@caupulican/pi-adaptative 0.94.0 → 0.95.0

package/dist/core/autonomy/envelope-enforcement.d.ts

@@ -14,7 +14,12 @@ export declare function extractToolPathArguments(toolName: string, params: unkno
 export declare function isPathWithinEnvelope(envelope: CapabilityEnvelope, rawPath: string, cwd: string): boolean;
 export interface EnvelopeScopedTool {
     name: string;
-    execute: (...args: unknown[]) => unknown;
+    /**
+     * The `never` parameter keeps this structural boundary compatible with both the synchronous
+     * fixtures used by the path-policy tests and the strongly typed async `AgentTool.execute`
+     * implementations. The wrapper itself preserves the concrete execute signature below.
+     */
+    execute: (...args: never[]) => unknown;
 }
 /**
  * Wrap a tool so path-bearing arguments are scope-checked when it RUNS, consulting canonical

package/dist/core/autonomy/envelope-enforcement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"envelope-enforcement.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/envelope-enforcement.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAezD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAiB9D;AAED,wFAAwF;AACxF,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAwBpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAoCxG;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;CACzC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,kBAAkB,EACrE,IAAI,EAAE,CAAC,EACP,QAAQ,EAAE,kBAAkB,EAC5B,GAAG,EAAE,MAAM,GACT,CAAC,CA8BH"}
+{"version":3,"file":"envelope-enforcement.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/envelope-enforcement.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAezD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAiB9D;AAED,wFAAwF;AACxF,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAwBpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAoCxG;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,kBAAkB,EACrE,IAAI,EAAE,CAAC,EACP,QAAQ,EAAE,kBAAkB,EAC5B,GAAG,EAAE,MAAM,GACT,CAAC,CAgCH"}

package/dist/core/autonomy/envelope-enforcement.js

@@ -120,34 +120,35 @@ export function isPathWithinEnvelope(envelope, rawPath, cwd) {
  * shape-identical; params are conventionally the second execute argument (toolCallId, params, …).
  */
 export function wrapToolWithEnvelopeScope(tool, envelope, cwd) {
-    return {
-        ...tool,
-        execute: (...args) => {
-            const params = args[1];
-            const pathAccess = resolveToolCallPathAccess(envelope.capabilities, tool.name, params);
-            if (pathAccess !== "none") {
-                for (const rawPath of extractToolPathArguments(tool.name, params)) {
-                    if (!isPathWithinEnvelope(envelope, rawPath, cwd)) {
-                        return {
-                            content: [
-                                {
-                                    type: "text",
-                                    text: `envelope_path_denied: "${rawPath}" is outside envelope ${envelope.id}'s path scope. The tool was NOT run.`,
-                                },
-                            ],
-                            details: {
-                                outcome: "envelope_path_denied",
-                                tool: tool.name,
-                                path: rawPath,
-                                envelopeId: envelope.id,
+    const execute = (...args) => {
+        const params = args[1];
+        const pathAccess = resolveToolCallPathAccess(envelope.capabilities, tool.name, params);
+        if (pathAccess !== "none") {
+            for (const rawPath of extractToolPathArguments(tool.name, params)) {
+                if (!isPathWithinEnvelope(envelope, rawPath, cwd)) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `envelope_path_denied: "${rawPath}" is outside envelope ${envelope.id}'s path scope. The tool was NOT run.`,
                             },
-                            isError: true,
-                        };
-                    }
+                        ],
+                        details: {
+                            outcome: "envelope_path_denied",
+                            tool: tool.name,
+                            path: rawPath,
+                            envelopeId: envelope.id,
+                        },
+                        isError: true,
+                    };
                 }
             }
-            return tool.execute(...args);
-        },
+        }
+        return tool.execute(...args);
+    };
+    return {
+        ...tool,
+        execute,
     };
 }
 //# sourceMappingURL=envelope-enforcement.js.map

package/dist/core/autonomy/envelope-enforcement.js.map

@@ -1 +1 @@
-{"version":3,"file":"envelope-enforcement.js","sourceRoot":"","sources":["../../../src/core/autonomy/envelope-enforcement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAEzE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEtE;;;;;;;GAOG;AAEH,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAU,CAAC;AAC3G,MAAM,uBAAuB,GAAG,CAAC,OAAO,EAAE,OAAO,CAAU,CAAC;AAE5D,MAAM,UAAU,oBAAoB,CAAC,MAAe;IACnD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;gBAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;oBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACzE,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,MAAe;IACzE,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,kBAAkB,KAAK,cAAc,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnF,MAAM,MAAM,GAAG,MAAiC,CAAC;QACjD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAClE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACrC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC;oBAAE,SAAS;gBAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;gBAC/B,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE;oBAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;YACxF,CAAC;QACF,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IACD,IACC,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,kBAAkB,KAAK,MAAM;YAC7B,kBAAkB,KAAK,MAAM;YAC7B,kBAAkB,KAAK,IAAI;YAC3B,kBAAkB,KAAK,UAAU,CAAC,EAClC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAA4B,EAAE,OAAe,EAAE,GAAW;IAC9F,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YAC5C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACvC,IAAI,iBAAiB,CAAC,aAAa,EAAE,WAAW,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/D,IAAI,CAAC;gBACJ,OAAO,iBAAiB,CAAC,aAAa,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC;YACxE,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,KAAK,CAAC;YACd,CAAC;QACF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,cAAc;YAAE,OAAO,KAAK,CAAC;IACnC,CAAC;IACD,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QACjD,IAAI,CAAC;YACJ,IAAI,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC;YACR,0EAA0E;QAC3E,CAAC;IACF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5B,IAAI,CAAC;YACJ,OAAO,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC,CAAC,CAAC;AACJ,CAAC;AAOD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACxC,IAAO,EACP,QAA4B,EAC5B,GAAW;IAEX,OAAO;QACN,GAAG,IAAI;QACP,OAAO,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;YAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,UAAU,GAAG,yBAAyB,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACvF,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;gBAC3B,KAAK,MAAM,OAAO,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;oBACnE,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;wBACnD,OAAO;4BACN,OAAO,EAAE;gCACR;oCACC,IAAI,EAAE,MAAM;oCACZ,IAAI,EAAE,0BAA0B,OAAO,yBAAyB,QAAQ,CAAC,EAAE,sCAAsC;iCACjH;6BACD;4BACD,OAAO,EAAE;gCACR,OAAO,EAAE,sBAAsB;gCAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;gCACf,IAAI,EAAE,OAAO;gCACb,UAAU,EAAE,QAAQ,CAAC,EAAE;6BACvB;4BACD,OAAO,EAAE,IAAI;yBACb,CAAC;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;YACD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9B,CAAC;KACD,CAAC;AACH,CAAC","sourcesContent":["import { resolve } from \"node:path\";\nimport { resolveToolCallPathAccess } from \"../tool-capability-policy.ts\";\nimport type { CapabilityEnvelope } from \"./contracts.ts\";\nimport { isPathWithinScope, safeRealpathSync } from \"./path-scope.ts\";\n\n/**\n * Tool-level envelope enforcement (G2 prerequisite for code-writing workers): the capability\n * envelope's `allowedPaths`/`deniedPaths` were previously VALIDATION-ONLY — recorded on the\n * envelope but never checked when a tool actually ran. This module wraps tools so path-bearing\n * arguments are checked AT EXECUTION TIME, structurally refusing out-of-scope paths the same way\n * a failed script can never look like success: the refusal is an isError result with a stable\n * outcome code, never a silent no-op.\n */\n\nconst PATH_ARGUMENT_KEYS = [\"path\", \"file_path\", \"filePath\", \"cwd\", \"directory\", \"dir\", \"target\"] as const;\nconst PATH_LIST_ARGUMENT_KEYS = [\"paths\", \"files\"] as const;\n\nexport function extractPathArguments(params: unknown): string[] {\n\tif (!params || typeof params !== \"object\") return [];\n\tconst record = params as Record<string, unknown>;\n\tconst found: string[] = [];\n\tfor (const key of PATH_ARGUMENT_KEYS) {\n\t\tconst value = record[key];\n\t\tif (typeof value === \"string\" && value.trim()) found.push(value.trim());\n\t}\n\tfor (const key of PATH_LIST_ARGUMENT_KEYS) {\n\t\tconst value = record[key];\n\t\tif (Array.isArray(value)) {\n\t\t\tfor (const entry of value) {\n\t\t\t\tif (typeof entry === \"string\" && entry.trim()) found.push(entry.trim());\n\t\t\t}\n\t\t}\n\t}\n\treturn found;\n}\n\n/** Tool-aware path projection shared by every envelope/gateway enforcement boundary. */\nexport function extractToolPathArguments(toolName: string, params: unknown): string[] {\n\tconst normalizedToolName = toolName.toLowerCase();\n\tconst paths = extractPathArguments(params);\n\tif (normalizedToolName === \"secret_store\" && params && typeof params === \"object\") {\n\t\tconst record = params as Record<string, unknown>;\n\t\tif (record.action === \"migrate\" && Array.isArray(record.sources)) {\n\t\t\tfor (const source of record.sources) {\n\t\t\t\tif (!source || typeof source !== \"object\" || !(\"path\" in source)) continue;\n\t\t\t\tconst sourcePath = source.path;\n\t\t\t\tif (typeof sourcePath === \"string\" && sourcePath.trim()) paths.push(sourcePath.trim());\n\t\t\t}\n\t\t}\n\t\tif (record.action === \"discover\" && paths.length === 0) paths.push(\".\");\n\t}\n\tif (\n\t\tpaths.length === 0 &&\n\t\t(normalizedToolName === \"find\" ||\n\t\t\tnormalizedToolName === \"grep\" ||\n\t\t\tnormalizedToolName === \"ls\" ||\n\t\t\tnormalizedToolName === \"pipeline\")\n\t) {\n\t\tpaths.push(\".\");\n\t}\n\treturn paths;\n}\n\n/**\n * Deny wins over allow; an empty/absent allow list means \"no positive scope restriction\"\n * (only denies apply) — mirroring the resource-profile filter semantics.\n *\n * Both the target and every scope root are resolved through the real filesystem\n * (symlinks expanded in the existing prefix) before comparison: a pre-existing symlink\n * under an allowed root cannot smuggle a write outside the scope, and a shortcut into a\n * denied subtree is still denied. An unresolvable target fails closed.\n */\nexport function isPathWithinEnvelope(envelope: CapabilityEnvelope, rawPath: string, cwd: string): boolean {\n\tconst lexicalTarget = resolve(cwd, rawPath);\n\tconst allowed = envelope.allowedPaths ?? [];\n\tif (allowed.length > 0) {\n\t\tconst couldBeAllowed = allowed.some((root) => {\n\t\t\tconst lexicalRoot = resolve(cwd, root);\n\t\t\tif (isPathWithinScope(lexicalTarget, lexicalRoot)) return true;\n\t\t\ttry {\n\t\t\t\treturn isPathWithinScope(lexicalTarget, safeRealpathSync(lexicalRoot));\n\t\t\t} catch {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t});\n\t\tif (!couldBeAllowed) return false;\n\t}\n\tlet target: string;\n\ttry {\n\t\ttarget = safeRealpathSync(lexicalTarget);\n\t} catch {\n\t\treturn false;\n\t}\n\tfor (const denied of envelope.deniedPaths ?? []) {\n\t\ttry {\n\t\t\tif (isPathWithinScope(target, safeRealpathSync(resolve(cwd, denied)))) return false;\n\t\t} catch {\n\t\t\t// Mirror checkPathScope: an unresolvable deny root cannot match anything.\n\t\t}\n\t}\n\tif (allowed.length === 0) return true;\n\treturn allowed.some((root) => {\n\t\ttry {\n\t\t\treturn isPathWithinScope(target, safeRealpathSync(resolve(cwd, root)));\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t});\n}\n\nexport interface EnvelopeScopedTool {\n\tname: string;\n\texecute: (...args: unknown[]) => unknown;\n}\n\n/**\n * Wrap a tool so path-bearing arguments are scope-checked when it RUNS, consulting canonical\n * tool capability policy so only tools whose policy declares path-scope access\n * (resolveToolCallPathAccess !== \"none\") are checked against envelope boundaries. The wrapped tool is\n * shape-identical; params are conventionally the second execute argument (toolCallId, params, …).\n */\nexport function wrapToolWithEnvelopeScope<T extends EnvelopeScopedTool>(\n\ttool: T,\n\tenvelope: CapabilityEnvelope,\n\tcwd: string,\n): T {\n\treturn {\n\t\t...tool,\n\t\texecute: (...args: unknown[]) => {\n\t\t\tconst params = args[1];\n\t\t\tconst pathAccess = resolveToolCallPathAccess(envelope.capabilities, tool.name, params);\n\t\t\tif (pathAccess !== \"none\") {\n\t\t\t\tfor (const rawPath of extractToolPathArguments(tool.name, params)) {\n\t\t\t\t\tif (!isPathWithinEnvelope(envelope, rawPath, cwd)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\t\ttext: `envelope_path_denied: \"${rawPath}\" is outside envelope ${envelope.id}'s path scope. The tool was NOT run.`,\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\tdetails: {\n\t\t\t\t\t\t\t\toutcome: \"envelope_path_denied\",\n\t\t\t\t\t\t\t\ttool: tool.name,\n\t\t\t\t\t\t\t\tpath: rawPath,\n\t\t\t\t\t\t\t\tenvelopeId: envelope.id,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tisError: true,\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn tool.execute(...args);\n\t\t},\n\t};\n}\n"]}
+{"version":3,"file":"envelope-enforcement.js","sourceRoot":"","sources":["../../../src/core/autonomy/envelope-enforcement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAEzE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEtE;;;;;;;GAOG;AAEH,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAU,CAAC;AAC3G,MAAM,uBAAuB,GAAG,CAAC,OAAO,EAAE,OAAO,CAAU,CAAC;AAE5D,MAAM,UAAU,oBAAoB,CAAC,MAAe;IACnD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;gBAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;oBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACzE,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,MAAe;IACzE,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,kBAAkB,KAAK,cAAc,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnF,MAAM,MAAM,GAAG,MAAiC,CAAC;QACjD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAClE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACrC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC;oBAAE,SAAS;gBAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;gBAC/B,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE;oBAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;YACxF,CAAC;QACF,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IACD,IACC,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,kBAAkB,KAAK,MAAM;YAC7B,kBAAkB,KAAK,MAAM;YAC7B,kBAAkB,KAAK,IAAI;YAC3B,kBAAkB,KAAK,UAAU,CAAC,EAClC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAA4B,EAAE,OAAe,EAAE,GAAW;IAC9F,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YAC5C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACvC,IAAI,iBAAiB,CAAC,aAAa,EAAE,WAAW,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/D,IAAI,CAAC;gBACJ,OAAO,iBAAiB,CAAC,aAAa,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC;YACxE,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,KAAK,CAAC;YACd,CAAC;QACF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,cAAc;YAAE,OAAO,KAAK,CAAC;IACnC,CAAC;IACD,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QACjD,IAAI,CAAC;YACJ,IAAI,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC;YACR,0EAA0E;QAC3E,CAAC;IACF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5B,IAAI,CAAC;YACJ,OAAO,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC,CAAC,CAAC;AACJ,CAAC;AAYD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACxC,IAAO,EACP,QAA4B,EAC5B,GAAW;IAGX,MAAM,OAAO,GAAG,CAAC,GAAG,IAAyB,EAAuB,EAAE;QACrE,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,UAAU,GAAG,yBAAyB,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvF,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC3B,KAAK,MAAM,OAAO,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;gBACnE,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;oBACnD,OAAO;wBACN,OAAO,EAAE;4BACR;gCACC,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,0BAA0B,OAAO,yBAAyB,QAAQ,CAAC,EAAE,sCAAsC;6BACjH;yBACD;wBACD,OAAO,EAAE;4BACR,OAAO,EAAE,sBAAsB;4BAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,IAAI,EAAE,OAAO;4BACb,UAAU,EAAE,QAAQ,CAAC,EAAE;yBACvB;wBACD,OAAO,EAAE,IAAI;qBACU,CAAC;gBAC1B,CAAC;YACF,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAwB,CAAC;IACrD,CAAC,CAAC;IACF,OAAO;QACN,GAAG,IAAI;QACP,OAAO;KACF,CAAC;AACR,CAAC","sourcesContent":["import { resolve } from \"node:path\";\nimport { resolveToolCallPathAccess } from \"../tool-capability-policy.ts\";\nimport type { CapabilityEnvelope } from \"./contracts.ts\";\nimport { isPathWithinScope, safeRealpathSync } from \"./path-scope.ts\";\n\n/**\n * Tool-level envelope enforcement (G2 prerequisite for code-writing workers): the capability\n * envelope's `allowedPaths`/`deniedPaths` were previously VALIDATION-ONLY — recorded on the\n * envelope but never checked when a tool actually ran. This module wraps tools so path-bearing\n * arguments are checked AT EXECUTION TIME, structurally refusing out-of-scope paths the same way\n * a failed script can never look like success: the refusal is an isError result with a stable\n * outcome code, never a silent no-op.\n */\n\nconst PATH_ARGUMENT_KEYS = [\"path\", \"file_path\", \"filePath\", \"cwd\", \"directory\", \"dir\", \"target\"] as const;\nconst PATH_LIST_ARGUMENT_KEYS = [\"paths\", \"files\"] as const;\n\nexport function extractPathArguments(params: unknown): string[] {\n\tif (!params || typeof params !== \"object\") return [];\n\tconst record = params as Record<string, unknown>;\n\tconst found: string[] = [];\n\tfor (const key of PATH_ARGUMENT_KEYS) {\n\t\tconst value = record[key];\n\t\tif (typeof value === \"string\" && value.trim()) found.push(value.trim());\n\t}\n\tfor (const key of PATH_LIST_ARGUMENT_KEYS) {\n\t\tconst value = record[key];\n\t\tif (Array.isArray(value)) {\n\t\t\tfor (const entry of value) {\n\t\t\t\tif (typeof entry === \"string\" && entry.trim()) found.push(entry.trim());\n\t\t\t}\n\t\t}\n\t}\n\treturn found;\n}\n\n/** Tool-aware path projection shared by every envelope/gateway enforcement boundary. */\nexport function extractToolPathArguments(toolName: string, params: unknown): string[] {\n\tconst normalizedToolName = toolName.toLowerCase();\n\tconst paths = extractPathArguments(params);\n\tif (normalizedToolName === \"secret_store\" && params && typeof params === \"object\") {\n\t\tconst record = params as Record<string, unknown>;\n\t\tif (record.action === \"migrate\" && Array.isArray(record.sources)) {\n\t\t\tfor (const source of record.sources) {\n\t\t\t\tif (!source || typeof source !== \"object\" || !(\"path\" in source)) continue;\n\t\t\t\tconst sourcePath = source.path;\n\t\t\t\tif (typeof sourcePath === \"string\" && sourcePath.trim()) paths.push(sourcePath.trim());\n\t\t\t}\n\t\t}\n\t\tif (record.action === \"discover\" && paths.length === 0) paths.push(\".\");\n\t}\n\tif (\n\t\tpaths.length === 0 &&\n\t\t(normalizedToolName === \"find\" ||\n\t\t\tnormalizedToolName === \"grep\" ||\n\t\t\tnormalizedToolName === \"ls\" ||\n\t\t\tnormalizedToolName === \"pipeline\")\n\t) {\n\t\tpaths.push(\".\");\n\t}\n\treturn paths;\n}\n\n/**\n * Deny wins over allow; an empty/absent allow list means \"no positive scope restriction\"\n * (only denies apply) — mirroring the resource-profile filter semantics.\n *\n * Both the target and every scope root are resolved through the real filesystem\n * (symlinks expanded in the existing prefix) before comparison: a pre-existing symlink\n * under an allowed root cannot smuggle a write outside the scope, and a shortcut into a\n * denied subtree is still denied. An unresolvable target fails closed.\n */\nexport function isPathWithinEnvelope(envelope: CapabilityEnvelope, rawPath: string, cwd: string): boolean {\n\tconst lexicalTarget = resolve(cwd, rawPath);\n\tconst allowed = envelope.allowedPaths ?? [];\n\tif (allowed.length > 0) {\n\t\tconst couldBeAllowed = allowed.some((root) => {\n\t\t\tconst lexicalRoot = resolve(cwd, root);\n\t\t\tif (isPathWithinScope(lexicalTarget, lexicalRoot)) return true;\n\t\t\ttry {\n\t\t\t\treturn isPathWithinScope(lexicalTarget, safeRealpathSync(lexicalRoot));\n\t\t\t} catch {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t});\n\t\tif (!couldBeAllowed) return false;\n\t}\n\tlet target: string;\n\ttry {\n\t\ttarget = safeRealpathSync(lexicalTarget);\n\t} catch {\n\t\treturn false;\n\t}\n\tfor (const denied of envelope.deniedPaths ?? []) {\n\t\ttry {\n\t\t\tif (isPathWithinScope(target, safeRealpathSync(resolve(cwd, denied)))) return false;\n\t\t} catch {\n\t\t\t// Mirror checkPathScope: an unresolvable deny root cannot match anything.\n\t\t}\n\t}\n\tif (allowed.length === 0) return true;\n\treturn allowed.some((root) => {\n\t\ttry {\n\t\t\treturn isPathWithinScope(target, safeRealpathSync(resolve(cwd, root)));\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t});\n}\n\nexport interface EnvelopeScopedTool {\n\tname: string;\n\t/**\n\t * The `never` parameter keeps this structural boundary compatible with both the synchronous\n\t * fixtures used by the path-policy tests and the strongly typed async `AgentTool.execute`\n\t * implementations. The wrapper itself preserves the concrete execute signature below.\n\t */\n\texecute: (...args: never[]) => unknown;\n}\n\n/**\n * Wrap a tool so path-bearing arguments are scope-checked when it RUNS, consulting canonical\n * tool capability policy so only tools whose policy declares path-scope access\n * (resolveToolCallPathAccess !== \"none\") are checked against envelope boundaries. The wrapped tool is\n * shape-identical; params are conventionally the second execute argument (toolCallId, params, …).\n */\nexport function wrapToolWithEnvelopeScope<T extends EnvelopeScopedTool>(\n\ttool: T,\n\tenvelope: CapabilityEnvelope,\n\tcwd: string,\n): T {\n\ttype Execute = T[\"execute\"];\n\tconst execute = (...args: Parameters<Execute>): ReturnType<Execute> => {\n\t\tconst params = args[1];\n\t\tconst pathAccess = resolveToolCallPathAccess(envelope.capabilities, tool.name, params);\n\t\tif (pathAccess !== \"none\") {\n\t\t\tfor (const rawPath of extractToolPathArguments(tool.name, params)) {\n\t\t\t\tif (!isPathWithinEnvelope(envelope, rawPath, cwd)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\ttext: `envelope_path_denied: \"${rawPath}\" is outside envelope ${envelope.id}'s path scope. The tool was NOT run.`,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t\tdetails: {\n\t\t\t\t\t\t\toutcome: \"envelope_path_denied\",\n\t\t\t\t\t\t\ttool: tool.name,\n\t\t\t\t\t\t\tpath: rawPath,\n\t\t\t\t\t\t\tenvelopeId: envelope.id,\n\t\t\t\t\t\t},\n\t\t\t\t\t\tisError: true,\n\t\t\t\t\t} as ReturnType<Execute>;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn tool.execute(...args) as ReturnType<Execute>;\n\t};\n\treturn {\n\t\t...tool,\n\t\texecute,\n\t} as T;\n}\n"]}

package/dist/core/autonomy/lane-private-paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lane-private-paths.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/lane-private-paths.ts"],"names":[],"mappings":"AAGA,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAYjF"}
+{"version":3,"file":"lane-private-paths.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/lane-private-paths.ts"],"names":[],"mappings":"AAGA,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAajF"}

package/dist/core/autonomy/lane-private-paths.js

@@ -1,10 +1,11 @@
 import path from "node:path";
-import { configFile, getWorkRoot, sessionsDir, stateDir } from "../agent-paths.js";
+import { configFile, getWorkRoot, okfMemoryDir, sessionsDir, stateDir } from "../agent-paths.js";
 export function getPrivateLaneDeniedPaths(cwd, agentDir) {
     return [
         configFile(agentDir, "auth.json"),
         configFile(agentDir, "MEMORY.md"),
         configFile(agentDir, "USER.md"),
+        okfMemoryDir(agentDir),
         configFile(agentDir, "settings.json"),
         configFile(agentDir, "models.json"),
         sessionsDir(agentDir),

package/dist/core/autonomy/lane-private-paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"lane-private-paths.js","sourceRoot":"","sources":["../../../src/core/autonomy/lane-private-paths.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEnF,MAAM,UAAU,yBAAyB,CAAC,GAAW,EAAE,QAAgB;IACtE,OAAO;QACN,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC;QACjC,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC;QACjC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC/B,UAAU,CAAC,QAAQ,EAAE,eAAe,CAAC;QACrC,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC;QACnC,WAAW,CAAC,QAAQ,CAAC;QACrB,QAAQ,CAAC,QAAQ,CAAC;QAClB,WAAW,CAAC,QAAQ,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,CAAC;KACtC,CAAC;AACH,CAAC","sourcesContent":["import path from \"node:path\";\nimport { configFile, getWorkRoot, sessionsDir, stateDir } from \"../agent-paths.ts\";\n\nexport function getPrivateLaneDeniedPaths(cwd: string, agentDir: string): string[] {\n\treturn [\n\t\tconfigFile(agentDir, \"auth.json\"),\n\t\tconfigFile(agentDir, \"MEMORY.md\"),\n\t\tconfigFile(agentDir, \"USER.md\"),\n\t\tconfigFile(agentDir, \"settings.json\"),\n\t\tconfigFile(agentDir, \"models.json\"),\n\t\tsessionsDir(agentDir),\n\t\tstateDir(agentDir),\n\t\tgetWorkRoot(agentDir),\n\t\tpath.join(cwd, \".pi\", \"settings.json\"),\n\t];\n}\n"]}
+{"version":3,"file":"lane-private-paths.js","sourceRoot":"","sources":["../../../src/core/autonomy/lane-private-paths.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEjG,MAAM,UAAU,yBAAyB,CAAC,GAAW,EAAE,QAAgB;IACtE,OAAO;QACN,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC;QACjC,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC;QACjC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC/B,YAAY,CAAC,QAAQ,CAAC;QACtB,UAAU,CAAC,QAAQ,EAAE,eAAe,CAAC;QACrC,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC;QACnC,WAAW,CAAC,QAAQ,CAAC;QACrB,QAAQ,CAAC,QAAQ,CAAC;QAClB,WAAW,CAAC,QAAQ,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,CAAC;KACtC,CAAC;AACH,CAAC","sourcesContent":["import path from \"node:path\";\nimport { configFile, getWorkRoot, okfMemoryDir, sessionsDir, stateDir } from \"../agent-paths.ts\";\n\nexport function getPrivateLaneDeniedPaths(cwd: string, agentDir: string): string[] {\n\treturn [\n\t\tconfigFile(agentDir, \"auth.json\"),\n\t\tconfigFile(agentDir, \"MEMORY.md\"),\n\t\tconfigFile(agentDir, \"USER.md\"),\n\t\tokfMemoryDir(agentDir),\n\t\tconfigFile(agentDir, \"settings.json\"),\n\t\tconfigFile(agentDir, \"models.json\"),\n\t\tsessionsDir(agentDir),\n\t\tstateDir(agentDir),\n\t\tgetWorkRoot(agentDir),\n\t\tpath.join(cwd, \".pi\", \"settings.json\"),\n\t];\n}\n"]}

package/dist/core/autonomy/lane-tool-surface.d.ts

@@ -2,6 +2,7 @@ import type { AgentLoopConfig, AgentTool } from "@caupulican/pi-agent-core";
 import { CapabilityGateway, type GatewayInitialUsage, type SharedCapabilityBudget } from "../orchestration/capability-gateway.ts";
 import type { ExecutionGrant, OrchestrationExecutionPolicy, ToolCapabilityManifest } from "../orchestration/contracts.ts";
 import type { NormalizedProfile } from "../profile-registry.ts";
+import type { WorkerToolAdapterRegistry } from "./worker-tool-adapter-registry.ts";
 export interface LaneToolSurface {
     /** Fresh tools owned by this lane only; no foreground tool instances or extension state leak in. */
     tools: AgentTool[];
@@ -13,7 +14,7 @@ export interface LaneToolSurface {
     deniedTools: string[];
     /** Explicit grants that bind to no classified lane candidate (opaque tools stay fail-closed). */
     unboundAllowPatterns: string[];
-    /** Per-call path and capability gate for the isolated child loop. */
+    /** Per-call path and capability gate for the isolated worker loop. */
     beforeToolCall: NonNullable<AgentLoopConfig["beforeToolCall"]>;
     /** Canonical cumulative authority/budget meter for a compiled worker grant. */
     gateway?: CapabilityGateway;
@@ -38,20 +39,19 @@ export interface LaneToolSurfaceOptions {
     /** Compiled policy path. When present, it is the only authorization source for this surface. */
     grant?: ExecutionGrant;
     toolManifests?: readonly ToolCapabilityManifest[];
-    /** Runtime-owned classified tools composed specifically for this lane (for example delegation control). */
-    additionalTools?: readonly AgentTool[];
     /** Durable cumulative active usage to seed the compiled grant's gateway on resume. */
     initialUsage?: GatewayInitialUsage;
-    /** Root-tree aggregate meter shared by this attempt and every descendant. */
+    /** Owner aggregate meter shared across retries and verification for this durable worker task. */
     sharedBudget?: SharedCapabilityBudget;
+    /** Host-owned fresh factories for worker-safe foreground/extension tools. */
+    workerToolAdapters?: WorkerToolAdapterRegistry;
 }
 /**
  * Materialize a fresh, fail-closed tool surface for one isolated lane.
  *
- * Admission selects classified built-ins plus runtime-owned injected controls. A compiled grant is
- * the only authority source for worker lanes; host shell and recursive delegation are materialized
- * when named by that grant. Write/edit additionally require the global write switch and a positive
- * path scope.
+ * Admission selects only tools this isolated lane can materialize. A compiled grant is the only
+ * authority source for worker lanes. Write/edit additionally require the global write switch and a
+ * positive path scope.
  */
 export declare function createLaneToolSurface(options: LaneToolSurfaceOptions): LaneToolSurface;
 //# sourceMappingURL=lane-tool-surface.d.ts.map

package/dist/core/autonomy/lane-tool-surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lane-tool-surface.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/lane-tool-surface.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAG5E,OAAO,EACN,iBAAiB,EAEjB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EACX,cAAc,EACd,4BAA4B,EAC5B,sBAAsB,EACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AA8BhE,MAAM,WAAW,eAAe;IAC/B,oGAAoG;IACpG,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,yEAAyE;IACzE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,8FAA8F;IAC9F,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,yEAAyE;IACzE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iGAAiG;IACjG,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,qEAAqE;IACrE,cAAc,EAAE,WAAW,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC/D,+EAA+E;IAC/E,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,yEAAyE;IACzE,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,wGAAwG;IACxG,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,4FAA4F;IAC5F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,qGAAqG;IACrG,eAAe,CAAC,EAAE,4BAA4B,CAAC;IAC/C,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mGAAmG;IACnG,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yGAAyG;IACzG,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gGAAgG;IAChG,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAClD,2GAA2G;IAC3G,eAAe,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IACvC,sFAAsF;IACtF,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,6EAA6E;IAC7E,YAAY,CAAC,EAAE,sBAAsB,CAAC;CACtC;AAiFD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CAiItF"}
+{"version":3,"file":"lane-tool-surface.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/lane-tool-surface.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAI5E,OAAO,EACN,iBAAiB,EAEjB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EACX,cAAc,EACd,4BAA4B,EAC5B,sBAAsB,EACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAoBhE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAgBnF,MAAM,WAAW,eAAe;IAC/B,oGAAoG;IACpG,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,yEAAyE;IACzE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,8FAA8F;IAC9F,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,yEAAyE;IACzE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iGAAiG;IACjG,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,sEAAsE;IACtE,cAAc,EAAE,WAAW,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC/D,+EAA+E;IAC/E,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,yEAAyE;IACzE,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,wGAAwG;IACxG,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,4FAA4F;IAC5F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,qGAAqG;IACrG,eAAe,CAAC,EAAE,4BAA4B,CAAC;IAC/C,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mGAAmG;IACnG,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yGAAyG;IACzG,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gGAAgG;IAChG,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAClD,sFAAsF;IACtF,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,iGAAiG;IACjG,YAAY,CAAC,EAAE,sBAAsB,CAAC;IACtC,6EAA6E;IAC7E,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CAC/C;AAqFD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CA8ItF"}

package/dist/core/autonomy/lane-tool-surface.js

@@ -1,8 +1,10 @@
 import path from "node:path";
 import { Type } from "typebox";
 import { STABLE_SHELL_TOOL_NAME } from "../default-tool-surface.js";
+import { WORKER_MEMORY_READ_TOOL_NAME } from "../memory/worker-memory-tools.js";
 import { CapabilityGateway, CapabilityGatewayDeniedError, } from "../orchestration/capability-gateway.js";
-import { wrapToolWithCredentialExposureGuard } from "../secrets/credential-exposure-guard.js";
+import { wrapToolWithCredentialExposureGuard, } from "../secrets/credential-exposure-guard.js";
+import { redactKnownSecrets } from "../security/secret-text.js";
 import { matchesResourceProfilePattern } from "../settings-manager.js";
 import { createBashTool } from "../tools/bash.js";
 import { createEditTool } from "../tools/edit.js";
@@ -10,14 +12,15 @@ import { FileMutationIntentController } from "../tools/file-mutation-intent.js";
 import { createFindTool } from "../tools/find.js";
 import { createGrepTool } from "../tools/grep.js";
 import { createLsTool } from "../tools/ls.js";
+import { createPythonTool } from "../tools/python.js";
 import { createReadTool } from "../tools/read.js";
 import { createRunProcessTool } from "../tools/run-process.js";
 import { disposeShellExecutionSession } from "../tools/shell-execution-session.js";
 import { createWriteTool } from "../tools/write.js";
 import { evaluateToolGate } from "./gates.js";
 const READ_ONLY_LANE_TOOL_NAMES = ["read", "grep", "find", "ls"];
-const MEMORY_LANE_TOOL_NAME = "memory";
 const WRITE_LANE_TOOL_NAMES = ["write", "edit"];
+const PYTHON_LANE_TOOL_NAME = "python";
 const PROCESS_LANE_TOOL_NAME = "run_process";
 const MAX_LANE_MEMORY_QUERY_CHARS = 4_096;
 const laneMemorySchema = Type.Object({
@@ -41,7 +44,7 @@ function strictLaneProfilePatterns(profile) {
 function resolveWriteRoots(cwd, writePaths) {
     return writePaths.map((entry) => (path.isAbsolute(entry) ? path.resolve(entry) : path.resolve(cwd, entry)));
 }
-function createLaneTools(cwd, names, fileMutationIntents, additionalTools, readMemory, executionPolicy, processMaxWallClockMs = 0, shellSessionKey, shellOutputDirectory) {
+function createLaneTools(cwd, names, fileMutationIntents, privatePathBoundary, readMemory, executionPolicy, processMaxWallClockMs = 0, shellSessionKey, shellOutputDirectory, workerToolAdapters) {
     const factories = new Map([
         ["read", () => createReadTool(cwd)],
         ["grep", () => createGrepTool(cwd)],
@@ -49,6 +52,7 @@ function createLaneTools(cwd, names, fileMutationIntents, additionalTools, readM
         ["ls", () => createLsTool(cwd)],
         ["write", () => createWriteTool(cwd, { intentController: fileMutationIntents })],
         ["edit", () => createEditTool(cwd, { intentController: fileMutationIntents })],
+        [PYTHON_LANE_TOOL_NAME, () => createPythonTool(cwd)],
     ]);
     if (executionPolicy) {
         factories.set(PROCESS_LANE_TOOL_NAME, () => createRunProcessTool(cwd, { policy: executionPolicy, maxWallClockMs: processMaxWallClockMs }));
@@ -61,8 +65,8 @@ function createLaneTools(cwd, names, fileMutationIntents, additionalTools, readM
         }));
     }
     if (readMemory) {
-        factories.set(MEMORY_LANE_TOOL_NAME, () => ({
-            name: MEMORY_LANE_TOOL_NAME,
+        factories.set(WORKER_MEMORY_READ_TOOL_NAME, () => ({
+            name: WORKER_MEMORY_READ_TOOL_NAME,
             label: "Read Memory",
             description: "Retrieve bounded, source-labeled standing memory relevant to this delegated task. Read-only: no memory writes or lifecycle actions are available.",
             parameters: laneMemorySchema,
@@ -79,47 +83,49 @@ function createLaneTools(cwd, names, fileMutationIntents, additionalTools, readM
         }));
     }
     return names.flatMap((name) => {
-        const additional = additionalTools.get(name);
-        if (additional)
-            return [additional];
         const factory = factories.get(name);
-        return factory ? [wrapToolWithCredentialExposureGuard(factory(), cwd)] : [];
+        if (factory)
+            return [wrapToolWithCredentialExposureGuard(factory(), cwd, privatePathBoundary)];
+        if (!workerToolAdapters)
+            return [];
+        const materialized = workerToolAdapters.materialize(name, { cwd, credentialBoundary: privatePathBoundary });
+        if (!materialized.ok)
+            throw new Error(materialized.reason);
+        return [wrapToolWithCredentialExposureGuard(materialized.tool, cwd, privatePathBoundary)];
     });
 }
 /**
  * Materialize a fresh, fail-closed tool surface for one isolated lane.
  *
- * Admission selects classified built-ins plus runtime-owned injected controls. A compiled grant is
- * the only authority source for worker lanes; host shell and recursive delegation are materialized
- * when named by that grant. Write/edit additionally require the global write switch and a positive
- * path scope.
+ * Admission selects only tools this isolated lane can materialize. A compiled grant is the only
+ * authority source for worker lanes. Write/edit additionally require the global write switch and a
+ * positive path scope.
  */
 export function createLaneToolSurface(options) {
     const fileMutationIntents = new FileMutationIntentController();
-    const additionalTools = new Map();
-    for (const tool of options.additionalTools ?? []) {
-        if (!tool.name.trim())
-            throw new Error("An injected lane tool must have a name.");
-        if (additionalTools.has(tool.name))
-            throw new Error(`Injected lane tool '${tool.name}' is duplicated.`);
-        additionalTools.set(tool.name, tool);
-    }
     const writeCapable = options.writeEnabled === true && (options.writePaths?.length ?? 0) > 0;
+    const pythonCapable = options.toolManifests?.some((manifest) => manifest.toolName === PYTHON_LANE_TOOL_NAME) === true;
     const builtInCandidateNames = [
         ...READ_ONLY_LANE_TOOL_NAMES,
-        ...(options.readMemory ? [MEMORY_LANE_TOOL_NAME] : []),
+        ...(options.readMemory ? [WORKER_MEMORY_READ_TOOL_NAME] : []),
         ...(writeCapable ? WRITE_LANE_TOOL_NAMES : []),
+        ...(pythonCapable ? [PYTHON_LANE_TOOL_NAME] : []),
         ...(options.executionPolicy ? [PROCESS_LANE_TOOL_NAME] : []),
         ...(options.shellSessionKey ? [STABLE_SHELL_TOOL_NAME] : []),
     ];
-    for (const name of additionalTools.keys()) {
-        if (builtInCandidateNames.includes(name)) {
-            throw new Error(`Injected lane tool '${name}' conflicts with a built-in lane tool.`);
-        }
+    const builtInNameSet = new Set(builtInCandidateNames);
+    const conflictingAdapter = options.workerToolAdapters?.names().find((name) => builtInNameSet.has(name));
+    if (conflictingAdapter) {
+        throw new Error(`Worker tool adapter '${conflictingAdapter}' conflicts with a built-in lane tool.`);
     }
-    const candidateNames = [...builtInCandidateNames, ...additionalTools.keys()];
+    const candidateNames = [...builtInCandidateNames, ...(options.workerToolAdapters?.names() ?? [])];
+    const candidateNameSet = new Set(candidateNames);
     const patterns = strictLaneProfilePatterns(options.profile);
     const compiledToolNames = new Set(options.grant?.allowedTools ?? []);
+    const unmaterializedGrantTool = options.grant?.allowedTools.find((name) => !candidateNameSet.has(name));
+    if (unmaterializedGrantTool) {
+        throw new Error(`Compiled lane grant references unmaterializable tool '${unmaterializedGrantTool}'.`);
+    }
     const deniedTools = candidateNames.filter((name) => options.grant ? !compiledToolNames.has(name) : matchesResourceProfilePattern(name, patterns.block));
     const unboundAllowPatterns = options.grant
         ? []
@@ -142,12 +148,21 @@ export function createLaneToolSurface(options) {
         })
         : undefined;
     const deniedPaths = options.deniedPaths?.map((entry) => path.resolve(entry));
+    const privatePathBoundary = deniedPaths && deniedPaths.length > 0
+        ? {
+            redactSensitiveText: redactKnownSecrets,
+            protectedFiles: deniedPaths,
+            protectedDirectories: deniedPaths,
+        }
+        : undefined;
     const readEnvelope = {
         id: "isolated-lane-read-tools",
         capabilities: [
             "filesystem.read",
-            ...(allowedToolSet.has(MEMORY_LANE_TOOL_NAME) ? ["memory.query"] : []),
-            ...(allowedToolSet.has(PROCESS_LANE_TOOL_NAME) || allowedToolSet.has(STABLE_SHELL_TOOL_NAME)
+            ...(allowedToolSet.has(WORKER_MEMORY_READ_TOOL_NAME) ? ["memory.query"] : []),
+            ...(allowedToolSet.has(PYTHON_LANE_TOOL_NAME) ||
+                allowedToolSet.has(PROCESS_LANE_TOOL_NAME) ||
+                allowedToolSet.has(STABLE_SHELL_TOOL_NAME)
                 ? ["process.exec"]
                 : []),
         ],
@@ -165,7 +180,7 @@ export function createLaneToolSurface(options) {
         ...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),
     };
     return {
-        tools: createLaneTools(options.cwd, allowedTools, fileMutationIntents, additionalTools, options.readMemory, options.executionPolicy, options.processMaxWallClockMs, options.shellSessionKey, options.shellOutputDirectory),
+        tools: createLaneTools(options.cwd, allowedTools, fileMutationIntents, privatePathBoundary, options.readMemory, options.executionPolicy, options.processMaxWallClockMs, options.shellSessionKey, options.shellOutputDirectory, options.workerToolAdapters),
         dispose: async () => {
             if (options.shellSessionKey)
                 disposeShellExecutionSession(options.shellSessionKey);

package/dist/core/autonomy/lane-tool-surface.js.map

@@ -1 +1 @@
-{"version":3,"file":"lane-tool-surface.js","sourceRoot":"","sources":["../../../src/core/autonomy/lane-tool-surface.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAe,IAAI,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EACN,iBAAiB,EACjB,4BAA4B,GAG5B,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EAAE,mCAAmC,EAAE,MAAM,yCAAyC,CAAC;AAC9F,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAU,CAAC;AAC1E,MAAM,qBAAqB,GAAG,QAAiB,CAAC;AAChD,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAU,CAAC;AACzD,MAAM,sBAAsB,GAAG,aAAsB,CAAC;AACtD,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAC1C,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;QAClB,SAAS,EAAE,2BAA2B;QACtC,WAAW,EAAE,6DAA6D;KAC1E,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAS,qBAAqB,CAAC,CAAC;AA+CxE,SAAS,yBAAyB,CAAC,OAAsC;IAIxE,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;IACvC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,6FAA6F;IAC7F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IACjF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,UAA6B;IACpE,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,SAAS,eAAe,CACvB,GAAW,EACX,KAAwB,EACxB,mBAAiD,EACjD,eAA+C,EAC/C,UAA+C,EAC/C,eAA8C,EAC9C,qBAAqB,GAAG,CAAC,EACzB,eAAwB,EACxB,oBAA6B;IAE7B,MAAM,SAAS,GAAG,IAAI,GAAG,CAA0B;QAClD,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChF,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC,CAAC;KAC9E,CAAC,CAAC;IACH,IAAI,eAAe,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAC1C,oBAAoB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,qBAAqB,EAAE,CAAC,CAC7F,CAAC;IACH,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAC1C,cAAc,CAAC,GAAG,EAAE;YACnB,UAAU,EAAE,eAAe;YAC3B,mBAAmB,EAAE,IAAI;YACzB,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAC,CACF,CAAC;IACH,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QAChB,SAAS,CAAC,GAAG,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,IAAI,EAAE,qBAAqB;YAC3B,KAAK,EAAE,aAAa;YACpB,WAAW,EACV,mJAAmJ;YACpJ,UAAU,EAAE,gBAAgB;YAC5B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE;gBACtC,MAAM,KAAK,GAAI,MAA2B,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;gBACzD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;oBAC1D,MAAM,IAAI,KAAK,CACd,2DAA2D,2BAA2B,cAAc,CACpG,CAAC;gBACH,CAAC;gBACD,OAAO;oBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC3B,CAAC;YACH,CAAC;SACD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC7B,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,UAAU;YAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACpE,MAAM,mBAAmB,GAAG,IAAI,4BAA4B,EAAE,CAAC;IAC/D,MAAM,eAAe,GAAG,IAAI,GAAG,EAAqB,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAClF,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,IAAI,kBAAkB,CAAC,CAAC;QACxG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5F,MAAM,qBAAqB,GAAG;QAC7B,GAAG,yBAAyB;QAC5B,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3C,IAAI,qBAAqB,CAAC,QAAQ,CAAC,IAA8C,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,wCAAwC,CAAC,CAAC;QACtF,CAAC;IACF,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,GAAG,qBAAqB,EAAE,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAClD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAClG,CAAC;IACF,MAAM,oBAAoB,GAAG,OAAO,CAAC,KAAK;QACzC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CACrB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,6BAA6B,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAC3F,CAAC;IACJ,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK;QACjC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9D,CAAC,CAAC,cAAc,CAAC,MAAM,CACrB,CAAC,IAAI,EAAE,EAAE,CACR,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YACpF,CAAC,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CACrD,CAAC;IACJ,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,YAAY,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/G,IAAI,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK;QAC5B,CAAC,CAAC,IAAI,iBAAiB,CAAC;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC;QACH,CAAC,CAAC,SAAS,CAAC;IACb,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAuB;QACxC,EAAE,EAAE,0BAA0B;QAC9B,YAAY,EAAE;YACb,iBAAiB;YACjB,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAE,CAAC,cAAc,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,sBAAsB,CAAC;gBAC3F,CAAC,CAAE,CAAC,cAAc,CAAW;gBAC7B,CAAC,CAAC,EAAE,CAAC;SACN;QACD,YAAY;QACZ,WAAW;QACX,YAAY,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzC,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IACF,MAAM,aAAa,GAAuB;QACzC,EAAE,EAAE,2BAA2B;QAC/B,YAAY,EAAE,CAAC,kBAAkB,CAAC;QAClC,YAAY;QACZ,WAAW;QACX,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QACtE,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IAEF,OAAO;QACN,KAAK,EAAE,eAAe,CACrB,OAAO,CAAC,GAAG,EACX,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,qBAAqB,EAC7B,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,oBAAoB,CAC5B;QACD,OAAO,EAAE,KAAK,IAAI,EAAE;YACnB,IAAI,OAAO,CAAC,eAAe;gBAAE,4BAA4B,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACnF,MAAM,mBAAmB,CAAC,OAAO,EAAE,CAAC;QACrC,CAAC;QACD,YAAY;QACZ,WAAW;QACX,oBAAoB;QACpB,cAAc,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;YAC5C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,QAAQ,CAAC,IAAI,4CAA4C,EAAE,CAAC;YACzG,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACf,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,QAAQ,CAAC,IAAI,wCAAwC,EAAE,CAAC;gBACrG,CAAC;gBACD,IAAI,CAAC;oBACJ,OAAO,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBACzD,OAAO,SAAS,CAAC;gBAClB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;wBACnD,IAAI,KAAK,CAAC,MAAM,KAAK,kBAAkB;4BAAE,MAAM,KAAK,CAAC;wBACrD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,KAAK,CAAC,UAAU,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC7F,CAAC;oBACD,MAAM,KAAK,CAAC;gBACb,CAAC;YACF,CAAC;YACD,MAAM,OAAO,GAAG,gBAAgB,CAAC;gBAChC,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,IAAI;gBACJ,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,QAAQ,EAAE,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY;aACpF,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;gBAAE,OAAO,SAAS,CAAC;YAClD,OAAO;gBACN,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,sBAAsB,OAAO,CAAC,UAAU,MAAM,OAAO,CAAC,OAAO,IAAI,2BAA2B,EAAE;aACtG,CAAC;QACH,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/B,CAAC;AACH,CAAC","sourcesContent":["import path from \"node:path\";\nimport type { AgentLoopConfig, AgentTool } from \"@caupulican/pi-agent-core\";\nimport { type Static, Type } from \"typebox\";\nimport { STABLE_SHELL_TOOL_NAME } from \"../default-tool-surface.ts\";\nimport {\n\tCapabilityGateway,\n\tCapabilityGatewayDeniedError,\n\ttype GatewayInitialUsage,\n\ttype SharedCapabilityBudget,\n} from \"../orchestration/capability-gateway.ts\";\nimport type {\n\tExecutionGrant,\n\tOrchestrationExecutionPolicy,\n\tToolCapabilityManifest,\n} from \"../orchestration/contracts.ts\";\nimport type { NormalizedProfile } from \"../profile-registry.ts\";\nimport { wrapToolWithCredentialExposureGuard } from \"../secrets/credential-exposure-guard.ts\";\nimport { matchesResourceProfilePattern } from \"../settings-manager.ts\";\nimport { createBashTool } from \"../tools/bash.ts\";\nimport { createEditTool } from \"../tools/edit.ts\";\nimport { FileMutationIntentController } from \"../tools/file-mutation-intent.ts\";\nimport { createFindTool } from \"../tools/find.ts\";\nimport { createGrepTool } from \"../tools/grep.ts\";\nimport { createLsTool } from \"../tools/ls.ts\";\nimport { createReadTool } from \"../tools/read.ts\";\nimport { createRunProcessTool } from \"../tools/run-process.ts\";\nimport { disposeShellExecutionSession } from \"../tools/shell-execution-session.ts\";\nimport { createWriteTool } from \"../tools/write.ts\";\nimport type { CapabilityEnvelope } from \"./contracts.ts\";\nimport { evaluateToolGate } from \"./gates.ts\";\n\nconst READ_ONLY_LANE_TOOL_NAMES = [\"read\", \"grep\", \"find\", \"ls\"] as const;\nconst MEMORY_LANE_TOOL_NAME = \"memory\" as const;\nconst WRITE_LANE_TOOL_NAMES = [\"write\", \"edit\"] as const;\nconst PROCESS_LANE_TOOL_NAME = \"run_process\" as const;\nconst MAX_LANE_MEMORY_QUERY_CHARS = 4_096;\nconst laneMemorySchema = Type.Object({\n\tquery: Type.String({\n\t\tmaxLength: MAX_LANE_MEMORY_QUERY_CHARS,\n\t\tdescription: \"What relevant standing memory or prior evidence to retrieve\",\n\t}),\n});\ntype LaneMemoryParams = Static<typeof laneMemorySchema>;\nconst WRITE_LANE_TOOL_NAME_SET = new Set<string>(WRITE_LANE_TOOL_NAMES);\n\nexport interface LaneToolSurface {\n\t/** Fresh tools owned by this lane only; no foreground tool instances or extension state leak in. */\n\ttools: AgentTool[];\n\t/** Release exact mutation payload leases owned by this isolated lane. */\n\tdispose(): Promise<void>;\n\t/** Exact names after profile globs are expanded. Safe to persist in a capability envelope. */\n\tallowedTools: string[];\n\t/** Exact safe-candidate names denied by the profile's block patterns. */\n\tdeniedTools: string[];\n\t/** Explicit grants that bind to no classified lane candidate (opaque tools stay fail-closed). */\n\tunboundAllowPatterns: string[];\n\t/** Per-call path and capability gate for the isolated child loop. */\n\tbeforeToolCall: NonNullable<AgentLoopConfig[\"beforeToolCall\"]>;\n\t/** Canonical cumulative authority/budget meter for a compiled worker grant. */\n\tgateway?: CapabilityGateway;\n}\n\nexport interface LaneToolSurfaceOptions {\n\tcwd: string;\n\tprofile?: NormalizedProfile;\n\t/** Private harness state that generic file tools must never traverse. */\n\tdeniedPaths?: readonly string[];\n\t/** Orchestrator-requested, policy-filtered read-only memory retrieval. Omitted means no memory tool. */\n\treadMemory?: (query: string) => Promise<string>;\n\t/** Research never sets this. Workers require both this flag and at least one write path. */\n\twriteEnabled?: boolean;\n\twritePaths?: readonly string[];\n\t/** Present only for process-capable owner profiles; absent means no process tool is materialized. */\n\texecutionPolicy?: OrchestrationExecutionPolicy;\n\tprocessMaxWallClockMs?: number;\n\t/** Stable per-agent shell identity. Omitted when the compiled plan does not grant a host shell. */\n\tshellSessionKey?: string;\n\t/** Host-owned managed directory for complete shell output; never inferred from process-global config. */\n\tshellOutputDirectory?: string;\n\t/** Compiled policy path. When present, it is the only authorization source for this surface. */\n\tgrant?: ExecutionGrant;\n\ttoolManifests?: readonly ToolCapabilityManifest[];\n\t/** Runtime-owned classified tools composed specifically for this lane (for example delegation control). */\n\tadditionalTools?: readonly AgentTool[];\n\t/** Durable cumulative active usage to seed the compiled grant's gateway on resume. */\n\tinitialUsage?: GatewayInitialUsage;\n\t/** Root-tree aggregate meter shared by this attempt and every descendant. */\n\tsharedBudget?: SharedCapabilityBudget;\n}\n\nfunction strictLaneProfilePatterns(profile: NormalizedProfile | undefined): {\n\tallow: string[];\n\tblock: string[];\n} {\n\tif (!profile) return { allow: [], block: [] };\n\tconst filter = profile.resources.tools;\n\tconst allow = [...(filter?.allow ?? [])];\n\tconst block = [...(filter?.block ?? [])];\n\t// Strict UAC: a shipped profile is the complete authority grant. Grant-all must be explicit.\n\tif (allow.length === 0 && block.length === 0) return { allow: [], block: [\"*\"] };\n\treturn { allow, block };\n}\n\nfunction resolveWriteRoots(cwd: string, writePaths: readonly string[]): string[] {\n\treturn writePaths.map((entry) => (path.isAbsolute(entry) ? path.resolve(entry) : path.resolve(cwd, entry)));\n}\n\nfunction createLaneTools(\n\tcwd: string,\n\tnames: readonly string[],\n\tfileMutationIntents: FileMutationIntentController,\n\tadditionalTools: ReadonlyMap<string, AgentTool>,\n\treadMemory?: (query: string) => Promise<string>,\n\texecutionPolicy?: OrchestrationExecutionPolicy,\n\tprocessMaxWallClockMs = 0,\n\tshellSessionKey?: string,\n\tshellOutputDirectory?: string,\n): AgentTool[] {\n\tconst factories = new Map<string, () => AgentTool>([\n\t\t[\"read\", () => createReadTool(cwd)],\n\t\t[\"grep\", () => createGrepTool(cwd)],\n\t\t[\"find\", () => createFindTool(cwd)],\n\t\t[\"ls\", () => createLsTool(cwd)],\n\t\t[\"write\", () => createWriteTool(cwd, { intentController: fileMutationIntents })],\n\t\t[\"edit\", () => createEditTool(cwd, { intentController: fileMutationIntents })],\n\t]);\n\tif (executionPolicy) {\n\t\tfactories.set(PROCESS_LANE_TOOL_NAME, () =>\n\t\t\tcreateRunProcessTool(cwd, { policy: executionPolicy, maxWallClockMs: processMaxWallClockMs }),\n\t\t);\n\t}\n\tif (shellSessionKey) {\n\t\tfactories.set(STABLE_SHELL_TOOL_NAME, () =>\n\t\t\tcreateBashTool(cwd, {\n\t\t\t\tsessionKey: shellSessionKey,\n\t\t\t\tprewarmWindowsShell: true,\n\t\t\t\t...(shellOutputDirectory ? { outputDirectory: shellOutputDirectory } : {}),\n\t\t\t}),\n\t\t);\n\t}\n\tif (readMemory) {\n\t\tfactories.set(MEMORY_LANE_TOOL_NAME, () => ({\n\t\t\tname: MEMORY_LANE_TOOL_NAME,\n\t\t\tlabel: \"Read Memory\",\n\t\t\tdescription:\n\t\t\t\t\"Retrieve bounded, source-labeled standing memory relevant to this delegated task. Read-only: no memory writes or lifecycle actions are available.\",\n\t\t\tparameters: laneMemorySchema,\n\t\t\texecute: async (_toolCallId, params) => {\n\t\t\t\tconst query = (params as LaneMemoryParams).query?.trim();\n\t\t\t\tif (!query || query.length > MAX_LANE_MEMORY_QUERY_CHARS) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`memory_query_invalid: query must contain from 1 through ${MAX_LANE_MEMORY_QUERY_CHARS} characters.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ type: \"text\" as const, text: await readMemory(query) }],\n\t\t\t\t\tdetails: { readOnly: true },\n\t\t\t\t};\n\t\t\t},\n\t\t}));\n\t}\n\treturn names.flatMap((name) => {\n\t\tconst additional = additionalTools.get(name);\n\t\tif (additional) return [additional];\n\t\tconst factory = factories.get(name);\n\t\treturn factory ? [wrapToolWithCredentialExposureGuard(factory(), cwd)] : [];\n\t});\n}\n\n/**\n * Materialize a fresh, fail-closed tool surface for one isolated lane.\n *\n * Admission selects classified built-ins plus runtime-owned injected controls. A compiled grant is\n * the only authority source for worker lanes; host shell and recursive delegation are materialized\n * when named by that grant. Write/edit additionally require the global write switch and a positive\n * path scope.\n */\nexport function createLaneToolSurface(options: LaneToolSurfaceOptions): LaneToolSurface {\n\tconst fileMutationIntents = new FileMutationIntentController();\n\tconst additionalTools = new Map<string, AgentTool>();\n\tfor (const tool of options.additionalTools ?? []) {\n\t\tif (!tool.name.trim()) throw new Error(\"An injected lane tool must have a name.\");\n\t\tif (additionalTools.has(tool.name)) throw new Error(`Injected lane tool '${tool.name}' is duplicated.`);\n\t\tadditionalTools.set(tool.name, tool);\n\t}\n\tconst writeCapable = options.writeEnabled === true && (options.writePaths?.length ?? 0) > 0;\n\tconst builtInCandidateNames = [\n\t\t...READ_ONLY_LANE_TOOL_NAMES,\n\t\t...(options.readMemory ? [MEMORY_LANE_TOOL_NAME] : []),\n\t\t...(writeCapable ? WRITE_LANE_TOOL_NAMES : []),\n\t\t...(options.executionPolicy ? [PROCESS_LANE_TOOL_NAME] : []),\n\t\t...(options.shellSessionKey ? [STABLE_SHELL_TOOL_NAME] : []),\n\t];\n\tfor (const name of additionalTools.keys()) {\n\t\tif (builtInCandidateNames.includes(name as (typeof builtInCandidateNames)[number])) {\n\t\t\tthrow new Error(`Injected lane tool '${name}' conflicts with a built-in lane tool.`);\n\t\t}\n\t}\n\tconst candidateNames = [...builtInCandidateNames, ...additionalTools.keys()];\n\tconst patterns = strictLaneProfilePatterns(options.profile);\n\tconst compiledToolNames = new Set(options.grant?.allowedTools ?? []);\n\tconst deniedTools = candidateNames.filter((name) =>\n\t\toptions.grant ? !compiledToolNames.has(name) : matchesResourceProfilePattern(name, patterns.block),\n\t);\n\tconst unboundAllowPatterns = options.grant\n\t\t? []\n\t\t: patterns.allow.filter(\n\t\t\t\t(pattern) => !candidateNames.some((name) => matchesResourceProfilePattern(name, [pattern])),\n\t\t\t);\n\tconst allowedTools = options.grant\n\t\t? candidateNames.filter((name) => compiledToolNames.has(name))\n\t\t: candidateNames.filter(\n\t\t\t\t(name) =>\n\t\t\t\t\t(patterns.allow.length === 0 || matchesResourceProfilePattern(name, patterns.allow)) &&\n\t\t\t\t\t!matchesResourceProfilePattern(name, patterns.block),\n\t\t\t);\n\tconst allowedToolSet = new Set<string>(allowedTools);\n\tconst manifestsByName = new Map(options.toolManifests?.map((manifest) => [manifest.toolName, manifest]) ?? []);\n\tif (options.grant?.allowedTools.some((name) => !manifestsByName.has(name))) {\n\t\tthrow new Error(\"Compiled lane grant references a tool without a capability manifest.\");\n\t}\n\tconst gateway = options.grant\n\t\t? new CapabilityGateway({\n\t\t\t\tgrant: options.grant,\n\t\t\t\tcwd: options.cwd,\n\t\t\t\t...(options.initialUsage !== undefined ? { initialUsage: options.initialUsage } : {}),\n\t\t\t\t...(options.sharedBudget ? { sharedBudget: options.sharedBudget } : {}),\n\t\t\t})\n\t\t: undefined;\n\tconst deniedPaths = options.deniedPaths?.map((entry) => path.resolve(entry));\n\tconst readEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-read-tools\",\n\t\tcapabilities: [\n\t\t\t\"filesystem.read\",\n\t\t\t...(allowedToolSet.has(MEMORY_LANE_TOOL_NAME) ? ([\"memory.query\"] as const) : []),\n\t\t\t...(allowedToolSet.has(PROCESS_LANE_TOOL_NAME) || allowedToolSet.has(STABLE_SHELL_TOOL_NAME)\n\t\t\t\t? ([\"process.exec\"] as const)\n\t\t\t\t: []),\n\t\t],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: [path.resolve(options.cwd)],\n\t\t...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),\n\t};\n\tconst writeEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-write-tools\",\n\t\tcapabilities: [\"filesystem.write\"],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: resolveWriteRoots(options.cwd, options.writePaths ?? []),\n\t\t...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),\n\t};\n\n\treturn {\n\t\ttools: createLaneTools(\n\t\t\toptions.cwd,\n\t\t\tallowedTools,\n\t\t\tfileMutationIntents,\n\t\t\tadditionalTools,\n\t\t\toptions.readMemory,\n\t\t\toptions.executionPolicy,\n\t\t\toptions.processMaxWallClockMs,\n\t\t\toptions.shellSessionKey,\n\t\t\toptions.shellOutputDirectory,\n\t\t),\n\t\tdispose: async () => {\n\t\t\tif (options.shellSessionKey) disposeShellExecutionSession(options.shellSessionKey);\n\t\t\tawait fileMutationIntents.dispose();\n\t\t},\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tunboundAllowPatterns,\n\t\tbeforeToolCall: async ({ toolCall, args }) => {\n\t\t\tif (!allowedToolSet.has(toolCall.name)) {\n\t\t\t\treturn { block: true, reason: `Lane tool '${toolCall.name}' is outside the materialized UAC surface.` };\n\t\t\t}\n\t\t\tif (gateway) {\n\t\t\t\tconst manifest = manifestsByName.get(toolCall.name);\n\t\t\t\tif (!manifest) {\n\t\t\t\t\treturn { block: true, reason: `Lane tool '${toolCall.name}' has no compiled capability manifest.` };\n\t\t\t\t}\n\t\t\t\ttry {\n\t\t\t\t\tgateway.authorizeToolCall(manifest, toolCall.name, args);\n\t\t\t\t\treturn undefined;\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (error instanceof CapabilityGatewayDeniedError) {\n\t\t\t\t\t\tif (error.status === \"budget_exhausted\") throw error;\n\t\t\t\t\t\treturn { block: true, reason: `Lane tool blocked (${error.reasonCode}): ${error.message}` };\n\t\t\t\t\t}\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst outcome = evaluateToolGate({\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\targs,\n\t\t\t\tcwd: options.cwd,\n\t\t\t\tenvelope: WRITE_LANE_TOOL_NAME_SET.has(toolCall.name) ? writeEnvelope : readEnvelope,\n\t\t\t});\n\t\t\tif (outcome.outcome === \"allow\") return undefined;\n\t\t\treturn {\n\t\t\t\tblock: true,\n\t\t\t\treason: `Lane tool blocked (${outcome.reasonCode}): ${outcome.message ?? \"capability gate denied it\"}`,\n\t\t\t};\n\t\t},\n\t\t...(gateway ? { gateway } : {}),\n\t};\n}\n"]}
+{"version":3,"file":"lane-tool-surface.js","sourceRoot":"","sources":["../../../src/core/autonomy/lane-tool-surface.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAe,IAAI,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,EACN,iBAAiB,EACjB,4BAA4B,GAG5B,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EAEN,mCAAmC,GACnC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG9C,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAU,CAAC;AAC1E,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAU,CAAC;AACzD,MAAM,qBAAqB,GAAG,QAAiB,CAAC;AAChD,MAAM,sBAAsB,GAAG,aAAsB,CAAC;AACtD,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAC1C,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;QAClB,SAAS,EAAE,2BAA2B;QACtC,WAAW,EAAE,6DAA6D;KAC1E,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAS,qBAAqB,CAAC,CAAC;AA+CxE,SAAS,yBAAyB,CAAC,OAAsC;IAIxE,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;IACvC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,6FAA6F;IAC7F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IACjF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,UAA6B;IACpE,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,SAAS,eAAe,CACvB,GAAW,EACX,KAAwB,EACxB,mBAAiD,EACjD,mBAAgD,EAChD,UAA+C,EAC/C,eAA8C,EAC9C,qBAAqB,GAAG,CAAC,EACzB,eAAwB,EACxB,oBAA6B,EAC7B,kBAA8C;IAE9C,MAAM,SAAS,GAAG,IAAI,GAAG,CAA0B;QAClD,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChF,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC9E,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,eAAe,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAC1C,oBAAoB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,qBAAqB,EAAE,CAAC,CAC7F,CAAC;IACH,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAC1C,cAAc,CAAC,GAAG,EAAE;YACnB,UAAU,EAAE,eAAe;YAC3B,mBAAmB,EAAE,IAAI;YACzB,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAC,CACF,CAAC;IACH,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QAChB,SAAS,CAAC,GAAG,CAAC,4BAA4B,EAAE,GAAG,EAAE,CAAC,CAAC;YAClD,IAAI,EAAE,4BAA4B;YAClC,KAAK,EAAE,aAAa;YACpB,WAAW,EACV,mJAAmJ;YACpJ,UAAU,EAAE,gBAAgB;YAC5B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE;gBACtC,MAAM,KAAK,GAAI,MAA2B,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;gBACzD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;oBAC1D,MAAM,IAAI,KAAK,CACd,2DAA2D,2BAA2B,cAAc,CACpG,CAAC;gBACH,CAAC;gBACD,OAAO;oBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC3B,CAAC;YACH,CAAC;SACD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,OAAO;YAAE,OAAO,CAAC,mCAAmC,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC/F,IAAI,CAAC,kBAAkB;YAAE,OAAO,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,kBAAkB,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5G,IAAI,CAAC,YAAY,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC3D,OAAO,CAAC,mCAAmC,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACpE,MAAM,mBAAmB,GAAG,IAAI,4BAA4B,EAAE,CAAC;IAC/D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5F,MAAM,aAAa,GAClB,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,qBAAqB,CAAC,KAAK,IAAI,CAAC;IACjG,MAAM,qBAAqB,GAAG;QAC7B,GAAG,yBAAyB;QAC5B,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,qBAAqB,CAAC,CAAC;IAC9D,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACxG,IAAI,kBAAkB,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wBAAwB,kBAAkB,wCAAwC,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,GAAG,qBAAqB,EAAE,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAClG,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS,cAAc,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;IACrE,MAAM,uBAAuB,GAAG,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACxG,IAAI,uBAAuB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,yDAAyD,uBAAuB,IAAI,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAClD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAClG,CAAC;IACF,MAAM,oBAAoB,GAAG,OAAO,CAAC,KAAK;QACzC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CACrB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,6BAA6B,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAC3F,CAAC;IACJ,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK;QACjC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9D,CAAC,CAAC,cAAc,CAAC,MAAM,CACrB,CAAC,IAAI,EAAE,EAAE,CACR,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YACpF,CAAC,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CACrD,CAAC;IACJ,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,YAAY,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/G,IAAI,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK;QAC5B,CAAC,CAAC,IAAI,iBAAiB,CAAC;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC;QACH,CAAC,CAAC,SAAS,CAAC;IACb,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,MAAM,mBAAmB,GACxB,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QACpC,CAAC,CAAC;YACA,mBAAmB,EAAE,kBAAkB;YACvC,cAAc,EAAE,WAAW;YAC3B,oBAAoB,EAAE,WAAW;SACjC;QACF,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,YAAY,GAAuB;QACxC,EAAE,EAAE,0BAA0B;QAC9B,YAAY,EAAE;YACb,iBAAiB;YACjB,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAE,CAAC,cAAc,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,qBAAqB,CAAC;gBAC7C,cAAc,CAAC,GAAG,CAAC,sBAAsB,CAAC;gBAC1C,cAAc,CAAC,GAAG,CAAC,sBAAsB,CAAC;gBACzC,CAAC,CAAE,CAAC,cAAc,CAAW;gBAC7B,CAAC,CAAC,EAAE,CAAC;SACN;QACD,YAAY;QACZ,WAAW;QACX,YAAY,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzC,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IACF,MAAM,aAAa,GAAuB;QACzC,EAAE,EAAE,2BAA2B;QAC/B,YAAY,EAAE,CAAC,kBAAkB,CAAC;QAClC,YAAY;QACZ,WAAW;QACX,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QACtE,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IAEF,OAAO;QACN,KAAK,EAAE,eAAe,CACrB,OAAO,CAAC,GAAG,EACX,YAAY,EACZ,mBAAmB,EACnB,mBAAmB,EACnB,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,qBAAqB,EAC7B,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,oBAAoB,EAC5B,OAAO,CAAC,kBAAkB,CAC1B;QACD,OAAO,EAAE,KAAK,IAAI,EAAE;YACnB,IAAI,OAAO,CAAC,eAAe;gBAAE,4BAA4B,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACnF,MAAM,mBAAmB,CAAC,OAAO,EAAE,CAAC;QACrC,CAAC;QACD,YAAY;QACZ,WAAW;QACX,oBAAoB;QACpB,cAAc,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;YAC5C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,QAAQ,CAAC,IAAI,4CAA4C,EAAE,CAAC;YACzG,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACf,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,QAAQ,CAAC,IAAI,wCAAwC,EAAE,CAAC;gBACrG,CAAC;gBACD,IAAI,CAAC;oBACJ,OAAO,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBACzD,OAAO,SAAS,CAAC;gBAClB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;wBACnD,IAAI,KAAK,CAAC,MAAM,KAAK,kBAAkB;4BAAE,MAAM,KAAK,CAAC;wBACrD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,KAAK,CAAC,UAAU,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC7F,CAAC;oBACD,MAAM,KAAK,CAAC;gBACb,CAAC;YACF,CAAC;YACD,MAAM,OAAO,GAAG,gBAAgB,CAAC;gBAChC,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,IAAI;gBACJ,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,QAAQ,EAAE,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY;aACpF,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;gBAAE,OAAO,SAAS,CAAC;YAClD,OAAO;gBACN,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,sBAAsB,OAAO,CAAC,UAAU,MAAM,OAAO,CAAC,OAAO,IAAI,2BAA2B,EAAE;aACtG,CAAC;QACH,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/B,CAAC;AACH,CAAC","sourcesContent":["import path from \"node:path\";\nimport type { AgentLoopConfig, AgentTool } from \"@caupulican/pi-agent-core\";\nimport { type Static, Type } from \"typebox\";\nimport { STABLE_SHELL_TOOL_NAME } from \"../default-tool-surface.ts\";\nimport { WORKER_MEMORY_READ_TOOL_NAME } from \"../memory/worker-memory-tools.ts\";\nimport {\n\tCapabilityGateway,\n\tCapabilityGatewayDeniedError,\n\ttype GatewayInitialUsage,\n\ttype SharedCapabilityBudget,\n} from \"../orchestration/capability-gateway.ts\";\nimport type {\n\tExecutionGrant,\n\tOrchestrationExecutionPolicy,\n\tToolCapabilityManifest,\n} from \"../orchestration/contracts.ts\";\nimport type { NormalizedProfile } from \"../profile-registry.ts\";\nimport {\n\ttype CredentialExposureBoundary,\n\twrapToolWithCredentialExposureGuard,\n} from \"../secrets/credential-exposure-guard.ts\";\nimport { redactKnownSecrets } from \"../security/secret-text.ts\";\nimport { matchesResourceProfilePattern } from \"../settings-manager.ts\";\nimport { createBashTool } from \"../tools/bash.ts\";\nimport { createEditTool } from \"../tools/edit.ts\";\nimport { FileMutationIntentController } from \"../tools/file-mutation-intent.ts\";\nimport { createFindTool } from \"../tools/find.ts\";\nimport { createGrepTool } from \"../tools/grep.ts\";\nimport { createLsTool } from \"../tools/ls.ts\";\nimport { createPythonTool } from \"../tools/python.ts\";\nimport { createReadTool } from \"../tools/read.ts\";\nimport { createRunProcessTool } from \"../tools/run-process.ts\";\nimport { disposeShellExecutionSession } from \"../tools/shell-execution-session.ts\";\nimport { createWriteTool } from \"../tools/write.ts\";\nimport type { CapabilityEnvelope } from \"./contracts.ts\";\nimport { evaluateToolGate } from \"./gates.ts\";\nimport type { WorkerToolAdapterRegistry } from \"./worker-tool-adapter-registry.ts\";\n\nconst READ_ONLY_LANE_TOOL_NAMES = [\"read\", \"grep\", \"find\", \"ls\"] as const;\nconst WRITE_LANE_TOOL_NAMES = [\"write\", \"edit\"] as const;\nconst PYTHON_LANE_TOOL_NAME = \"python\" as const;\nconst PROCESS_LANE_TOOL_NAME = \"run_process\" as const;\nconst MAX_LANE_MEMORY_QUERY_CHARS = 4_096;\nconst laneMemorySchema = Type.Object({\n\tquery: Type.String({\n\t\tmaxLength: MAX_LANE_MEMORY_QUERY_CHARS,\n\t\tdescription: \"What relevant standing memory or prior evidence to retrieve\",\n\t}),\n});\ntype LaneMemoryParams = Static<typeof laneMemorySchema>;\nconst WRITE_LANE_TOOL_NAME_SET = new Set<string>(WRITE_LANE_TOOL_NAMES);\n\nexport interface LaneToolSurface {\n\t/** Fresh tools owned by this lane only; no foreground tool instances or extension state leak in. */\n\ttools: AgentTool[];\n\t/** Release exact mutation payload leases owned by this isolated lane. */\n\tdispose(): Promise<void>;\n\t/** Exact names after profile globs are expanded. Safe to persist in a capability envelope. */\n\tallowedTools: string[];\n\t/** Exact safe-candidate names denied by the profile's block patterns. */\n\tdeniedTools: string[];\n\t/** Explicit grants that bind to no classified lane candidate (opaque tools stay fail-closed). */\n\tunboundAllowPatterns: string[];\n\t/** Per-call path and capability gate for the isolated worker loop. */\n\tbeforeToolCall: NonNullable<AgentLoopConfig[\"beforeToolCall\"]>;\n\t/** Canonical cumulative authority/budget meter for a compiled worker grant. */\n\tgateway?: CapabilityGateway;\n}\n\nexport interface LaneToolSurfaceOptions {\n\tcwd: string;\n\tprofile?: NormalizedProfile;\n\t/** Private harness state that generic file tools must never traverse. */\n\tdeniedPaths?: readonly string[];\n\t/** Orchestrator-requested, policy-filtered read-only memory retrieval. Omitted means no memory tool. */\n\treadMemory?: (query: string) => Promise<string>;\n\t/** Research never sets this. Workers require both this flag and at least one write path. */\n\twriteEnabled?: boolean;\n\twritePaths?: readonly string[];\n\t/** Present only for process-capable owner profiles; absent means no process tool is materialized. */\n\texecutionPolicy?: OrchestrationExecutionPolicy;\n\tprocessMaxWallClockMs?: number;\n\t/** Stable per-agent shell identity. Omitted when the compiled plan does not grant a host shell. */\n\tshellSessionKey?: string;\n\t/** Host-owned managed directory for complete shell output; never inferred from process-global config. */\n\tshellOutputDirectory?: string;\n\t/** Compiled policy path. When present, it is the only authorization source for this surface. */\n\tgrant?: ExecutionGrant;\n\ttoolManifests?: readonly ToolCapabilityManifest[];\n\t/** Durable cumulative active usage to seed the compiled grant's gateway on resume. */\n\tinitialUsage?: GatewayInitialUsage;\n\t/** Owner aggregate meter shared across retries and verification for this durable worker task. */\n\tsharedBudget?: SharedCapabilityBudget;\n\t/** Host-owned fresh factories for worker-safe foreground/extension tools. */\n\tworkerToolAdapters?: WorkerToolAdapterRegistry;\n}\n\nfunction strictLaneProfilePatterns(profile: NormalizedProfile | undefined): {\n\tallow: string[];\n\tblock: string[];\n} {\n\tif (!profile) return { allow: [], block: [] };\n\tconst filter = profile.resources.tools;\n\tconst allow = [...(filter?.allow ?? [])];\n\tconst block = [...(filter?.block ?? [])];\n\t// Strict UAC: a shipped profile is the complete authority grant. Grant-all must be explicit.\n\tif (allow.length === 0 && block.length === 0) return { allow: [], block: [\"*\"] };\n\treturn { allow, block };\n}\n\nfunction resolveWriteRoots(cwd: string, writePaths: readonly string[]): string[] {\n\treturn writePaths.map((entry) => (path.isAbsolute(entry) ? path.resolve(entry) : path.resolve(cwd, entry)));\n}\n\nfunction createLaneTools(\n\tcwd: string,\n\tnames: readonly string[],\n\tfileMutationIntents: FileMutationIntentController,\n\tprivatePathBoundary?: CredentialExposureBoundary,\n\treadMemory?: (query: string) => Promise<string>,\n\texecutionPolicy?: OrchestrationExecutionPolicy,\n\tprocessMaxWallClockMs = 0,\n\tshellSessionKey?: string,\n\tshellOutputDirectory?: string,\n\tworkerToolAdapters?: WorkerToolAdapterRegistry,\n): AgentTool[] {\n\tconst factories = new Map<string, () => AgentTool>([\n\t\t[\"read\", () => createReadTool(cwd)],\n\t\t[\"grep\", () => createGrepTool(cwd)],\n\t\t[\"find\", () => createFindTool(cwd)],\n\t\t[\"ls\", () => createLsTool(cwd)],\n\t\t[\"write\", () => createWriteTool(cwd, { intentController: fileMutationIntents })],\n\t\t[\"edit\", () => createEditTool(cwd, { intentController: fileMutationIntents })],\n\t\t[PYTHON_LANE_TOOL_NAME, () => createPythonTool(cwd)],\n\t]);\n\tif (executionPolicy) {\n\t\tfactories.set(PROCESS_LANE_TOOL_NAME, () =>\n\t\t\tcreateRunProcessTool(cwd, { policy: executionPolicy, maxWallClockMs: processMaxWallClockMs }),\n\t\t);\n\t}\n\tif (shellSessionKey) {\n\t\tfactories.set(STABLE_SHELL_TOOL_NAME, () =>\n\t\t\tcreateBashTool(cwd, {\n\t\t\t\tsessionKey: shellSessionKey,\n\t\t\t\tprewarmWindowsShell: true,\n\t\t\t\t...(shellOutputDirectory ? { outputDirectory: shellOutputDirectory } : {}),\n\t\t\t}),\n\t\t);\n\t}\n\tif (readMemory) {\n\t\tfactories.set(WORKER_MEMORY_READ_TOOL_NAME, () => ({\n\t\t\tname: WORKER_MEMORY_READ_TOOL_NAME,\n\t\t\tlabel: \"Read Memory\",\n\t\t\tdescription:\n\t\t\t\t\"Retrieve bounded, source-labeled standing memory relevant to this delegated task. Read-only: no memory writes or lifecycle actions are available.\",\n\t\t\tparameters: laneMemorySchema,\n\t\t\texecute: async (_toolCallId, params) => {\n\t\t\t\tconst query = (params as LaneMemoryParams).query?.trim();\n\t\t\t\tif (!query || query.length > MAX_LANE_MEMORY_QUERY_CHARS) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`memory_query_invalid: query must contain from 1 through ${MAX_LANE_MEMORY_QUERY_CHARS} characters.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ type: \"text\" as const, text: await readMemory(query) }],\n\t\t\t\t\tdetails: { readOnly: true },\n\t\t\t\t};\n\t\t\t},\n\t\t}));\n\t}\n\treturn names.flatMap((name) => {\n\t\tconst factory = factories.get(name);\n\t\tif (factory) return [wrapToolWithCredentialExposureGuard(factory(), cwd, privatePathBoundary)];\n\t\tif (!workerToolAdapters) return [];\n\t\tconst materialized = workerToolAdapters.materialize(name, { cwd, credentialBoundary: privatePathBoundary });\n\t\tif (!materialized.ok) throw new Error(materialized.reason);\n\t\treturn [wrapToolWithCredentialExposureGuard(materialized.tool, cwd, privatePathBoundary)];\n\t});\n}\n\n/**\n * Materialize a fresh, fail-closed tool surface for one isolated lane.\n *\n * Admission selects only tools this isolated lane can materialize. A compiled grant is the only\n * authority source for worker lanes. Write/edit additionally require the global write switch and a\n * positive path scope.\n */\nexport function createLaneToolSurface(options: LaneToolSurfaceOptions): LaneToolSurface {\n\tconst fileMutationIntents = new FileMutationIntentController();\n\tconst writeCapable = options.writeEnabled === true && (options.writePaths?.length ?? 0) > 0;\n\tconst pythonCapable =\n\t\toptions.toolManifests?.some((manifest) => manifest.toolName === PYTHON_LANE_TOOL_NAME) === true;\n\tconst builtInCandidateNames = [\n\t\t...READ_ONLY_LANE_TOOL_NAMES,\n\t\t...(options.readMemory ? [WORKER_MEMORY_READ_TOOL_NAME] : []),\n\t\t...(writeCapable ? WRITE_LANE_TOOL_NAMES : []),\n\t\t...(pythonCapable ? [PYTHON_LANE_TOOL_NAME] : []),\n\t\t...(options.executionPolicy ? [PROCESS_LANE_TOOL_NAME] : []),\n\t\t...(options.shellSessionKey ? [STABLE_SHELL_TOOL_NAME] : []),\n\t];\n\tconst builtInNameSet = new Set<string>(builtInCandidateNames);\n\tconst conflictingAdapter = options.workerToolAdapters?.names().find((name) => builtInNameSet.has(name));\n\tif (conflictingAdapter) {\n\t\tthrow new Error(`Worker tool adapter '${conflictingAdapter}' conflicts with a built-in lane tool.`);\n\t}\n\tconst candidateNames = [...builtInCandidateNames, ...(options.workerToolAdapters?.names() ?? [])];\n\tconst candidateNameSet = new Set<string>(candidateNames);\n\tconst patterns = strictLaneProfilePatterns(options.profile);\n\tconst compiledToolNames = new Set(options.grant?.allowedTools ?? []);\n\tconst unmaterializedGrantTool = options.grant?.allowedTools.find((name) => !candidateNameSet.has(name));\n\tif (unmaterializedGrantTool) {\n\t\tthrow new Error(`Compiled lane grant references unmaterializable tool '${unmaterializedGrantTool}'.`);\n\t}\n\tconst deniedTools = candidateNames.filter((name) =>\n\t\toptions.grant ? !compiledToolNames.has(name) : matchesResourceProfilePattern(name, patterns.block),\n\t);\n\tconst unboundAllowPatterns = options.grant\n\t\t? []\n\t\t: patterns.allow.filter(\n\t\t\t\t(pattern) => !candidateNames.some((name) => matchesResourceProfilePattern(name, [pattern])),\n\t\t\t);\n\tconst allowedTools = options.grant\n\t\t? candidateNames.filter((name) => compiledToolNames.has(name))\n\t\t: candidateNames.filter(\n\t\t\t\t(name) =>\n\t\t\t\t\t(patterns.allow.length === 0 || matchesResourceProfilePattern(name, patterns.allow)) &&\n\t\t\t\t\t!matchesResourceProfilePattern(name, patterns.block),\n\t\t\t);\n\tconst allowedToolSet = new Set<string>(allowedTools);\n\tconst manifestsByName = new Map(options.toolManifests?.map((manifest) => [manifest.toolName, manifest]) ?? []);\n\tif (options.grant?.allowedTools.some((name) => !manifestsByName.has(name))) {\n\t\tthrow new Error(\"Compiled lane grant references a tool without a capability manifest.\");\n\t}\n\tconst gateway = options.grant\n\t\t? new CapabilityGateway({\n\t\t\t\tgrant: options.grant,\n\t\t\t\tcwd: options.cwd,\n\t\t\t\t...(options.initialUsage !== undefined ? { initialUsage: options.initialUsage } : {}),\n\t\t\t\t...(options.sharedBudget ? { sharedBudget: options.sharedBudget } : {}),\n\t\t\t})\n\t\t: undefined;\n\tconst deniedPaths = options.deniedPaths?.map((entry) => path.resolve(entry));\n\tconst privatePathBoundary =\n\t\tdeniedPaths && deniedPaths.length > 0\n\t\t\t? {\n\t\t\t\t\tredactSensitiveText: redactKnownSecrets,\n\t\t\t\t\tprotectedFiles: deniedPaths,\n\t\t\t\t\tprotectedDirectories: deniedPaths,\n\t\t\t\t}\n\t\t\t: undefined;\n\tconst readEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-read-tools\",\n\t\tcapabilities: [\n\t\t\t\"filesystem.read\",\n\t\t\t...(allowedToolSet.has(WORKER_MEMORY_READ_TOOL_NAME) ? ([\"memory.query\"] as const) : []),\n\t\t\t...(allowedToolSet.has(PYTHON_LANE_TOOL_NAME) ||\n\t\t\tallowedToolSet.has(PROCESS_LANE_TOOL_NAME) ||\n\t\t\tallowedToolSet.has(STABLE_SHELL_TOOL_NAME)\n\t\t\t\t? ([\"process.exec\"] as const)\n\t\t\t\t: []),\n\t\t],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: [path.resolve(options.cwd)],\n\t\t...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),\n\t};\n\tconst writeEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-write-tools\",\n\t\tcapabilities: [\"filesystem.write\"],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: resolveWriteRoots(options.cwd, options.writePaths ?? []),\n\t\t...(deniedPaths && deniedPaths.length > 0 ? { deniedPaths } : {}),\n\t};\n\n\treturn {\n\t\ttools: createLaneTools(\n\t\t\toptions.cwd,\n\t\t\tallowedTools,\n\t\t\tfileMutationIntents,\n\t\t\tprivatePathBoundary,\n\t\t\toptions.readMemory,\n\t\t\toptions.executionPolicy,\n\t\t\toptions.processMaxWallClockMs,\n\t\t\toptions.shellSessionKey,\n\t\t\toptions.shellOutputDirectory,\n\t\t\toptions.workerToolAdapters,\n\t\t),\n\t\tdispose: async () => {\n\t\t\tif (options.shellSessionKey) disposeShellExecutionSession(options.shellSessionKey);\n\t\t\tawait fileMutationIntents.dispose();\n\t\t},\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tunboundAllowPatterns,\n\t\tbeforeToolCall: async ({ toolCall, args }) => {\n\t\t\tif (!allowedToolSet.has(toolCall.name)) {\n\t\t\t\treturn { block: true, reason: `Lane tool '${toolCall.name}' is outside the materialized UAC surface.` };\n\t\t\t}\n\t\t\tif (gateway) {\n\t\t\t\tconst manifest = manifestsByName.get(toolCall.name);\n\t\t\t\tif (!manifest) {\n\t\t\t\t\treturn { block: true, reason: `Lane tool '${toolCall.name}' has no compiled capability manifest.` };\n\t\t\t\t}\n\t\t\t\ttry {\n\t\t\t\t\tgateway.authorizeToolCall(manifest, toolCall.name, args);\n\t\t\t\t\treturn undefined;\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (error instanceof CapabilityGatewayDeniedError) {\n\t\t\t\t\t\tif (error.status === \"budget_exhausted\") throw error;\n\t\t\t\t\t\treturn { block: true, reason: `Lane tool blocked (${error.reasonCode}): ${error.message}` };\n\t\t\t\t\t}\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst outcome = evaluateToolGate({\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\targs,\n\t\t\t\tcwd: options.cwd,\n\t\t\t\tenvelope: WRITE_LANE_TOOL_NAME_SET.has(toolCall.name) ? writeEnvelope : readEnvelope,\n\t\t\t});\n\t\t\tif (outcome.outcome === \"allow\") return undefined;\n\t\t\treturn {\n\t\t\t\tblock: true,\n\t\t\t\treason: `Lane tool blocked (${outcome.reasonCode}): ${outcome.message ?? \"capability gate denied it\"}`,\n\t\t\t};\n\t\t},\n\t\t...(gateway ? { gateway } : {}),\n\t};\n}\n"]}

package/dist/core/autonomy/worker-session-private-scope.d.ts

@@ -0,0 +1,12 @@
+import type { CapabilityEnvelope } from "./contracts.ts";
+export declare const PI_WORKER_ALLOWED_PATHS_ENV = "PI_WORKER_ALLOWED_PATHS";
+export declare function parseWorkerSessionAllowedPaths(raw: string | undefined): readonly string[];
+export declare function encodeWorkerSessionAllowedPaths(paths: readonly string[]): string;
+/**
+ * Structural filesystem envelope for a standalone worker process (for example a Pi child launched
+ * in tmux). An empty allow list deliberately preserves the worker's host-wide project access while
+ * the private harness roots remain denied. Process tools are not path-confined by this envelope:
+ * bash/python are explicit host-trust boundaries and retain their OS-visible filesystem surface.
+ */
+export declare function buildWorkerSessionPrivatePathEnvelope(cwd: string, agentDir: string, allowedPaths?: readonly string[]): CapabilityEnvelope;
+//# sourceMappingURL=worker-session-private-scope.d.ts.map

package/dist/core/autonomy/worker-session-private-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-session-private-scope.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/worker-session-private-scope.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGzD,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,CAoBzF;AAED,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAEhF;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,CACpD,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,YAAY,GAAE,SAAS,MAAM,EAA6E,GACxG,kBAAkB,CAUpB"}

package/dist/core/autonomy/worker-session-private-scope.js

@@ -0,0 +1,42 @@
+import * as path from "node:path";
+import { getPrivateLaneDeniedPaths } from "./lane-private-paths.js";
+export const PI_WORKER_ALLOWED_PATHS_ENV = "PI_WORKER_ALLOWED_PATHS";
+export function parseWorkerSessionAllowedPaths(raw) {
+    if (raw === undefined)
+        return Object.freeze([]);
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`${PI_WORKER_ALLOWED_PATHS_ENV} must be a JSON array of absolute paths.`);
+    }
+    if (!Array.isArray(parsed) ||
+        !parsed.every((entry) => typeof entry === "string" &&
+            entry.trim().length > 0 &&
+            (path.isAbsolute(entry) || path.win32.isAbsolute(entry)))) {
+        throw new Error(`${PI_WORKER_ALLOWED_PATHS_ENV} must be a JSON array of absolute paths.`);
+    }
+    return Object.freeze([...new Set(parsed.map((entry) => entry.trim()))]);
+}
+export function encodeWorkerSessionAllowedPaths(paths) {
+    return JSON.stringify(parseWorkerSessionAllowedPaths(JSON.stringify(paths)));
+}
+/**
+ * Structural filesystem envelope for a standalone worker process (for example a Pi child launched
+ * in tmux). An empty allow list deliberately preserves the worker's host-wide project access while
+ * the private harness roots remain denied. Process tools are not path-confined by this envelope:
+ * bash/python are explicit host-trust boundaries and retain their OS-visible filesystem surface.
+ */
+export function buildWorkerSessionPrivatePathEnvelope(cwd, agentDir, allowedPaths = parseWorkerSessionAllowedPaths(process.env[PI_WORKER_ALLOWED_PATHS_ENV])) {
+    const capabilities = Object.freeze(["filesystem.read", "filesystem.write"]);
+    const immutableAllowedPaths = Object.freeze([...allowedPaths]);
+    const deniedPaths = Object.freeze(getPrivateLaneDeniedPaths(cwd, agentDir));
+    return Object.freeze({
+        id: "worker-session-private-paths",
+        capabilities,
+        allowedPaths: immutableAllowedPaths,
+        deniedPaths,
+    });
+}
+//# sourceMappingURL=worker-session-private-scope.js.map

package/dist/core/autonomy/worker-session-private-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-session-private-scope.js","sourceRoot":"","sources":["../../../src/core/autonomy/worker-session-private-scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,MAAM,CAAC,MAAM,2BAA2B,GAAG,yBAAyB,CAAC;AAErE,MAAM,UAAU,8BAA8B,CAAC,GAAuB;IACrE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAChD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,0CAA0C,CAAC,CAAC;IAC3F,CAAC;IACD,IACC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACtB,CAAC,MAAM,CAAC,KAAK,CACZ,CAAC,KAAK,EAAE,EAAE,CACT,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YACvB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CACzD,EACA,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,0CAA0C,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAAwB;IACvE,OAAO,IAAI,CAAC,SAAS,CAAC,8BAA8B,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CACpD,GAAW,EACX,QAAgB,EAChB,YAAY,GAAsB,8BAA8B,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAE1G,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,iBAAiB,EAAE,kBAAkB,CAAU,CAAC,CAAC;IACrF,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,EAAE,EAAE,8BAA8B;QAClC,YAAY;QACZ,YAAY,EAAE,qBAAqB;QACnC,WAAW;KACX,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import * as path from \"node:path\";\nimport type { CapabilityEnvelope } from \"./contracts.ts\";\nimport { getPrivateLaneDeniedPaths } from \"./lane-private-paths.ts\";\n\nexport const PI_WORKER_ALLOWED_PATHS_ENV = \"PI_WORKER_ALLOWED_PATHS\";\n\nexport function parseWorkerSessionAllowedPaths(raw: string | undefined): readonly string[] {\n\tif (raw === undefined) return Object.freeze([]);\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(raw);\n\t} catch {\n\t\tthrow new Error(`${PI_WORKER_ALLOWED_PATHS_ENV} must be a JSON array of absolute paths.`);\n\t}\n\tif (\n\t\t!Array.isArray(parsed) ||\n\t\t!parsed.every(\n\t\t\t(entry) =>\n\t\t\t\ttypeof entry === \"string\" &&\n\t\t\t\tentry.trim().length > 0 &&\n\t\t\t\t(path.isAbsolute(entry) || path.win32.isAbsolute(entry)),\n\t\t)\n\t) {\n\t\tthrow new Error(`${PI_WORKER_ALLOWED_PATHS_ENV} must be a JSON array of absolute paths.`);\n\t}\n\treturn Object.freeze([...new Set(parsed.map((entry) => entry.trim()))]);\n}\n\nexport function encodeWorkerSessionAllowedPaths(paths: readonly string[]): string {\n\treturn JSON.stringify(parseWorkerSessionAllowedPaths(JSON.stringify(paths)));\n}\n\n/**\n * Structural filesystem envelope for a standalone worker process (for example a Pi child launched\n * in tmux). An empty allow list deliberately preserves the worker's host-wide project access while\n * the private harness roots remain denied. Process tools are not path-confined by this envelope:\n * bash/python are explicit host-trust boundaries and retain their OS-visible filesystem surface.\n */\nexport function buildWorkerSessionPrivatePathEnvelope(\n\tcwd: string,\n\tagentDir: string,\n\tallowedPaths: readonly string[] = parseWorkerSessionAllowedPaths(process.env[PI_WORKER_ALLOWED_PATHS_ENV]),\n): CapabilityEnvelope {\n\tconst capabilities = Object.freeze([\"filesystem.read\", \"filesystem.write\"] as const);\n\tconst immutableAllowedPaths = Object.freeze([...allowedPaths]);\n\tconst deniedPaths = Object.freeze(getPrivateLaneDeniedPaths(cwd, agentDir));\n\treturn Object.freeze({\n\t\tid: \"worker-session-private-paths\",\n\t\tcapabilities,\n\t\tallowedPaths: immutableAllowedPaths,\n\t\tdeniedPaths,\n\t});\n}\n"]}