturn false;\n\t}\n\tfor (const denied of envelope.deniedPaths ?? []) {\n\t\ttry {\n\t\t\tif (isPathWithinScope(target, safeRealpathSync(resolve(cwd, denied)))) return false;\n\t\t} catch {\n\t\t\t// Mirror checkPathScope: an unresolvable deny root cannot match anything.\n\t\t}\n\t}\n\tconst allowed = envelope.allowedPaths ?? [];\n\tif (allowed.length === 0) return true;\n\treturn allowed.some((root) => {\n\t\ttry {\n\t\t\treturn isPathWithinScope(target, safeRealpathSync(resolve(cwd, root)));\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t});\n}\n\nexport interface EnvelopeScopedTool {\n\tname: string;\n\texecute: (...args: unknown[]) => unknown;\n}\n\n/\n Wrap a tool so every path-bearing argument is scope-checked when it RUNS. The wrapped tool is\n * shape-identical; params are conventionally the second execute argument (toolCallId, params, …).\n */\nexport function wrapToolWithEnvelopeScope<T extends EnvelopeScopedTool>(\n\ttool: T,\n\tenvelope: CapabilityEnvelope,\n\tcwd: string,\n): T {\n\treturn {\n\t\t...tool,\n\t\texecute: (...args: unknown[]) => {\n\t\t\tconst params = args[1];\n\t\t\tfor (const rawPath of extractPathArguments(params)) {\n\t\t\t\tif (!isPathWithinEnvelope(envelope, rawPath, cwd)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\ttext: `envelope_path_denied: \"${rawPath}\" is outside envelope ${envelope.id}'s path scope. The tool was NOT run.`,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t\tdetails: { outcome: \"envelope_path_denied\", tool: tool.name, path: rawPath, envelopeId: envelope.id },\n\t\t\t\t\t\tisError: true,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn tool.execute(...args);\n\t\t},\n\t};\n}\n"]}

package/dist/core/autonomy/envelope-enforcement.js CHANGED Viewed

@@ -1,5 +1,5 @@
-import { isAbsolute, relative, resolve, sep } from "node:path";
-import { safeRealpathSync } from "./path-scope.js";
+import { resolve } from "node:path";
+import { isPathWithinScope, safeRealpathSync } from "./path-scope.js";
 /**
  * Tool-level envelope enforcement (G2 prerequisite for code-writing workers): the capability
  * envelope's `allowedPaths`/`deniedPaths` were previously VALIDATION-ONLY — recorded on the
@@ -31,11 +31,6 @@ export function extractPathArguments(params) {
     }
     return found;
 }
-function isWithinRoot(target, root) {
-    const relativePath = relative(root, target);
-    return (relativePath === "" ||
-        (!relativePath.startsWith(`..${sep}`) && relativePath !== ".." && !isAbsolute(relativePath)));
-}
 /**
  * Deny wins over allow; an empty/absent allow list means "no positive scope restriction"
  * (only denies apply) — mirroring the resource-profile filter semantics.
@@ -55,7 +50,7 @@ export function isPathWithinEnvelope(envelope, rawPath, cwd) {
     }
     for (const denied of envelope.deniedPaths ?? []) {
         try {
-            if (isWithinRoot(target, safeRealpathSync(resolve(cwd, denied))))
+            if (isPathWithinScope(target, safeRealpathSync(resolve(cwd, denied))))
                 return false;
         }
         catch {
@@ -67,7 +62,7 @@ export function isPathWithinEnvelope(envelope, rawPath, cwd) {
         return true;
     return allowed.some((root) => {
         try {
-            return isWithinRoot(target, safeRealpathSync(resolve(cwd, root)));
+            return isPathWithinScope(target, safeRealpathSync(resolve(cwd, root)));
         }
         catch {
             return false;

package/dist/core/autonomy/envelope-enforcement.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"envelope-enforcement.js","sourceRoot":"","sources":["../../../src/core/autonomy/envelope-enforcement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,~~UAAU,EAAE,QAAQ,EAAE,~~OAAO,EAAE,~~GAAG,EAAE,~~MAAM,WAAW,CAAC;~~AAE/D~~,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;~~AAEnD~~;;;;;;;GAOG;AAEH,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAU,CAAC;AAC3G,MAAM,uBAAuB,GAAG,CAAC,OAAO,EAAE,OAAO,CAAU,CAAC;AAE5D,MAAM,UAAU,oBAAoB,CAAC,MAAe,EAAY;IAC/D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;gBAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtE,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,IAAY,EAAW;IAC5D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,OAAO,CACN,YAAY,KAAK,EAAE;QACnB,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAC5F,CAAC;AAAA,CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAA4B,EAAE,OAAe,EAAE,GAAW,EAAW;IACzG,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QACjD,IAAI,CAAC;YACJ,IAAI,~~YAAY~~,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;~~QAChF~~,CAAC;QAAC,MAAM,CAAC;YACR,0EAA0E;QAC3E,CAAC;IACF,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC;YACJ,OAAO,~~YAAY~~,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;~~QACnE~~,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;IAAA,CACD,CAAC,CAAC;AAAA,CACH;AAOD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACxC,IAAO,EACP,QAA4B,EAC5B,GAAW,EACP;IACJ,OAAO;QACN,GAAG,IAAI;QACP,OAAO,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,KAAK,MAAM,OAAO,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpD,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;oBACnD,OAAO;wBACN,OAAO,EAAE;4BACR;gCACC,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,0BAA0B,OAAO,yBAAyB,QAAQ,CAAC,EAAE,sCAAsC;6BACjH;yBACD;wBACD,OAAO,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE;wBACrG,OAAO,EAAE,IAAI;qBACb,CAAC;gBACH,CAAC;YACF,CAAC;YACD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QAAA,CAC7B;KACD,CAAC;AAAA,CACF","sourcesContent":["import { ~~isAbsolute, relative,~~ resolve, ~~sep~~ } from \"node:path\";\nimport type { CapabilityEnvelope } from \"./contracts.ts\";\nimport { safeRealpathSync } from \"./path-scope.ts\";\n\n/*\n Tool-level envelope enforcement (G2 prerequisite for code-writing workers): the capability\n * envelope's `allowedPaths`/`deniedPaths` were previously VALIDATION-ONLY — recorded on the\n * envelope but never checked when a tool actually ran. This module wraps tools so path-bearing\n * arguments are checked AT EXECUTION TIME, structurally refusing out-of-scope paths the same way\n * a failed script can never look like success: the refusal is an isError result with a stable\n * outcome code, never a silent no-op.\n /\n\nconst PATH_ARGUMENT_KEYS = [\"path\", \"file_path\", \"filePath\", \"cwd\", \"directory\", \"dir\", \"target\"] as const;\nconst PATH_LIST_ARGUMENT_KEYS = [\"paths\", \"files\"] as const;\n\nexport function extractPathArguments(params: unknown): string[] {\n\tif (!params \|\| typeof params !== \"object\") return [];\n\tconst record = params as Record<string, unknown>;\n\tconst found: string[] = [];\n\tfor (const key of PATH_ARGUMENT_KEYS) {\n\t\tconst value = record[key];\n\t\tif (typeof value === \"string\" && value.length > 0) found.push(value);\n\t}\n\tfor (const key of PATH_LIST_ARGUMENT_KEYS) {\n\t\tconst value = record[key];\n\t\tif (Array.isArray(value)) {\n\t\t\tfor (const entry of value) {\n\t\t\t\tif (typeof entry === \"string\" && entry.length > 0) found.push(entry);\n\t\t\t}\n\t\t}\n\t}\n\treturn found;\n}\n\~~nfunction isWithinRoot(target: string, root: string): boolean {\~~n\tconst relativePath = relative(root, target);\n\treturn (\n\t\trelativePath === \"\" \|\|\n\t\t(!relativePath.startsWith(`..${sep}`) && relativePath !== \"..\" && !isAbsolute(relativePath))\n\t);\n}\n\n/\n Deny wins over allow; an empty/absent allow list means \"no positive scope restriction\"\n * (only denies apply) — mirroring the resource-profile filter semantics.\n \n Both the target and every scope root are resolved through the real filesystem\n * (symlinks expanded in the existing prefix) before comparison: a pre-existing symlink\n * under an allowed root cannot smuggle a write outside the scope, and a shortcut into a\n * denied subtree is still denied. An unresolvable target fails closed.\n /\nexport function isPathWithinEnvelope(envelope: CapabilityEnvelope, rawPath: string, cwd: string): boolean {\n\tlet target: string;\n\ttry {\n\t\ttarget = safeRealpathSync(resolve(cwd, rawPath));\n\t} catch {\n\t\treturn false;\n\t}\n\tfor (const denied of envelope.deniedPaths ?? []) {\n\t\ttry {\n\t\t\tif (~~isWithinRoot~~(target, safeRealpathSync(resolve(cwd, denied)))) return false;\n\t\t} catch {\n\t\t\t// Mirror checkPathScope: an unresolvable deny root cannot match anything.\n\t\t}\n\t}\n\tconst allowed = envelope.allowedPaths ?? [];\n\tif (allowed.length === 0) return true;\n\treturn allowed.some((root) => {\n\t\ttry {\n\t\t\treturn ~~isWithinRoot~~(target, safeRealpathSync(resolve(cwd, root)));\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t});\n}\n\nexport interface EnvelopeScopedTool {\n\tname: string;\n\texecute: (...args: unknown[]) => unknown;\n}\n\n/\n Wrap a tool so every path-bearing argument is scope-checked when it RUNS. The wrapped tool is\n * shape-identical; params are conventionally the second execute argument (toolCallId, params, …).\n */\nexport function wrapToolWithEnvelopeScope<T extends EnvelopeScopedTool>(\n\ttool: T,\n\tenvelope: CapabilityEnvelope,\n\tcwd: string,\n): T {\n\treturn {\n\t\t...tool,\n\t\texecute: (...args: unknown[]) => {\n\t\t\tconst params = args[1];\n\t\t\tfor (const rawPath of extractPathArguments(params)) {\n\t\t\t\tif (!isPathWithinEnvelope(envelope, rawPath, cwd)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\ttext: `envelope_path_denied: \"${rawPath}\" is outside envelope ${envelope.id}'s path scope. The tool was NOT run.`,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t\tdetails: { outcome: \"envelope_path_denied\", tool: tool.name, path: rawPath, envelopeId: envelope.id },\n\t\t\t\t\t\tisError: true,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn tool.execute(...args);\n\t\t},\n\t};\n}\n"]}
1	+ {"version":3,"file":"envelope-enforcement.js","sourceRoot":"","sources":["../../../src/core/autonomy/envelope-enforcement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEtE;;;;;;;GAOG;AAEH,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAU,CAAC;AAC3G,MAAM,uBAAuB,GAAG,CAAC,OAAO,EAAE,OAAO,CAAU,CAAC;AAE5D,MAAM,UAAU,oBAAoB,CAAC,MAAe,EAAY;IAC/D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;gBAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtE,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAA4B,EAAE,OAAe,EAAE,GAAW,EAAW;IACzG,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QACjD,IAAI,CAAC;YACJ,IAAI,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC;YACR,0EAA0E;QAC3E,CAAC;IACF,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC;YACJ,OAAO,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;IAAA,CACD,CAAC,CAAC;AAAA,CACH;AAOD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACxC,IAAO,EACP,QAA4B,EAC5B,GAAW,EACP;IACJ,OAAO;QACN,GAAG,IAAI;QACP,OAAO,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,KAAK,MAAM,OAAO,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpD,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;oBACnD,OAAO;wBACN,OAAO,EAAE;4BACR;gCACC,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,0BAA0B,OAAO,yBAAyB,QAAQ,CAAC,EAAE,sCAAsC;6BACjH;yBACD;wBACD,OAAO,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE;wBACrG,OAAO,EAAE,IAAI;qBACb,CAAC;gBACH,CAAC;YACF,CAAC;YACD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QAAA,CAC7B;KACD,CAAC;AAAA,CACF","sourcesContent":["import { resolve } from \"node:path\";\nimport type { CapabilityEnvelope } from \"./contracts.ts\";\nimport { isPathWithinScope, safeRealpathSync } from \"./path-scope.ts\";\n\n/*\n Tool-level envelope enforcement (G2 prerequisite for code-writing workers): the capability\n * envelope's `allowedPaths`/`deniedPaths` were previously VALIDATION-ONLY — recorded on the\n * envelope but never checked when a tool actually ran. This module wraps tools so path-bearing\n * arguments are checked AT EXECUTION TIME, structurally refusing out-of-scope paths the same way\n * a failed script can never look like success: the refusal is an isError result with a stable\n * outcome code, never a silent no-op.\n /\n\nconst PATH_ARGUMENT_KEYS = [\"path\", \"file_path\", \"filePath\", \"cwd\", \"directory\", \"dir\", \"target\"] as const;\nconst PATH_LIST_ARGUMENT_KEYS = [\"paths\", \"files\"] as const;\n\nexport function extractPathArguments(params: unknown): string[] {\n\tif (!params \|\| typeof params !== \"object\") return [];\n\tconst record = params as Record<string, unknown>;\n\tconst found: string[] = [];\n\tfor (const key of PATH_ARGUMENT_KEYS) {\n\t\tconst value = record[key];\n\t\tif (typeof value === \"string\" && value.length > 0) found.push(value);\n\t}\n\tfor (const key of PATH_LIST_ARGUMENT_KEYS) {\n\t\tconst value = record[key];\n\t\tif (Array.isArray(value)) {\n\t\t\tfor (const entry of value) {\n\t\t\t\tif (typeof entry === \"string\" && entry.length > 0) found.push(entry);\n\t\t\t}\n\t\t}\n\t}\n\treturn found;\n}\n\n/\n Deny wins over allow; an empty/absent allow list means \"no positive scope restriction\"\n * (only denies apply) — mirroring the resource-profile filter semantics.\n \n Both the target and every scope root are resolved through the real filesystem\n * (symlinks expanded in the existing prefix) before comparison: a pre-existing symlink\n * under an allowed root cannot smuggle a write outside the scope, and a shortcut into a\n * denied subtree is still denied. An unresolvable target fails closed.\n /\nexport function isPathWithinEnvelope(envelope: CapabilityEnvelope, rawPath: string, cwd: string): boolean {\n\tlet target: string;\n\ttry {\n\t\ttarget = safeRealpathSync(resolve(cwd, rawPath));\n\t} catch {\n\t\treturn false;\n\t}\n\tfor (const denied of envelope.deniedPaths ?? []) {\n\t\ttry {\n\t\t\tif (isPathWithinScope(target, safeRealpathSync(resolve(cwd, denied)))) return false;\n\t\t} catch {\n\t\t\t// Mirror checkPathScope: an unresolvable deny root cannot match anything.\n\t\t}\n\t}\n\tconst allowed = envelope.allowedPaths ?? [];\n\tif (allowed.length === 0) return true;\n\treturn allowed.some((root) => {\n\t\ttry {\n\t\t\treturn isPathWithinScope(target, safeRealpathSync(resolve(cwd, root)));\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t});\n}\n\nexport interface EnvelopeScopedTool {\n\tname: string;\n\texecute: (...args: unknown[]) => unknown;\n}\n\n/\n Wrap a tool so every path-bearing argument is scope-checked when it RUNS. The wrapped tool is\n * shape-identical; params are conventionally the second execute argument (toolCallId, params, …).\n */\nexport function wrapToolWithEnvelopeScope<T extends EnvelopeScopedTool>(\n\ttool: T,\n\tenvelope: CapabilityEnvelope,\n\tcwd: string,\n): T {\n\treturn {\n\t\t...tool,\n\t\texecute: (...args: unknown[]) => {\n\t\t\tconst params = args[1];\n\t\t\tfor (const rawPath of extractPathArguments(params)) {\n\t\t\t\tif (!isPathWithinEnvelope(envelope, rawPath, cwd)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\ttext: `envelope_path_denied: \"${rawPath}\" is outside envelope ${envelope.id}'s path scope. The tool was NOT run.`,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t\tdetails: { outcome: \"envelope_path_denied\", tool: tool.name, path: rawPath, envelopeId: envelope.id },\n\t\t\t\t\t\tisError: true,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn tool.execute(...args);\n\t\t},\n\t};\n}\n"]}

package/dist/core/autonomy/lane-tool-surface.d.ts CHANGED Viewed

@@ -1,5 +1,5 @@
 import type { AgentLoopConfig, AgentTool } from "@caupulican/pi-agent-core";
-import { CapabilityGateway } from "../orchestration/capability-gateway.ts";
+import { CapabilityGateway, type GatewayInitialUsage } from "../orchestration/capability-gateway.ts";
 import type { ExecutionGrant, OrchestrationExecutionPolicy, ToolCapabilityManifest } from "../orchestration/contracts.ts";
 import type { NormalizedProfile } from "../profile-registry.ts";
 export interface LaneToolSurface {
@@ -32,6 +32,8 @@ export interface LaneToolSurfaceOptions {
     /** Compiled policy path. When present, it is the only authorization source for this surface. */
     grant?: ExecutionGrant;
     toolManifests?: readonly ToolCapabilityManifest[];
+    /** Durable cumulative active usage to seed the compiled grant's gateway on resume. */
+    initialUsage?: GatewayInitialUsage;
 }
 /**
  * Materialize a fresh, fail-closed tool surface for one isolated lane.

package/dist/core/autonomy/lane-tool-surface.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"lane-tool-surface.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/lane-tool-surface.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE5E,OAAO,EAAE,iBAAiB,EAAgC,MAAM,wCAAwC,CAAC;AACzG,OAAO,KAAK,EACX,cAAc,EACd,4BAA4B,EAC5B,sBAAsB,EACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAuBhE,MAAM,WAAW,eAAe;IAC/B,oGAAoG;IACpG,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,8FAA8F;IAC9F,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,yEAAyE;IACzE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iGAAiG;IACjG,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,qEAAqE;IACrE,cAAc,EAAE,WAAW,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC/D,+EAA+E;IAC/E,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,yEAAyE;IACzE,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,wGAAwG;IACxG,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,4FAA4F;IAC5F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,qGAAqG;IACrG,eAAe,CAAC,EAAE,4BAA4B,CAAC;IAC/C,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gGAAgG;IAChG,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAClD;AA6DD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CAiGtF","sourcesContent":["import path from \"node:path\";\nimport type { AgentLoopConfig, AgentTool } from \"@caupulican/pi-agent-core\";\nimport { type Static, Type } from \"typebox\";\nimport { CapabilityGateway, CapabilityGatewayDeniedError } from \"../orchestration/capability-gateway.ts\";\nimport type {\n\tExecutionGrant,\n\tOrchestrationExecutionPolicy,\n\tToolCapabilityManifest,\n} from \"../orchestration/contracts.ts\";\nimport type { NormalizedProfile } from \"../profile-registry.ts\";\nimport { wrapToolWithCredentialExposureGuard } from \"../secrets/credential-exposure-guard.ts\";\nimport { matchesResourceProfilePattern } from \"../settings-manager.ts\";\nimport { createEditTool } from \"../tools/edit.ts\";\nimport { createFindTool } from \"../tools/find.ts\";\nimport { createGrepTool } from \"../tools/grep.ts\";\nimport { createLsTool } from \"../tools/ls.ts\";\nimport { createReadTool } from \"../tools/read.ts\";\nimport { createRunProcessTool } from \"../tools/run-process.ts\";\nimport { createWriteTool } from \"../tools/write.ts\";\nimport type { CapabilityEnvelope } from \"./contracts.ts\";\nimport { evaluateToolGate } from \"./gates.ts\";\n\nconst READ_ONLY_LANE_TOOL_NAMES = [\"read\", \"grep\", \"find\", \"ls\"] as const;\nconst MEMORY_LANE_TOOL_NAME = \"memory\" as const;\nconst WRITE_LANE_TOOL_NAMES = [\"write\", \"edit\"] as const;\nconst PROCESS_LANE_TOOL_NAME = \"run_process\" as const;\nconst laneMemorySchema = Type.Object({\n\tquery: Type.String({ description: \"What relevant standing memory or prior evidence to retrieve\" }),\n});\ntype LaneMemoryParams = Static<typeof laneMemorySchema>;\nconst WRITE_LANE_TOOL_NAME_SET = new Set<string>(WRITE_LANE_TOOL_NAMES);\n\nexport interface LaneToolSurface {\n\t/** Fresh tools owned by this lane only; no foreground tool instances or extension state leak in. /\n\ttools: AgentTool[];\n\t/* Exact names after profile globs are expanded. Safe to persist in a capability envelope. /\n\tallowedTools: string[];\n\t/* Exact safe-candidate names denied by the profile's block patterns. /\n\tdeniedTools: string[];\n\t/* Explicit grants that bind to no classified lane candidate (opaque tools stay fail-closed). /\n\tunboundAllowPatterns: string[];\n\t/* Per-call path and capability gate for the isolated child loop. /\n\tbeforeToolCall: NonNullable<AgentLoopConfig[\"beforeToolCall\"]>;\n\t/* Canonical cumulative authority/budget meter for a compiled worker grant. /\n\tgateway?: CapabilityGateway;\n}\n\nexport interface LaneToolSurfaceOptions {\n\tcwd: string;\n\tprofile?: NormalizedProfile;\n\t/* Private harness state that generic file tools must never traverse. /\n\tdeniedPaths?: readonly string[];\n\t/* Orchestrator-requested, policy-filtered read-only memory retrieval. Omitted means no memory tool. /\n\treadMemory?: (query: string) => Promise<string>;\n\t/* Research never sets this. Workers require both this flag and at least one write path. /\n\twriteEnabled?: boolean;\n\twritePaths?: readonly string[];\n\t/* Present only for process-capable owner profiles; absent means no process tool is materialized. /\n\texecutionPolicy?: OrchestrationExecutionPolicy;\n\tprocessMaxWallClockMs?: number;\n\t/* Compiled policy path. When present, it is the only authorization source for this surface. /\n\tgrant?: ExecutionGrant;\n\ttoolManifests?: readonly ToolCapabilityManifest[];\n}\n\nfunction strictLaneProfilePatterns(profile: NormalizedProfile \| undefined): {\n\tallow: string[];\n\tblock: string[];\n} {\n\tif (!profile) return { allow: [], block: [] };\n\tconst filter = profile.resources.tools;\n\tconst allow = [...(filter?.allow ?? [])];\n\tconst block = [...(filter?.block ?? [])];\n\t// Strict UAC: a shipped profile is the complete authority grant. Grant-all must be explicit.\n\tif (allow.length === 0 && block.length === 0) return { allow: [], block: [\"\"] };\n\treturn { allow, block };\n}\n\nfunction resolveWriteRoots(cwd: string, writePaths: readonly string[]): string[] {\n\treturn writePaths.map((entry) => (path.isAbsolute(entry) ? path.resolve(entry) : path.resolve(cwd, entry)));\n}\n\nfunction createLaneTools(\n\tcwd: string,\n\tnames: readonly string[],\n\treadMemory?: (query: string) => Promise<string>,\n\texecutionPolicy?: OrchestrationExecutionPolicy,\n\tprocessMaxWallClockMs = 0,\n): AgentTool[] {\n\tconst factories = new Map<string, () => AgentTool>([\n\t\t[\"read\", () => createReadTool(cwd)],\n\t\t[\"grep\", () => createGrepTool(cwd)],\n\t\t[\"find\", () => createFindTool(cwd)],\n\t\t[\"ls\", () => createLsTool(cwd)],\n\t\t[\"write\", () => createWriteTool(cwd)],\n\t\t[\"edit\", () => createEditTool(cwd)],\n\t]);\n\tif (executionPolicy) {\n\t\tfactories.set(PROCESS_LANE_TOOL_NAME, () =>\n\t\t\tcreateRunProcessTool(cwd, { policy: executionPolicy, maxWallClockMs: processMaxWallClockMs }),\n\t\t);\n\t}\n\tif (readMemory) {\n\t\tfactories.set(MEMORY_LANE_TOOL_NAME, () => ({\n\t\t\tname: MEMORY_LANE_TOOL_NAME,\n\t\t\tlabel: \"Read Memory\",\n\t\t\tdescription:\n\t\t\t\t\"Retrieve bounded, source-labeled standing memory relevant to this delegated task. Read-only: no memory writes or lifecycle actions are available.\",\n\t\t\tparameters: laneMemorySchema,\n\t\t\texecute: async (_toolCallId, params) => {\n\t\t\t\tconst { query } = params as LaneMemoryParams;\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ type: \"text\" as const, text: await readMemory(query) }],\n\t\t\t\t\tdetails: { readOnly: true },\n\t\t\t\t};\n\t\t\t},\n\t\t}));\n\t}\n\treturn names.flatMap((name) => {\n\t\tconst factory = factories.get(name);\n\t\treturn factory ? [wrapToolWithCredentialExposureGuard(factory(), cwd)] : [];\n\t});\n}\n\n/*\n Materialize a fresh, fail-closed tool surface for one isolated lane.\n \n Profiles select only from classified built-ins. Opaque extension tools, shell, memory, goals,\n * and `delegate` are never candidates, so a wildcard cannot manufacture unknown authority or\n * recursively spawn more workers. Write/edit additionally require the explicit worker write switch\n * and a non-empty path scope; research therefore stays read-only regardless of profile contents.\n */\nexport function createLaneToolSurface(options: LaneToolSurfaceOptions): LaneToolSurface {\n\tconst writeCapable = options.writeEnabled === true && (options.writePaths?.length ?? 0) > 0;\n\tconst candidateNames = [\n\t\t...READ_ONLY_LANE_TOOL_NAMES,\n\t\t...(options.readMemory ? [MEMORY_LANE_TOOL_NAME] : []),\n\t\t...(writeCapable ? WRITE_LANE_TOOL_NAMES : []),\n\t\t...(options.executionPolicy ? [PROCESS_LANE_TOOL_NAME] : []),\n\t];\n\tconst patterns = strictLaneProfilePatterns(options.profile);\n\tconst compiledToolNames = new Set(options.grant?.allowedTools ?? []);\n\tconst deniedTools = candidateNames.filter((name) =>\n\t\toptions.grant ? !compiledToolNames.has(name) : matchesResourceProfilePattern(name, patterns.block),\n\t);\n\tconst unboundAllowPatterns = options.grant\n\t\t? []\n\t\t: patterns.allow.filter(\n\t\t\t\t(pattern) => !candidateNames.some((name) => matchesResourceProfilePattern(name, [pattern])),\n\t\t\t);\n\tconst allowedTools = options.grant\n\t\t? candidateNames.filter((name) => compiledToolNames.has(name))\n\t\t: candidateNames.filter(\n\t\t\t\t(name) =>\n\t\t\t\t\t(patterns.allow.length === 0 \|\| matchesResourceProfilePattern(name, patterns.allow)) &&\n\t\t\t\t\t!matchesResourceProfilePattern(name, patterns.block),\n\t\t\t);\n\tconst allowedToolSet = new Set<string>(allowedTools);\n\tconst manifestsByName = new Map(options.toolManifests?.map((manifest) => [manifest.toolName, manifest]) ?? []);\n\tif (options.grant?.allowedTools.some((name) => !manifestsByName.has(name))) {\n\t\tthrow new Error(\"Compiled lane grant references a tool without a capability manifest.\");\n\t}\n\tconst gateway = options.grant ? new CapabilityGateway({ grant: options.grant, cwd: options.cwd }) : undefined;\n\tconst deniedPaths = options.deniedPaths?.map((entry) => path.resolve(entry));\n\tconst readEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-read-tools\",\n\t\tcapabilities: [\n\t\t\t\"filesystem.read\",\n\t\t\t...(allowedToolSet.has(MEMORY_LANE_TOOL_NAME) ? ([\"memory.query\"] as const) : []),\n\t\t\t...(allowedToolSet.has(PROCESS_LANE_TOOL_NAME) ? ([\"process.exec\"] as const) : []),\n\t\t],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: [path.resolve(options.cwd)],\n\t\t...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),\n\t};\n\tconst writeEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-write-tools\",\n\t\tcapabilities: [\"filesystem.write\"],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: resolveWriteRoots(options.cwd, options.writePaths ?? []),\n\t\t...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),\n\t};\n\n\treturn {\n\t\ttools: createLaneTools(\n\t\t\toptions.cwd,\n\t\t\tallowedTools,\n\t\t\toptions.readMemory,\n\t\t\toptions.executionPolicy,\n\t\t\toptions.processMaxWallClockMs,\n\t\t),\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tunboundAllowPatterns,\n\t\tbeforeToolCall: async ({ toolCall, args }) => {\n\t\t\tif (!allowedToolSet.has(toolCall.name)) {\n\t\t\t\treturn { block: true, reason: `Lane tool '${toolCall.name}' is outside the materialized UAC surface.` };\n\t\t\t}\n\t\t\tif (gateway) {\n\t\t\t\tconst manifest = manifestsByName.get(toolCall.name);\n\t\t\t\tif (!manifest) {\n\t\t\t\t\treturn { block: true, reason: `Lane tool '${toolCall.name}' has no compiled capability manifest.` };\n\t\t\t\t}\n\t\t\t\ttry {\n\t\t\t\t\tgateway.authorizeToolCall(manifest, toolCall.name, args);\n\t\t\t\t\treturn undefined;\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (error instanceof CapabilityGatewayDeniedError) {\n\t\t\t\t\t\treturn { block: true, reason: `Lane tool blocked (${error.reasonCode}): ${error.message}` };\n\t\t\t\t\t}\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst outcome = evaluateToolGate({\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\targs,\n\t\t\t\tcwd: options.cwd,\n\t\t\t\tenvelope: WRITE_LANE_TOOL_NAME_SET.has(toolCall.name) ? writeEnvelope : readEnvelope,\n\t\t\t});\n\t\t\tif (outcome.outcome === \"allow\") return undefined;\n\t\t\treturn {\n\t\t\t\tblock: true,\n\t\t\t\treason: `Lane tool blocked (${outcome.reasonCode}): ${outcome.message ?? \"capability gate denied it\"}`,\n\t\t\t};\n\t\t},\n\t\t...(gateway ? { gateway } : {}),\n\t};\n}\n"]}
1	+ {"version":3,"file":"lane-tool-surface.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/lane-tool-surface.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE5E,OAAO,EACN,iBAAiB,EAEjB,KAAK,mBAAmB,EACxB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EACX,cAAc,EACd,4BAA4B,EAC5B,sBAAsB,EACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AA2BhE,MAAM,WAAW,eAAe;IAC/B,oGAAoG;IACpG,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,8FAA8F;IAC9F,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,yEAAyE;IACzE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iGAAiG;IACjG,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,qEAAqE;IACrE,cAAc,EAAE,WAAW,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC/D,+EAA+E;IAC/E,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,yEAAyE;IACzE,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,wGAAwG;IACxG,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,4FAA4F;IAC5F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,qGAAqG;IACrG,eAAe,CAAC,EAAE,4BAA4B,CAAC;IAC/C,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gGAAgG;IAChG,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAClD,sFAAsF;IACtF,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACnC;AAkED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CAuGtF","sourcesContent":["import path from \"node:path\";\nimport type { AgentLoopConfig, AgentTool } from \"@caupulican/pi-agent-core\";\nimport { type Static, Type } from \"typebox\";\nimport {\n\tCapabilityGateway,\n\tCapabilityGatewayDeniedError,\n\ttype GatewayInitialUsage,\n} from \"../orchestration/capability-gateway.ts\";\nimport type {\n\tExecutionGrant,\n\tOrchestrationExecutionPolicy,\n\tToolCapabilityManifest,\n} from \"../orchestration/contracts.ts\";\nimport type { NormalizedProfile } from \"../profile-registry.ts\";\nimport { wrapToolWithCredentialExposureGuard } from \"../secrets/credential-exposure-guard.ts\";\nimport { matchesResourceProfilePattern } from \"../settings-manager.ts\";\nimport { createEditTool } from \"../tools/edit.ts\";\nimport { createFindTool } from \"../tools/find.ts\";\nimport { createGrepTool } from \"../tools/grep.ts\";\nimport { createLsTool } from \"../tools/ls.ts\";\nimport { createReadTool } from \"../tools/read.ts\";\nimport { createRunProcessTool } from \"../tools/run-process.ts\";\nimport { createWriteTool } from \"../tools/write.ts\";\nimport type { CapabilityEnvelope } from \"./contracts.ts\";\nimport { evaluateToolGate } from \"./gates.ts\";\n\nconst READ_ONLY_LANE_TOOL_NAMES = [\"read\", \"grep\", \"find\", \"ls\"] as const;\nconst MEMORY_LANE_TOOL_NAME = \"memory\" as const;\nconst WRITE_LANE_TOOL_NAMES = [\"write\", \"edit\"] as const;\nconst PROCESS_LANE_TOOL_NAME = \"run_process\" as const;\nconst MAX_LANE_MEMORY_QUERY_CHARS = 4_096;\nconst laneMemorySchema = Type.Object({\n\tquery: Type.String({\n\t\tmaxLength: MAX_LANE_MEMORY_QUERY_CHARS,\n\t\tdescription: \"What relevant standing memory or prior evidence to retrieve\",\n\t}),\n});\ntype LaneMemoryParams = Static<typeof laneMemorySchema>;\nconst WRITE_LANE_TOOL_NAME_SET = new Set<string>(WRITE_LANE_TOOL_NAMES);\n\nexport interface LaneToolSurface {\n\t/** Fresh tools owned by this lane only; no foreground tool instances or extension state leak in. /\n\ttools: AgentTool[];\n\t/* Exact names after profile globs are expanded. Safe to persist in a capability envelope. /\n\tallowedTools: string[];\n\t/* Exact safe-candidate names denied by the profile's block patterns. /\n\tdeniedTools: string[];\n\t/* Explicit grants that bind to no classified lane candidate (opaque tools stay fail-closed). /\n\tunboundAllowPatterns: string[];\n\t/* Per-call path and capability gate for the isolated child loop. /\n\tbeforeToolCall: NonNullable<AgentLoopConfig[\"beforeToolCall\"]>;\n\t/* Canonical cumulative authority/budget meter for a compiled worker grant. /\n\tgateway?: CapabilityGateway;\n}\n\nexport interface LaneToolSurfaceOptions {\n\tcwd: string;\n\tprofile?: NormalizedProfile;\n\t/* Private harness state that generic file tools must never traverse. /\n\tdeniedPaths?: readonly string[];\n\t/* Orchestrator-requested, policy-filtered read-only memory retrieval. Omitted means no memory tool. /\n\treadMemory?: (query: string) => Promise<string>;\n\t/* Research never sets this. Workers require both this flag and at least one write path. /\n\twriteEnabled?: boolean;\n\twritePaths?: readonly string[];\n\t/* Present only for process-capable owner profiles; absent means no process tool is materialized. /\n\texecutionPolicy?: OrchestrationExecutionPolicy;\n\tprocessMaxWallClockMs?: number;\n\t/* Compiled policy path. When present, it is the only authorization source for this surface. /\n\tgrant?: ExecutionGrant;\n\ttoolManifests?: readonly ToolCapabilityManifest[];\n\t/* Durable cumulative active usage to seed the compiled grant's gateway on resume. /\n\tinitialUsage?: GatewayInitialUsage;\n}\n\nfunction strictLaneProfilePatterns(profile: NormalizedProfile \| undefined): {\n\tallow: string[];\n\tblock: string[];\n} {\n\tif (!profile) return { allow: [], block: [] };\n\tconst filter = profile.resources.tools;\n\tconst allow = [...(filter?.allow ?? [])];\n\tconst block = [...(filter?.block ?? [])];\n\t// Strict UAC: a shipped profile is the complete authority grant. Grant-all must be explicit.\n\tif (allow.length === 0 && block.length === 0) return { allow: [], block: [\"\"] };\n\treturn { allow, block };\n}\n\nfunction resolveWriteRoots(cwd: string, writePaths: readonly string[]): string[] {\n\treturn writePaths.map((entry) => (path.isAbsolute(entry) ? path.resolve(entry) : path.resolve(cwd, entry)));\n}\n\nfunction createLaneTools(\n\tcwd: string,\n\tnames: readonly string[],\n\treadMemory?: (query: string) => Promise<string>,\n\texecutionPolicy?: OrchestrationExecutionPolicy,\n\tprocessMaxWallClockMs = 0,\n): AgentTool[] {\n\tconst factories = new Map<string, () => AgentTool>([\n\t\t[\"read\", () => createReadTool(cwd)],\n\t\t[\"grep\", () => createGrepTool(cwd)],\n\t\t[\"find\", () => createFindTool(cwd)],\n\t\t[\"ls\", () => createLsTool(cwd)],\n\t\t[\"write\", () => createWriteTool(cwd)],\n\t\t[\"edit\", () => createEditTool(cwd)],\n\t]);\n\tif (executionPolicy) {\n\t\tfactories.set(PROCESS_LANE_TOOL_NAME, () =>\n\t\t\tcreateRunProcessTool(cwd, { policy: executionPolicy, maxWallClockMs: processMaxWallClockMs }),\n\t\t);\n\t}\n\tif (readMemory) {\n\t\tfactories.set(MEMORY_LANE_TOOL_NAME, () => ({\n\t\t\tname: MEMORY_LANE_TOOL_NAME,\n\t\t\tlabel: \"Read Memory\",\n\t\t\tdescription:\n\t\t\t\t\"Retrieve bounded, source-labeled standing memory relevant to this delegated task. Read-only: no memory writes or lifecycle actions are available.\",\n\t\t\tparameters: laneMemorySchema,\n\t\t\texecute: async (_toolCallId, params) => {\n\t\t\t\tconst query = (params as LaneMemoryParams).query?.trim();\n\t\t\t\tif (!query \|\| query.length > MAX_LANE_MEMORY_QUERY_CHARS) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`memory_query_invalid: query must contain from 1 through ${MAX_LANE_MEMORY_QUERY_CHARS} characters.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ type: \"text\" as const, text: await readMemory(query) }],\n\t\t\t\t\tdetails: { readOnly: true },\n\t\t\t\t};\n\t\t\t},\n\t\t}));\n\t}\n\treturn names.flatMap((name) => {\n\t\tconst factory = factories.get(name);\n\t\treturn factory ? [wrapToolWithCredentialExposureGuard(factory(), cwd)] : [];\n\t});\n}\n\n/*\n Materialize a fresh, fail-closed tool surface for one isolated lane.\n \n Profiles select only from classified built-ins. Opaque extension tools, shell, memory, goals,\n * and `delegate` are never candidates, so a wildcard cannot manufacture unknown authority or\n * recursively spawn more workers. Write/edit additionally require the explicit worker write switch\n * and a non-empty path scope; research therefore stays read-only regardless of profile contents.\n */\nexport function createLaneToolSurface(options: LaneToolSurfaceOptions): LaneToolSurface {\n\tconst writeCapable = options.writeEnabled === true && (options.writePaths?.length ?? 0) > 0;\n\tconst candidateNames = [\n\t\t...READ_ONLY_LANE_TOOL_NAMES,\n\t\t...(options.readMemory ? [MEMORY_LANE_TOOL_NAME] : []),\n\t\t...(writeCapable ? WRITE_LANE_TOOL_NAMES : []),\n\t\t...(options.executionPolicy ? [PROCESS_LANE_TOOL_NAME] : []),\n\t];\n\tconst patterns = strictLaneProfilePatterns(options.profile);\n\tconst compiledToolNames = new Set(options.grant?.allowedTools ?? []);\n\tconst deniedTools = candidateNames.filter((name) =>\n\t\toptions.grant ? !compiledToolNames.has(name) : matchesResourceProfilePattern(name, patterns.block),\n\t);\n\tconst unboundAllowPatterns = options.grant\n\t\t? []\n\t\t: patterns.allow.filter(\n\t\t\t\t(pattern) => !candidateNames.some((name) => matchesResourceProfilePattern(name, [pattern])),\n\t\t\t);\n\tconst allowedTools = options.grant\n\t\t? candidateNames.filter((name) => compiledToolNames.has(name))\n\t\t: candidateNames.filter(\n\t\t\t\t(name) =>\n\t\t\t\t\t(patterns.allow.length === 0 \|\| matchesResourceProfilePattern(name, patterns.allow)) &&\n\t\t\t\t\t!matchesResourceProfilePattern(name, patterns.block),\n\t\t\t);\n\tconst allowedToolSet = new Set<string>(allowedTools);\n\tconst manifestsByName = new Map(options.toolManifests?.map((manifest) => [manifest.toolName, manifest]) ?? []);\n\tif (options.grant?.allowedTools.some((name) => !manifestsByName.has(name))) {\n\t\tthrow new Error(\"Compiled lane grant references a tool without a capability manifest.\");\n\t}\n\tconst gateway = options.grant\n\t\t? new CapabilityGateway({\n\t\t\t\tgrant: options.grant,\n\t\t\t\tcwd: options.cwd,\n\t\t\t\t...(options.initialUsage !== undefined ? { initialUsage: options.initialUsage } : {}),\n\t\t\t})\n\t\t: undefined;\n\tconst deniedPaths = options.deniedPaths?.map((entry) => path.resolve(entry));\n\tconst readEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-read-tools\",\n\t\tcapabilities: [\n\t\t\t\"filesystem.read\",\n\t\t\t...(allowedToolSet.has(MEMORY_LANE_TOOL_NAME) ? ([\"memory.query\"] as const) : []),\n\t\t\t...(allowedToolSet.has(PROCESS_LANE_TOOL_NAME) ? ([\"process.exec\"] as const) : []),\n\t\t],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: [path.resolve(options.cwd)],\n\t\t...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),\n\t};\n\tconst writeEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-write-tools\",\n\t\tcapabilities: [\"filesystem.write\"],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: resolveWriteRoots(options.cwd, options.writePaths ?? []),\n\t\t...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),\n\t};\n\n\treturn {\n\t\ttools: createLaneTools(\n\t\t\toptions.cwd,\n\t\t\tallowedTools,\n\t\t\toptions.readMemory,\n\t\t\toptions.executionPolicy,\n\t\t\toptions.processMaxWallClockMs,\n\t\t),\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tunboundAllowPatterns,\n\t\tbeforeToolCall: async ({ toolCall, args }) => {\n\t\t\tif (!allowedToolSet.has(toolCall.name)) {\n\t\t\t\treturn { block: true, reason: `Lane tool '${toolCall.name}' is outside the materialized UAC surface.` };\n\t\t\t}\n\t\t\tif (gateway) {\n\t\t\t\tconst manifest = manifestsByName.get(toolCall.name);\n\t\t\t\tif (!manifest) {\n\t\t\t\t\treturn { block: true, reason: `Lane tool '${toolCall.name}' has no compiled capability manifest.` };\n\t\t\t\t}\n\t\t\t\ttry {\n\t\t\t\t\tgateway.authorizeToolCall(manifest, toolCall.name, args);\n\t\t\t\t\treturn undefined;\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (error instanceof CapabilityGatewayDeniedError) {\n\t\t\t\t\t\treturn { block: true, reason: `Lane tool blocked (${error.reasonCode}): ${error.message}` };\n\t\t\t\t\t}\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst outcome = evaluateToolGate({\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\targs,\n\t\t\t\tcwd: options.cwd,\n\t\t\t\tenvelope: WRITE_LANE_TOOL_NAME_SET.has(toolCall.name) ? writeEnvelope : readEnvelope,\n\t\t\t});\n\t\t\tif (outcome.outcome === \"allow\") return undefined;\n\t\t\treturn {\n\t\t\t\tblock: true,\n\t\t\t\treason: `Lane tool blocked (${outcome.reasonCode}): ${outcome.message ?? \"capability gate denied it\"}`,\n\t\t\t};\n\t\t},\n\t\t...(gateway ? { gateway } : {}),\n\t};\n}\n"]}

package/dist/core/autonomy/lane-tool-surface.js CHANGED Viewed

@@ -1,6 +1,6 @@
 import path from "node:path";
 import { Type } from "typebox";
-import { CapabilityGateway, CapabilityGatewayDeniedError } from "../orchestration/capability-gateway.js";
+import { CapabilityGateway, CapabilityGatewayDeniedError, } from "../orchestration/capability-gateway.js";
 import { wrapToolWithCredentialExposureGuard } from "../secrets/credential-exposure-guard.js";
 import { matchesResourceProfilePattern } from "../settings-manager.js";
 import { createEditTool } from "../tools/edit.js";
@@ -15,8 +15,12 @@ const READ_ONLY_LANE_TOOL_NAMES = ["read", "grep", "find", "ls"];
 const MEMORY_LANE_TOOL_NAME = "memory";
 const WRITE_LANE_TOOL_NAMES = ["write", "edit"];
 const PROCESS_LANE_TOOL_NAME = "run_process";
+const MAX_LANE_MEMORY_QUERY_CHARS = 4_096;
 const laneMemorySchema = Type.Object({
-    query: Type.String({ description: "What relevant standing memory or prior evidence to retrieve" }),
+    query: Type.String({
+        maxLength: MAX_LANE_MEMORY_QUERY_CHARS,
+        description: "What relevant standing memory or prior evidence to retrieve",
+    }),
 });
 const WRITE_LANE_TOOL_NAME_SET = new Set(WRITE_LANE_TOOL_NAMES);
 function strictLaneProfilePatterns(profile) {
@@ -52,7 +56,10 @@ function createLaneTools(cwd, names, readMemory, executionPolicy, processMaxWall
             description: "Retrieve bounded, source-labeled standing memory relevant to this delegated task. Read-only: no memory writes or lifecycle actions are available.",
             parameters: laneMemorySchema,
             execute: async (_toolCallId, params) => {
-                const { query } = params;
+                const query = params.query?.trim();
+                if (!query || query.length > MAX_LANE_MEMORY_QUERY_CHARS) {
+                    throw new Error(`memory_query_invalid: query must contain from 1 through ${MAX_LANE_MEMORY_QUERY_CHARS} characters.`);
+                }
                 return {
                     content: [{ type: "text", text: await readMemory(query) }],
                     details: { readOnly: true },
@@ -96,7 +103,13 @@ export function createLaneToolSurface(options) {
     if (options.grant?.allowedTools.some((name) => !manifestsByName.has(name))) {
         throw new Error("Compiled lane grant references a tool without a capability manifest.");
     }
-    const gateway = options.grant ? new CapabilityGateway({ grant: options.grant, cwd: options.cwd }) : undefined;
+    const gateway = options.grant
+        ? new CapabilityGateway({
+            grant: options.grant,
+            cwd: options.cwd,
+            ...(options.initialUsage !== undefined ? { initialUsage: options.initialUsage } : {}),
+        })
+        : undefined;
     const deniedPaths = options.deniedPaths?.map((entry) => path.resolve(entry));
     const readEnvelope = {
         id: "isolated-lane-read-tools",

package/dist/core/autonomy/lane-tool-surface.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"lane-tool-surface.js","sourceRoot":"","sources":["../../../src/core/autonomy/lane-tool-surface.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAe,IAAI,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAOzG,OAAO,EAAE,mCAAmC,EAAE,MAAM,yCAAyC,CAAC;AAC9F,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAU,CAAC;AAC1E,MAAM,qBAAqB,GAAG,QAAiB,CAAC;AAChD,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAU,CAAC;AACzD,MAAM,sBAAsB,GAAG,aAAsB,CAAC;AACtD,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,6DAA6D,EAAE,CAAC;CAClG,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAS,qBAAqB,CAAC,CAAC;AAmCxE,SAAS,yBAAyB,CAAC,OAAsC,EAGvE;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;IACvC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,6FAA6F;IAC7F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IACjF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAAA,CACxB;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,UAA6B,EAAY;IAChF,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAAA,CAC5G;AAED,SAAS,eAAe,CACvB,GAAW,EACX,KAAwB,EACxB,UAA+C,EAC/C,eAA8C,EAC9C,qBAAqB,GAAG,CAAC,EACX;IACd,MAAM,SAAS,GAAG,IAAI,GAAG,CAA0B;QAClD,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,eAAe,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAC1C,oBAAoB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,qBAAqB,EAAE,CAAC,CAC7F,CAAC;IACH,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QAChB,SAAS,CAAC,GAAG,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,IAAI,EAAE,qBAAqB;YAC3B,KAAK,EAAE,aAAa;YACpB,WAAW,EACV,mJAAmJ;YACpJ,UAAU,EAAE,gBAAgB;YAC5B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC;gBACvC,MAAM,EAAE,KAAK,EAAE,GAAG,MAA0B,CAAC;gBAC7C,OAAO;oBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC3B,CAAC;YAAA,CACF;SACD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAAA,CAC5E,CAAC,CAAC;AAAA,CACH;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA+B,EAAmB;IACvF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5F,MAAM,cAAc,GAAG;QACtB,GAAG,yBAAyB;QAC5B,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;IACF,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAClD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAClG,CAAC;IACF,MAAM,oBAAoB,GAAG,OAAO,CAAC,KAAK;QACzC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CACrB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,6BAA6B,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAC3F,CAAC;IACJ,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK;QACjC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9D,CAAC,CAAC,cAAc,CAAC,MAAM,CACrB,CAAC,IAAI,EAAE,EAAE,CACR,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YACpF,CAAC,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CACrD,CAAC;IACJ,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,YAAY,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/G,IAAI,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9G,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAuB;QACxC,EAAE,EAAE,0BAA0B;QAC9B,YAAY,EAAE;YACb,iBAAiB;YACjB,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAE,CAAC,cAAc,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAE,CAAC,cAAc,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF;QACD,YAAY;QACZ,WAAW;QACX,YAAY,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzC,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IACF,MAAM,aAAa,GAAuB;QACzC,EAAE,EAAE,2BAA2B;QAC/B,YAAY,EAAE,CAAC,kBAAkB,CAAC;QAClC,YAAY;QACZ,WAAW;QACX,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QACtE,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IAEF,OAAO;QACN,KAAK,EAAE,eAAe,CACrB,OAAO,CAAC,GAAG,EACX,YAAY,EACZ,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,qBAAqB,CAC7B;QACD,YAAY;QACZ,WAAW;QACX,oBAAoB;QACpB,cAAc,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,QAAQ,CAAC,IAAI,4CAA4C,EAAE,CAAC;YACzG,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACf,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,QAAQ,CAAC,IAAI,wCAAwC,EAAE,CAAC;gBACrG,CAAC;gBACD,IAAI,CAAC;oBACJ,OAAO,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBACzD,OAAO,SAAS,CAAC;gBAClB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;wBACnD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,KAAK,CAAC,UAAU,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC7F,CAAC;oBACD,MAAM,KAAK,CAAC;gBACb,CAAC;YACF,CAAC;YACD,MAAM,OAAO,GAAG,gBAAgB,CAAC;gBAChC,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,IAAI;gBACJ,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,QAAQ,EAAE,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY;aACpF,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;gBAAE,OAAO,SAAS,CAAC;YAClD,OAAO;gBACN,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,sBAAsB,OAAO,CAAC,UAAU,MAAM,OAAO,CAAC,OAAO,IAAI,2BAA2B,EAAE;aACtG,CAAC;QAAA,CACF;QACD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/B,CAAC;AAAA,CACF","sourcesContent":["import path from \"node:path\";\nimport type { AgentLoopConfig, AgentTool } from \"@caupulican/pi-agent-core\";\nimport { type Static, Type } from \"typebox\";\nimport { CapabilityGateway, CapabilityGatewayDeniedError } from \"../orchestration/capability-gateway.ts\";\nimport type {\n\tExecutionGrant,\n\tOrchestrationExecutionPolicy,\n\tToolCapabilityManifest,\n} from \"../orchestration/contracts.ts\";\nimport type { NormalizedProfile } from \"../profile-registry.ts\";\nimport { wrapToolWithCredentialExposureGuard } from \"../secrets/credential-exposure-guard.ts\";\nimport { matchesResourceProfilePattern } from \"../settings-manager.ts\";\nimport { createEditTool } from \"../tools/edit.ts\";\nimport { createFindTool } from \"../tools/find.ts\";\nimport { createGrepTool } from \"../tools/grep.ts\";\nimport { createLsTool } from \"../tools/ls.ts\";\nimport { createReadTool } from \"../tools/read.ts\";\nimport { createRunProcessTool } from \"../tools/run-process.ts\";\nimport { createWriteTool } from \"../tools/write.ts\";\nimport type { CapabilityEnvelope } from \"./contracts.ts\";\nimport { evaluateToolGate } from \"./gates.ts\";\n\nconst READ_ONLY_LANE_TOOL_NAMES = [\"read\", \"grep\", \"find\", \"ls\"] as const;\nconst MEMORY_LANE_TOOL_NAME = \"memory\" as const;\nconst WRITE_LANE_TOOL_NAMES = [\"write\", \"edit\"] as const;\nconst PROCESS_LANE_TOOL_NAME = \"run_process\" as const;\nconst laneMemorySchema = Type.Object({\n\tquery: Type.String({ description: \"What relevant standing memory or prior evidence to retrieve\" }),\n});\ntype LaneMemoryParams = Static<typeof laneMemorySchema>;\nconst WRITE_LANE_TOOL_NAME_SET = new Set<string>(WRITE_LANE_TOOL_NAMES);\n\nexport interface LaneToolSurface {\n\t/** Fresh tools owned by this lane only; no foreground tool instances or extension state leak in. /\n\ttools: AgentTool[];\n\t/* Exact names after profile globs are expanded. Safe to persist in a capability envelope. /\n\tallowedTools: string[];\n\t/* Exact safe-candidate names denied by the profile's block patterns. /\n\tdeniedTools: string[];\n\t/* Explicit grants that bind to no classified lane candidate (opaque tools stay fail-closed). /\n\tunboundAllowPatterns: string[];\n\t/* Per-call path and capability gate for the isolated child loop. /\n\tbeforeToolCall: NonNullable<AgentLoopConfig[\"beforeToolCall\"]>;\n\t/* Canonical cumulative authority/budget meter for a compiled worker grant. /\n\tgateway?: CapabilityGateway;\n}\n\nexport interface LaneToolSurfaceOptions {\n\tcwd: string;\n\tprofile?: NormalizedProfile;\n\t/* Private harness state that generic file tools must never traverse. /\n\tdeniedPaths?: readonly string[];\n\t/* Orchestrator-requested, policy-filtered read-only memory retrieval. Omitted means no memory tool. /\n\treadMemory?: (query: string) => Promise<string>;\n\t/* Research never sets this. Workers require both this flag and at least one write path. /\n\twriteEnabled?: boolean;\n\twritePaths?: readonly string[];\n\t/* Present only for process-capable owner profiles; absent means no process tool is materialized. /\n\texecutionPolicy?: OrchestrationExecutionPolicy;\n\tprocessMaxWallClockMs?: number;\n\t/* Compiled policy path. When present, it is the only authorization source for this surface. /\n\tgrant?: ExecutionGrant;\n\ttoolManifests?: readonly ToolCapabilityManifest[];\n}\n\nfunction strictLaneProfilePatterns(profile: NormalizedProfile \| undefined): {\n\tallow: string[];\n\tblock: string[];\n} {\n\tif (!profile) return { allow: [], block: [] };\n\tconst filter = profile.resources.tools;\n\tconst allow = [...(filter?.allow ?? [])];\n\tconst block = [...(filter?.block ?? [])];\n\t// Strict UAC: a shipped profile is the complete authority grant. Grant-all must be explicit.\n\tif (allow.length === 0 && block.length === 0) return { allow: [], block: [\"\"] };\n\treturn { allow, block };\n}\n\nfunction resolveWriteRoots(cwd: string, writePaths: readonly string[]): string[] {\n\treturn writePaths.map((entry) => (path.isAbsolute(entry) ? path.resolve(entry) : path.resolve(cwd, entry)));\n}\n\nfunction createLaneTools(\n\tcwd: string,\n\tnames: readonly string[],\n\treadMemory?: (query: string) => Promise<string>,\n\texecutionPolicy?: OrchestrationExecutionPolicy,\n\tprocessMaxWallClockMs = 0,\n): AgentTool[] {\n\tconst factories = new Map<string, () => AgentTool>([\n\t\t[\"read\", () => createReadTool(cwd)],\n\t\t[\"grep\", () => createGrepTool(cwd)],\n\t\t[\"find\", () => createFindTool(cwd)],\n\t\t[\"ls\", () => createLsTool(cwd)],\n\t\t[\"write\", () => createWriteTool(cwd)],\n\t\t[\"edit\", () => createEditTool(cwd)],\n\t]);\n\tif (executionPolicy) {\n\t\tfactories.set(PROCESS_LANE_TOOL_NAME, () =>\n\t\t\tcreateRunProcessTool(cwd, { policy: executionPolicy, maxWallClockMs: processMaxWallClockMs }),\n\t\t);\n\t}\n\tif (readMemory) {\n\t\tfactories.set(MEMORY_LANE_TOOL_NAME, () => ({\n\t\t\tname: MEMORY_LANE_TOOL_NAME,\n\t\t\tlabel: \"Read Memory\",\n\t\t\tdescription:\n\t\t\t\t\"Retrieve bounded, source-labeled standing memory relevant to this delegated task. Read-only: no memory writes or lifecycle actions are available.\",\n\t\t\tparameters: laneMemorySchema,\n\t\t\texecute: async (_toolCallId, params) => {\n\t\t\t\tconst { query } = params as LaneMemoryParams;\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ type: \"text\" as const, text: await readMemory(query) }],\n\t\t\t\t\tdetails: { readOnly: true },\n\t\t\t\t};\n\t\t\t},\n\t\t}));\n\t}\n\treturn names.flatMap((name) => {\n\t\tconst factory = factories.get(name);\n\t\treturn factory ? [wrapToolWithCredentialExposureGuard(factory(), cwd)] : [];\n\t});\n}\n\n/*\n Materialize a fresh, fail-closed tool surface for one isolated lane.\n \n Profiles select only from classified built-ins. Opaque extension tools, shell, memory, goals,\n * and `delegate` are never candidates, so a wildcard cannot manufacture unknown authority or\n * recursively spawn more workers. Write/edit additionally require the explicit worker write switch\n * and a non-empty path scope; research therefore stays read-only regardless of profile contents.\n */\nexport function createLaneToolSurface(options: LaneToolSurfaceOptions): LaneToolSurface {\n\tconst writeCapable = options.writeEnabled === true && (options.writePaths?.length ?? 0) > 0;\n\tconst candidateNames = [\n\t\t...READ_ONLY_LANE_TOOL_NAMES,\n\t\t...(options.readMemory ? [MEMORY_LANE_TOOL_NAME] : []),\n\t\t...(writeCapable ? WRITE_LANE_TOOL_NAMES : []),\n\t\t...(options.executionPolicy ? [PROCESS_LANE_TOOL_NAME] : []),\n\t];\n\tconst patterns = strictLaneProfilePatterns(options.profile);\n\tconst compiledToolNames = new Set(options.grant?.allowedTools ?? []);\n\tconst deniedTools = candidateNames.filter((name) =>\n\t\toptions.grant ? !compiledToolNames.has(name) : matchesResourceProfilePattern(name, patterns.block),\n\t);\n\tconst unboundAllowPatterns = options.grant\n\t\t? []\n\t\t: patterns.allow.filter(\n\t\t\t\t(pattern) => !candidateNames.some((name) => matchesResourceProfilePattern(name, [pattern])),\n\t\t\t);\n\tconst allowedTools = options.grant\n\t\t? candidateNames.filter((name) => compiledToolNames.has(name))\n\t\t: candidateNames.filter(\n\t\t\t\t(name) =>\n\t\t\t\t\t(patterns.allow.length === 0 \|\| matchesResourceProfilePattern(name, patterns.allow)) &&\n\t\t\t\t\t!matchesResourceProfilePattern(name, patterns.block),\n\t\t\t);\n\tconst allowedToolSet = new Set<string>(allowedTools);\n\tconst manifestsByName = new Map(options.toolManifests?.map((manifest) => [manifest.toolName, manifest]) ?? []);\n\tif (options.grant?.allowedTools.some((name) => !manifestsByName.has(name))) {\n\t\tthrow new Error(\"Compiled lane grant references a tool without a capability manifest.\");\n\t}\n\tconst gateway = options.grant ? new CapabilityGateway({ grant: options.grant, cwd: options.cwd }) : undefined;\n\tconst deniedPaths = options.deniedPaths?.map((entry) => path.resolve(entry));\n\tconst readEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-read-tools\",\n\t\tcapabilities: [\n\t\t\t\"filesystem.read\",\n\t\t\t...(allowedToolSet.has(MEMORY_LANE_TOOL_NAME) ? ([\"memory.query\"] as const) : []),\n\t\t\t...(allowedToolSet.has(PROCESS_LANE_TOOL_NAME) ? ([\"process.exec\"] as const) : []),\n\t\t],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: [path.resolve(options.cwd)],\n\t\t...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),\n\t};\n\tconst writeEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-write-tools\",\n\t\tcapabilities: [\"filesystem.write\"],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: resolveWriteRoots(options.cwd, options.writePaths ?? []),\n\t\t...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),\n\t};\n\n\treturn {\n\t\ttools: createLaneTools(\n\t\t\toptions.cwd,\n\t\t\tallowedTools,\n\t\t\toptions.readMemory,\n\t\t\toptions.executionPolicy,\n\t\t\toptions.processMaxWallClockMs,\n\t\t),\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tunboundAllowPatterns,\n\t\tbeforeToolCall: async ({ toolCall, args }) => {\n\t\t\tif (!allowedToolSet.has(toolCall.name)) {\n\t\t\t\treturn { block: true, reason: `Lane tool '${toolCall.name}' is outside the materialized UAC surface.` };\n\t\t\t}\n\t\t\tif (gateway) {\n\t\t\t\tconst manifest = manifestsByName.get(toolCall.name);\n\t\t\t\tif (!manifest) {\n\t\t\t\t\treturn { block: true, reason: `Lane tool '${toolCall.name}' has no compiled capability manifest.` };\n\t\t\t\t}\n\t\t\t\ttry {\n\t\t\t\t\tgateway.authorizeToolCall(manifest, toolCall.name, args);\n\t\t\t\t\treturn undefined;\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (error instanceof CapabilityGatewayDeniedError) {\n\t\t\t\t\t\treturn { block: true, reason: `Lane tool blocked (${error.reasonCode}): ${error.message}` };\n\t\t\t\t\t}\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst outcome = evaluateToolGate({\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\targs,\n\t\t\t\tcwd: options.cwd,\n\t\t\t\tenvelope: WRITE_LANE_TOOL_NAME_SET.has(toolCall.name) ? writeEnvelope : readEnvelope,\n\t\t\t});\n\t\t\tif (outcome.outcome === \"allow\") return undefined;\n\t\t\treturn {\n\t\t\t\tblock: true,\n\t\t\t\treason: `Lane tool blocked (${outcome.reasonCode}): ${outcome.message ?? \"capability gate denied it\"}`,\n\t\t\t};\n\t\t},\n\t\t...(gateway ? { gateway } : {}),\n\t};\n}\n"]}
1	+ {"version":3,"file":"lane-tool-surface.js","sourceRoot":"","sources":["../../../src/core/autonomy/lane-tool-surface.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAe,IAAI,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EACN,iBAAiB,EACjB,4BAA4B,GAE5B,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EAAE,mCAAmC,EAAE,MAAM,yCAAyC,CAAC;AAC9F,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAU,CAAC;AAC1E,MAAM,qBAAqB,GAAG,QAAiB,CAAC;AAChD,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAU,CAAC;AACzD,MAAM,sBAAsB,GAAG,aAAsB,CAAC;AACtD,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAC1C,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;QAClB,SAAS,EAAE,2BAA2B;QACtC,WAAW,EAAE,6DAA6D;KAC1E,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAS,qBAAqB,CAAC,CAAC;AAqCxE,SAAS,yBAAyB,CAAC,OAAsC,EAGvE;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;IACvC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,6FAA6F;IAC7F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IACjF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAAA,CACxB;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,UAA6B,EAAY;IAChF,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAAA,CAC5G;AAED,SAAS,eAAe,CACvB,GAAW,EACX,KAAwB,EACxB,UAA+C,EAC/C,eAA8C,EAC9C,qBAAqB,GAAG,CAAC,EACX;IACd,MAAM,SAAS,GAAG,IAAI,GAAG,CAA0B;QAClD,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,eAAe,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAC1C,oBAAoB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,qBAAqB,EAAE,CAAC,CAC7F,CAAC;IACH,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QAChB,SAAS,CAAC,GAAG,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,IAAI,EAAE,qBAAqB;YAC3B,KAAK,EAAE,aAAa;YACpB,WAAW,EACV,mJAAmJ;YACpJ,UAAU,EAAE,gBAAgB;YAC5B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC;gBACvC,MAAM,KAAK,GAAI,MAA2B,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;gBACzD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;oBAC1D,MAAM,IAAI,KAAK,CACd,2DAA2D,2BAA2B,cAAc,CACpG,CAAC;gBACH,CAAC;gBACD,OAAO;oBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC3B,CAAC;YAAA,CACF;SACD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAAA,CAC5E,CAAC,CAAC;AAAA,CACH;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA+B,EAAmB;IACvF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5F,MAAM,cAAc,GAAG;QACtB,GAAG,yBAAyB;QAC5B,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;IACF,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAClD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAClG,CAAC;IACF,MAAM,oBAAoB,GAAG,OAAO,CAAC,KAAK;QACzC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CACrB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,6BAA6B,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAC3F,CAAC;IACJ,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK;QACjC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9D,CAAC,CAAC,cAAc,CAAC,MAAM,CACrB,CAAC,IAAI,EAAE,EAAE,CACR,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YACpF,CAAC,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CACrD,CAAC;IACJ,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,YAAY,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/G,IAAI,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK;QAC5B,CAAC,CAAC,IAAI,iBAAiB,CAAC;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrF,CAAC;QACH,CAAC,CAAC,SAAS,CAAC;IACb,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAuB;QACxC,EAAE,EAAE,0BAA0B;QAC9B,YAAY,EAAE;YACb,iBAAiB;YACjB,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAE,CAAC,cAAc,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAE,CAAC,cAAc,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF;QACD,YAAY;QACZ,WAAW;QACX,YAAY,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzC,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IACF,MAAM,aAAa,GAAuB;QACzC,EAAE,EAAE,2BAA2B;QAC/B,YAAY,EAAE,CAAC,kBAAkB,CAAC;QAClC,YAAY;QACZ,WAAW;QACX,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QACtE,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IAEF,OAAO;QACN,KAAK,EAAE,eAAe,CACrB,OAAO,CAAC,GAAG,EACX,YAAY,EACZ,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,qBAAqB,CAC7B;QACD,YAAY;QACZ,WAAW;QACX,oBAAoB;QACpB,cAAc,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,QAAQ,CAAC,IAAI,4CAA4C,EAAE,CAAC;YACzG,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACf,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,QAAQ,CAAC,IAAI,wCAAwC,EAAE,CAAC;gBACrG,CAAC;gBACD,IAAI,CAAC;oBACJ,OAAO,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBACzD,OAAO,SAAS,CAAC;gBAClB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;wBACnD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,KAAK,CAAC,UAAU,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC7F,CAAC;oBACD,MAAM,KAAK,CAAC;gBACb,CAAC;YACF,CAAC;YACD,MAAM,OAAO,GAAG,gBAAgB,CAAC;gBAChC,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,IAAI;gBACJ,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,QAAQ,EAAE,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY;aACpF,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;gBAAE,OAAO,SAAS,CAAC;YAClD,OAAO;gBACN,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,sBAAsB,OAAO,CAAC,UAAU,MAAM,OAAO,CAAC,OAAO,IAAI,2BAA2B,EAAE;aACtG,CAAC;QAAA,CACF;QACD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/B,CAAC;AAAA,CACF","sourcesContent":["import path from \"node:path\";\nimport type { AgentLoopConfig, AgentTool } from \"@caupulican/pi-agent-core\";\nimport { type Static, Type } from \"typebox\";\nimport {\n\tCapabilityGateway,\n\tCapabilityGatewayDeniedError,\n\ttype GatewayInitialUsage,\n} from \"../orchestration/capability-gateway.ts\";\nimport type {\n\tExecutionGrant,\n\tOrchestrationExecutionPolicy,\n\tToolCapabilityManifest,\n} from \"../orchestration/contracts.ts\";\nimport type { NormalizedProfile } from \"../profile-registry.ts\";\nimport { wrapToolWithCredentialExposureGuard } from \"../secrets/credential-exposure-guard.ts\";\nimport { matchesResourceProfilePattern } from \"../settings-manager.ts\";\nimport { createEditTool } from \"../tools/edit.ts\";\nimport { createFindTool } from \"../tools/find.ts\";\nimport { createGrepTool } from \"../tools/grep.ts\";\nimport { createLsTool } from \"../tools/ls.ts\";\nimport { createReadTool } from \"../tools/read.ts\";\nimport { createRunProcessTool } from \"../tools/run-process.ts\";\nimport { createWriteTool } from \"../tools/write.ts\";\nimport type { CapabilityEnvelope } from \"./contracts.ts\";\nimport { evaluateToolGate } from \"./gates.ts\";\n\nconst READ_ONLY_LANE_TOOL_NAMES = [\"read\", \"grep\", \"find\", \"ls\"] as const;\nconst MEMORY_LANE_TOOL_NAME = \"memory\" as const;\nconst WRITE_LANE_TOOL_NAMES = [\"write\", \"edit\"] as const;\nconst PROCESS_LANE_TOOL_NAME = \"run_process\" as const;\nconst MAX_LANE_MEMORY_QUERY_CHARS = 4_096;\nconst laneMemorySchema = Type.Object({\n\tquery: Type.String({\n\t\tmaxLength: MAX_LANE_MEMORY_QUERY_CHARS,\n\t\tdescription: \"What relevant standing memory or prior evidence to retrieve\",\n\t}),\n});\ntype LaneMemoryParams = Static<typeof laneMemorySchema>;\nconst WRITE_LANE_TOOL_NAME_SET = new Set<string>(WRITE_LANE_TOOL_NAMES);\n\nexport interface LaneToolSurface {\n\t/** Fresh tools owned by this lane only; no foreground tool instances or extension state leak in. /\n\ttools: AgentTool[];\n\t/* Exact names after profile globs are expanded. Safe to persist in a capability envelope. /\n\tallowedTools: string[];\n\t/* Exact safe-candidate names denied by the profile's block patterns. /\n\tdeniedTools: string[];\n\t/* Explicit grants that bind to no classified lane candidate (opaque tools stay fail-closed). /\n\tunboundAllowPatterns: string[];\n\t/* Per-call path and capability gate for the isolated child loop. /\n\tbeforeToolCall: NonNullable<AgentLoopConfig[\"beforeToolCall\"]>;\n\t/* Canonical cumulative authority/budget meter for a compiled worker grant. /\n\tgateway?: CapabilityGateway;\n}\n\nexport interface LaneToolSurfaceOptions {\n\tcwd: string;\n\tprofile?: NormalizedProfile;\n\t/* Private harness state that generic file tools must never traverse. /\n\tdeniedPaths?: readonly string[];\n\t/* Orchestrator-requested, policy-filtered read-only memory retrieval. Omitted means no memory tool. /\n\treadMemory?: (query: string) => Promise<string>;\n\t/* Research never sets this. Workers require both this flag and at least one write path. /\n\twriteEnabled?: boolean;\n\twritePaths?: readonly string[];\n\t/* Present only for process-capable owner profiles; absent means no process tool is materialized. /\n\texecutionPolicy?: OrchestrationExecutionPolicy;\n\tprocessMaxWallClockMs?: number;\n\t/* Compiled policy path. When present, it is the only authorization source for this surface. /\n\tgrant?: ExecutionGrant;\n\ttoolManifests?: readonly ToolCapabilityManifest[];\n\t/* Durable cumulative active usage to seed the compiled grant's gateway on resume. /\n\tinitialUsage?: GatewayInitialUsage;\n}\n\nfunction strictLaneProfilePatterns(profile: NormalizedProfile \| undefined): {\n\tallow: string[];\n\tblock: string[];\n} {\n\tif (!profile) return { allow: [], block: [] };\n\tconst filter = profile.resources.tools;\n\tconst allow = [...(filter?.allow ?? [])];\n\tconst block = [...(filter?.block ?? [])];\n\t// Strict UAC: a shipped profile is the complete authority grant. Grant-all must be explicit.\n\tif (allow.length === 0 && block.length === 0) return { allow: [], block: [\"\"] };\n\treturn { allow, block };\n}\n\nfunction resolveWriteRoots(cwd: string, writePaths: readonly string[]): string[] {\n\treturn writePaths.map((entry) => (path.isAbsolute(entry) ? path.resolve(entry) : path.resolve(cwd, entry)));\n}\n\nfunction createLaneTools(\n\tcwd: string,\n\tnames: readonly string[],\n\treadMemory?: (query: string) => Promise<string>,\n\texecutionPolicy?: OrchestrationExecutionPolicy,\n\tprocessMaxWallClockMs = 0,\n): AgentTool[] {\n\tconst factories = new Map<string, () => AgentTool>([\n\t\t[\"read\", () => createReadTool(cwd)],\n\t\t[\"grep\", () => createGrepTool(cwd)],\n\t\t[\"find\", () => createFindTool(cwd)],\n\t\t[\"ls\", () => createLsTool(cwd)],\n\t\t[\"write\", () => createWriteTool(cwd)],\n\t\t[\"edit\", () => createEditTool(cwd)],\n\t]);\n\tif (executionPolicy) {\n\t\tfactories.set(PROCESS_LANE_TOOL_NAME, () =>\n\t\t\tcreateRunProcessTool(cwd, { policy: executionPolicy, maxWallClockMs: processMaxWallClockMs }),\n\t\t);\n\t}\n\tif (readMemory) {\n\t\tfactories.set(MEMORY_LANE_TOOL_NAME, () => ({\n\t\t\tname: MEMORY_LANE_TOOL_NAME,\n\t\t\tlabel: \"Read Memory\",\n\t\t\tdescription:\n\t\t\t\t\"Retrieve bounded, source-labeled standing memory relevant to this delegated task. Read-only: no memory writes or lifecycle actions are available.\",\n\t\t\tparameters: laneMemorySchema,\n\t\t\texecute: async (_toolCallId, params) => {\n\t\t\t\tconst query = (params as LaneMemoryParams).query?.trim();\n\t\t\t\tif (!query \|\| query.length > MAX_LANE_MEMORY_QUERY_CHARS) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`memory_query_invalid: query must contain from 1 through ${MAX_LANE_MEMORY_QUERY_CHARS} characters.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ type: \"text\" as const, text: await readMemory(query) }],\n\t\t\t\t\tdetails: { readOnly: true },\n\t\t\t\t};\n\t\t\t},\n\t\t}));\n\t}\n\treturn names.flatMap((name) => {\n\t\tconst factory = factories.get(name);\n\t\treturn factory ? [wrapToolWithCredentialExposureGuard(factory(), cwd)] : [];\n\t});\n}\n\n/*\n Materialize a fresh, fail-closed tool surface for one isolated lane.\n \n Profiles select only from classified built-ins. Opaque extension tools, shell, memory, goals,\n * and `delegate` are never candidates, so a wildcard cannot manufacture unknown authority or\n * recursively spawn more workers. Write/edit additionally require the explicit worker write switch\n * and a non-empty path scope; research therefore stays read-only regardless of profile contents.\n */\nexport function createLaneToolSurface(options: LaneToolSurfaceOptions): LaneToolSurface {\n\tconst writeCapable = options.writeEnabled === true && (options.writePaths?.length ?? 0) > 0;\n\tconst candidateNames = [\n\t\t...READ_ONLY_LANE_TOOL_NAMES,\n\t\t...(options.readMemory ? [MEMORY_LANE_TOOL_NAME] : []),\n\t\t...(writeCapable ? WRITE_LANE_TOOL_NAMES : []),\n\t\t...(options.executionPolicy ? [PROCESS_LANE_TOOL_NAME] : []),\n\t];\n\tconst patterns = strictLaneProfilePatterns(options.profile);\n\tconst compiledToolNames = new Set(options.grant?.allowedTools ?? []);\n\tconst deniedTools = candidateNames.filter((name) =>\n\t\toptions.grant ? !compiledToolNames.has(name) : matchesResourceProfilePattern(name, patterns.block),\n\t);\n\tconst unboundAllowPatterns = options.grant\n\t\t? []\n\t\t: patterns.allow.filter(\n\t\t\t\t(pattern) => !candidateNames.some((name) => matchesResourceProfilePattern(name, [pattern])),\n\t\t\t);\n\tconst allowedTools = options.grant\n\t\t? candidateNames.filter((name) => compiledToolNames.has(name))\n\t\t: candidateNames.filter(\n\t\t\t\t(name) =>\n\t\t\t\t\t(patterns.allow.length === 0 \|\| matchesResourceProfilePattern(name, patterns.allow)) &&\n\t\t\t\t\t!matchesResourceProfilePattern(name, patterns.block),\n\t\t\t);\n\tconst allowedToolSet = new Set<string>(allowedTools);\n\tconst manifestsByName = new Map(options.toolManifests?.map((manifest) => [manifest.toolName, manifest]) ?? []);\n\tif (options.grant?.allowedTools.some((name) => !manifestsByName.has(name))) {\n\t\tthrow new Error(\"Compiled lane grant references a tool without a capability manifest.\");\n\t}\n\tconst gateway = options.grant\n\t\t? new CapabilityGateway({\n\t\t\t\tgrant: options.grant,\n\t\t\t\tcwd: options.cwd,\n\t\t\t\t...(options.initialUsage !== undefined ? { initialUsage: options.initialUsage } : {}),\n\t\t\t})\n\t\t: undefined;\n\tconst deniedPaths = options.deniedPaths?.map((entry) => path.resolve(entry));\n\tconst readEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-read-tools\",\n\t\tcapabilities: [\n\t\t\t\"filesystem.read\",\n\t\t\t...(allowedToolSet.has(MEMORY_LANE_TOOL_NAME) ? ([\"memory.query\"] as const) : []),\n\t\t\t...(allowedToolSet.has(PROCESS_LANE_TOOL_NAME) ? ([\"process.exec\"] as const) : []),\n\t\t],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: [path.resolve(options.cwd)],\n\t\t...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),\n\t};\n\tconst writeEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-write-tools\",\n\t\tcapabilities: [\"filesystem.write\"],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: resolveWriteRoots(options.cwd, options.writePaths ?? []),\n\t\t...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),\n\t};\n\n\treturn {\n\t\ttools: createLaneTools(\n\t\t\toptions.cwd,\n\t\t\tallowedTools,\n\t\t\toptions.readMemory,\n\t\t\toptions.executionPolicy,\n\t\t\toptions.processMaxWallClockMs,\n\t\t),\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tunboundAllowPatterns,\n\t\tbeforeToolCall: async ({ toolCall, args }) => {\n\t\t\tif (!allowedToolSet.has(toolCall.name)) {\n\t\t\t\treturn { block: true, reason: `Lane tool '${toolCall.name}' is outside the materialized UAC surface.` };\n\t\t\t}\n\t\t\tif (gateway) {\n\t\t\t\tconst manifest = manifestsByName.get(toolCall.name);\n\t\t\t\tif (!manifest) {\n\t\t\t\t\treturn { block: true, reason: `Lane tool '${toolCall.name}' has no compiled capability manifest.` };\n\t\t\t\t}\n\t\t\t\ttry {\n\t\t\t\t\tgateway.authorizeToolCall(manifest, toolCall.name, args);\n\t\t\t\t\treturn undefined;\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (error instanceof CapabilityGatewayDeniedError) {\n\t\t\t\t\t\treturn { block: true, reason: `Lane tool blocked (${error.reasonCode}): ${error.message}` };\n\t\t\t\t\t}\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst outcome = evaluateToolGate({\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\targs,\n\t\t\t\tcwd: options.cwd,\n\t\t\t\tenvelope: WRITE_LANE_TOOL_NAME_SET.has(toolCall.name) ? writeEnvelope : readEnvelope,\n\t\t\t});\n\t\t\tif (outcome.outcome === \"allow\") return undefined;\n\t\t\treturn {\n\t\t\t\tblock: true,\n\t\t\t\treason: `Lane tool blocked (${outcome.reasonCode}): ${outcome.message ?? \"capability gate denied it\"}`,\n\t\t\t};\n\t\t},\n\t\t...(gateway ? { gateway } : {}),\n\t};\n}\n"]}

package/dist/core/autonomy/path-scope.d.ts CHANGED Viewed

@@ -5,5 +5,19 @@ import type { PathScope, PathScopeDecision } from "./contracts.ts";
  * remainder, ensuring that any symlinks in the existing path prefix are expanded.
  */
 export declare function safeRealpathSync(targetPath: string): string;
+/**
+ * Stable lexical scope identity for durable planners. Windows drive and UNC paths are normalized
+ * case-insensitively even when a WSL process is only comparing them and cannot realpath them.
+ */
+export declare function canonicalPathScopeIdentity(value: string): string;
+/**
+ * Boundary-safe lexical containment for already-resolved paths and portable scope planning.
+ * Windows drive and UNC paths compare case-insensitively; native POSIX paths remain case-sensitive.
+ * This deliberately does not resolve symlinks — callers that authorize filesystem access must first
+ * use {@link safeRealpathSync}.
+ */
+export declare function isPathWithinScope(targetPath: string, scopeRoot: string): boolean;
+/** True when either scope contains the other, including an exact match. */
+export declare function pathScopesOverlap(firstScope: string, secondScope: string): boolean;
 export declare function checkPathScope(scope: PathScope, targetPath: string): PathScopeDecision;
 //# sourceMappingURL=path-scope.d.ts.map

package/dist/core/autonomy/path-scope.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"path-scope.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/path-scope.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAOnE;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3D;~~AAiDD~~,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,iBAAiB,CAqGtF","sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport type { PathScope, PathScopeDecision } from \"./contracts.ts\";\n\n// Bounds the symlink-following recursion in resolveSafely: a chain of dangling links is finite\n// in practice, and a genuine symlink cycle (a -> b -> a) must fail closed with a throw rather\n// than recurse forever.\nconst MAX_SYMLINK_HOPS = 32;\n\n/*\n Resolves the real path of a target. If the target does not exist, it recursively\n * resolves the deepest existing parent directory and then appends the non-existent\n * remainder, ensuring that any symlinks in the existing path prefix are expanded.\n */\nexport function safeRealpathSync(targetPath: string): string {\n\treturn resolveSafely(path.resolve(targetPath), 0);\n}\n\nfunction resolveSafely(absolutePath: string, hops: number): string {\n\tif (hops > MAX_SYMLINK_HOPS) {\n\t\tthrow new Error(`safeRealpathSync: exceeded ${MAX_SYMLINK_HOPS} symlink hops resolving \"${absolutePath}\"`);\n\t}\n\n\tif (fs.existsSync(absolutePath)) {\n\t\treturn fs.realpathSync(absolutePath);\n\t}\n\n\t// existsSync FOLLOWS symlinks, so it reports false for a DANGLING link (the link exists but\n\t// its target does not) — the same as a path that plain doesn't exist at all. Without this\n\t// lstat check, a dangling leaf would fall straight into the lexical parent-join below, never\n\t// dereferencing the link itself. That would let a dangling symlink placed inside an allowed\n\t// root smuggle writes to wherever it points, since the write itself (e.g. writeFileSync) DOES\n\t// follow the link. lstatSync throws ENOENT for a path that truly doesn't exist anywhere in\n\t// the chain — that case falls through to the parent-recursion branch below, unchanged.\n\tlet lstat: ReturnType<typeof fs.lstatSync> \| undefined;\n\ttry {\n\t\tlstat = fs.lstatSync(absolutePath);\n\t} catch {\n\t\tlstat = undefined;\n\t}\n\n\tif (lstat?.isSymbolicLink()) {\n\t\tconst linkTarget = fs.readlinkSync(absolutePath);\n\t\tconst resolvedParent = resolveSafely(path.dirname(absolutePath), hops + 1);\n\t\tconst resolvedTarget = path.isAbsolute(linkTarget)\n\t\t\t? path.resolve(linkTarget)\n\t\t\t: path.resolve(resolvedParent, linkTarget);\n\t\treturn resolveSafely(resolvedTarget, hops + 1);\n\t}\n\n\tconst parent = path.dirname(absolutePath);\n\t// Base case: if parent is the same as absolutePath, we've hit the root\n\tif (parent === absolutePath) {\n\t\treturn absolutePath;\n\t}\n\n\tconst resolvedParent = resolveSafely(parent, hops + 1);\n\treturn path.join(resolvedParent, path.basename(absolutePath));\n}\n\nfunction ~~isPathInside~~(~~target~~: string, ~~root~~: string): ~~boolean~~ {\n\tconst ~~rootWithSep~~ = ~~root~~.~~endsWith~~(path.~~sep)~~ ? ~~root~~ : `${~~root~~}${~~path.sep~~}~~`;\~~n\~~treturn~~ target ~~===~~ root \|\| target.startsWith(~~rootWithSep~~);\n}\n\nexport function checkPathScope(scope: PathScope, targetPath: string): PathScopeDecision {\n\tif (!targetPath) {\n\t\treturn {\n\t\t\tkind: \"missing\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"empty_path\",\n\t\t};\n\t}\n\n\tlet resolvedTarget: string;\n\ttry {\n\t\tresolvedTarget = safeRealpathSync(targetPath);\n\t} catch {\n\t\t// If we can't resolve the path at all (e.g. permission error), fail safely\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"unresolvable_target\",\n\t\t};\n\t}\n\n\tlet resolvedRoot: string;\n\ttry {\n\t\tresolvedRoot = safeRealpathSync(scope.root);\n\t} catch {\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"unresolvable_root\",\n\t\t};\n\t}\n\n\t// First, it must be inside the main root\n\tif (!~~isPathInside~~(resolvedTarget, resolvedRoot)) {\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\tresolvedPath: resolvedTarget,\n\t\t\treasonCode: \"outside_root\",\n\t\t};\n\t}\n\n\t// Check deniedPaths (overrides allowedPaths)\n\tif (scope.deniedPaths && scope.deniedPaths.length > 0) {\n\t\tfor (const denied of scope.deniedPaths) {\n\t\t\ttry {\n\t\t\t\tconst resolvedDenied = safeRealpathSync(denied);\n\t\t\t\tif (~~isPathInside~~(resolvedTarget, resolvedDenied)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tkind: \"denied\",\n\t\t\t\t\t\tpath: targetPath,\n\t\t\t\t\t\tresolvedPath: resolvedTarget,\n\t\t\t\t\t\tmatchedRule: denied,\n\t\t\t\t\t\treasonCode: \"matches_denied_path\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} catch {}\n\t\t}\n\t}\n\n\t// Check allowedPaths\n\tif (scope.allowedPaths && scope.allowedPaths.length > 0) {\n\t\tlet isAllowed = false;\n\t\tlet matchedAllowed: string \| undefined;\n\n\t\tfor (const allowed of scope.allowedPaths) {\n\t\t\ttry {\n\t\t\t\tconst resolvedAllowed = safeRealpathSync(allowed);\n\t\t\t\tif (~~isPathInside~~(resolvedTarget, resolvedAllowed)) {\n\t\t\t\t\tisAllowed = true;\n\t\t\t\t\tmatchedAllowed = allowed;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t} catch {}\n\t\t}\n\n\t\tif (!isAllowed) {\n\t\t\treturn {\n\t\t\t\tkind: \"outside\",\n\t\t\t\tpath: targetPath,\n\t\t\t\tresolvedPath: resolvedTarget,\n\t\t\t\treasonCode: \"outside_allowed_paths\",\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tkind: \"inside\",\n\t\t\tpath: targetPath,\n\t\t\tresolvedPath: resolvedTarget,\n\t\t\tmatchedRule: matchedAllowed,\n\t\t\treasonCode: \"inside_allowed_paths\",\n\t\t};\n\t}\n\n\treturn {\n\t\tkind: \"inside\",\n\t\tpath: targetPath,\n\t\tresolvedPath: resolvedTarget,\n\t\tmatchedRule: scope.root,\n\t\treasonCode: \"inside_root\",\n\t};\n}\n"]}
1	+ {"version":3,"file":"path-scope.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/path-scope.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAOnE;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3D;AAyDD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAShF;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAElF;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,iBAAiB,CAqGtF","sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport type { PathScope, PathScopeDecision } from \"./contracts.ts\";\n\n// Bounds the symlink-following recursion in resolveSafely: a chain of dangling links is finite\n// in practice, and a genuine symlink cycle (a -> b -> a) must fail closed with a throw rather\n// than recurse forever.\nconst MAX_SYMLINK_HOPS = 32;\n\n/*\n Resolves the real path of a target. If the target does not exist, it recursively\n * resolves the deepest existing parent directory and then appends the non-existent\n * remainder, ensuring that any symlinks in the existing path prefix are expanded.\n /\nexport function safeRealpathSync(targetPath: string): string {\n\treturn resolveSafely(path.resolve(targetPath), 0);\n}\n\nfunction resolveSafely(absolutePath: string, hops: number): string {\n\tif (hops > MAX_SYMLINK_HOPS) {\n\t\tthrow new Error(`safeRealpathSync: exceeded ${MAX_SYMLINK_HOPS} symlink hops resolving \"${absolutePath}\"`);\n\t}\n\n\tif (fs.existsSync(absolutePath)) {\n\t\treturn fs.realpathSync(absolutePath);\n\t}\n\n\t// existsSync FOLLOWS symlinks, so it reports false for a DANGLING link (the link exists but\n\t// its target does not) — the same as a path that plain doesn't exist at all. Without this\n\t// lstat check, a dangling leaf would fall straight into the lexical parent-join below, never\n\t// dereferencing the link itself. That would let a dangling symlink placed inside an allowed\n\t// root smuggle writes to wherever it points, since the write itself (e.g. writeFileSync) DOES\n\t// follow the link. lstatSync throws ENOENT for a path that truly doesn't exist anywhere in\n\t// the chain — that case falls through to the parent-recursion branch below, unchanged.\n\tlet lstat: ReturnType<typeof fs.lstatSync> \| undefined;\n\ttry {\n\t\tlstat = fs.lstatSync(absolutePath);\n\t} catch {\n\t\tlstat = undefined;\n\t}\n\n\tif (lstat?.isSymbolicLink()) {\n\t\tconst linkTarget = fs.readlinkSync(absolutePath);\n\t\tconst resolvedParent = resolveSafely(path.dirname(absolutePath), hops + 1);\n\t\tconst resolvedTarget = path.isAbsolute(linkTarget)\n\t\t\t? path.resolve(linkTarget)\n\t\t\t: path.resolve(resolvedParent, linkTarget);\n\t\treturn resolveSafely(resolvedTarget, hops + 1);\n\t}\n\n\tconst parent = path.dirname(absolutePath);\n\t// Base case: if parent is the same as absolutePath, we've hit the root\n\tif (parent === absolutePath) {\n\t\treturn absolutePath;\n\t}\n\n\tconst resolvedParent = resolveSafely(parent, hops + 1);\n\treturn path.join(resolvedParent, path.basename(absolutePath));\n}\n\nfunction usesWindowsPath(value: string): boolean {\n\treturn /^[a-zA-Z]:([\\\\/]\|$)/.test(value) \|\| value.startsWith(\"\\\\\\\\\") \|\| value.startsWith(\"//\");\n}\n\nfunction lexicalPathApi(...paths: readonly string[]): typeof path.posix \| typeof path.win32 {\n\treturn paths.some(usesWindowsPath) ? path.win32 : path.posix;\n}\n\nfunction canonicalPathScopeIdentityWithApi(value: string, pathApi: typeof path.posix \| typeof path.win32): string {\n\tconst resolved = pathApi.resolve(value);\n\treturn pathApi === path.win32 ? resolved.toLowerCase() : resolved;\n}\n\n/\n Stable lexical scope identity for durable planners. Windows drive and UNC paths are normalized\n * case-insensitively even when a WSL process is only comparing them and cannot realpath them.\n /\nexport function canonicalPathScopeIdentity(value: string): string {\n\treturn canonicalPathScopeIdentityWithApi(value, lexicalPathApi(value));\n}\n\n/\n Boundary-safe lexical containment for already-resolved paths and portable scope planning.\n * Windows drive and UNC paths compare case-insensitively; native POSIX paths remain case-sensitive.\n * This deliberately does not resolve symlinks — callers that authorize filesystem access must first\n * use {@link safeRealpathSync}.\n /\nexport function isPathWithinScope(targetPath: string, scopeRoot: string): boolean {\n\tconst pathApi = lexicalPathApi(targetPath, scopeRoot);\n\tconst target = canonicalPathScopeIdentityWithApi(targetPath, pathApi);\n\tconst root = canonicalPathScopeIdentityWithApi(scopeRoot, pathApi);\n\tconst relativePath = pathApi.relative(root, target);\n\treturn (\n\t\trelativePath === \"\" \|\|\n\t\t(!relativePath.startsWith(`..${pathApi.sep}`) && relativePath !== \"..\" && !pathApi.isAbsolute(relativePath))\n\t);\n}\n\n/* True when either scope contains the other, including an exact match. */\nexport function pathScopesOverlap(firstScope: string, secondScope: string): boolean {\n\treturn isPathWithinScope(firstScope, secondScope) \|\| isPathWithinScope(secondScope, firstScope);\n}\n\nexport function checkPathScope(scope: PathScope, targetPath: string): PathScopeDecision {\n\tif (!targetPath) {\n\t\treturn {\n\t\t\tkind: \"missing\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"empty_path\",\n\t\t};\n\t}\n\n\tlet resolvedTarget: string;\n\ttry {\n\t\tresolvedTarget = safeRealpathSync(targetPath);\n\t} catch {\n\t\t// If we can't resolve the path at all (e.g. permission error), fail safely\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"unresolvable_target\",\n\t\t};\n\t}\n\n\tlet resolvedRoot: string;\n\ttry {\n\t\tresolvedRoot = safeRealpathSync(scope.root);\n\t} catch {\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"unresolvable_root\",\n\t\t};\n\t}\n\n\t// First, it must be inside the main root\n\tif (!isPathWithinScope(resolvedTarget, resolvedRoot)) {\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\tresolvedPath: resolvedTarget,\n\t\t\treasonCode: \"outside_root\",\n\t\t};\n\t}\n\n\t// Check deniedPaths (overrides allowedPaths)\n\tif (scope.deniedPaths && scope.deniedPaths.length > 0) {\n\t\tfor (const denied of scope.deniedPaths) {\n\t\t\ttry {\n\t\t\t\tconst resolvedDenied = safeRealpathSync(denied);\n\t\t\t\tif (isPathWithinScope(resolvedTarget, resolvedDenied)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tkind: \"denied\",\n\t\t\t\t\t\tpath: targetPath,\n\t\t\t\t\t\tresolvedPath: resolvedTarget,\n\t\t\t\t\t\tmatchedRule: denied,\n\t\t\t\t\t\treasonCode: \"matches_denied_path\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} catch {}\n\t\t}\n\t}\n\n\t// Check allowedPaths\n\tif (scope.allowedPaths && scope.allowedPaths.length > 0) {\n\t\tlet isAllowed = false;\n\t\tlet matchedAllowed: string \| undefined;\n\n\t\tfor (const allowed of scope.allowedPaths) {\n\t\t\ttry {\n\t\t\t\tconst resolvedAllowed = safeRealpathSync(allowed);\n\t\t\t\tif (isPathWithinScope(resolvedTarget, resolvedAllowed)) {\n\t\t\t\t\tisAllowed = true;\n\t\t\t\t\tmatchedAllowed = allowed;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t} catch {}\n\t\t}\n\n\t\tif (!isAllowed) {\n\t\t\treturn {\n\t\t\t\tkind: \"outside\",\n\t\t\t\tpath: targetPath,\n\t\t\t\tresolvedPath: resolvedTarget,\n\t\t\t\treasonCode: \"outside_allowed_paths\",\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tkind: \"inside\",\n\t\t\tpath: targetPath,\n\t\t\tresolvedPath: resolvedTarget,\n\t\t\tmatchedRule: matchedAllowed,\n\t\t\treasonCode: \"inside_allowed_paths\",\n\t\t};\n\t}\n\n\treturn {\n\t\tkind: \"inside\",\n\t\tpath: targetPath,\n\t\tresolvedPath: resolvedTarget,\n\t\tmatchedRule: scope.root,\n\t\treasonCode: \"inside_root\",\n\t};\n}\n"]}

package/dist/core/autonomy/path-scope.js CHANGED Viewed

@@ -49,9 +49,40 @@ function resolveSafely(absolutePath, hops) {
     const resolvedParent = resolveSafely(parent, hops + 1);
     return path.join(resolvedParent, path.basename(absolutePath));
 }
-function isPathInside(target, root) {
-    const rootWithSep = root.endsWith(path.sep) ? root : `${root}${path.sep}`;
-    return target === root || target.startsWith(rootWithSep);
+function usesWindowsPath(value) {
+    return /^[a-zA-Z]:([\\/]|$)/.test(value) || value.startsWith("\\\\") || value.startsWith("//");
+}
+function lexicalPathApi(...paths) {
+    return paths.some(usesWindowsPath) ? path.win32 : path.posix;
+}
+function canonicalPathScopeIdentityWithApi(value, pathApi) {
+    const resolved = pathApi.resolve(value);
+    return pathApi === path.win32 ? resolved.toLowerCase() : resolved;
+}
+/**
+ * Stable lexical scope identity for durable planners. Windows drive and UNC paths are normalized
+ * case-insensitively even when a WSL process is only comparing them and cannot realpath them.
+ */
+export function canonicalPathScopeIdentity(value) {
+    return canonicalPathScopeIdentityWithApi(value, lexicalPathApi(value));
+}
+/**
+ * Boundary-safe lexical containment for already-resolved paths and portable scope planning.
+ * Windows drive and UNC paths compare case-insensitively; native POSIX paths remain case-sensitive.
+ * This deliberately does not resolve symlinks — callers that authorize filesystem access must first
+ * use {@link safeRealpathSync}.
+ */
+export function isPathWithinScope(targetPath, scopeRoot) {
+    const pathApi = lexicalPathApi(targetPath, scopeRoot);
+    const target = canonicalPathScopeIdentityWithApi(targetPath, pathApi);
+    const root = canonicalPathScopeIdentityWithApi(scopeRoot, pathApi);
+    const relativePath = pathApi.relative(root, target);
+    return (relativePath === "" ||
+        (!relativePath.startsWith(`..${pathApi.sep}`) && relativePath !== ".." && !pathApi.isAbsolute(relativePath)));
+}
+/** True when either scope contains the other, including an exact match. */
+export function pathScopesOverlap(firstScope, secondScope) {
+    return isPathWithinScope(firstScope, secondScope) || isPathWithinScope(secondScope, firstScope);
 }
 export function checkPathScope(scope, targetPath) {
     if (!targetPath) {
@@ -85,7 +116,7 @@ export function checkPathScope(scope, targetPath) {
         };
     }
     // First, it must be inside the main root
-    if (!isPathInside(resolvedTarget, resolvedRoot)) {
+    if (!isPathWithinScope(resolvedTarget, resolvedRoot)) {
         return {
             kind: "outside",
             path: targetPath,
@@ -98,7 +129,7 @@ export function checkPathScope(scope, targetPath) {
         for (const denied of scope.deniedPaths) {
             try {
                 const resolvedDenied = safeRealpathSync(denied);
-                if (isPathInside(resolvedTarget, resolvedDenied)) {
+                if (isPathWithinScope(resolvedTarget, resolvedDenied)) {
                     return {
                         kind: "denied",
                         path: targetPath,
@@ -118,7 +149,7 @@ export function checkPathScope(scope, targetPath) {
         for (const allowed of scope.allowedPaths) {
             try {
                 const resolvedAllowed = safeRealpathSync(allowed);
-                if (isPathInside(resolvedTarget, resolvedAllowed)) {
+                if (isPathWithinScope(resolvedTarget, resolvedAllowed)) {
                     isAllowed = true;
                     matchedAllowed = allowed;
                     break;

package/dist/core/autonomy/path-scope.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"path-scope.js","sourceRoot":"","sources":["../../../src/core/autonomy/path-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,+FAA+F;AAC/F,8FAA8F;AAC9F,wBAAwB;AACxB,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAU;IAC5D,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;AAAA,CAClD;AAED,SAAS,aAAa,CAAC,YAAoB,EAAE,IAAY,EAAU;IAClE,IAAI,IAAI,GAAG,gBAAgB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,8BAA8B,gBAAgB,4BAA4B,YAAY,GAAG,CAAC,CAAC;IAC5G,CAAC;IAED,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IAED,4FAA4F;IAC5F,4FAA0F;IAC1F,6FAA6F;IAC7F,4FAA4F;IAC5F,8FAA8F;IAC9F,2FAA2F;IAC3F,yFAAuF;IACvF,IAAI,KAAkD,CAAC;IACvD,IAAI,CAAC;QACJ,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACR,KAAK,GAAG,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;QAC3E,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;YAC1B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAC5C,OAAO,aAAa,CAAC,cAAc,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1C,uEAAuE;IACvE,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC7B,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;AAAA,CAC9D;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,IAAY,EAAW;IAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1E,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAAA,CACzD;AAED,MAAM,UAAU,cAAc,CAAC,KAAgB,EAAE,UAAkB,EAAqB;IACvF,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO;YACN,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,YAAY;SACxB,CAAC;IACH,CAAC;IAED,IAAI,cAAsB,CAAC;IAC3B,IAAI,CAAC;QACJ,cAAc,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACR,2EAA2E;QAC3E,OAAO;YACN,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,qBAAqB;SACjC,CAAC;IACH,CAAC;IAED,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACJ,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO;YACN,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,mBAAmB;SAC/B,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,YAAY,CAAC,EAAE,CAAC;QACjD,OAAO;YACN,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,UAAU;YAChB,YAAY,EAAE,cAAc;YAC5B,UAAU,EAAE,cAAc;SAC1B,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,CAAC;gBACJ,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBAChD,IAAI,YAAY,CAAC,cAAc,EAAE,cAAc,CAAC,EAAE,CAAC;oBAClD,OAAO;wBACN,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,UAAU;wBAChB,YAAY,EAAE,cAAc;wBAC5B,WAAW,EAAE,MAAM;wBACnB,UAAU,EAAE,qBAAqB;qBACjC,CAAC;gBACH,CAAC;YACF,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACX,CAAC;IACF,CAAC;IAED,qBAAqB;IACrB,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzD,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,cAAkC,CAAC;QAEvC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACJ,MAAM,eAAe,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,YAAY,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,CAAC;oBACnD,SAAS,GAAG,IAAI,CAAC;oBACjB,cAAc,GAAG,OAAO,CAAC;oBACzB,MAAM;gBACP,CAAC;YACF,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACX,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,OAAO;gBACN,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,UAAU;gBAChB,YAAY,EAAE,cAAc;gBAC5B,UAAU,EAAE,uBAAuB;aACnC,CAAC;QACH,CAAC;QAED,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,UAAU;YAChB,YAAY,EAAE,cAAc;YAC5B,WAAW,EAAE,cAAc;YAC3B,UAAU,EAAE,sBAAsB;SAClC,CAAC;IACH,CAAC;IAED,OAAO;QACN,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE,cAAc;QAC5B,WAAW,EAAE,KAAK,CAAC,IAAI;QACvB,UAAU,EAAE,aAAa;KACzB,CAAC;AAAA,CACF","sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport type { PathScope, PathScopeDecision } from \"./contracts.ts\";\n\n// Bounds the symlink-following recursion in resolveSafely: a chain of dangling links is finite\n// in practice, and a genuine symlink cycle (a -> b -> a) must fail closed with a throw rather\n// than recurse forever.\nconst MAX_SYMLINK_HOPS = 32;\n\n/*\n Resolves the real path of a target. If the target does not exist, it recursively\n * resolves the deepest existing parent directory and then appends the non-existent\n * remainder, ensuring that any symlinks in the existing path prefix are expanded.\n */\nexport function safeRealpathSync(targetPath: string): string {\n\treturn resolveSafely(path.resolve(targetPath), 0);\n}\n\nfunction resolveSafely(absolutePath: string, hops: number): string {\n\tif (hops > MAX_SYMLINK_HOPS) {\n\t\tthrow new Error(`safeRealpathSync: exceeded ${MAX_SYMLINK_HOPS} symlink hops resolving \"${absolutePath}\"`);\n\t}\n\n\tif (fs.existsSync(absolutePath)) {\n\t\treturn fs.realpathSync(absolutePath);\n\t}\n\n\t// existsSync FOLLOWS symlinks, so it reports false for a DANGLING link (the link exists but\n\t// its target does not) — the same as a path that plain doesn't exist at all. Without this\n\t// lstat check, a dangling leaf would fall straight into the lexical parent-join below, never\n\t// dereferencing the link itself. That would let a dangling symlink placed inside an allowed\n\t// root smuggle writes to wherever it points, since the write itself (e.g. writeFileSync) DOES\n\t// follow the link. lstatSync throws ENOENT for a path that truly doesn't exist anywhere in\n\t// the chain — that case falls through to the parent-recursion branch below, unchanged.\n\tlet lstat: ReturnType<typeof fs.lstatSync> \| undefined;\n\ttry {\n\t\tlstat = fs.lstatSync(absolutePath);\n\t} catch {\n\t\tlstat = undefined;\n\t}\n\n\tif (lstat?.isSymbolicLink()) {\n\t\tconst linkTarget = fs.readlinkSync(absolutePath);\n\t\tconst resolvedParent = resolveSafely(path.dirname(absolutePath), hops + 1);\n\t\tconst resolvedTarget = path.isAbsolute(linkTarget)\n\t\t\t? path.resolve(linkTarget)\n\t\t\t: path.resolve(resolvedParent, linkTarget);\n\t\treturn resolveSafely(resolvedTarget, hops + 1);\n\t}\n\n\tconst parent = path.dirname(absolutePath);\n\t// Base case: if parent is the same as absolutePath, we've hit the root\n\tif (parent === absolutePath) {\n\t\treturn absolutePath;\n\t}\n\n\tconst resolvedParent = resolveSafely(parent, hops + 1);\n\treturn path.join(resolvedParent, path.basename(absolutePath));\n}\n\nfunction isPathInside(target: string, root: string): boolean {\n\tconst rootWithSep = root.endsWith(path.sep) ? root : `${root}${path.sep}`;\n\treturn target === root \|\| target.startsWith(rootWithSep);\n}\n\nexport function checkPathScope(scope: PathScope, targetPath: string): PathScopeDecision {\n\tif (!targetPath) {\n\t\treturn {\n\t\t\tkind: \"missing\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"empty_path\",\n\t\t};\n\t}\n\n\tlet resolvedTarget: string;\n\ttry {\n\t\tresolvedTarget = safeRealpathSync(targetPath);\n\t} catch {\n\t\t// If we can't resolve the path at all (e.g. permission error), fail safely\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"unresolvable_target\",\n\t\t};\n\t}\n\n\tlet resolvedRoot: string;\n\ttry {\n\t\tresolvedRoot = safeRealpathSync(scope.root);\n\t} catch {\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"unresolvable_root\",\n\t\t};\n\t}\n\n\t// First, it must be inside the main root\n\tif (!isPathInside(resolvedTarget, resolvedRoot)) {\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\tresolvedPath: resolvedTarget,\n\t\t\treasonCode: \"outside_root\",\n\t\t};\n\t}\n\n\t// Check deniedPaths (overrides allowedPaths)\n\tif (scope.deniedPaths && scope.deniedPaths.length > 0) {\n\t\tfor (const denied of scope.deniedPaths) {\n\t\t\ttry {\n\t\t\t\tconst resolvedDenied = safeRealpathSync(denied);\n\t\t\t\tif (isPathInside(resolvedTarget, resolvedDenied)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tkind: \"denied\",\n\t\t\t\t\t\tpath: targetPath,\n\t\t\t\t\t\tresolvedPath: resolvedTarget,\n\t\t\t\t\t\tmatchedRule: denied,\n\t\t\t\t\t\treasonCode: \"matches_denied_path\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} catch {}\n\t\t}\n\t}\n\n\t// Check allowedPaths\n\tif (scope.allowedPaths && scope.allowedPaths.length > 0) {\n\t\tlet isAllowed = false;\n\t\tlet matchedAllowed: string \| undefined;\n\n\t\tfor (const allowed of scope.allowedPaths) {\n\t\t\ttry {\n\t\t\t\tconst resolvedAllowed = safeRealpathSync(allowed);\n\t\t\t\tif (isPathInside(resolvedTarget, resolvedAllowed)) {\n\t\t\t\t\tisAllowed = true;\n\t\t\t\t\tmatchedAllowed = allowed;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t} catch {}\n\t\t}\n\n\t\tif (!isAllowed) {\n\t\t\treturn {\n\t\t\t\tkind: \"outside\",\n\t\t\t\tpath: targetPath,\n\t\t\t\tresolvedPath: resolvedTarget,\n\t\t\t\treasonCode: \"outside_allowed_paths\",\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tkind: \"inside\",\n\t\t\tpath: targetPath,\n\t\t\tresolvedPath: resolvedTarget,\n\t\t\tmatchedRule: matchedAllowed,\n\t\t\treasonCode: \"inside_allowed_paths\",\n\t\t};\n\t}\n\n\treturn {\n\t\tkind: \"inside\",\n\t\tpath: targetPath,\n\t\tresolvedPath: resolvedTarget,\n\t\tmatchedRule: scope.root,\n\t\treasonCode: \"inside_root\",\n\t};\n}\n"]}
1	+ {"version":3,"file":"path-scope.js","sourceRoot":"","sources":["../../../src/core/autonomy/path-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,+FAA+F;AAC/F,8FAA8F;AAC9F,wBAAwB;AACxB,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAU;IAC5D,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;AAAA,CAClD;AAED,SAAS,aAAa,CAAC,YAAoB,EAAE,IAAY,EAAU;IAClE,IAAI,IAAI,GAAG,gBAAgB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,8BAA8B,gBAAgB,4BAA4B,YAAY,GAAG,CAAC,CAAC;IAC5G,CAAC;IAED,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IAED,4FAA4F;IAC5F,4FAA0F;IAC1F,6FAA6F;IAC7F,4FAA4F;IAC5F,8FAA8F;IAC9F,2FAA2F;IAC3F,yFAAuF;IACvF,IAAI,KAAkD,CAAC;IACvD,IAAI,CAAC;QACJ,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACR,KAAK,GAAG,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;QAC3E,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;YAC1B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAC5C,OAAO,aAAa,CAAC,cAAc,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1C,uEAAuE;IACvE,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC7B,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;AAAA,CAC9D;AAED,SAAS,eAAe,CAAC,KAAa,EAAW;IAChD,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAAA,CAC/F;AAED,SAAS,cAAc,CAAC,GAAG,KAAwB,EAAyC;IAC3F,OAAO,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;AAAA,CAC7D;AAED,SAAS,iCAAiC,CAAC,KAAa,EAAE,OAA8C,EAAU;IACjH,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAAA,CAClE;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAU;IACjE,OAAO,iCAAiC,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;AAAA,CACvE;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,SAAiB,EAAW;IACjF,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,iCAAiC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,iCAAiC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpD,OAAO,CACN,YAAY,KAAK,EAAE;QACnB,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAC5G,CAAC;AAAA,CACF;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,WAAmB,EAAW;IACnF,OAAO,iBAAiB,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,iBAAiB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;AAAA,CAChG;AAED,MAAM,UAAU,cAAc,CAAC,KAAgB,EAAE,UAAkB,EAAqB;IACvF,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO;YACN,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,YAAY;SACxB,CAAC;IACH,CAAC;IAED,IAAI,cAAsB,CAAC;IAC3B,IAAI,CAAC;QACJ,cAAc,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACR,2EAA2E;QAC3E,OAAO;YACN,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,qBAAqB;SACjC,CAAC;IACH,CAAC;IAED,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACJ,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO;YACN,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,mBAAmB;SAC/B,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,YAAY,CAAC,EAAE,CAAC;QACtD,OAAO;YACN,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,UAAU;YAChB,YAAY,EAAE,cAAc;YAC5B,UAAU,EAAE,cAAc;SAC1B,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,CAAC;gBACJ,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBAChD,IAAI,iBAAiB,CAAC,cAAc,EAAE,cAAc,CAAC,EAAE,CAAC;oBACvD,OAAO;wBACN,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,UAAU;wBAChB,YAAY,EAAE,cAAc;wBAC5B,WAAW,EAAE,MAAM;wBACnB,UAAU,EAAE,qBAAqB;qBACjC,CAAC;gBACH,CAAC;YACF,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACX,CAAC;IACF,CAAC;IAED,qBAAqB;IACrB,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzD,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,cAAkC,CAAC;QAEvC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACJ,MAAM,eAAe,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,iBAAiB,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,CAAC;oBACxD,SAAS,GAAG,IAAI,CAAC;oBACjB,cAAc,GAAG,OAAO,CAAC;oBACzB,MAAM;gBACP,CAAC;YACF,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACX,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,OAAO;gBACN,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,UAAU;gBAChB,YAAY,EAAE,cAAc;gBAC5B,UAAU,EAAE,uBAAuB;aACnC,CAAC;QACH,CAAC;QAED,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,UAAU;YAChB,YAAY,EAAE,cAAc;YAC5B,WAAW,EAAE,cAAc;YAC3B,UAAU,EAAE,sBAAsB;SAClC,CAAC;IACH,CAAC;IAED,OAAO;QACN,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE,cAAc;QAC5B,WAAW,EAAE,KAAK,CAAC,IAAI;QACvB,UAAU,EAAE,aAAa;KACzB,CAAC;AAAA,CACF","sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport type { PathScope, PathScopeDecision } from \"./contracts.ts\";\n\n// Bounds the symlink-following recursion in resolveSafely: a chain of dangling links is finite\n// in practice, and a genuine symlink cycle (a -> b -> a) must fail closed with a throw rather\n// than recurse forever.\nconst MAX_SYMLINK_HOPS = 32;\n\n/*\n Resolves the real path of a target. If the target does not exist, it recursively\n * resolves the deepest existing parent directory and then appends the non-existent\n * remainder, ensuring that any symlinks in the existing path prefix are expanded.\n /\nexport function safeRealpathSync(targetPath: string): string {\n\treturn resolveSafely(path.resolve(targetPath), 0);\n}\n\nfunction resolveSafely(absolutePath: string, hops: number): string {\n\tif (hops > MAX_SYMLINK_HOPS) {\n\t\tthrow new Error(`safeRealpathSync: exceeded ${MAX_SYMLINK_HOPS} symlink hops resolving \"${absolutePath}\"`);\n\t}\n\n\tif (fs.existsSync(absolutePath)) {\n\t\treturn fs.realpathSync(absolutePath);\n\t}\n\n\t// existsSync FOLLOWS symlinks, so it reports false for a DANGLING link (the link exists but\n\t// its target does not) — the same as a path that plain doesn't exist at all. Without this\n\t// lstat check, a dangling leaf would fall straight into the lexical parent-join below, never\n\t// dereferencing the link itself. That would let a dangling symlink placed inside an allowed\n\t// root smuggle writes to wherever it points, since the write itself (e.g. writeFileSync) DOES\n\t// follow the link. lstatSync throws ENOENT for a path that truly doesn't exist anywhere in\n\t// the chain — that case falls through to the parent-recursion branch below, unchanged.\n\tlet lstat: ReturnType<typeof fs.lstatSync> \| undefined;\n\ttry {\n\t\tlstat = fs.lstatSync(absolutePath);\n\t} catch {\n\t\tlstat = undefined;\n\t}\n\n\tif (lstat?.isSymbolicLink()) {\n\t\tconst linkTarget = fs.readlinkSync(absolutePath);\n\t\tconst resolvedParent = resolveSafely(path.dirname(absolutePath), hops + 1);\n\t\tconst resolvedTarget = path.isAbsolute(linkTarget)\n\t\t\t? path.resolve(linkTarget)\n\t\t\t: path.resolve(resolvedParent, linkTarget);\n\t\treturn resolveSafely(resolvedTarget, hops + 1);\n\t}\n\n\tconst parent = path.dirname(absolutePath);\n\t// Base case: if parent is the same as absolutePath, we've hit the root\n\tif (parent === absolutePath) {\n\t\treturn absolutePath;\n\t}\n\n\tconst resolvedParent = resolveSafely(parent, hops + 1);\n\treturn path.join(resolvedParent, path.basename(absolutePath));\n}\n\nfunction usesWindowsPath(value: string): boolean {\n\treturn /^[a-zA-Z]:([\\\\/]\|$)/.test(value) \|\| value.startsWith(\"\\\\\\\\\") \|\| value.startsWith(\"//\");\n}\n\nfunction lexicalPathApi(...paths: readonly string[]): typeof path.posix \| typeof path.win32 {\n\treturn paths.some(usesWindowsPath) ? path.win32 : path.posix;\n}\n\nfunction canonicalPathScopeIdentityWithApi(value: string, pathApi: typeof path.posix \| typeof path.win32): string {\n\tconst resolved = pathApi.resolve(value);\n\treturn pathApi === path.win32 ? resolved.toLowerCase() : resolved;\n}\n\n/\n Stable lexical scope identity for durable planners. Windows drive and UNC paths are normalized\n * case-insensitively even when a WSL process is only comparing them and cannot realpath them.\n /\nexport function canonicalPathScopeIdentity(value: string): string {\n\treturn canonicalPathScopeIdentityWithApi(value, lexicalPathApi(value));\n}\n\n/\n Boundary-safe lexical containment for already-resolved paths and portable scope planning.\n * Windows drive and UNC paths compare case-insensitively; native POSIX paths remain case-sensitive.\n * This deliberately does not resolve symlinks — callers that authorize filesystem access must first\n * use {@link safeRealpathSync}.\n /\nexport function isPathWithinScope(targetPath: string, scopeRoot: string): boolean {\n\tconst pathApi = lexicalPathApi(targetPath, scopeRoot);\n\tconst target = canonicalPathScopeIdentityWithApi(targetPath, pathApi);\n\tconst root = canonicalPathScopeIdentityWithApi(scopeRoot, pathApi);\n\tconst relativePath = pathApi.relative(root, target);\n\treturn (\n\t\trelativePath === \"\" \|\|\n\t\t(!relativePath.startsWith(`..${pathApi.sep}`) && relativePath !== \"..\" && !pathApi.isAbsolute(relativePath))\n\t);\n}\n\n/* True when either scope contains the other, including an exact match. */\nexport function pathScopesOverlap(firstScope: string, secondScope: string): boolean {\n\treturn isPathWithinScope(firstScope, secondScope) \|\| isPathWithinScope(secondScope, firstScope);\n}\n\nexport function checkPathScope(scope: PathScope, targetPath: string): PathScopeDecision {\n\tif (!targetPath) {\n\t\treturn {\n\t\t\tkind: \"missing\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"empty_path\",\n\t\t};\n\t}\n\n\tlet resolvedTarget: string;\n\ttry {\n\t\tresolvedTarget = safeRealpathSync(targetPath);\n\t} catch {\n\t\t// If we can't resolve the path at all (e.g. permission error), fail safely\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"unresolvable_target\",\n\t\t};\n\t}\n\n\tlet resolvedRoot: string;\n\ttry {\n\t\tresolvedRoot = safeRealpathSync(scope.root);\n\t} catch {\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\treasonCode: \"unresolvable_root\",\n\t\t};\n\t}\n\n\t// First, it must be inside the main root\n\tif (!isPathWithinScope(resolvedTarget, resolvedRoot)) {\n\t\treturn {\n\t\t\tkind: \"outside\",\n\t\t\tpath: targetPath,\n\t\t\tresolvedPath: resolvedTarget,\n\t\t\treasonCode: \"outside_root\",\n\t\t};\n\t}\n\n\t// Check deniedPaths (overrides allowedPaths)\n\tif (scope.deniedPaths && scope.deniedPaths.length > 0) {\n\t\tfor (const denied of scope.deniedPaths) {\n\t\t\ttry {\n\t\t\t\tconst resolvedDenied = safeRealpathSync(denied);\n\t\t\t\tif (isPathWithinScope(resolvedTarget, resolvedDenied)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tkind: \"denied\",\n\t\t\t\t\t\tpath: targetPath,\n\t\t\t\t\t\tresolvedPath: resolvedTarget,\n\t\t\t\t\t\tmatchedRule: denied,\n\t\t\t\t\t\treasonCode: \"matches_denied_path\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} catch {}\n\t\t}\n\t}\n\n\t// Check allowedPaths\n\tif (scope.allowedPaths && scope.allowedPaths.length > 0) {\n\t\tlet isAllowed = false;\n\t\tlet matchedAllowed: string \| undefined;\n\n\t\tfor (const allowed of scope.allowedPaths) {\n\t\t\ttry {\n\t\t\t\tconst resolvedAllowed = safeRealpathSync(allowed);\n\t\t\t\tif (isPathWithinScope(resolvedTarget, resolvedAllowed)) {\n\t\t\t\t\tisAllowed = true;\n\t\t\t\t\tmatchedAllowed = allowed;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t} catch {}\n\t\t}\n\n\t\tif (!isAllowed) {\n\t\t\treturn {\n\t\t\t\tkind: \"outside\",\n\t\t\t\tpath: targetPath,\n\t\t\t\tresolvedPath: resolvedTarget,\n\t\t\t\treasonCode: \"outside_allowed_paths\",\n\t\t\t};\n\t\t}\n\n\t\treturn {\n\t\t\tkind: \"inside\",\n\t\t\tpath: targetPath,\n\t\t\tresolvedPath: resolvedTarget,\n\t\t\tmatchedRule: matchedAllowed,\n\t\t\treasonCode: \"inside_allowed_paths\",\n\t\t};\n\t}\n\n\treturn {\n\t\tkind: \"inside\",\n\t\tpath: targetPath,\n\t\tresolvedPath: resolvedTarget,\n\t\tmatchedRule: scope.root,\n\t\treasonCode: \"inside_root\",\n\t};\n}\n"]}