@caupulican/pi-adaptative 0.94.1 → 0.96.0

package/dist/core/tools/tmux-dispatch.js

@@ -1,25 +1,10 @@
-/**
- * Classify a `fire_task` launch failure into an honest, stable skip reason. For an UNATTENDED
- * caller (`ctx.hasUI === false`, always true from the goal/idle path) `authorizeLaunch`'s ONLY
- * refusal throw is the no-standing-grant error (`tmux-agent-manager/index.ts`'s `authorizeLaunch`,
- * message containing the stable phrase "no standing grant") -- matched here by substring since the
- * extension throws a plain `Error`, not a tagged error code (documented follow-up hardening, not
- * blocking). Every other thrown error (a bad jobId, a live session-name collision,
- * an environment failure) maps onto the generic `"tmux_dispatch_failed"` -- still surfaced through
- * the existing `dispatchSkipReason` contract, never a crash and never a silently-ignored failure.
- */
-export function classifyDispatchError(error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return message.includes("no standing grant") ? "no_standing_grant" : "tmux_dispatch_failed";
-}
 /**
  * Structurally dispatch ONE persistent tmux worker agent for a single goal requirement, by
  * invoking the SAME `tmux_agent_manager` `fire_task` tool call the model itself would make. Core
  * -- not model discretion -- decides WHEN this fires (the goal tool's `dispatchTarget:"tmux"`
- * routing gates the call); the launch itself always still goes through the extension's own
- * grant-gated `authorizeLaunch`, so an ungranted unattended call is honestly refused here (never a
- * silent launch, never a fabricated laneId) and the refusal is surfaced through the existing
- * `dispatchSkipReason` contract on the goal tool's response.
+ * routing gates the call). The extension derives an immutable child profile from the parent's
+ * admitted worker surface and reserves it durably before launch; no separate approval handshake is
+ * involved. Any launch failure is surfaced through the existing `dispatchSkipReason` contract.
  */
 export async function dispatchTmuxWorker(deps, args) {
     // Capability check FIRST -- before the tool-definition lookup and before createLaneWorktree --
@@ -86,8 +71,8 @@ export async function dispatchTmuxWorker(deps, args) {
     try {
         result = await toolDef.execute(toolCallId, params, ctx.signal, undefined, ctx);
     }
-    catch (error) {
-        return { skipReason: classifyDispatchError(error) };
+    catch {
+        return { skipReason: "tmux_dispatch_failed" };
     }
     // Correlate: the extension reports its dispatch under its OWN caller-chosen laneId
     // (`tmux:${job.id}:${agent.id}`, reconstructed here from the tool result's `details.job` --

package/dist/core/tools/tmux-dispatch.js.map

@@ -1 +1 @@
-{"version":3,"file":"tmux-dispatch.js","sourceRoot":"","sources":["../../../src/core/tools/tmux-dispatch.ts"],"names":[],"mappings":"AAuDA;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IACnD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,sBAAsB,CAAC;AAC7F,CAAC;AAaD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,IAAsB,EACtB,IAAqD;IAErD,+FAA+F;IAC/F,gGAAgG;IAChG,8FAA8F;IAC9F,6FAA6F;IAC7F,kGAAkG;IAClG,IAAI,IAAI,CAAC,yBAAyB,EAAE,EAAE,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO,EAAE,UAAU,EAAE,gCAAgC,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO;QAAE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;IAE/F,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,CAAC;IAC7D,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,UAAU,EAAE,2BAA2B,EAAE,CAAC;IAEjE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,iBAAiB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;IAC1E,IAAI,CAAC;QACJ,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,UAAU,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QAClH,MAAM,KAAK,GAAI,WAAW,CAAC,OAA8C,EAAE,KAAK,CAAC;QACjF,IAAI,KAAK,EAAE,OAAO,KAAK,IAAI;YAAE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACR,gGAAgG;QAChG,4EAA4E;QAC5E,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;IAC3C,CAAC;IAED,+FAA+F;IAC/F,gEAAgE;IAChE,kGAAkG;IAClG,kGAAkG;IAClG,+FAA+F;IAC/F,kGAAkG;IAClG,sBAAsB;IACtB,IAAI,YAAmE,CAAC;IACxE,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7F,IAAI,YAAY,IAAI,OAAO;YAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,CAAC;QAC7E,YAAY,GAAG,OAAO,CAAC;IACxB,CAAC;IAED,wFAAwF;IACxF,yFAAyF;IACzF,yFAAyF;IACzF,0BAA0B;IAC1B,MAAM,MAAM,GAAG;QACd,MAAM,EAAE,WAAW;QACnB,IAAI,EAAE,IAAI,CAAC,YAAY;QACvB,MAAM;QACN,MAAM,EAAE;YACP,YAAY;gBACX,CAAC,CAAC;oBACA,QAAQ,EAAE,IAAI;oBACd,IAAI,EAAE,aAAa;oBACnB,GAAG,EAAE,YAAY,CAAC,YAAY;oBAC9B,YAAY,EAAE,YAAY,CAAC,OAAO;iBAClC;gBACF,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE;SAC1C;KACD,CAAC;IACF,IAAI,MAAsD,CAAC;IAC3D,IAAI,CAAC;QACJ,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,UAAU,EAAE,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;IACrD,CAAC;IAED,mFAAmF;IACnF,4FAA4F;IAC5F,4FAA4F;IAC5F,yFAAyF;IACzF,sEAAsE;IACtE,MAAM,GAAG,GAAI,MAAM,CAAC,OAA6C,EAAE,GAAG,CAAC;IACvE,MAAM,OAAO,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE;QAAE,OAAO,EAAE,UAAU,EAAE,0BAA0B,EAAE,CAAC;IAEhF,MAAM,YAAY,GAAG,QAAQ,GAAG,CAAC,EAAE,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;IACpD,MAAM,gBAAgB,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACjE,OAAO,gBAAgB,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,yBAAyB,EAAE,CAAC;AACjH,CAAC","sourcesContent":["import type { ExtensionContext, ToolDefinition } from \"../extensions/types.ts\";\nimport type { LaneWorkerRefusal } from \"../model-capability.ts\";\n\n/**\n * Dependencies for {@link dispatchTmuxWorker}, injected from the construction site\n * (`RuntimeBuilder`) so the adapter itself stays a small, unit-testable, faux-tool-driven module\n * with no direct dependency on `AgentSession`/`ExtensionRunner`/`BackgroundLaneController`.\n */\nexport interface TmuxDispatchDeps {\n\t/** Runtime platform seam. Native Windows has no supported tmux backend; WSL reports `linux`. */\n\tplatform?: NodeJS.Platform;\n\t/** Look up a registered tool by name -- the SAME seam the model's own tool calls resolve\n\t * through (`AgentSession.getToolDefinition` -> `RuntimeBuilder.getToolDefinition`). `undefined`\n\t * when the tmux extension is not loaded in this session -- an honest, non-fatal skip, not a\n\t * crash and not a silent no-op. */\n\tgetToolDefinition: (name: string) => ToolDefinition | undefined;\n\t/** Build a fresh, non-turn-bound `ExtensionContext` for this call\n\t * (`ExtensionRunner.createContext()`) -- safe to invoke from the goal/idle path, outside any\n\t * live model turn. */\n\tcreateExtensionContext: () => ExtensionContext;\n\t/**\n\t * Confirm that the tmux extension's caller-chosen lane id (reconstructed below from the\n\t * `fire_task` result's `details.job`) was durably registered by the host. The returned id is\n\t * identity-preserving and is the same value `Requirement.boundLaneId` uses.\n\t */\n\tresolveManagedLaneId: (callerLaneId: string) => string | undefined;\n\t/** Active goal id, threaded onto the `fire_task` call so the dispatched lane is goal-tagged\n\t * (`ManagedLaneEvent.goalId`) -- `undefined` when no goal is active (dispatch still proceeds;\n\t * the resulting lane is simply untagged). */\n\tgetGoalId: () => string | undefined;\n\t/**\n\t * Worktree-sync lane-first dispatch (opt-in -- wired ONLY inside `runtime-builder.ts`'s\n\t * `worktreeSync.enabled` block, via the engine's `createLane`): when present, `dispatchTmuxWorker`\n\t * creates a fresh worktree-sync lane for this requirement BEFORE issuing any `fire_task` call, so\n\t * a creation refusal aborts cleanly before any tmux/pane side effect ever runs -- never a\n\t * half-made lane, never a fabricated worktree. On success the dispatched agent's `cwd` is the new\n\t * lane worktree and it carries `worktreeLane` (threaded to the tmux extension's launch profile --\n\t * see `dispatch-grant.ts`'s `buildLaunchProfileFlags`). Absent dep -> existing byte-identical\n\t * `params.agents` (no `cwd`/`worktreeLane`), exactly as before this field existed.\n\t */\n\tcreateLaneWorktree?: (args: {\n\t\tgoalId?: string;\n\t\trequirementId: string;\n\t}) => Promise<{ laneKey: string; worktreePath: string } | { skipReason: string }>;\n\t/**\n\t * Lane-worker capability eligibility (opt-in -- wired only from `runtime-builder.ts`, backed by\n\t * `AgentSession.getLaneWorkerRefusal`): checked FIRST, before `createLaneWorktree`, so an\n\t * ineligible model's dispatch is refused before any lane/pane side effect ever runs. This is the\n\t * parent's best-effort check only -- the dispatched child session refuses authoritatively at its\n\t * own startup (main.ts) regardless of what the parent decides here. Absent dep -> no capability\n\t * check runs, byte-identical to before this field existed.\n\t */\n\tevaluateWorkerLaneRefusal?: () => LaneWorkerRefusal | undefined;\n}\n\n/**\n * Classify a `fire_task` launch failure into an honest, stable skip reason. For an UNATTENDED\n * caller (`ctx.hasUI === false`, always true from the goal/idle path) `authorizeLaunch`'s ONLY\n * refusal throw is the no-standing-grant error (`tmux-agent-manager/index.ts`'s `authorizeLaunch`,\n * message containing the stable phrase \"no standing grant\") -- matched here by substring since the\n * extension throws a plain `Error`, not a tagged error code (documented follow-up hardening, not\n * blocking). Every other thrown error (a bad jobId, a live session-name collision,\n * an environment failure) maps onto the generic `\"tmux_dispatch_failed\"` -- still surfaced through\n * the existing `dispatchSkipReason` contract, never a crash and never a silently-ignored failure.\n */\nexport function classifyDispatchError(error: unknown): string {\n\tconst message = error instanceof Error ? error.message : String(error);\n\treturn message.includes(\"no standing grant\") ? \"no_standing_grant\" : \"tmux_dispatch_failed\";\n}\n\ninterface FireTaskResultDetails {\n\tjob?: {\n\t\tid?: string;\n\t\tagents?: ReadonlyArray<{ id?: string }>;\n\t};\n}\n\ninterface TmuxGuardResultDetails {\n\tguard?: { allowed?: boolean };\n}\n\n/**\n * Structurally dispatch ONE persistent tmux worker agent for a single goal requirement, by\n * invoking the SAME `tmux_agent_manager` `fire_task` tool call the model itself would make. Core\n * -- not model discretion -- decides WHEN this fires (the goal tool's `dispatchTarget:\"tmux\"`\n * routing gates the call); the launch itself always still goes through the extension's own\n * grant-gated `authorizeLaunch`, so an ungranted unattended call is honestly refused here (never a\n * silent launch, never a fabricated laneId) and the refusal is surfaced through the existing\n * `dispatchSkipReason` contract on the goal tool's response.\n */\nexport async function dispatchTmuxWorker(\n\tdeps: TmuxDispatchDeps,\n\targs: { requirementId: string; instructions: string },\n): Promise<{ laneId?: string; skipReason?: string }> {\n\t// Capability check FIRST -- before the tool-definition lookup and before createLaneWorktree --\n\t// so an ineligible model's dispatch is refused with zero lane/pane/tool side effect. The coarse\n\t// \"worker_capability_insufficient\" skip reason is the stable contract code on the goal tool's\n\t// response; the granular reason (class/window/tool-calling) lives only in the refusal object\n\t// itself, surfaced by the caller for logging (see model-capability.ts's formatLaneWorkerRefusal).\n\tif (deps.evaluateWorkerLaneRefusal?.() !== undefined) {\n\t\treturn { skipReason: \"worker_capability_insufficient\" };\n\t}\n\tif ((deps.platform ?? process.platform) === \"win32\") return { skipReason: \"tmux_unavailable\" };\n\n\tconst toolDef = deps.getToolDefinition(\"tmux_agent_manager\");\n\tif (!toolDef) return { skipReason: \"tmux_extension_not_loaded\" };\n\n\tconst goalId = deps.getGoalId();\n\tconst ctx = deps.createExtensionContext();\n\tconst toolCallId = `goal-dispatch:${goalId ?? \"?\"}:${args.requirementId}`;\n\ttry {\n\t\tconst guardResult = await toolDef.execute(`${toolCallId}:guard`, { action: \"guard\" }, ctx.signal, undefined, ctx);\n\t\tconst guard = (guardResult.details as TmuxGuardResultDetails | undefined)?.guard;\n\t\tif (guard?.allowed !== true) return { skipReason: \"tmux_unavailable\" };\n\t} catch {\n\t\t// A guard failure is side-effect free. Treat it as backend unavailability so the goal owner can\n\t\t// safely choose its native worker fallback without fabricating a tmux lane.\n\t\treturn { skipReason: \"tmux_unavailable\" };\n\t}\n\n\t// Availability first, then lane-first: when worktree-sync is wired, create the lane only after\n\t// tmux's pure guard succeeds and BEFORE any fire_task call so a\n\t// creation refusal (max lanes, invalid key, git error, ...) aborts cleanly with no tmux/pane side\n\t// effect ever having run. The specific engine refusal code is deliberately collapsed onto the one\n\t// stable `worktree_create_failed` skip reason -- same narrow `{laneId?, skipReason?}` contract\n\t// every other skip path here already uses; the engine's own detail lives in its audit log, not in\n\t// this narrow return.\n\tlet laneWorktree: { laneKey: string; worktreePath: string } | undefined;\n\tif (deps.createLaneWorktree) {\n\t\tconst created = await deps.createLaneWorktree({ goalId, requirementId: args.requirementId });\n\t\tif (\"skipReason\" in created) return { skipReason: \"worktree_create_failed\" };\n\t\tlaneWorktree = created;\n\t}\n\n\t// Single-agent 1:1 mapping: a bare fire_task with no `agents` defaults to a THREE-agent\n\t// team (pi/agy/codex -- `DEFAULT_AGENT_PROVIDERS`), which would mint three lanes for one\n\t// requirement. A goal-bound dispatch must map to exactly one lane, so `agents` is always\n\t// passed explicitly here.\n\tconst params = {\n\t\taction: \"fire_task\",\n\t\ttask: args.instructions,\n\t\tgoalId,\n\t\tagents: [\n\t\t\tlaneWorktree\n\t\t\t\t? {\n\t\t\t\t\t\tprovider: \"pi\",\n\t\t\t\t\t\tname: \"goal-worker\",\n\t\t\t\t\t\tcwd: laneWorktree.worktreePath,\n\t\t\t\t\t\tworktreeLane: laneWorktree.laneKey,\n\t\t\t\t\t}\n\t\t\t\t: { provider: \"pi\", name: \"goal-worker\" },\n\t\t],\n\t};\n\tlet result: Awaited<ReturnType<ToolDefinition[\"execute\"]>>;\n\ttry {\n\t\tresult = await toolDef.execute(toolCallId, params, ctx.signal, undefined, ctx);\n\t} catch (error) {\n\t\treturn { skipReason: classifyDispatchError(error) };\n\t}\n\n\t// Correlate: the extension reports its dispatch under its OWN caller-chosen laneId\n\t// (`tmux:${job.id}:${agent.id}`, reconstructed here from the tool result's `details.job` --\n\t// the same format `agentLaneId` builds extension-side) which the host's `recordManagedLane`\n\t// bridge preserves as the canonical durable id; `resolveManagedLaneId` confirms that the\n\t// matching dispatch report reached the host before the goal binds it.\n\tconst job = (result.details as FireTaskResultDetails | undefined)?.job;\n\tconst primary = job?.agents?.[0];\n\tif (!job?.id || !primary?.id) return { skipReason: \"tmux_dispatch_incomplete\" };\n\n\tconst callerLaneId = `tmux:${job.id}:${primary.id}`;\n\tconst registeredLaneId = deps.resolveManagedLaneId(callerLaneId);\n\treturn registeredLaneId === callerLaneId ? { laneId: callerLaneId } : { skipReason: \"lane_correlation_failed\" };\n}\n"]}
+{"version":3,"file":"tmux-dispatch.js","sourceRoot":"","sources":["../../../src/core/tools/tmux-dispatch.ts"],"names":[],"mappings":"AAkEA;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,IAAsB,EACtB,IAAqD;IAErD,+FAA+F;IAC/F,gGAAgG;IAChG,8FAA8F;IAC9F,6FAA6F;IAC7F,kGAAkG;IAClG,IAAI,IAAI,CAAC,yBAAyB,EAAE,EAAE,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO,EAAE,UAAU,EAAE,gCAAgC,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO;QAAE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;IAE/F,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,CAAC;IAC7D,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,UAAU,EAAE,2BAA2B,EAAE,CAAC;IAEjE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,iBAAiB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;IAC1E,IAAI,CAAC;QACJ,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,UAAU,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QAClH,MAAM,KAAK,GAAI,WAAW,CAAC,OAA8C,EAAE,KAAK,CAAC;QACjF,IAAI,KAAK,EAAE,OAAO,KAAK,IAAI;YAAE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACR,gGAAgG;QAChG,4EAA4E;QAC5E,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;IAC3C,CAAC;IAED,+FAA+F;IAC/F,gEAAgE;IAChE,kGAAkG;IAClG,kGAAkG;IAClG,+FAA+F;IAC/F,kGAAkG;IAClG,sBAAsB;IACtB,IAAI,YAAmE,CAAC;IACxE,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7F,IAAI,YAAY,IAAI,OAAO;YAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,CAAC;QAC7E,YAAY,GAAG,OAAO,CAAC;IACxB,CAAC;IAED,wFAAwF;IACxF,yFAAyF;IACzF,yFAAyF;IACzF,0BAA0B;IAC1B,MAAM,MAAM,GAAG;QACd,MAAM,EAAE,WAAW;QACnB,IAAI,EAAE,IAAI,CAAC,YAAY;QACvB,MAAM;QACN,MAAM,EAAE;YACP,YAAY;gBACX,CAAC,CAAC;oBACA,QAAQ,EAAE,IAAI;oBACd,IAAI,EAAE,aAAa;oBACnB,GAAG,EAAE,YAAY,CAAC,YAAY;oBAC9B,YAAY,EAAE,YAAY,CAAC,OAAO;iBAClC;gBACF,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE;SAC1C;KACD,CAAC;IACF,IAAI,MAAsD,CAAC;IAC3D,IAAI,CAAC;QACJ,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAC;IAC/C,CAAC;IAED,mFAAmF;IACnF,4FAA4F;IAC5F,4FAA4F;IAC5F,yFAAyF;IACzF,sEAAsE;IACtE,MAAM,GAAG,GAAI,MAAM,CAAC,OAA6C,EAAE,GAAG,CAAC;IACvE,MAAM,OAAO,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE;QAAE,OAAO,EAAE,UAAU,EAAE,0BAA0B,EAAE,CAAC;IAEhF,MAAM,YAAY,GAAG,QAAQ,GAAG,CAAC,EAAE,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;IACpD,MAAM,gBAAgB,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACjE,OAAO,gBAAgB,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,yBAAyB,EAAE,CAAC;AACjH,CAAC","sourcesContent":["import type { ExtensionContext, ToolDefinition } from \"../extensions/types.ts\";\nimport type { LaneWorkerRefusal } from \"../model-capability.ts\";\n\n/**\n * Dependencies for {@link dispatchTmuxWorker}, injected from the construction site\n * (`RuntimeBuilder`) so the adapter itself stays a small, unit-testable, faux-tool-driven module\n * with no direct dependency on `AgentSession`/`ExtensionRunner`/`BackgroundLaneController`.\n */\nexport interface TmuxDispatchDeps {\n\t/** Runtime platform seam. Native Windows has no supported tmux backend; WSL reports `linux`. */\n\tplatform?: NodeJS.Platform;\n\t/** Look up a registered tool by name -- the SAME seam the model's own tool calls resolve\n\t * through (`AgentSession.getToolDefinition` -> `RuntimeBuilder.getToolDefinition`). `undefined`\n\t * when the tmux extension is not loaded in this session -- an honest, non-fatal skip, not a\n\t * crash and not a silent no-op. */\n\tgetToolDefinition: (name: string) => ToolDefinition | undefined;\n\t/** Build a fresh, non-turn-bound `ExtensionContext` for this call\n\t * (`ExtensionRunner.createContext()`) -- safe to invoke from the goal/idle path, outside any\n\t * live model turn. */\n\tcreateExtensionContext: () => ExtensionContext;\n\t/**\n\t * Confirm that the tmux extension's caller-chosen lane id (reconstructed below from the\n\t * `fire_task` result's `details.job`) was durably registered by the host. The returned id is\n\t * identity-preserving and is the same value `Requirement.boundLaneId` uses.\n\t */\n\tresolveManagedLaneId: (callerLaneId: string) => string | undefined;\n\t/** Active goal id, threaded onto the `fire_task` call so the dispatched lane is goal-tagged\n\t * (`ManagedLaneEvent.goalId`) -- `undefined` when no goal is active (dispatch still proceeds;\n\t * the resulting lane is simply untagged). */\n\tgetGoalId: () => string | undefined;\n\t/**\n\t * Worktree-sync lane-first dispatch (opt-in -- wired ONLY inside `runtime-builder.ts`'s\n\t * `worktreeSync.enabled` block, via the engine's `createLane`): when present, `dispatchTmuxWorker`\n\t * creates a fresh worktree-sync lane for this requirement BEFORE issuing any `fire_task` call, so\n\t * a creation refusal aborts cleanly before any tmux/pane side effect ever runs -- never a\n\t * half-made lane, never a fabricated worktree. On success the dispatched agent's `cwd` is the new\n\t * lane worktree and it carries `worktreeLane` (threaded to the tmux extension's launch profile --\n\t * see `launch-profile.ts`'s `buildLaunchProfileFlags`). Absent dep -> existing byte-identical\n\t * `params.agents` (no `cwd`/`worktreeLane`), exactly as before this field existed.\n\t */\n\tcreateLaneWorktree?: (args: {\n\t\tgoalId?: string;\n\t\trequirementId: string;\n\t}) => Promise<{ laneKey: string; worktreePath: string } | { skipReason: string }>;\n\t/**\n\t * Lane-worker capability eligibility (opt-in -- wired only from `runtime-builder.ts`, backed by\n\t * `AgentSession.getLaneWorkerRefusal`): checked FIRST, before `createLaneWorktree`, so an\n\t * ineligible model's dispatch is refused before any lane/pane side effect ever runs. This is the\n\t * parent's best-effort check only -- the dispatched child session refuses authoritatively at its\n\t * own startup (main.ts) regardless of what the parent decides here. Absent dep -> no capability\n\t * check runs, byte-identical to before this field existed.\n\t */\n\tevaluateWorkerLaneRefusal?: () => LaneWorkerRefusal | undefined;\n}\n\ninterface FireTaskResultDetails {\n\tjob?: {\n\t\tid?: string;\n\t\tagents?: ReadonlyArray<{ id?: string }>;\n\t};\n}\n\ninterface TmuxGuardResultDetails {\n\tguard?: { allowed?: boolean };\n}\n\n/**\n * Structurally dispatch ONE persistent tmux worker agent for a single goal requirement, by\n * invoking the SAME `tmux_agent_manager` `fire_task` tool call the model itself would make. Core\n * -- not model discretion -- decides WHEN this fires (the goal tool's `dispatchTarget:\"tmux\"`\n * routing gates the call). The extension derives an immutable child profile from the parent's\n * admitted worker surface and reserves it durably before launch; no separate approval handshake is\n * involved. Any launch failure is surfaced through the existing `dispatchSkipReason` contract.\n */\nexport async function dispatchTmuxWorker(\n\tdeps: TmuxDispatchDeps,\n\targs: { requirementId: string; instructions: string },\n): Promise<{ laneId?: string; skipReason?: string }> {\n\t// Capability check FIRST -- before the tool-definition lookup and before createLaneWorktree --\n\t// so an ineligible model's dispatch is refused with zero lane/pane/tool side effect. The coarse\n\t// \"worker_capability_insufficient\" skip reason is the stable contract code on the goal tool's\n\t// response; the granular reason (class/window/tool-calling) lives only in the refusal object\n\t// itself, surfaced by the caller for logging (see model-capability.ts's formatLaneWorkerRefusal).\n\tif (deps.evaluateWorkerLaneRefusal?.() !== undefined) {\n\t\treturn { skipReason: \"worker_capability_insufficient\" };\n\t}\n\tif ((deps.platform ?? process.platform) === \"win32\") return { skipReason: \"tmux_unavailable\" };\n\n\tconst toolDef = deps.getToolDefinition(\"tmux_agent_manager\");\n\tif (!toolDef) return { skipReason: \"tmux_extension_not_loaded\" };\n\n\tconst goalId = deps.getGoalId();\n\tconst ctx = deps.createExtensionContext();\n\tconst toolCallId = `goal-dispatch:${goalId ?? \"?\"}:${args.requirementId}`;\n\ttry {\n\t\tconst guardResult = await toolDef.execute(`${toolCallId}:guard`, { action: \"guard\" }, ctx.signal, undefined, ctx);\n\t\tconst guard = (guardResult.details as TmuxGuardResultDetails | undefined)?.guard;\n\t\tif (guard?.allowed !== true) return { skipReason: \"tmux_unavailable\" };\n\t} catch {\n\t\t// A guard failure is side-effect free. Treat it as backend unavailability so the goal owner can\n\t\t// safely choose its native worker fallback without fabricating a tmux lane.\n\t\treturn { skipReason: \"tmux_unavailable\" };\n\t}\n\n\t// Availability first, then lane-first: when worktree-sync is wired, create the lane only after\n\t// tmux's pure guard succeeds and BEFORE any fire_task call so a\n\t// creation refusal (max lanes, invalid key, git error, ...) aborts cleanly with no tmux/pane side\n\t// effect ever having run. The specific engine refusal code is deliberately collapsed onto the one\n\t// stable `worktree_create_failed` skip reason -- same narrow `{laneId?, skipReason?}` contract\n\t// every other skip path here already uses; the engine's own detail lives in its audit log, not in\n\t// this narrow return.\n\tlet laneWorktree: { laneKey: string; worktreePath: string } | undefined;\n\tif (deps.createLaneWorktree) {\n\t\tconst created = await deps.createLaneWorktree({ goalId, requirementId: args.requirementId });\n\t\tif (\"skipReason\" in created) return { skipReason: \"worktree_create_failed\" };\n\t\tlaneWorktree = created;\n\t}\n\n\t// Single-agent 1:1 mapping: a bare fire_task with no `agents` defaults to a THREE-agent\n\t// team (pi/agy/codex -- `DEFAULT_AGENT_PROVIDERS`), which would mint three lanes for one\n\t// requirement. A goal-bound dispatch must map to exactly one lane, so `agents` is always\n\t// passed explicitly here.\n\tconst params = {\n\t\taction: \"fire_task\",\n\t\ttask: args.instructions,\n\t\tgoalId,\n\t\tagents: [\n\t\t\tlaneWorktree\n\t\t\t\t? {\n\t\t\t\t\t\tprovider: \"pi\",\n\t\t\t\t\t\tname: \"goal-worker\",\n\t\t\t\t\t\tcwd: laneWorktree.worktreePath,\n\t\t\t\t\t\tworktreeLane: laneWorktree.laneKey,\n\t\t\t\t\t}\n\t\t\t\t: { provider: \"pi\", name: \"goal-worker\" },\n\t\t],\n\t};\n\tlet result: Awaited<ReturnType<ToolDefinition[\"execute\"]>>;\n\ttry {\n\t\tresult = await toolDef.execute(toolCallId, params, ctx.signal, undefined, ctx);\n\t} catch {\n\t\treturn { skipReason: \"tmux_dispatch_failed\" };\n\t}\n\n\t// Correlate: the extension reports its dispatch under its OWN caller-chosen laneId\n\t// (`tmux:${job.id}:${agent.id}`, reconstructed here from the tool result's `details.job` --\n\t// the same format `agentLaneId` builds extension-side) which the host's `recordManagedLane`\n\t// bridge preserves as the canonical durable id; `resolveManagedLaneId` confirms that the\n\t// matching dispatch report reached the host before the goal binds it.\n\tconst job = (result.details as FireTaskResultDetails | undefined)?.job;\n\tconst primary = job?.agents?.[0];\n\tif (!job?.id || !primary?.id) return { skipReason: \"tmux_dispatch_incomplete\" };\n\n\tconst callerLaneId = `tmux:${job.id}:${primary.id}`;\n\tconst registeredLaneId = deps.resolveManagedLaneId(callerLaneId);\n\treturn registeredLaneId === callerLaneId ? { laneId: callerLaneId } : { skipReason: \"lane_correlation_failed\" };\n}\n"]}

package/dist/core/worktree-sync/codes.d.ts

@@ -2,8 +2,7 @@
  * Worktree-sync SSOT for tagged result codes and shared record types.
  *
  * Every worktree-sync operation reports its outcome through one of these string-literal codes in
- * a typed result -- callers branch on `code`, NEVER on message/stderr substrings (the
- * `classifyDispatchError` substring compromise is deliberately not repeated here). Git stderr is
+ * a typed result -- callers branch on `code`, NEVER on message/stderr substrings. Git stderr is
  * carried alongside as evidence for humans, not as a branch condition.
  */
 /** Cap on `WorktreeSyncEpoch.changedPaths`; beyond it the list is truncated and overlap checks

package/dist/core/worktree-sync/codes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codes.d.ts","sourceRoot":"","sources":["../../../src/core/worktree-sync/codes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;gGACgG;AAChG,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAE3C,MAAM,MAAM,gBAAgB,GACzB,IAAI,GACJ,UAAU,GACV,gBAAgB,GAChB,2BAA2B,GAC3B,aAAa,GACb,kBAAkB,GAClB,aAAa,GACb,gBAAgB,GAChB,mBAAmB,GACnB,YAAY,GACZ,WAAW,GACX,YAAY,GACZ,eAAe,GACf,YAAY,GACZ,gBAAgB,GAChB,oBAAoB,GACpB,uBAAuB,GACvB,0BAA0B,GAC1B,oBAAoB,GACpB,aAAa,GACb,0BAA0B,GAC1B,WAAW,GACX,WAAW,GACX,eAAe,GACf,iBAAiB,GACjB,uBAAuB,GACvB,oBAAoB,GACpB,kBAAkB,GAClB,UAAU,GACV,YAAY,GACZ,WAAW,GACX,gBAAgB,GAChB,mBAAmB,GACnB,qBAAqB,CAAC;AAEzB;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB;IACjF,IAAI,EAAE,CAAC,CAAC;IACR,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,oBAAoB,CAAC;CAC9B;AAED;;yFAEyF;AACzF,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,gBAAgB,CAAC;AAE9F;gGACgG;AAChG,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,UAAU,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4FAA4F;IAC5F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;yFACyF;AACzF,MAAM,WAAW,iBAAiB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,qBAAqB,EAAE,OAAO,CAAC;CAC/B;AAED;mCACmC;AACnC,MAAM,WAAW,SAAS;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC/C,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,KAAK,EAAE,OAAO,CAAC;IACf,wEAAwE;IACxE,KAAK,EAAE,OAAO,CAAC;IACf,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,yDAAyD;IACzD,UAAU,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,gGAAgG;IAChG,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,0BAA0B,GACnC;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC;AAE5E,0DAA0D;AAC1D,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,iGAAiG;IACjG,IAAI,EAAE,eAAe,GAAG,YAAY,GAAG,eAAe,GAAG,iBAAiB,GAAG,SAAS,CAAC;IACvF,2GAA2G;IAC3G,gBAAgB,EAAE,OAAO,CAAC;CAC1B;AAED,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAChC,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,KAAK,EAAE,oBAAoB,EAAE,CAAC;CAC9B;AAED,MAAM,MAAM,oBAAoB,GAC7B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAClE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5C,MAAM,MAAM,gBAAgB,GACzB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GACtC,mBAAmB,CACjB,gBAAgB,GAChB,2BAA2B,GAC3B,kBAAkB,GAClB,aAAa,GACb,mBAAmB,GACnB,WAAW,CACZ,CAAC;AAEL,MAAM,MAAM,iBAAiB,GAC1B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrC,mBAAmB,CACjB,gBAAgB,GAChB,2BAA2B,GAC3B,gBAAgB,GAChB,oBAAoB,GACpB,qBAAqB,GACrB,WAAW,CACZ,CAAC;AAEL,MAAM,WAAW,kBAAkB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,QAAQ,GAAG,KAAK,CAAC;IACvB,KAAK,EAAE,gBAAgB,GAAG,YAAY,GAAG,eAAe,GAAG,cAAc,CAAC;CAC1E;AAED,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,YAAY,CAAC;IACnB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,iBAAiB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,MAAM,eAAe,GACxB,gBAAgB,GAChB,mBAAmB,CAAC,gBAAgB,GAAG,2BAA2B,GAAG,WAAW,CAAC,CAAC;AAErF,MAAM,MAAM,cAAc,GACvB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACrF;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GACvE,mBAAmB,CACjB,gBAAgB,GAChB,2BAA2B,GAC3B,gBAAgB,GAChB,kBAAkB,GAClB,YAAY,GACZ,oBAAoB,GACpB,WAAW,CACZ,CAAC;AAEL,MAAM,MAAM,kBAAkB,GAC3B;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GACvE,mBAAmB,CACjB,gBAAgB,GAChB,2BAA2B,GAC3B,gBAAgB,GAChB,kBAAkB,GAClB,uBAAuB,GACvB,0BAA0B,GAC1B,WAAW,CACZ,CAAC;AAEL,MAAM,MAAM,eAAe,GACxB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/B,mBAAmB,CACnB,gBAAgB,GAAG,2BAA2B,GAAG,gBAAgB,GAAG,uBAAuB,GAAG,WAAW,CACxG,CAAC;AAEL,MAAM,MAAM,UAAU,GACnB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,GAAG,KAAK,CAAA;CAAE,GACvF,mBAAmB,CACjB,gBAAgB,GAChB,2BAA2B,GAC3B,gBAAgB,GAChB,kBAAkB,GAClB,oBAAoB,GACpB,YAAY,GACZ,YAAY,GACZ,aAAa,GACb,WAAW,GACX,oBAAoB,GACpB,aAAa,GACb,0BAA0B,GAC1B,WAAW,GACX,WAAW,GACX,iBAAiB,GACjB,qBAAqB,GACrB,WAAW,CACZ,CAAC;AAEL,kGAAkG;AAClG,MAAM,WAAW,eAAgB,SAAQ,SAAS;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,KAAK,EAAE,OAAO,CAAC;IACf,kFAAkF;IAClF,YAAY,EAAE,OAAO,CAAC;IACtB;0EACsE;IACtE,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED;qEACqE;AACrE,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;IACvC,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC9E,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,iGAAiG;IACjG,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,gBAAgB,GACzB,UAAU,GACV,mBAAmB,CAAC,gBAAgB,GAAG,2BAA2B,GAAG,WAAW,CAAC,CAAC"}
+{"version":3,"file":"codes.d.ts","sourceRoot":"","sources":["../../../src/core/worktree-sync/codes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;gGACgG;AAChG,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAE3C,MAAM,MAAM,gBAAgB,GACzB,IAAI,GACJ,UAAU,GACV,gBAAgB,GAChB,2BAA2B,GAC3B,aAAa,GACb,kBAAkB,GAClB,aAAa,GACb,gBAAgB,GAChB,mBAAmB,GACnB,YAAY,GACZ,WAAW,GACX,YAAY,GACZ,eAAe,GACf,YAAY,GACZ,gBAAgB,GAChB,oBAAoB,GACpB,uBAAuB,GACvB,0BAA0B,GAC1B,oBAAoB,GACpB,aAAa,GACb,0BAA0B,GAC1B,WAAW,GACX,WAAW,GACX,eAAe,GACf,iBAAiB,GACjB,uBAAuB,GACvB,oBAAoB,GACpB,kBAAkB,GAClB,UAAU,GACV,YAAY,GACZ,WAAW,GACX,gBAAgB,GAChB,mBAAmB,GACnB,qBAAqB,CAAC;AAEzB;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB;IACjF,IAAI,EAAE,CAAC,CAAC;IACR,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,oBAAoB,CAAC;CAC9B;AAED;;yFAEyF;AACzF,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,gBAAgB,CAAC;AAE9F;gGACgG;AAChG,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,UAAU,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4FAA4F;IAC5F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;yFACyF;AACzF,MAAM,WAAW,iBAAiB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,qBAAqB,EAAE,OAAO,CAAC;CAC/B;AAED;mCACmC;AACnC,MAAM,WAAW,SAAS;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC/C,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,KAAK,EAAE,OAAO,CAAC;IACf,wEAAwE;IACxE,KAAK,EAAE,OAAO,CAAC;IACf,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,yDAAyD;IACzD,UAAU,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,gGAAgG;IAChG,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,0BAA0B,GACnC;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC;AAE5E,0DAA0D;AAC1D,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,iGAAiG;IACjG,IAAI,EAAE,eAAe,GAAG,YAAY,GAAG,eAAe,GAAG,iBAAiB,GAAG,SAAS,CAAC;IACvF,2GAA2G;IAC3G,gBAAgB,EAAE,OAAO,CAAC;CAC1B;AAED,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAChC,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,KAAK,EAAE,oBAAoB,EAAE,CAAC;CAC9B;AAED,MAAM,MAAM,oBAAoB,GAC7B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAClE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5C,MAAM,MAAM,gBAAgB,GACzB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GACtC,mBAAmB,CACjB,gBAAgB,GAChB,2BAA2B,GAC3B,kBAAkB,GAClB,aAAa,GACb,mBAAmB,GACnB,WAAW,CACZ,CAAC;AAEL,MAAM,MAAM,iBAAiB,GAC1B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrC,mBAAmB,CACjB,gBAAgB,GAChB,2BAA2B,GAC3B,gBAAgB,GAChB,oBAAoB,GACpB,qBAAqB,GACrB,WAAW,CACZ,CAAC;AAEL,MAAM,WAAW,kBAAkB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,QAAQ,GAAG,KAAK,CAAC;IACvB,KAAK,EAAE,gBAAgB,GAAG,YAAY,GAAG,eAAe,GAAG,cAAc,CAAC;CAC1E;AAED,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,YAAY,CAAC;IACnB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,iBAAiB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,MAAM,eAAe,GACxB,gBAAgB,GAChB,mBAAmB,CAAC,gBAAgB,GAAG,2BAA2B,GAAG,WAAW,CAAC,CAAC;AAErF,MAAM,MAAM,cAAc,GACvB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACrF;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GACvE,mBAAmB,CACjB,gBAAgB,GAChB,2BAA2B,GAC3B,gBAAgB,GAChB,kBAAkB,GAClB,YAAY,GACZ,oBAAoB,GACpB,WAAW,CACZ,CAAC;AAEL,MAAM,MAAM,kBAAkB,GAC3B;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GACvE,mBAAmB,CACjB,gBAAgB,GAChB,2BAA2B,GAC3B,gBAAgB,GAChB,kBAAkB,GAClB,uBAAuB,GACvB,0BAA0B,GAC1B,WAAW,CACZ,CAAC;AAEL,MAAM,MAAM,eAAe,GACxB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/B,mBAAmB,CACnB,gBAAgB,GAAG,2BAA2B,GAAG,gBAAgB,GAAG,uBAAuB,GAAG,WAAW,CACxG,CAAC;AAEL,MAAM,MAAM,UAAU,GACnB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,GAAG,KAAK,CAAA;CAAE,GACvF,mBAAmB,CACjB,gBAAgB,GAChB,2BAA2B,GAC3B,gBAAgB,GAChB,kBAAkB,GAClB,oBAAoB,GACpB,YAAY,GACZ,YAAY,GACZ,aAAa,GACb,WAAW,GACX,oBAAoB,GACpB,aAAa,GACb,0BAA0B,GAC1B,WAAW,GACX,WAAW,GACX,iBAAiB,GACjB,qBAAqB,GACrB,WAAW,CACZ,CAAC;AAEL,kGAAkG;AAClG,MAAM,WAAW,eAAgB,SAAQ,SAAS;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,KAAK,EAAE,OAAO,CAAC;IACf,kFAAkF;IAClF,YAAY,EAAE,OAAO,CAAC;IACtB;0EACsE;IACtE,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED;qEACqE;AACrE,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;IACvC,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC9E,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,iGAAiG;IACjG,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,gBAAgB,GACzB,UAAU,GACV,mBAAmB,CAAC,gBAAgB,GAAG,2BAA2B,GAAG,WAAW,CAAC,CAAC"}

package/dist/core/worktree-sync/codes.js

@@ -2,8 +2,7 @@
  * Worktree-sync SSOT for tagged result codes and shared record types.
  *
  * Every worktree-sync operation reports its outcome through one of these string-literal codes in
- * a typed result -- callers branch on `code`, NEVER on message/stderr substrings (the
- * `classifyDispatchError` substring compromise is deliberately not repeated here). Git stderr is
+ * a typed result -- callers branch on `code`, NEVER on message/stderr substrings. Git stderr is
  * carried alongside as evidence for humans, not as a branch condition.
  */
 /** Cap on `WorktreeSyncEpoch.changedPaths`; beyond it the list is truncated and overlap checks

package/dist/core/worktree-sync/codes.js.map

@@ -1 +1 @@
-{"version":3,"file":"codes.js","sourceRoot":"","sources":["../../../src/core/worktree-sync/codes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;gGACgG;AAChG,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C,6DAA6D;AAC7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC","sourcesContent":["/**\n * Worktree-sync SSOT for tagged result codes and shared record types.\n *\n * Every worktree-sync operation reports its outcome through one of these string-literal codes in\n * a typed result -- callers branch on `code`, NEVER on message/stderr substrings (the\n * `classifyDispatchError` substring compromise is deliberately not repeated here). Git stderr is\n * carried alongside as evidence for humans, not as a branch condition.\n */\n\n/** Cap on `WorktreeSyncEpoch.changedPaths`; beyond it the list is truncated and overlap checks\n * treat the land as conservatively overlapping EVERYTHING (deterministic, never optimistic). */\nexport const EPOCH_CHANGED_PATHS_CAP = 500;\n\n/** Branch namespace for lane branches: `pi/wt/<laneKey>`. */\nexport const LANE_BRANCH_PREFIX = \"pi/wt/\";\n\nexport type WorktreeSyncCode =\n\t| \"ok\"\n\t| \"disabled\"\n\t| \"not_a_git_repo\"\n\t| \"default_branch_unresolved\"\n\t| \"hub_missing\"\n\t| \"invalid_lane_key\"\n\t| \"lane_exists\"\n\t| \"lane_not_found\"\n\t| \"max_lanes_reached\"\n\t| \"lane_dirty\"\n\t| \"hub_dirty\"\n\t| \"stale_lane\"\n\t| \"sync_required\"\n\t| \"sync_clean\"\n\t| \"sync_conflicts\"\n\t| \"rebase_in_progress\"\n\t| \"no_rebase_in_progress\"\n\t| \"conflict_markers_present\"\n\t| \"gate_command_unset\"\n\t| \"gate_failed\"\n\t| \"lane_changed_during_gate\"\n\t| \"ff_failed\"\n\t| \"lock_busy\"\n\t| \"lock_takeover\"\n\t| \"nothing_to_land\"\n\t| \"main_mutation_refused\"\n\t| \"lane_unlanded_work\"\n\t| \"worktree_missing\"\n\t| \"released\"\n\t| \"reconciled\"\n\t| \"git_error\"\n\t| \"role_forbidden\"\n\t| \"path_outside_lane\"\n\t| \"lane_owner_conflict\";\n\n/**\n * A refusal/failure outcome. `message` is deterministic text assembled from facts (safe to show a\n * model verbatim); `gitStderr` is bounded raw evidence; `paths` names offending files where the\n * refusal is about specific files (dirty files, conflict markers); `holder` identifies the\n * integration-lock holder on `lock_busy`.\n */\nexport interface WorktreeSyncRefusal<C extends WorktreeSyncCode = WorktreeSyncCode> {\n\tcode: C;\n\tmessage: string;\n\tgitStderr?: string;\n\tpaths?: string[];\n\tholder?: IntegrationLockOwner;\n}\n\n/** Staleness-propagation policy (D9). `on_land_mandatory` is the default: every land marks every\n * other active lane sync_required. `overlap_mandatory` requires it only on changed-file overlap.\n * `land_time_only` keeps staleness advisory until the land gate (G3 always enforces). */\nexport type WorktreeSyncPolicy = \"on_land_mandatory\" | \"overlap_mandatory\" | \"land_time_only\";\n\n/** One lane registration record (`lanes/<laneKey>.json`). Identity/binding fields ONLY -- git\n * truths (freshness, dirtiness, ahead/behind) are always re-derived live, never stored here. */\nexport interface LaneRegistration {\n\tlaneKey: string;\n\tbranch: string;\n\tworktreePath: string;\n\tstatus: \"active\" | \"released\" | \"orphaned\";\n\tcreatedAt: string;\n\tupdatedAt: string;\n\tgoalId?: string;\n\trequirementId?: string;\n\t/** Host `LaneRecord.laneId` after dispatch correlation (tmux/in-process worker binding). */\n\tboundLaneId?: string;\n\townerPid?: number;\n\townerSessionId?: string;\n}\n\n/** `epoch.json` -- the integration epoch. `epoch` is monotonic messaging/audit sugar; correctness\n * always derives from git shas (`merge-base --is-ancestor`), never from this counter. */\nexport interface WorktreeSyncEpoch {\n\tepoch: number;\n\tmainSha: string;\n\tpreviousMainSha?: string;\n\tlandedLaneKey?: string;\n\tlandedAt?: string;\n\tchangedPaths: string[];\n\tchangedPathsTruncated: boolean;\n}\n\n/** Live, git-derived facts about one lane. Computed fresh per call -- there is no cached copy to\n * go stale, which is the point. */\nexport interface LaneFacts {\n\tlaneKey: string;\n\tbranch: string;\n\tworktreePath: string;\n\tregistrationStatus: LaneRegistration[\"status\"];\n\t/** Lane branch tip sha; undefined when the branch no longer exists. */\n\tbranchSha?: string;\n\t/** True iff current main is an ancestor of the lane tip (`merge-base --is-ancestor`). */\n\tfresh: boolean;\n\t/** True when `status --porcelain` in the lane worktree is non-empty. */\n\tdirty: boolean;\n\trebaseInProgress: boolean;\n\taheadOfMain: number;\n\tbehindMain: number;\n\tworktreePresent: boolean;\n\t/** Undefined when the lane has no recorded owner pid. */\n\townerAlive?: boolean;\n}\n\nexport interface IntegrationLockOwner {\n\tpid: number;\n\thostname: string;\n\t/** Random acquisition identity; PID/session are diagnostic only and never authorize release. */\n\ttoken: string;\n\tsessionId?: string;\n\tlaneKey?: string;\n\tacquiredAt: string;\n}\n\nexport type IntegrationLockAcquisition =\n\t| { acquired: true; takeover: boolean; token: string }\n\t| { acquired: false; holder?: IntegrationLockOwner; holderAlive: boolean };\n\n/** One conflicted file in a sync stopped on conflicts. */\nexport interface ConflictWorklistFile {\n\tpath: string;\n\t/** Both-modified is the common case; add/add and modify/delete surface as their index states. */\n\tkind: \"both_modified\" | \"both_added\" | \"deleted_by_us\" | \"deleted_by_them\" | \"unknown\";\n\t/** True when git rerere already replayed a recorded resolution for this file -- review, not re-resolve. */\n\tresolvedByRerere: boolean;\n}\n\n/** Structured conflict worklist returned when a sync/continue stops on conflicts. */\nexport interface ConflictWorklist {\n\t/** e.g. \"2/5\" -- rebase progress (stopped step / total steps). */\n\tstep: string;\n\tstoppedAtCommit?: { sha: string; subject: string };\n\tfiles: ConflictWorklistFile[];\n}\n\nexport type BindLaneWorkerResult =\n\t| { code: \"bound\"; laneKey: string; laneId: string }\n\t| { code: \"already_bound\"; laneKey: string; laneId: string }\n\t| { code: \"binding_conflict\"; laneKey: string; boundLaneId: string }\n\t| { code: \"lane_not_found\"; message: string }\n\t| { code: \"lane_not_active\"; message: string }\n\t| { code: \"store_error\"; message: string };\n\nexport type CreateLaneResult =\n\t| { code: \"ok\"; lane: LaneRegistration }\n\t| WorktreeSyncRefusal<\n\t\t\t| \"not_a_git_repo\"\n\t\t\t| \"default_branch_unresolved\"\n\t\t\t| \"invalid_lane_key\"\n\t\t\t| \"lane_exists\"\n\t\t\t| \"max_lanes_reached\"\n\t\t\t| \"git_error\"\n\t  >;\n\nexport type ReleaseLaneResult =\n\t| { code: \"released\"; laneKey: string }\n\t| WorktreeSyncRefusal<\n\t\t\t| \"not_a_git_repo\"\n\t\t\t| \"default_branch_unresolved\"\n\t\t\t| \"lane_not_found\"\n\t\t\t| \"lane_unlanded_work\"\n\t\t\t| \"lane_owner_conflict\"\n\t\t\t| \"git_error\"\n\t  >;\n\nexport interface LandingTransaction {\n\tlaneKey: string;\n\tpriorMainSha: string;\n\ttestedTipSha: string;\n\tchangedPaths: string[];\n\tchangedPathsTruncated: boolean;\n\tlockToken: string;\n\tgate: \"passed\" | \"off\";\n\tstage: \"ready_to_merge\" | \"main_moved\" | \"epoch_written\" | \"audit_logged\";\n}\n\nexport interface ReconcileSummary {\n\tcode: \"reconciled\";\n\torphanedLaneKeys: string[];\n\treRegisteredLaneKeys: string[];\n\townerClearedLaneKeys: string[];\n\tstaleLockReleased: boolean;\n}\n\nexport type ReconcileResult =\n\t| ReconcileSummary\n\t| WorktreeSyncRefusal<\"not_a_git_repo\" | \"default_branch_unresolved\" | \"git_error\">;\n\nexport type SyncLaneResult =\n\t| { code: \"sync_clean\"; laneKey: string; alreadyFresh: boolean; autoContinued: number }\n\t| { code: \"sync_conflicts\"; laneKey: string; worklist: ConflictWorklist }\n\t| WorktreeSyncRefusal<\n\t\t\t| \"not_a_git_repo\"\n\t\t\t| \"default_branch_unresolved\"\n\t\t\t| \"lane_not_found\"\n\t\t\t| \"worktree_missing\"\n\t\t\t| \"lane_dirty\"\n\t\t\t| \"rebase_in_progress\"\n\t\t\t| \"git_error\"\n\t  >;\n\nexport type ContinueSyncResult =\n\t| { code: \"sync_clean\"; laneKey: string; autoContinued: number }\n\t| { code: \"sync_conflicts\"; laneKey: string; worklist: ConflictWorklist }\n\t| WorktreeSyncRefusal<\n\t\t\t| \"not_a_git_repo\"\n\t\t\t| \"default_branch_unresolved\"\n\t\t\t| \"lane_not_found\"\n\t\t\t| \"worktree_missing\"\n\t\t\t| \"no_rebase_in_progress\"\n\t\t\t| \"conflict_markers_present\"\n\t\t\t| \"git_error\"\n\t  >;\n\nexport type AbortSyncResult =\n\t| { code: \"ok\"; laneKey: string }\n\t| WorktreeSyncRefusal<\n\t\t\t\"not_a_git_repo\" | \"default_branch_unresolved\" | \"lane_not_found\" | \"no_rebase_in_progress\" | \"git_error\"\n\t  >;\n\nexport type LandResult =\n\t| { code: \"ok\"; laneKey: string; epoch: number; mainSha: string; gate: \"passed\" | \"off\" }\n\t| WorktreeSyncRefusal<\n\t\t\t| \"not_a_git_repo\"\n\t\t\t| \"default_branch_unresolved\"\n\t\t\t| \"lane_not_found\"\n\t\t\t| \"worktree_missing\"\n\t\t\t| \"rebase_in_progress\"\n\t\t\t| \"lane_dirty\"\n\t\t\t| \"stale_lane\"\n\t\t\t| \"hub_missing\"\n\t\t\t| \"hub_dirty\"\n\t\t\t| \"gate_command_unset\"\n\t\t\t| \"gate_failed\"\n\t\t\t| \"lane_changed_during_gate\"\n\t\t\t| \"ff_failed\"\n\t\t\t| \"lock_busy\"\n\t\t\t| \"nothing_to_land\"\n\t\t\t| \"lane_owner_conflict\"\n\t\t\t| \"git_error\"\n\t  >;\n\n/** One lane's full status entry: live git facts plus registry identity plus policy derivation. */\nexport interface LaneStatusEntry extends LaneFacts {\n\tgoalId?: string;\n\trequirementId?: string;\n\tboundLaneId?: string;\n\t/** Not fresh: main moved past this lane's base. Derived, never stored. */\n\tstale: boolean;\n\t/** Stale AND the active policy makes syncing mandatory NOW (G8 gates on this). */\n\tsyncRequired: boolean;\n\t/** Lane-changed files intersecting the last land's changed files (conservatively the whole\n\t * lane-changed list when the epoch's changedPaths were truncated). */\n\toverlapWithLastLand: string[];\n}\n\n/** The deterministic full picture (`status` action): everything an agent would otherwise infer\n * probabilistically from porcelain output, computed mechanically. */\nexport interface SyncStatus {\n\tcode: \"ok\";\n\tmainBranch: string;\n\tmainSha: string;\n\tepoch: number;\n\thub?: { path: string; clean: boolean };\n\tlock: { held: boolean; holder?: IntegrationLockOwner; holderAlive?: boolean };\n\tlanes: LaneStatusEntry[];\n\t/** One deterministic advisory sentence assembled from the codes above; never model-generated. */\n\tadvice?: string;\n}\n\nexport type SyncStatusResult =\n\t| SyncStatus\n\t| WorktreeSyncRefusal<\"not_a_git_repo\" | \"default_branch_unresolved\" | \"git_error\">;\n"]}
+{"version":3,"file":"codes.js","sourceRoot":"","sources":["../../../src/core/worktree-sync/codes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;gGACgG;AAChG,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C,6DAA6D;AAC7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC","sourcesContent":["/**\n * Worktree-sync SSOT for tagged result codes and shared record types.\n *\n * Every worktree-sync operation reports its outcome through one of these string-literal codes in\n * a typed result -- callers branch on `code`, NEVER on message/stderr substrings. Git stderr is\n * carried alongside as evidence for humans, not as a branch condition.\n */\n\n/** Cap on `WorktreeSyncEpoch.changedPaths`; beyond it the list is truncated and overlap checks\n * treat the land as conservatively overlapping EVERYTHING (deterministic, never optimistic). */\nexport const EPOCH_CHANGED_PATHS_CAP = 500;\n\n/** Branch namespace for lane branches: `pi/wt/<laneKey>`. */\nexport const LANE_BRANCH_PREFIX = \"pi/wt/\";\n\nexport type WorktreeSyncCode =\n\t| \"ok\"\n\t| \"disabled\"\n\t| \"not_a_git_repo\"\n\t| \"default_branch_unresolved\"\n\t| \"hub_missing\"\n\t| \"invalid_lane_key\"\n\t| \"lane_exists\"\n\t| \"lane_not_found\"\n\t| \"max_lanes_reached\"\n\t| \"lane_dirty\"\n\t| \"hub_dirty\"\n\t| \"stale_lane\"\n\t| \"sync_required\"\n\t| \"sync_clean\"\n\t| \"sync_conflicts\"\n\t| \"rebase_in_progress\"\n\t| \"no_rebase_in_progress\"\n\t| \"conflict_markers_present\"\n\t| \"gate_command_unset\"\n\t| \"gate_failed\"\n\t| \"lane_changed_during_gate\"\n\t| \"ff_failed\"\n\t| \"lock_busy\"\n\t| \"lock_takeover\"\n\t| \"nothing_to_land\"\n\t| \"main_mutation_refused\"\n\t| \"lane_unlanded_work\"\n\t| \"worktree_missing\"\n\t| \"released\"\n\t| \"reconciled\"\n\t| \"git_error\"\n\t| \"role_forbidden\"\n\t| \"path_outside_lane\"\n\t| \"lane_owner_conflict\";\n\n/**\n * A refusal/failure outcome. `message` is deterministic text assembled from facts (safe to show a\n * model verbatim); `gitStderr` is bounded raw evidence; `paths` names offending files where the\n * refusal is about specific files (dirty files, conflict markers); `holder` identifies the\n * integration-lock holder on `lock_busy`.\n */\nexport interface WorktreeSyncRefusal<C extends WorktreeSyncCode = WorktreeSyncCode> {\n\tcode: C;\n\tmessage: string;\n\tgitStderr?: string;\n\tpaths?: string[];\n\tholder?: IntegrationLockOwner;\n}\n\n/** Staleness-propagation policy (D9). `on_land_mandatory` is the default: every land marks every\n * other active lane sync_required. `overlap_mandatory` requires it only on changed-file overlap.\n * `land_time_only` keeps staleness advisory until the land gate (G3 always enforces). */\nexport type WorktreeSyncPolicy = \"on_land_mandatory\" | \"overlap_mandatory\" | \"land_time_only\";\n\n/** One lane registration record (`lanes/<laneKey>.json`). Identity/binding fields ONLY -- git\n * truths (freshness, dirtiness, ahead/behind) are always re-derived live, never stored here. */\nexport interface LaneRegistration {\n\tlaneKey: string;\n\tbranch: string;\n\tworktreePath: string;\n\tstatus: \"active\" | \"released\" | \"orphaned\";\n\tcreatedAt: string;\n\tupdatedAt: string;\n\tgoalId?: string;\n\trequirementId?: string;\n\t/** Host `LaneRecord.laneId` after dispatch correlation (tmux/in-process worker binding). */\n\tboundLaneId?: string;\n\townerPid?: number;\n\townerSessionId?: string;\n}\n\n/** `epoch.json` -- the integration epoch. `epoch` is monotonic messaging/audit sugar; correctness\n * always derives from git shas (`merge-base --is-ancestor`), never from this counter. */\nexport interface WorktreeSyncEpoch {\n\tepoch: number;\n\tmainSha: string;\n\tpreviousMainSha?: string;\n\tlandedLaneKey?: string;\n\tlandedAt?: string;\n\tchangedPaths: string[];\n\tchangedPathsTruncated: boolean;\n}\n\n/** Live, git-derived facts about one lane. Computed fresh per call -- there is no cached copy to\n * go stale, which is the point. */\nexport interface LaneFacts {\n\tlaneKey: string;\n\tbranch: string;\n\tworktreePath: string;\n\tregistrationStatus: LaneRegistration[\"status\"];\n\t/** Lane branch tip sha; undefined when the branch no longer exists. */\n\tbranchSha?: string;\n\t/** True iff current main is an ancestor of the lane tip (`merge-base --is-ancestor`). */\n\tfresh: boolean;\n\t/** True when `status --porcelain` in the lane worktree is non-empty. */\n\tdirty: boolean;\n\trebaseInProgress: boolean;\n\taheadOfMain: number;\n\tbehindMain: number;\n\tworktreePresent: boolean;\n\t/** Undefined when the lane has no recorded owner pid. */\n\townerAlive?: boolean;\n}\n\nexport interface IntegrationLockOwner {\n\tpid: number;\n\thostname: string;\n\t/** Random acquisition identity; PID/session are diagnostic only and never authorize release. */\n\ttoken: string;\n\tsessionId?: string;\n\tlaneKey?: string;\n\tacquiredAt: string;\n}\n\nexport type IntegrationLockAcquisition =\n\t| { acquired: true; takeover: boolean; token: string }\n\t| { acquired: false; holder?: IntegrationLockOwner; holderAlive: boolean };\n\n/** One conflicted file in a sync stopped on conflicts. */\nexport interface ConflictWorklistFile {\n\tpath: string;\n\t/** Both-modified is the common case; add/add and modify/delete surface as their index states. */\n\tkind: \"both_modified\" | \"both_added\" | \"deleted_by_us\" | \"deleted_by_them\" | \"unknown\";\n\t/** True when git rerere already replayed a recorded resolution for this file -- review, not re-resolve. */\n\tresolvedByRerere: boolean;\n}\n\n/** Structured conflict worklist returned when a sync/continue stops on conflicts. */\nexport interface ConflictWorklist {\n\t/** e.g. \"2/5\" -- rebase progress (stopped step / total steps). */\n\tstep: string;\n\tstoppedAtCommit?: { sha: string; subject: string };\n\tfiles: ConflictWorklistFile[];\n}\n\nexport type BindLaneWorkerResult =\n\t| { code: \"bound\"; laneKey: string; laneId: string }\n\t| { code: \"already_bound\"; laneKey: string; laneId: string }\n\t| { code: \"binding_conflict\"; laneKey: string; boundLaneId: string }\n\t| { code: \"lane_not_found\"; message: string }\n\t| { code: \"lane_not_active\"; message: string }\n\t| { code: \"store_error\"; message: string };\n\nexport type CreateLaneResult =\n\t| { code: \"ok\"; lane: LaneRegistration }\n\t| WorktreeSyncRefusal<\n\t\t\t| \"not_a_git_repo\"\n\t\t\t| \"default_branch_unresolved\"\n\t\t\t| \"invalid_lane_key\"\n\t\t\t| \"lane_exists\"\n\t\t\t| \"max_lanes_reached\"\n\t\t\t| \"git_error\"\n\t  >;\n\nexport type ReleaseLaneResult =\n\t| { code: \"released\"; laneKey: string }\n\t| WorktreeSyncRefusal<\n\t\t\t| \"not_a_git_repo\"\n\t\t\t| \"default_branch_unresolved\"\n\t\t\t| \"lane_not_found\"\n\t\t\t| \"lane_unlanded_work\"\n\t\t\t| \"lane_owner_conflict\"\n\t\t\t| \"git_error\"\n\t  >;\n\nexport interface LandingTransaction {\n\tlaneKey: string;\n\tpriorMainSha: string;\n\ttestedTipSha: string;\n\tchangedPaths: string[];\n\tchangedPathsTruncated: boolean;\n\tlockToken: string;\n\tgate: \"passed\" | \"off\";\n\tstage: \"ready_to_merge\" | \"main_moved\" | \"epoch_written\" | \"audit_logged\";\n}\n\nexport interface ReconcileSummary {\n\tcode: \"reconciled\";\n\torphanedLaneKeys: string[];\n\treRegisteredLaneKeys: string[];\n\townerClearedLaneKeys: string[];\n\tstaleLockReleased: boolean;\n}\n\nexport type ReconcileResult =\n\t| ReconcileSummary\n\t| WorktreeSyncRefusal<\"not_a_git_repo\" | \"default_branch_unresolved\" | \"git_error\">;\n\nexport type SyncLaneResult =\n\t| { code: \"sync_clean\"; laneKey: string; alreadyFresh: boolean; autoContinued: number }\n\t| { code: \"sync_conflicts\"; laneKey: string; worklist: ConflictWorklist }\n\t| WorktreeSyncRefusal<\n\t\t\t| \"not_a_git_repo\"\n\t\t\t| \"default_branch_unresolved\"\n\t\t\t| \"lane_not_found\"\n\t\t\t| \"worktree_missing\"\n\t\t\t| \"lane_dirty\"\n\t\t\t| \"rebase_in_progress\"\n\t\t\t| \"git_error\"\n\t  >;\n\nexport type ContinueSyncResult =\n\t| { code: \"sync_clean\"; laneKey: string; autoContinued: number }\n\t| { code: \"sync_conflicts\"; laneKey: string; worklist: ConflictWorklist }\n\t| WorktreeSyncRefusal<\n\t\t\t| \"not_a_git_repo\"\n\t\t\t| \"default_branch_unresolved\"\n\t\t\t| \"lane_not_found\"\n\t\t\t| \"worktree_missing\"\n\t\t\t| \"no_rebase_in_progress\"\n\t\t\t| \"conflict_markers_present\"\n\t\t\t| \"git_error\"\n\t  >;\n\nexport type AbortSyncResult =\n\t| { code: \"ok\"; laneKey: string }\n\t| WorktreeSyncRefusal<\n\t\t\t\"not_a_git_repo\" | \"default_branch_unresolved\" | \"lane_not_found\" | \"no_rebase_in_progress\" | \"git_error\"\n\t  >;\n\nexport type LandResult =\n\t| { code: \"ok\"; laneKey: string; epoch: number; mainSha: string; gate: \"passed\" | \"off\" }\n\t| WorktreeSyncRefusal<\n\t\t\t| \"not_a_git_repo\"\n\t\t\t| \"default_branch_unresolved\"\n\t\t\t| \"lane_not_found\"\n\t\t\t| \"worktree_missing\"\n\t\t\t| \"rebase_in_progress\"\n\t\t\t| \"lane_dirty\"\n\t\t\t| \"stale_lane\"\n\t\t\t| \"hub_missing\"\n\t\t\t| \"hub_dirty\"\n\t\t\t| \"gate_command_unset\"\n\t\t\t| \"gate_failed\"\n\t\t\t| \"lane_changed_during_gate\"\n\t\t\t| \"ff_failed\"\n\t\t\t| \"lock_busy\"\n\t\t\t| \"nothing_to_land\"\n\t\t\t| \"lane_owner_conflict\"\n\t\t\t| \"git_error\"\n\t  >;\n\n/** One lane's full status entry: live git facts plus registry identity plus policy derivation. */\nexport interface LaneStatusEntry extends LaneFacts {\n\tgoalId?: string;\n\trequirementId?: string;\n\tboundLaneId?: string;\n\t/** Not fresh: main moved past this lane's base. Derived, never stored. */\n\tstale: boolean;\n\t/** Stale AND the active policy makes syncing mandatory NOW (G8 gates on this). */\n\tsyncRequired: boolean;\n\t/** Lane-changed files intersecting the last land's changed files (conservatively the whole\n\t * lane-changed list when the epoch's changedPaths were truncated). */\n\toverlapWithLastLand: string[];\n}\n\n/** The deterministic full picture (`status` action): everything an agent would otherwise infer\n * probabilistically from porcelain output, computed mechanically. */\nexport interface SyncStatus {\n\tcode: \"ok\";\n\tmainBranch: string;\n\tmainSha: string;\n\tepoch: number;\n\thub?: { path: string; clean: boolean };\n\tlock: { held: boolean; holder?: IntegrationLockOwner; holderAlive?: boolean };\n\tlanes: LaneStatusEntry[];\n\t/** One deterministic advisory sentence assembled from the codes above; never model-generated. */\n\tadvice?: string;\n}\n\nexport type SyncStatusResult =\n\t| SyncStatus\n\t| WorktreeSyncRefusal<\"not_a_git_repo\" | \"default_branch_unresolved\" | \"git_error\">;\n"]}

package/dist/core/worktree-sync/lane-gate.d.ts

@@ -4,9 +4,10 @@
  * write / bash) with {@link WorktreeLaneGate.checkMutation}; a lane that the active policy marks
  * sync_required fails closed with the exact recovery step until it rebases main.
  *
- * Honesty boundary (unchanged from the tmux trust model): this is HARD for pi children -- the
- * wrapper lives under the tool layer, not in the prompt -- and cooperative-only for foreign
- * CLIs, whose backstop is the land CAS (G3): stale work simply cannot land.
+ * Honesty boundary: edit/write checks are structural for Pi children because the wrapper lives
+ * under the tool layer. Bash remains a deliberate host-trust boundary; this gate only rejects
+ * integration-sensitive Git forms and never claims to sandbox arbitrary process code. Foreign
+ * CLIs stay cooperative-only, with the land CAS (G3) as their backstop.
  *
  * Determinism: the gate re-derives from git only when the epoch file actually changed (mtime
  * fence) or while blocked; verdicts in between are cached. No polling, no timers.
@@ -44,11 +45,6 @@ export interface WorktreeLaneGateConfig {
     laneKey: string;
     engineDeps: () => WorktreeSyncEngineDeps;
     policy: () => WorktreeSyncPolicy;
-    /** Worker launches use a hard shell envelope: only lane-safe Git/WIP commands and the owner-configured
-     * exact gate command may pass through bash. Interactive lane sessions retain the legacy cooperative
-     * command surface while the typed worktree_sync actions are used for hard worker mutations. */
-    hardShell?: boolean;
-    trustedGateCommand?: () => string | undefined;
 }
 export type LaneMutationCheck = {
     allowed: true;

package/dist/core/worktree-sync/lane-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lane-gate.d.ts","sourceRoot":"","sources":["../../../src/core/worktree-sync/lane-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAyD,KAAK,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAGrH,MAAM,MAAM,eAAe,GACxB;IAAE,OAAO,EAAE,SAAS,CAAA;CAAE,GACtB;IAAE,OAAO,EAAE,iCAAiC,CAAA;CAAE,GAC9C;IAAE,OAAO,EAAE,uBAAuB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAkBxD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,eAAe,CAiF5F;AA8BD,gGAAgG;AAChG,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CASnF;AAED,oFAAoF;AACpF,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGnG;AAED,MAAM,WAAW,sBAAsB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,sBAAsB,CAAC;IACzC,MAAM,EAAE,MAAM,kBAAkB,CAAC;IACjC;;mGAE+F;IAC/F,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;CAC9C;AAED,MAAM,MAAM,iBAAiB,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAqCtG;;;GAGG;AACH,qBAAa,gBAAgB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,IAAI,CAA0B;IACtC,OAAO,CAAC,iBAAiB,CAAqB;IAC9C,OAAO,CAAC,cAAc,CAAS;IAE/B,YAAY,MAAM,EAAE,sBAAsB,EAEzC;YAEa,cAAc;IAQ5B,8EAA8E;IAC9E,OAAO,CAAC,YAAY;IAYd,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA2H3G;CACD"}
+{"version":3,"file":"lane-gate.d.ts","sourceRoot":"","sources":["../../../src/core/worktree-sync/lane-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAyD,KAAK,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAGrH,MAAM,MAAM,eAAe,GACxB;IAAE,OAAO,EAAE,SAAS,CAAA;CAAE,GACtB;IAAE,OAAO,EAAE,iCAAiC,CAAA;CAAE,GAC9C;IAAE,OAAO,EAAE,uBAAuB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAkBxD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,eAAe,CAiF5F;AA8BD,gGAAgG;AAChG,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CASnF;AAED,oFAAoF;AACpF,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGnG;AAED,MAAM,WAAW,sBAAsB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,sBAAsB,CAAC;IACzC,MAAM,EAAE,MAAM,kBAAkB,CAAC;CACjC;AAED,MAAM,MAAM,iBAAiB,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAsBtG;;;GAGG;AACH,qBAAa,gBAAgB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,IAAI,CAA0B;IACtC,OAAO,CAAC,iBAAiB,CAAqB;IAC9C,OAAO,CAAC,cAAc,CAAS;IAE/B,YAAY,MAAM,EAAE,sBAAsB,EAEzC;YAEa,cAAc;IAQ5B,8EAA8E;IAC9E,OAAO,CAAC,YAAY;IAYd,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA0F3G;CACD"}

package/dist/core/worktree-sync/lane-gate.js

@@ -4,9 +4,10 @@
  * write / bash) with {@link WorktreeLaneGate.checkMutation}; a lane that the active policy marks
  * sync_required fails closed with the exact recovery step until it rebases main.
  *
- * Honesty boundary (unchanged from the tmux trust model): this is HARD for pi children -- the
- * wrapper lives under the tool layer, not in the prompt -- and cooperative-only for foreign
- * CLIs, whose backstop is the land CAS (G3): stale work simply cannot land.
+ * Honesty boundary: edit/write checks are structural for Pi children because the wrapper lives
+ * under the tool layer. Bash remains a deliberate host-trust boundary; this gate only rejects
+ * integration-sensitive Git forms and never claims to sandbox arbitrary process code. Foreign
+ * CLIs stay cooperative-only, with the land CAS (G3) as their backstop.
  *
  * Determinism: the gate re-derives from git only when the epoch file actually changed (mtime
  * fence) or while blocked; verdicts in between are cached. No polling, no timers.
@@ -184,24 +185,6 @@ async function changedPaths(deps, cwd, base, ref) {
         .map((path) => path.trim())
         .filter(Boolean));
 }
-function hardShellCommandAllowed(command, mainBranch, trustedGateCommand) {
-    const trimmed = command.trim();
-    if (trustedGateCommand && trimmed === trustedGateCommand.trim())
-        return true;
-    if (!/^git(?:\s|$)/u.test(trimmed))
-        return false;
-    const verdict = classifyLaneBashCommand(trimmed, mainBranch);
-    if (verdict.verdict === "main_mutation_refused")
-        return false;
-    const tokens = trimmed.split(/\s+/u);
-    const subcommand = tokens[1] ?? "";
-    if (!SYNC_SAFE_GIT_SUBCOMMANDS.has(subcommand) && subcommand !== "commit")
-        return false;
-    // Git path operands must not escape the lane checkout. The typed worktree
-    // actions are the authoritative route for path-sensitive add/diff operations;
-    // this final check prevents the common absolute/parent escape in the shell floor.
-    return !tokens.slice(2).some((token) => token.startsWith("/") || token.startsWith("..") || token.includes("/../"));
-}
 /**
  * The G8 gate object RuntimeBuilder holds per lane-bound session. `checkMutation` is called by
  * the wrapped edit/write/bash tools before every mutating execution.
@@ -237,24 +220,9 @@ export class WorktreeLaneGate {
     async checkMutation(toolName, bashCommand, targetPath) {
         const ctx = await this.resolveContext();
         // No repo context (deleted repo, engine failure): fail OPEN for plain tools -- the land
-        // CAS still holds -- but the G10 bash rules below never depend on repo state.
+        // CAS still holds -- but the integration-sensitive Git rules below never depend on repo state.
         const mainBranch = ctx?.mainBranch ?? "main";
-        if (this.config.hardShell && !ctx) {
-            return {
-                allowed: false,
-                code: "lane_state_unavailable",
-                message: "worktree-sync: lane state is unavailable; hard worker mutations fail closed",
-            };
-        }
         if (toolName === "bash" && bashCommand !== undefined) {
-            if (this.config.hardShell &&
-                !hardShellCommandAllowed(bashCommand, mainBranch, this.config.trustedGateCommand?.())) {
-                return {
-                    allowed: false,
-                    code: "main_mutation_refused",
-                    message: "worktree-sync: unrestricted bash is unavailable in a hard worker lane; use typed worktree_sync actions",
-                };
-            }
             const verdict = classifyLaneBashCommand(bashCommand, mainBranch);
             if (verdict.verdict === "main_mutation_refused") {
                 return { allowed: false, code: "main_mutation_refused", message: `worktree-sync: ${verdict.reason}` };
@@ -284,26 +252,12 @@ export class WorktreeLaneGate {
         const deps = this.config.engineDeps();
         const lane = await readLane(ctx.paths, this.config.laneKey);
         if (!lane || lane.status !== "active") {
-            if (this.config.hardShell) {
-                return {
-                    allowed: false,
-                    code: "lane_state_unavailable",
-                    message: "worktree-sync: hard worker lane registration is missing or inactive; reconcile before mutating",
-                };
-            }
             this._cachedAllowed = true;
             return { allowed: true };
         }
         // Re-derive main tip: the cached ctx pins the sha from session start.
         const fresh = await resolveRepoContext(deps);
         if ("code" in fresh) {
-            if (this.config.hardShell) {
-                return {
-                    allowed: false,
-                    code: "lane_state_unavailable",
-                    message: "worktree-sync: Git context is unavailable; hard worker mutation refused",
-                };
-            }
             this._cachedAllowed = true;
             return { allowed: true };
         }

package/dist/core/worktree-sync/lane-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"lane-gate.js","sourceRoot":"","sources":["../../../src/core/worktree-sync/lane-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAElE,OAAO,EAAE,eAAe,EAAoB,kBAAkB,EAA+B,MAAM,iBAAiB,CAAC;AACrH,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAOtC,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACzC,QAAQ;IACR,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,OAAO;IACP,WAAW;IACX,UAAU;IACV,OAAO;IACP,MAAM;CACN,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;AAEtH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,UAAkB;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,2DAA2D;IAC3D,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO;YACN,OAAO,EAAE,uBAAuB;YAChC,MAAM,EAAE,6EAA6E;SACrF,CAAC;IACH,CAAC;IACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO;YACN,OAAO,EAAE,uBAAuB;YAChC,MAAM,EAAE,uEAAuE;SAC/E,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,uBAAuB,GAAG,KAAK,CAAC;IACpC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK;YAAE,SAAS;QAClC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,qFAAqF;QACrF,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;gBACxE,eAAe,GAAG,IAAI,CAAC;gBACvB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACV,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC9C,eAAe,GAAG,IAAI,CAAC;gBACvB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACV,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACxE,eAAe,GAAG,IAAI,CAAC;gBACvB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACV,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACV,CAAC;YACD,MAAM;QACP,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO;gBACN,OAAO,EAAE,uBAAuB;gBAChC,MAAM,EACL,+GAA+G;aAChH,CAAC;QACH,CAAC;QACD,IAAI,eAAe,IAAI,6BAA6B,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACtE,OAAO;gBACN,OAAO,EAAE,uBAAuB;gBAChC,MAAM,EAAE,0BAA0B,UAAU,8DAA8D;aAC1G,CAAC;QACH,CAAC;QACD,IACC,UAAU,KAAK,QAAQ;YACvB,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EACxB,CAAC;YACF,OAAO;gBACN,OAAO,EAAE,uBAAuB;gBAChC,MAAM,EAAE,mCAAmC,UAAU,4DAA4D;aACjH,CAAC;QACH,CAAC;QACD,IAAI,UAAU,KAAK,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,cAAc,UAAU,EAAE,CAAC,EAAE,CAAC;YAC/F,OAAO;gBACN,OAAO,EAAE,uBAAuB;gBAChC,MAAM,EAAE,2CAA2C,UAAU,oBAAoB;aACjF,CAAC;QACH,CAAC;QACD,IAAI,yBAAyB,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,uBAAuB,GAAG,IAAI,CAAC;IAC/E,CAAC;IACD,OAAO,uBAAuB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC1G,CAAC;AAED;;oEAEoE;AACpE,SAAS,kBAAkB,CAAC,UAAkB;IAC7C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACJ,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,UAAU,CAAC;QACnB,CAAC;IACF,CAAC;IACD,MAAM,IAAI,GAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,IAAI,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,QAAQ;YAAE,MAAM,CAAC,kDAAkD;QAClF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjC,QAAQ,GAAG,MAAM,CAAC;IACnB,CAAC;IACD,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACJ,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACR,YAAY,GAAG,QAAQ,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,YAAoB;IACzE,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACJ,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACR,QAAQ,GAAG,YAAY,CAAC;IACzB,CAAC;IACD,MAAM,cAAc,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACtD,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;AAClF,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,uBAAuB,CAAC,YAAoB,EAAE,SAAiB;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,iBAAiB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;AACrE,CAAC;AAeD,KAAK,UAAU,YAAY,CAC1B,IAA4B,EAC5B,GAAW,EACX,IAAY,EACZ,GAAW;IAEX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,KAAK,GAAG,EAAE,EAAE,IAAI,CAAC,EAAE;QACvF,GAAG;QACH,OAAO,EAAE,MAAM;QACf,SAAS,EAAE,IAAI,GAAG,IAAI;KACtB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,IAAI,GAAG,CACb,MAAM,CAAC,MAAM;SACX,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CACjB,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe,EAAE,UAAkB,EAAE,kBAA2B;IAChG,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,kBAAkB,IAAI,OAAO,KAAK,kBAAkB,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,UAAU,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxF,0EAA0E;IAC1E,8EAA8E;IAC9E,kFAAkF;IAClF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACpH,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IAM5B,YAAY,MAA8B;QAFlC,mBAAc,GAAG,KAAK,CAAC;QAG9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,cAAc;QAC3B,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAC/D,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,SAAS,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,8EAA8E;IACtE,YAAY,CAAC,GAAgB;QACpC,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACJ,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,GAAG,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,CAAC,iBAAiB;YAAE,OAAO,KAAK,CAAC;QACrD,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC;QACjC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,WAAoB,EAAE,UAAmB;QAC9E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,wFAAwF;QACxF,8EAA8E;QAC9E,MAAM,UAAU,GAAG,GAAG,EAAE,UAAU,IAAI,MAAM,CAAC;QAC7C,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC;YACnC,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,6EAA6E;aACtF,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,KAAK,MAAM,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YACtD,IACC,IAAI,CAAC,MAAM,CAAC,SAAS;gBACrB,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,CAAC,EACpF,CAAC;gBACF,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,IAAI,EAAE,uBAAuB;oBAC7B,OAAO,EACN,wGAAwG;iBACzG,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YACjE,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,EAAE,CAAC;gBACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,kBAAkB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACvG,CAAC;YACD,IAAI,OAAO,CAAC,OAAO,KAAK,iCAAiC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAEnC,wFAAwF;QACxF,6FAA6F;QAC7F,2FAA2F;QAC3F,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,OAAO,CAAC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC/E,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACnE,IAAI,WAAW,EAAE,MAAM,KAAK,QAAQ,IAAI,iBAAiB,CAAC,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;gBACjG,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,mBAAmB,UAAU,4BAA4B,IAAI,CAAC,MAAM,CAAC,OAAO,eAAe,WAAW,CAAC,YAAY,8CAA8C;iBAC1K,CAAC;YACH,CAAC;QACF,CAAC;QAED,yFAAyF;QACzF,uEAAuE;QACvE,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAE7E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3B,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EACN,gGAAgG;iBACjG,CAAC;YACH,CAAC;YACD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,sEAAsE;QACtE,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;YACrB,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3B,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,yEAAyE;iBAClF,CAAC;YACH,CAAC;YACD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,YAAY,GAAG,MAAM,KAAK,mBAAmB,CAAC;QAClD,IAAI,MAAM,KAAK,mBAAmB,EAAE,CAAC;YACpC,iFAAiF;YACjF,0FAA0F;YAC1F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;gBACvF,GAAG,EAAE,KAAK,CAAC,QAAQ;gBACnB,OAAO,EAAE,MAAM;gBACf,SAAS,EAAE,IAAI,GAAG,IAAI;aACtB,CAAC,CAAC;YACH,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtD,YAAY,GAAG,IAAI,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACP,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC9E,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;gBACnF,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;oBAC9B,YAAY,GAAG,IAAI,CAAC;gBACrB,CAAC;qBAAM,CAAC;oBACP,YAAY,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnE,CAAC;YACF,CAAC;QACF,CAAC;QACD,IAAI,MAAM,KAAK,gBAAgB;YAAE,YAAY,GAAG,KAAK,CAAC;QAEtD,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;QAC5B,OAAO;YACN,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,eAAe;YACrB,OAAO,EACN,wBAAwB,IAAI,CAAC,MAAM,CAAC,OAAO,8CAA8C;gBACzF,yFAAyF;gBACzF,0FAA0F;SAC3F,CAAC;IACH,CAAC;CACD","sourcesContent":["/**\n * Lane gate: G8/G10 enforcement for a LANE-BOUND `pi` session (launched with\n * `PI_WORKTREE_LANE=<key>`). RuntimeBuilder wraps the session's file-mutation tools (edit /\n * write / bash) with {@link WorktreeLaneGate.checkMutation}; a lane that the active policy marks\n * sync_required fails closed with the exact recovery step until it rebases main.\n *\n * Honesty boundary (unchanged from the tmux trust model): this is HARD for pi children -- the\n * wrapper lives under the tool layer, not in the prompt -- and cooperative-only for foreign\n * CLIs, whose backstop is the land CAS (G3): stale work simply cannot land.\n *\n * Determinism: the gate re-derives from git only when the epoch file actually changed (mtime\n * fence) or while blocked; verdicts in between are cached. No polling, no timers.\n */\n\nimport { existsSync, realpathSync, statSync } from \"node:fs\";\nimport { basename, dirname, join, resolve, sep } from \"node:path\";\nimport type { WorktreeSyncPolicy } from \"./codes.ts\";\nimport { deriveLaneFacts, type RepoContext, resolveRepoContext, type WorktreeSyncEngineDeps } from \"./git-engine.ts\";\nimport { readLane } from \"./store.ts\";\n\nexport type LaneBashVerdict =\n\t| { verdict: \"allowed\" }\n\t| { verdict: \"allowed_even_when_sync_required\" }\n\t| { verdict: \"main_mutation_refused\"; reason: string };\n\nconst SYNC_SAFE_GIT_SUBCOMMANDS = new Set([\n\t\"status\",\n\t\"diff\",\n\t\"log\",\n\t\"show\",\n\t\"add\",\n\t\"commit\",\n\t\"stash\",\n\t\"rev-parse\",\n\t\"ls-files\",\n\t\"blame\",\n\t\"grep\",\n]);\n\nconst MAIN_MUTATING_GIT_SUBCOMMANDS = new Set([\"merge\", \"rebase\", \"reset\", \"commit\", \"branch\", \"update-ref\", \"push\"]);\n\n/**\n * Classify one bash command line for a lane-bound session (G10 + the sync_required allowlist).\n * Tokenization is whitespace-naive by design -- deterministic and reviewable; shell-quoting\n * tricks can evade it, which is the documented cooperative boundary (the land CAS cannot be\n * evaded). Command POSITION still matters: `git` only begins an invocation at the start of the\n * command or immediately after a shell separator (`&&`, `||`, `;`, `|`) -- a bare `git` token\n * elsewhere (e.g. as a plain argument to `echo`) is not an invocation. Rules:\n * - `git push` anywhere: refused (main moves only through the land gate; pushing is owner-only).\n * - `git -C <path>` / `--git-dir` combined with a mutating subcommand: refused (escaping the\n *   lane worktree to operate on another checkout, e.g. the hub).\n * - `git branch -f/-M/-D <main>` / `git update-ref refs/heads/<main>`: refused.\n * - Everything else: allowed; a read/commit-shaped git subcommand additionally stays allowed\n *   while the lane is sync_required (committing WIP is the prescribed step BEFORE syncing).\n */\nexport function classifyLaneBashCommand(command: string, mainBranch: string): LaneBashVerdict {\n\t// This classifier is defense-in-depth, not a shell parser. Refuse compound\n\t// syntax before any segment can return an allow verdict; otherwise `git\n\t// status; git push` is approved by the first safe segment.\n\tif (/[|;&<>$`(){}\\n\\r]/u.test(command)) {\n\t\treturn {\n\t\t\tverdict: \"main_mutation_refused\",\n\t\t\treason: \"compound shell syntax is refused in a lane; use typed worktree_sync actions\",\n\t\t};\n\t}\n\tif (/^\\s*[\"']git[\"']\\s/u.test(command)) {\n\t\treturn {\n\t\t\tverdict: \"main_mutation_refused\",\n\t\t\treason: \"quoted command names are refused in a lane; use the typed Git actions\",\n\t\t};\n\t}\n\tconst segments = [command];\n\tlet allowedWhenSyncRequired = false;\n\tfor (const segment of segments) {\n\t\tconst tokens = segment.trim().split(/\\s+/).filter(Boolean);\n\t\tif (tokens[0] !== \"git\") continue;\n\t\tlet j = 1;\n\t\tlet escapesWorktree = false;\n\t\t// Skip git global options to find the subcommand; -C/--git-dir mark checkout escape.\n\t\twhile (j < tokens.length) {\n\t\t\tconst token = tokens[j] ?? \"\";\n\t\t\tif (token === \"-C\" || token === \"--git-dir\" || token === \"--work-tree\") {\n\t\t\t\tescapesWorktree = true;\n\t\t\t\tj += 2;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (token.startsWith(\"-C\") && token !== \"-C\") {\n\t\t\t\tescapesWorktree = true;\n\t\t\t\tj += 1;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (token.startsWith(\"--git-dir=\") || token.startsWith(\"--work-tree=\")) {\n\t\t\t\tescapesWorktree = true;\n\t\t\t\tj += 1;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (token.startsWith(\"-\")) {\n\t\t\t\tj += 1;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tbreak;\n\t\t}\n\t\tconst subcommand = tokens[j] ?? \"\";\n\t\tconst rest = tokens.slice(j + 1);\n\t\tif (subcommand === \"push\") {\n\t\t\treturn {\n\t\t\t\tverdict: \"main_mutation_refused\",\n\t\t\t\treason:\n\t\t\t\t\t\"git push is refused in a lane session; landing is the only integration path and pushing stays an owner action\",\n\t\t\t};\n\t\t}\n\t\tif (escapesWorktree && MAIN_MUTATING_GIT_SUBCOMMANDS.has(subcommand)) {\n\t\t\treturn {\n\t\t\t\tverdict: \"main_mutation_refused\",\n\t\t\t\treason: `git -C/--git-dir with '${subcommand}' escapes the lane worktree; operate only on this lane (G10)`,\n\t\t\t};\n\t\t}\n\t\tif (\n\t\t\tsubcommand === \"branch\" &&\n\t\t\trest.some((token) => /^(?:-f|--force|-M|-m|-D|-d)$/.test(token)) &&\n\t\t\trest.includes(mainBranch)\n\t\t) {\n\t\t\treturn {\n\t\t\t\tverdict: \"main_mutation_refused\",\n\t\t\t\treason: `git branch may not move/delete '${mainBranch}' from a lane; main moves only through the land gate (G10)`,\n\t\t\t};\n\t\t}\n\t\tif (subcommand === \"update-ref\" && rest.some((token) => token === `refs/heads/${mainBranch}`)) {\n\t\t\treturn {\n\t\t\t\tverdict: \"main_mutation_refused\",\n\t\t\t\treason: `git update-ref may not touch refs/heads/${mainBranch} from a lane (G10)`,\n\t\t\t};\n\t\t}\n\t\tif (SYNC_SAFE_GIT_SUBCOMMANDS.has(subcommand)) allowedWhenSyncRequired = true;\n\t}\n\treturn allowedWhenSyncRequired ? { verdict: \"allowed_even_when_sync_required\" } : { verdict: \"allowed\" };\n}\n\n/** Symlink-safe resolution of a path that may not exist yet: realpath the NEAREST EXISTING\n * ancestor, then re-append the not-yet-existing tail literally (a not-yet-created file's own\n * missing final component can never itself be a symlink escape). */\nfunction resolveSymlinkSafe(targetPath: string): string {\n\tif (existsSync(targetPath)) {\n\t\ttry {\n\t\t\treturn realpathSync(targetPath);\n\t\t} catch {\n\t\t\treturn targetPath;\n\t\t}\n\t}\n\tconst tail: string[] = [basename(targetPath)];\n\tlet ancestor = dirname(targetPath);\n\twhile (!existsSync(ancestor)) {\n\t\tconst parent = dirname(ancestor);\n\t\tif (parent === ancestor) break; // reached the filesystem root without finding one\n\t\ttail.unshift(basename(ancestor));\n\t\tancestor = parent;\n\t}\n\tlet realAncestor: string;\n\ttry {\n\t\trealAncestor = realpathSync(ancestor);\n\t} catch {\n\t\trealAncestor = ancestor;\n\t}\n\treturn join(realAncestor, ...tail);\n}\n\n/** Symlink-safe containment check (G-path): does `targetPath` resolve inside `worktreePath`? */\nexport function isPathOutsideLane(targetPath: string, worktreePath: string): boolean {\n\tlet realRoot: string;\n\ttry {\n\t\trealRoot = realpathSync(worktreePath);\n\t} catch {\n\t\trealRoot = worktreePath;\n\t}\n\tconst resolvedTarget = resolveSymlinkSafe(targetPath);\n\treturn resolvedTarget !== realRoot && !resolvedTarget.startsWith(realRoot + sep);\n}\n\n/** Resolve a user-supplied relative lane path and reject symlink/parent escapes. */\nexport function resolveLaneMutationPath(worktreePath: string, candidate: string): string | undefined {\n\tconst target = resolve(worktreePath, candidate);\n\treturn isPathOutsideLane(target, worktreePath) ? undefined : target;\n}\n\nexport interface WorktreeLaneGateConfig {\n\tlaneKey: string;\n\tengineDeps: () => WorktreeSyncEngineDeps;\n\tpolicy: () => WorktreeSyncPolicy;\n\t/** Worker launches use a hard shell envelope: only lane-safe Git/WIP commands and the owner-configured\n\t * exact gate command may pass through bash. Interactive lane sessions retain the legacy cooperative\n\t * command surface while the typed worktree_sync actions are used for hard worker mutations. */\n\thardShell?: boolean;\n\ttrustedGateCommand?: () => string | undefined;\n}\n\nexport type LaneMutationCheck = { allowed: true } | { allowed: false; code: string; message: string };\n\nasync function changedPaths(\n\tdeps: WorktreeSyncEngineDeps,\n\tcwd: string,\n\tbase: string,\n\tref: string,\n): Promise<Set<string> | undefined> {\n\tconst result = await deps.exec(\"git\", [\"diff\", \"--name-only\", `${base}..${ref}`, \"--\"], {\n\t\tcwd,\n\t\ttimeout: 60_000,\n\t\tmaxBuffer: 1024 * 1024,\n\t});\n\tif (result.code !== 0) return undefined;\n\treturn new Set(\n\t\tresult.stdout\n\t\t\t.split(/\\r?\\n/u)\n\t\t\t.map((path) => path.trim())\n\t\t\t.filter(Boolean),\n\t);\n}\n\nfunction hardShellCommandAllowed(command: string, mainBranch: string, trustedGateCommand?: string): boolean {\n\tconst trimmed = command.trim();\n\tif (trustedGateCommand && trimmed === trustedGateCommand.trim()) return true;\n\tif (!/^git(?:\\s|$)/u.test(trimmed)) return false;\n\tconst verdict = classifyLaneBashCommand(trimmed, mainBranch);\n\tif (verdict.verdict === \"main_mutation_refused\") return false;\n\tconst tokens = trimmed.split(/\\s+/u);\n\tconst subcommand = tokens[1] ?? \"\";\n\tif (!SYNC_SAFE_GIT_SUBCOMMANDS.has(subcommand) && subcommand !== \"commit\") return false;\n\t// Git path operands must not escape the lane checkout. The typed worktree\n\t// actions are the authoritative route for path-sensitive add/diff operations;\n\t// this final check prevents the common absolute/parent escape in the shell floor.\n\treturn !tokens.slice(2).some((token) => token.startsWith(\"/\") || token.startsWith(\"..\") || token.includes(\"/../\"));\n}\n\n/**\n * The G8 gate object RuntimeBuilder holds per lane-bound session. `checkMutation` is called by\n * the wrapped edit/write/bash tools before every mutating execution.\n */\nexport class WorktreeLaneGate {\n\tprivate readonly config: WorktreeLaneGateConfig;\n\tprivate _ctx: RepoContext | undefined;\n\tprivate _epochFileMtimeMs: number | undefined;\n\tprivate _cachedAllowed = false;\n\n\tconstructor(config: WorktreeLaneGateConfig) {\n\t\tthis.config = config;\n\t}\n\n\tprivate async resolveContext(): Promise<RepoContext | undefined> {\n\t\tif (this._ctx) return this._ctx;\n\t\tconst ctx = await resolveRepoContext(this.config.engineDeps());\n\t\tif (\"code\" in ctx) return undefined;\n\t\tthis._ctx = ctx;\n\t\treturn ctx;\n\t}\n\n\t/** Cheap fence: has the epoch file changed since the last allowed verdict? */\n\tprivate epochChanged(ctx: RepoContext): boolean {\n\t\tlet mtimeMs: number | undefined;\n\t\ttry {\n\t\t\tmtimeMs = statSync(ctx.paths.epochFile).mtimeMs;\n\t\t} catch {\n\t\t\tmtimeMs = undefined;\n\t\t}\n\t\tif (mtimeMs === this._epochFileMtimeMs) return false;\n\t\tthis._epochFileMtimeMs = mtimeMs;\n\t\treturn true;\n\t}\n\n\tasync checkMutation(toolName: string, bashCommand?: string, targetPath?: string): Promise<LaneMutationCheck> {\n\t\tconst ctx = await this.resolveContext();\n\t\t// No repo context (deleted repo, engine failure): fail OPEN for plain tools -- the land\n\t\t// CAS still holds -- but the G10 bash rules below never depend on repo state.\n\t\tconst mainBranch = ctx?.mainBranch ?? \"main\";\n\t\tif (this.config.hardShell && !ctx) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\tcode: \"lane_state_unavailable\",\n\t\t\t\tmessage: \"worktree-sync: lane state is unavailable; hard worker mutations fail closed\",\n\t\t\t};\n\t\t}\n\n\t\tif (toolName === \"bash\" && bashCommand !== undefined) {\n\t\t\tif (\n\t\t\t\tthis.config.hardShell &&\n\t\t\t\t!hardShellCommandAllowed(bashCommand, mainBranch, this.config.trustedGateCommand?.())\n\t\t\t) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\tcode: \"main_mutation_refused\",\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t\"worktree-sync: unrestricted bash is unavailable in a hard worker lane; use typed worktree_sync actions\",\n\t\t\t\t};\n\t\t\t}\n\t\t\tconst verdict = classifyLaneBashCommand(bashCommand, mainBranch);\n\t\t\tif (verdict.verdict === \"main_mutation_refused\") {\n\t\t\t\treturn { allowed: false, code: \"main_mutation_refused\", message: `worktree-sync: ${verdict.reason}` };\n\t\t\t}\n\t\t\tif (verdict.verdict === \"allowed_even_when_sync_required\") return { allowed: true };\n\t\t}\n\t\tif (!ctx) return { allowed: true };\n\n\t\t// G-path: an edit/write target must resolve INSIDE this lane's worktree (symlink-safe),\n\t\t// checked BEFORE the staleness cache so a cached \"allowed\" verdict never short-circuits past\n\t\t// it. No active lane record: existing fail-open stands (mirrors the readLane check below).\n\t\tif ((toolName === \"edit\" || toolName === \"write\") && targetPath !== undefined) {\n\t\t\tconst laneForPath = await readLane(ctx.paths, this.config.laneKey);\n\t\t\tif (laneForPath?.status === \"active\" && isPathOutsideLane(targetPath, laneForPath.worktreePath)) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\tcode: \"path_outside_lane\",\n\t\t\t\t\tmessage: `worktree-sync: '${targetPath}' resolves outside lane '${this.config.laneKey}' worktree (${laneForPath.worktreePath}); edit/write only inside your lane checkout`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// G8: sync_required fails mutations closed. Re-derive only when the epoch moved or while\n\t\t// blocked (a successful sync clears the block on the very next check).\n\t\tif (this._cachedAllowed && !this.epochChanged(ctx)) return { allowed: true };\n\n\t\tconst deps = this.config.engineDeps();\n\t\tconst lane = await readLane(ctx.paths, this.config.laneKey);\n\t\tif (!lane || lane.status !== \"active\") {\n\t\t\tif (this.config.hardShell) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\tcode: \"lane_state_unavailable\",\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t\"worktree-sync: hard worker lane registration is missing or inactive; reconcile before mutating\",\n\t\t\t\t};\n\t\t\t}\n\t\t\tthis._cachedAllowed = true;\n\t\t\treturn { allowed: true };\n\t\t}\n\t\t// Re-derive main tip: the cached ctx pins the sha from session start.\n\t\tconst fresh = await resolveRepoContext(deps);\n\t\tif (\"code\" in fresh) {\n\t\t\tif (this.config.hardShell) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\tcode: \"lane_state_unavailable\",\n\t\t\t\t\tmessage: \"worktree-sync: Git context is unavailable; hard worker mutation refused\",\n\t\t\t\t};\n\t\t\t}\n\t\t\tthis._cachedAllowed = true;\n\t\t\treturn { allowed: true };\n\t\t}\n\t\tthis._ctx = fresh;\n\t\tconst facts = await deriveLaneFacts(deps, fresh, lane);\n\t\tif (facts.fresh) {\n\t\t\tthis._cachedAllowed = true;\n\t\t\treturn { allowed: true };\n\t\t}\n\n\t\tconst policy = this.config.policy();\n\t\tlet syncRequired = policy === \"on_land_mandatory\";\n\t\tif (policy === \"overlap_mandatory\") {\n\t\t\t// Epoch files are notification/diagnostic state only. Derive both sides from the\n\t\t\t// current merge base so an overlap from land N remains enforced after unrelated land N+1.\n\t\t\tconst mergeBase = await deps.exec(\"git\", [\"merge-base\", fresh.mainBranch, lane.branch], {\n\t\t\t\tcwd: fresh.topLevel,\n\t\t\t\ttimeout: 60_000,\n\t\t\t\tmaxBuffer: 1024 * 1024,\n\t\t\t});\n\t\t\tif (mergeBase.code !== 0 || !mergeBase.stdout.trim()) {\n\t\t\t\tsyncRequired = true;\n\t\t\t} else {\n\t\t\t\tconst base = mergeBase.stdout.trim().split(/\\s+/u)[0];\n\t\t\t\tconst lanePaths = await changedPaths(deps, fresh.topLevel, base, lane.branch);\n\t\t\t\tconst mainPaths = await changedPaths(deps, fresh.topLevel, base, fresh.mainBranch);\n\t\t\t\tif (!lanePaths || !mainPaths) {\n\t\t\t\t\tsyncRequired = true;\n\t\t\t\t} else {\n\t\t\t\t\tsyncRequired = [...lanePaths].some((path) => mainPaths.has(path));\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif (policy === \"land_time_only\") syncRequired = false;\n\n\t\tif (!syncRequired) {\n\t\t\tthis._cachedAllowed = true;\n\t\t\treturn { allowed: true };\n\t\t}\n\t\tthis._cachedAllowed = false;\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tcode: \"sync_required\",\n\t\t\tmessage:\n\t\t\t\t`worktree-sync: lane '${this.config.laneKey}' must rebase main before further mutations ` +\n\t\t\t\t`(main moved past this lane). Commit any WIP (git add/commit stay available), then call ` +\n\t\t\t\t`worktree_sync {\"action\":\"sync\"}, resolve conflicts if any, and continue. (sync_required)`,\n\t\t};\n\t}\n}\n"]}
+{"version":3,"file":"lane-gate.js","sourceRoot":"","sources":["../../../src/core/worktree-sync/lane-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAElE,OAAO,EAAE,eAAe,EAAoB,kBAAkB,EAA+B,MAAM,iBAAiB,CAAC;AACrH,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAOtC,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACzC,QAAQ;IACR,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,OAAO;IACP,WAAW;IACX,UAAU;IACV,OAAO;IACP,MAAM;CACN,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;AAEtH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,UAAkB;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,2DAA2D;IAC3D,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO;YACN,OAAO,EAAE,uBAAuB;YAChC,MAAM,EAAE,6EAA6E;SACrF,CAAC;IACH,CAAC;IACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO;YACN,OAAO,EAAE,uBAAuB;YAChC,MAAM,EAAE,uEAAuE;SAC/E,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,uBAAuB,GAAG,KAAK,CAAC;IACpC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK;YAAE,SAAS;QAClC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,qFAAqF;QACrF,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;gBACxE,eAAe,GAAG,IAAI,CAAC;gBACvB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACV,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC9C,eAAe,GAAG,IAAI,CAAC;gBACvB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACV,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACxE,eAAe,GAAG,IAAI,CAAC;gBACvB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACV,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACV,CAAC;YACD,MAAM;QACP,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO;gBACN,OAAO,EAAE,uBAAuB;gBAChC,MAAM,EACL,+GAA+G;aAChH,CAAC;QACH,CAAC;QACD,IAAI,eAAe,IAAI,6BAA6B,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACtE,OAAO;gBACN,OAAO,EAAE,uBAAuB;gBAChC,MAAM,EAAE,0BAA0B,UAAU,8DAA8D;aAC1G,CAAC;QACH,CAAC;QACD,IACC,UAAU,KAAK,QAAQ;YACvB,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EACxB,CAAC;YACF,OAAO;gBACN,OAAO,EAAE,uBAAuB;gBAChC,MAAM,EAAE,mCAAmC,UAAU,4DAA4D;aACjH,CAAC;QACH,CAAC;QACD,IAAI,UAAU,KAAK,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,cAAc,UAAU,EAAE,CAAC,EAAE,CAAC;YAC/F,OAAO;gBACN,OAAO,EAAE,uBAAuB;gBAChC,MAAM,EAAE,2CAA2C,UAAU,oBAAoB;aACjF,CAAC;QACH,CAAC;QACD,IAAI,yBAAyB,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,uBAAuB,GAAG,IAAI,CAAC;IAC/E,CAAC;IACD,OAAO,uBAAuB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC1G,CAAC;AAED;;oEAEoE;AACpE,SAAS,kBAAkB,CAAC,UAAkB;IAC7C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACJ,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,UAAU,CAAC;QACnB,CAAC;IACF,CAAC;IACD,MAAM,IAAI,GAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,IAAI,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,QAAQ;YAAE,MAAM,CAAC,kDAAkD;QAClF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjC,QAAQ,GAAG,MAAM,CAAC;IACnB,CAAC;IACD,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACJ,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACR,YAAY,GAAG,QAAQ,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,YAAoB;IACzE,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACJ,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACR,QAAQ,GAAG,YAAY,CAAC;IACzB,CAAC;IACD,MAAM,cAAc,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACtD,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;AAClF,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,uBAAuB,CAAC,YAAoB,EAAE,SAAiB;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,iBAAiB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;AACrE,CAAC;AAUD,KAAK,UAAU,YAAY,CAC1B,IAA4B,EAC5B,GAAW,EACX,IAAY,EACZ,GAAW;IAEX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,KAAK,GAAG,EAAE,EAAE,IAAI,CAAC,EAAE;QACvF,GAAG;QACH,OAAO,EAAE,MAAM;QACf,SAAS,EAAE,IAAI,GAAG,IAAI;KACtB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,IAAI,GAAG,CACb,MAAM,CAAC,MAAM;SACX,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CACjB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IAM5B,YAAY,MAA8B;QAFlC,mBAAc,GAAG,KAAK,CAAC;QAG9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,cAAc;QAC3B,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAC/D,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,SAAS,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,8EAA8E;IACtE,YAAY,CAAC,GAAgB;QACpC,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACJ,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,GAAG,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,CAAC,iBAAiB;YAAE,OAAO,KAAK,CAAC;QACrD,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC;QACjC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,WAAoB,EAAE,UAAmB;QAC9E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,wFAAwF;QACxF,+FAA+F;QAC/F,MAAM,UAAU,GAAG,GAAG,EAAE,UAAU,IAAI,MAAM,CAAC;QAE7C,IAAI,QAAQ,KAAK,MAAM,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YACtD,MAAM,OAAO,GAAG,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YACjE,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,EAAE,CAAC;gBACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,kBAAkB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACvG,CAAC;YACD,IAAI,OAAO,CAAC,OAAO,KAAK,iCAAiC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAEnC,wFAAwF;QACxF,6FAA6F;QAC7F,2FAA2F;QAC3F,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,OAAO,CAAC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC/E,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACnE,IAAI,WAAW,EAAE,MAAM,KAAK,QAAQ,IAAI,iBAAiB,CAAC,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;gBACjG,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,mBAAmB,UAAU,4BAA4B,IAAI,CAAC,MAAM,CAAC,OAAO,eAAe,WAAW,CAAC,YAAY,8CAA8C;iBAC1K,CAAC;YACH,CAAC;QACF,CAAC;QAED,yFAAyF;QACzF,uEAAuE;QACvE,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAE7E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACvC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,sEAAsE;QACtE,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,YAAY,GAAG,MAAM,KAAK,mBAAmB,CAAC;QAClD,IAAI,MAAM,KAAK,mBAAmB,EAAE,CAAC;YACpC,iFAAiF;YACjF,0FAA0F;YAC1F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;gBACvF,GAAG,EAAE,KAAK,CAAC,QAAQ;gBACnB,OAAO,EAAE,MAAM;gBACf,SAAS,EAAE,IAAI,GAAG,IAAI;aACtB,CAAC,CAAC;YACH,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtD,YAAY,GAAG,IAAI,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACP,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC9E,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;gBACnF,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;oBAC9B,YAAY,GAAG,IAAI,CAAC;gBACrB,CAAC;qBAAM,CAAC;oBACP,YAAY,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnE,CAAC;YACF,CAAC;QACF,CAAC;QACD,IAAI,MAAM,KAAK,gBAAgB;YAAE,YAAY,GAAG,KAAK,CAAC;QAEtD,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;QAC5B,OAAO;YACN,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,eAAe;YACrB,OAAO,EACN,wBAAwB,IAAI,CAAC,MAAM,CAAC,OAAO,8CAA8C;gBACzF,yFAAyF;gBACzF,0FAA0F;SAC3F,CAAC;IACH,CAAC;CACD","sourcesContent":["/**\n * Lane gate: G8/G10 enforcement for a LANE-BOUND `pi` session (launched with\n * `PI_WORKTREE_LANE=<key>`). RuntimeBuilder wraps the session's file-mutation tools (edit /\n * write / bash) with {@link WorktreeLaneGate.checkMutation}; a lane that the active policy marks\n * sync_required fails closed with the exact recovery step until it rebases main.\n *\n * Honesty boundary: edit/write checks are structural for Pi children because the wrapper lives\n * under the tool layer. Bash remains a deliberate host-trust boundary; this gate only rejects\n * integration-sensitive Git forms and never claims to sandbox arbitrary process code. Foreign\n * CLIs stay cooperative-only, with the land CAS (G3) as their backstop.\n *\n * Determinism: the gate re-derives from git only when the epoch file actually changed (mtime\n * fence) or while blocked; verdicts in between are cached. No polling, no timers.\n */\n\nimport { existsSync, realpathSync, statSync } from \"node:fs\";\nimport { basename, dirname, join, resolve, sep } from \"node:path\";\nimport type { WorktreeSyncPolicy } from \"./codes.ts\";\nimport { deriveLaneFacts, type RepoContext, resolveRepoContext, type WorktreeSyncEngineDeps } from \"./git-engine.ts\";\nimport { readLane } from \"./store.ts\";\n\nexport type LaneBashVerdict =\n\t| { verdict: \"allowed\" }\n\t| { verdict: \"allowed_even_when_sync_required\" }\n\t| { verdict: \"main_mutation_refused\"; reason: string };\n\nconst SYNC_SAFE_GIT_SUBCOMMANDS = new Set([\n\t\"status\",\n\t\"diff\",\n\t\"log\",\n\t\"show\",\n\t\"add\",\n\t\"commit\",\n\t\"stash\",\n\t\"rev-parse\",\n\t\"ls-files\",\n\t\"blame\",\n\t\"grep\",\n]);\n\nconst MAIN_MUTATING_GIT_SUBCOMMANDS = new Set([\"merge\", \"rebase\", \"reset\", \"commit\", \"branch\", \"update-ref\", \"push\"]);\n\n/**\n * Classify one bash command line for a lane-bound session (G10 + the sync_required allowlist).\n * Tokenization is whitespace-naive by design -- deterministic and reviewable; shell-quoting\n * tricks can evade it, which is the documented cooperative boundary (the land CAS cannot be\n * evaded). Command POSITION still matters: `git` only begins an invocation at the start of the\n * command or immediately after a shell separator (`&&`, `||`, `;`, `|`) -- a bare `git` token\n * elsewhere (e.g. as a plain argument to `echo`) is not an invocation. Rules:\n * - `git push` anywhere: refused (main moves only through the land gate; pushing is owner-only).\n * - `git -C <path>` / `--git-dir` combined with a mutating subcommand: refused (escaping the\n *   lane worktree to operate on another checkout, e.g. the hub).\n * - `git branch -f/-M/-D <main>` / `git update-ref refs/heads/<main>`: refused.\n * - Everything else: allowed; a read/commit-shaped git subcommand additionally stays allowed\n *   while the lane is sync_required (committing WIP is the prescribed step BEFORE syncing).\n */\nexport function classifyLaneBashCommand(command: string, mainBranch: string): LaneBashVerdict {\n\t// This classifier is defense-in-depth, not a shell parser. Refuse compound\n\t// syntax before any segment can return an allow verdict; otherwise `git\n\t// status; git push` is approved by the first safe segment.\n\tif (/[|;&<>$`(){}\\n\\r]/u.test(command)) {\n\t\treturn {\n\t\t\tverdict: \"main_mutation_refused\",\n\t\t\treason: \"compound shell syntax is refused in a lane; use typed worktree_sync actions\",\n\t\t};\n\t}\n\tif (/^\\s*[\"']git[\"']\\s/u.test(command)) {\n\t\treturn {\n\t\t\tverdict: \"main_mutation_refused\",\n\t\t\treason: \"quoted command names are refused in a lane; use the typed Git actions\",\n\t\t};\n\t}\n\tconst segments = [command];\n\tlet allowedWhenSyncRequired = false;\n\tfor (const segment of segments) {\n\t\tconst tokens = segment.trim().split(/\\s+/).filter(Boolean);\n\t\tif (tokens[0] !== \"git\") continue;\n\t\tlet j = 1;\n\t\tlet escapesWorktree = false;\n\t\t// Skip git global options to find the subcommand; -C/--git-dir mark checkout escape.\n\t\twhile (j < tokens.length) {\n\t\t\tconst token = tokens[j] ?? \"\";\n\t\t\tif (token === \"-C\" || token === \"--git-dir\" || token === \"--work-tree\") {\n\t\t\t\tescapesWorktree = true;\n\t\t\t\tj += 2;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (token.startsWith(\"-C\") && token !== \"-C\") {\n\t\t\t\tescapesWorktree = true;\n\t\t\t\tj += 1;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (token.startsWith(\"--git-dir=\") || token.startsWith(\"--work-tree=\")) {\n\t\t\t\tescapesWorktree = true;\n\t\t\t\tj += 1;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (token.startsWith(\"-\")) {\n\t\t\t\tj += 1;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tbreak;\n\t\t}\n\t\tconst subcommand = tokens[j] ?? \"\";\n\t\tconst rest = tokens.slice(j + 1);\n\t\tif (subcommand === \"push\") {\n\t\t\treturn {\n\t\t\t\tverdict: \"main_mutation_refused\",\n\t\t\t\treason:\n\t\t\t\t\t\"git push is refused in a lane session; landing is the only integration path and pushing stays an owner action\",\n\t\t\t};\n\t\t}\n\t\tif (escapesWorktree && MAIN_MUTATING_GIT_SUBCOMMANDS.has(subcommand)) {\n\t\t\treturn {\n\t\t\t\tverdict: \"main_mutation_refused\",\n\t\t\t\treason: `git -C/--git-dir with '${subcommand}' escapes the lane worktree; operate only on this lane (G10)`,\n\t\t\t};\n\t\t}\n\t\tif (\n\t\t\tsubcommand === \"branch\" &&\n\t\t\trest.some((token) => /^(?:-f|--force|-M|-m|-D|-d)$/.test(token)) &&\n\t\t\trest.includes(mainBranch)\n\t\t) {\n\t\t\treturn {\n\t\t\t\tverdict: \"main_mutation_refused\",\n\t\t\t\treason: `git branch may not move/delete '${mainBranch}' from a lane; main moves only through the land gate (G10)`,\n\t\t\t};\n\t\t}\n\t\tif (subcommand === \"update-ref\" && rest.some((token) => token === `refs/heads/${mainBranch}`)) {\n\t\t\treturn {\n\t\t\t\tverdict: \"main_mutation_refused\",\n\t\t\t\treason: `git update-ref may not touch refs/heads/${mainBranch} from a lane (G10)`,\n\t\t\t};\n\t\t}\n\t\tif (SYNC_SAFE_GIT_SUBCOMMANDS.has(subcommand)) allowedWhenSyncRequired = true;\n\t}\n\treturn allowedWhenSyncRequired ? { verdict: \"allowed_even_when_sync_required\" } : { verdict: \"allowed\" };\n}\n\n/** Symlink-safe resolution of a path that may not exist yet: realpath the NEAREST EXISTING\n * ancestor, then re-append the not-yet-existing tail literally (a not-yet-created file's own\n * missing final component can never itself be a symlink escape). */\nfunction resolveSymlinkSafe(targetPath: string): string {\n\tif (existsSync(targetPath)) {\n\t\ttry {\n\t\t\treturn realpathSync(targetPath);\n\t\t} catch {\n\t\t\treturn targetPath;\n\t\t}\n\t}\n\tconst tail: string[] = [basename(targetPath)];\n\tlet ancestor = dirname(targetPath);\n\twhile (!existsSync(ancestor)) {\n\t\tconst parent = dirname(ancestor);\n\t\tif (parent === ancestor) break; // reached the filesystem root without finding one\n\t\ttail.unshift(basename(ancestor));\n\t\tancestor = parent;\n\t}\n\tlet realAncestor: string;\n\ttry {\n\t\trealAncestor = realpathSync(ancestor);\n\t} catch {\n\t\trealAncestor = ancestor;\n\t}\n\treturn join(realAncestor, ...tail);\n}\n\n/** Symlink-safe containment check (G-path): does `targetPath` resolve inside `worktreePath`? */\nexport function isPathOutsideLane(targetPath: string, worktreePath: string): boolean {\n\tlet realRoot: string;\n\ttry {\n\t\trealRoot = realpathSync(worktreePath);\n\t} catch {\n\t\trealRoot = worktreePath;\n\t}\n\tconst resolvedTarget = resolveSymlinkSafe(targetPath);\n\treturn resolvedTarget !== realRoot && !resolvedTarget.startsWith(realRoot + sep);\n}\n\n/** Resolve a user-supplied relative lane path and reject symlink/parent escapes. */\nexport function resolveLaneMutationPath(worktreePath: string, candidate: string): string | undefined {\n\tconst target = resolve(worktreePath, candidate);\n\treturn isPathOutsideLane(target, worktreePath) ? undefined : target;\n}\n\nexport interface WorktreeLaneGateConfig {\n\tlaneKey: string;\n\tengineDeps: () => WorktreeSyncEngineDeps;\n\tpolicy: () => WorktreeSyncPolicy;\n}\n\nexport type LaneMutationCheck = { allowed: true } | { allowed: false; code: string; message: string };\n\nasync function changedPaths(\n\tdeps: WorktreeSyncEngineDeps,\n\tcwd: string,\n\tbase: string,\n\tref: string,\n): Promise<Set<string> | undefined> {\n\tconst result = await deps.exec(\"git\", [\"diff\", \"--name-only\", `${base}..${ref}`, \"--\"], {\n\t\tcwd,\n\t\ttimeout: 60_000,\n\t\tmaxBuffer: 1024 * 1024,\n\t});\n\tif (result.code !== 0) return undefined;\n\treturn new Set(\n\t\tresult.stdout\n\t\t\t.split(/\\r?\\n/u)\n\t\t\t.map((path) => path.trim())\n\t\t\t.filter(Boolean),\n\t);\n}\n\n/**\n * The G8 gate object RuntimeBuilder holds per lane-bound session. `checkMutation` is called by\n * the wrapped edit/write/bash tools before every mutating execution.\n */\nexport class WorktreeLaneGate {\n\tprivate readonly config: WorktreeLaneGateConfig;\n\tprivate _ctx: RepoContext | undefined;\n\tprivate _epochFileMtimeMs: number | undefined;\n\tprivate _cachedAllowed = false;\n\n\tconstructor(config: WorktreeLaneGateConfig) {\n\t\tthis.config = config;\n\t}\n\n\tprivate async resolveContext(): Promise<RepoContext | undefined> {\n\t\tif (this._ctx) return this._ctx;\n\t\tconst ctx = await resolveRepoContext(this.config.engineDeps());\n\t\tif (\"code\" in ctx) return undefined;\n\t\tthis._ctx = ctx;\n\t\treturn ctx;\n\t}\n\n\t/** Cheap fence: has the epoch file changed since the last allowed verdict? */\n\tprivate epochChanged(ctx: RepoContext): boolean {\n\t\tlet mtimeMs: number | undefined;\n\t\ttry {\n\t\t\tmtimeMs = statSync(ctx.paths.epochFile).mtimeMs;\n\t\t} catch {\n\t\t\tmtimeMs = undefined;\n\t\t}\n\t\tif (mtimeMs === this._epochFileMtimeMs) return false;\n\t\tthis._epochFileMtimeMs = mtimeMs;\n\t\treturn true;\n\t}\n\n\tasync checkMutation(toolName: string, bashCommand?: string, targetPath?: string): Promise<LaneMutationCheck> {\n\t\tconst ctx = await this.resolveContext();\n\t\t// No repo context (deleted repo, engine failure): fail OPEN for plain tools -- the land\n\t\t// CAS still holds -- but the integration-sensitive Git rules below never depend on repo state.\n\t\tconst mainBranch = ctx?.mainBranch ?? \"main\";\n\n\t\tif (toolName === \"bash\" && bashCommand !== undefined) {\n\t\t\tconst verdict = classifyLaneBashCommand(bashCommand, mainBranch);\n\t\t\tif (verdict.verdict === \"main_mutation_refused\") {\n\t\t\t\treturn { allowed: false, code: \"main_mutation_refused\", message: `worktree-sync: ${verdict.reason}` };\n\t\t\t}\n\t\t\tif (verdict.verdict === \"allowed_even_when_sync_required\") return { allowed: true };\n\t\t}\n\t\tif (!ctx) return { allowed: true };\n\n\t\t// G-path: an edit/write target must resolve INSIDE this lane's worktree (symlink-safe),\n\t\t// checked BEFORE the staleness cache so a cached \"allowed\" verdict never short-circuits past\n\t\t// it. No active lane record: existing fail-open stands (mirrors the readLane check below).\n\t\tif ((toolName === \"edit\" || toolName === \"write\") && targetPath !== undefined) {\n\t\t\tconst laneForPath = await readLane(ctx.paths, this.config.laneKey);\n\t\t\tif (laneForPath?.status === \"active\" && isPathOutsideLane(targetPath, laneForPath.worktreePath)) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\tcode: \"path_outside_lane\",\n\t\t\t\t\tmessage: `worktree-sync: '${targetPath}' resolves outside lane '${this.config.laneKey}' worktree (${laneForPath.worktreePath}); edit/write only inside your lane checkout`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// G8: sync_required fails mutations closed. Re-derive only when the epoch moved or while\n\t\t// blocked (a successful sync clears the block on the very next check).\n\t\tif (this._cachedAllowed && !this.epochChanged(ctx)) return { allowed: true };\n\n\t\tconst deps = this.config.engineDeps();\n\t\tconst lane = await readLane(ctx.paths, this.config.laneKey);\n\t\tif (!lane || lane.status !== \"active\") {\n\t\t\tthis._cachedAllowed = true;\n\t\t\treturn { allowed: true };\n\t\t}\n\t\t// Re-derive main tip: the cached ctx pins the sha from session start.\n\t\tconst fresh = await resolveRepoContext(deps);\n\t\tif (\"code\" in fresh) {\n\t\t\tthis._cachedAllowed = true;\n\t\t\treturn { allowed: true };\n\t\t}\n\t\tthis._ctx = fresh;\n\t\tconst facts = await deriveLaneFacts(deps, fresh, lane);\n\t\tif (facts.fresh) {\n\t\t\tthis._cachedAllowed = true;\n\t\t\treturn { allowed: true };\n\t\t}\n\n\t\tconst policy = this.config.policy();\n\t\tlet syncRequired = policy === \"on_land_mandatory\";\n\t\tif (policy === \"overlap_mandatory\") {\n\t\t\t// Epoch files are notification/diagnostic state only. Derive both sides from the\n\t\t\t// current merge base so an overlap from land N remains enforced after unrelated land N+1.\n\t\t\tconst mergeBase = await deps.exec(\"git\", [\"merge-base\", fresh.mainBranch, lane.branch], {\n\t\t\t\tcwd: fresh.topLevel,\n\t\t\t\ttimeout: 60_000,\n\t\t\t\tmaxBuffer: 1024 * 1024,\n\t\t\t});\n\t\t\tif (mergeBase.code !== 0 || !mergeBase.stdout.trim()) {\n\t\t\t\tsyncRequired = true;\n\t\t\t} else {\n\t\t\t\tconst base = mergeBase.stdout.trim().split(/\\s+/u)[0];\n\t\t\t\tconst lanePaths = await changedPaths(deps, fresh.topLevel, base, lane.branch);\n\t\t\t\tconst mainPaths = await changedPaths(deps, fresh.topLevel, base, fresh.mainBranch);\n\t\t\t\tif (!lanePaths || !mainPaths) {\n\t\t\t\t\tsyncRequired = true;\n\t\t\t\t} else {\n\t\t\t\t\tsyncRequired = [...lanePaths].some((path) => mainPaths.has(path));\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif (policy === \"land_time_only\") syncRequired = false;\n\n\t\tif (!syncRequired) {\n\t\t\tthis._cachedAllowed = true;\n\t\t\treturn { allowed: true };\n\t\t}\n\t\tthis._cachedAllowed = false;\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tcode: \"sync_required\",\n\t\t\tmessage:\n\t\t\t\t`worktree-sync: lane '${this.config.laneKey}' must rebase main before further mutations ` +\n\t\t\t\t`(main moved past this lane). Commit any WIP (git add/commit stay available), then call ` +\n\t\t\t\t`worktree_sync {\"action\":\"sync\"}, resolve conflicts if any, and continue. (sync_required)`,\n\t\t};\n\t}\n}\n"]}

package/dist/index.d.ts

@@ -4,6 +4,8 @@ export { type Args, parseArgs } from "./cli/args.ts";
 export { getAgentDir, VERSION } from "./config.ts";
 export { AgentSession, type AgentSessionConfig, type AgentSessionEvent, type AgentSessionEventListener, type ModelCycleResult, type ParsedSkillBlock, type PromptOptions, parseSkillBlock, type SessionStats, } from "./core/agent-session.ts";
 export { type ApiKeyCredential, type AuthCredential, type AuthStatus, AuthStorage, type AuthStorageBackend, FileAuthStorageBackend, InMemoryAuthStorageBackend, type OAuthCredential, } from "./core/auth-storage.ts";
+export { encodeWorkerSessionAllowedPaths, PI_WORKER_ALLOWED_PATHS_ENV, } from "./core/autonomy/worker-session-private-scope.ts";
+export { mapToolNamesForPlatform } from "./core/default-tool-surface.ts";
 export { createEventBus, type EventBus, type EventBusController } from "./core/event-bus.ts";
 export type { AgentEndEvent, AgentStartEvent, AgentToolResult, AgentToolUpdateCallback, AppKeybinding, AutocompleteProviderFactory, BashToolCallEvent, BeforeAgentStartEvent, BeforeAgentStartEventResult, BeforeProviderRequestEvent, BeforeProviderRequestEventResult, BuildSystemPromptOptions, CompactOptions, ContextEvent, ContextEventResult, ContextUsage, CustomToolCallEvent, EditToolCallEvent, ExecOptions, ExecResult, Extension, ExtensionActions, ExtensionAPI, ExtensionCommandContext, ExtensionCommandContextActions, ExtensionContext, ExtensionContextActions, ExtensionError, ExtensionEvent, ExtensionFactory, ExtensionFlag, ExtensionHandler, ExtensionRuntime, ExtensionShortcut, ExtensionStorage, ExtensionUIContext, ExtensionUIDialogOptions, ExtensionWidgetOptions, ExtensionWorkRunOptions, FindToolCallEvent, GrepToolCallEvent, InputEvent, InputEventResult, InputSource, KeybindingsManager, LoadExtensionsResult, LsToolCallEvent, MessageEndEvent, MessageRenderer, MessageRenderOptions, MessageStartEvent, MessageUpdateEvent, ProviderConfig, ProviderModelConfig, ReadToolCallEvent, RegisteredCommand, RegisteredTool, ResolvedCommand, SessionBeforeCompactEvent, SessionBeforeForkEvent, SessionBeforeSwitchEvent, SessionBeforeTreeEvent, SessionCompactEvent, SessionShutdownEvent, SessionStartEvent, SessionTreeEvent, SlashCommandInfo, SlashCommandSource, SourceInfo, TerminalInputHandler, ToolCallEvent, ToolCallEventResult, ToolDefinition, ToolExecutionEndEvent, ToolExecutionMode, ToolExecutionStartEvent, ToolExecutionUpdateEvent, ToolInfo, ToolRenderResultOptions, ToolResultEvent, TurnEndEvent, TurnStartEvent, UserBashEvent, UserBashEventResult, WidgetPlacement, WorkingIndicatorOptions, WriteToolCallEvent, } from "./core/extensions/index.ts";
 export { defineTool, ExtensionRunner, isBashToolResult, isEditToolResult, isFindToolResult, isGrepToolResult, isLsToolResult, isReadToolResult, isToolCallEventType, isWriteToolResult, wrapRegisteredTool, wrapRegisteredTools, } from "./core/extensions/index.ts";
@@ -19,6 +21,7 @@ export * from "./core/orchestration/policy-compiler.ts";
 export * from "./core/orchestration/profile-registry.ts";
 export * from "./core/orchestration/profile-store.ts";
 export * from "./core/orchestration/task-runtime.ts";
+export { orchestrationThinkingLevelSchema } from "./core/orchestration/thinking-level-schema.ts";
 export type { PackageManager, PathMetadata, ProgressCallback, ProgressEvent, ResolvedPaths, ResolvedResource, } from "./core/package-manager.ts";
 export { DefaultPackageManager } from "./core/package-manager.ts";
 export { PI_ORCHESTRATION_AGENT_ID_ENV } from "./core/process-identity.ts";
@@ -33,10 +36,12 @@ export { type BitwardenSecretsManagerCommandRequest, type BitwardenSecretsManage
 export { type CredentialActivationResult, type CredentialConnectionStatus, CredentialManager, CredentialManagerError, type CredentialManagerErrorCode, type CredentialManagerOptions, type CredentialMutationResult, type CredentialProfileRecord, type CredentialProfileStorage, type CredentialProfileSummary, type CredentialProjectIdentity, type CredentialProjectResolver, CredentialStorageError, type CredentialStorageErrorCode, type CredentialStorageProvider, type CredentialVariable, type MachineCredentialSession, type MachineCredentialSessionResolver, type StoredCredentialProfileSummary, } from "./core/secrets/credential-manager.ts";
 export { type CredentialMigrationSource, CredentialMigrationSourceError, type CredentialMigrationSourceErrorCode, type CredentialMigrationSourceResolver, resolveCredentialMigrationSources, } from "./core/secrets/credential-migration-source.ts";
 export { createPortableGitProjectKey, resolveCredentialProject } from "./core/secrets/credential-project.ts";
+export { WORKER_FORBIDDEN_TOOLS } from "./core/session-role.ts";
 export { type CompactionSettings, type DirectoryResourceProfileInfo, getDirectoryResourceProfileInfo, type ImageSettings, matchesResourceProfilePattern, type PackageSource, type ResourceProfileFilterSettings, type ResourceProfileKind, type ResourceProfileSettings, type RetrySettings, SettingsManager, type SettingsManagerCreateOptions, } from "./core/settings-manager.ts";
 export { DEFAULT_SKILL_IDLE_TIMEOUT_MS, MAX_ACTIVE_SKILL_BODY_BYTES, MAX_LOADED_SKILLS, MAX_PINNED_SKILLS, MIN_ACTIVE_SKILL_BODY_BYTES, resolveActiveSkillBodyByteLimit, type SkillLoadResult, type SkillSearchResult, type SkillSlotStatus, SkillVaultController, type SkillVaultControllerOptions, type SkillVaultStatus, } from "./core/skill-vault.ts";
 export { type LoadSkillsFromDirOptions, type LoadSkillsResult, loadSkills, loadSkillsFromDir, MAX_SKILL_FRONTMATTER_BYTES, readSkillFrontmatterFile, type Skill, type SkillFrontmatter, } from "./core/skills.ts";
 export { createSyntheticSourceInfo } from "./core/source-info.ts";
+export { POLICY_OWNED_RUNTIME_TOOL_NAMES } from "./core/tool-capability-policy.ts";
 export { type AskQuestion, type AskQuestionAnswer, AskQuestionDialog, type AskQuestionStopReason, type AskQuestionToolDetails, type AskQuestionToolInput, type AskQuestionToolOptions, createAskQuestionToolDefinition, } from "./core/tools/ask-question.ts";
 export { type BashOperations, type BashSpawnContext, type BashSpawnHook, type BashToolDetails, type BashToolInput, type BashToolOptions, createBashToolDefinition, createEditToolDefinition, createFileFailureRecoveryAuthority, createFindToolDefinition, createGrepToolDefinition, createLocalBashOperations, createLsToolDefinition, createReadToolDefinition, createSecretStoreToolDefinition, createWriteToolDefinition, DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, type EditOperations, type EditToolDetails, type EditToolInput, type EditToolOptions, type FileContentReference, type FileFailureRecoveryAuthority, FileMutationIntentController, type FileMutationIntentControllerOptions, type FileMutationIntentOperations, type FileMutationKind, type FileMutationLease, type FileMutationPayloadReference, FileMutationPreflightError, type FileMutationPreflightFailureReason, type FilePathIdentity, type FilePathInspection, type FindOperations, type FindToolDetails, type FindToolInput, type FindToolOptions, formatMiddleOmissionMarker, formatSize, type GrepOperations, type GrepToolDetails, type GrepToolInput, type GrepToolOptions, type LsOperations, type LsToolDetails, type LsToolInput, type LsToolOptions, type ReadOperations, type ReadToolDetails, type ReadToolInput, type ReadToolOptions, type SecretStoreStatus, type SecretStoreToolDetails, type SecretStoreToolInput, type SecretStoreToolOptions, type ToolsOptions, type TruncationOptions, type TruncationResult, truncateHead, truncateKnownHeadTail, truncateLine, truncateMiddle, truncateTail, type WriteOperations, type WriteToolDetails, type WriteToolInput, type WriteToolOptions, withFileMutationQueue, } from "./core/tools/index.ts";
 export { createSkillVaultToolDefinition, type SkillToolDetails, type SkillToolInput, } from "./core/tools/skill.ts";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,mBAAmB,EACnB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,uBAAuB,EACvB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,sBAAsB,EACtB,8BAA8B,EAC9B,OAAO,EACP,2BAA2B,EAC3B,cAAc,EACd,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,YAAY,EACZ,kBAAkB,EAClB,KAAK,4BAA4B,EACjC,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,qBAAqB,EACrB,KAAK,iBAAiB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,cAAc,EACd,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,aAAa,EACb,KAAK,wBAAwB,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,KAAK,IAAI,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACN,YAAY,EACZ,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,eAAe,EACf,KAAK,YAAY,GACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,WAAW,EACX,KAAK,kBAAkB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,eAAe,GACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE7F,YAAY,EACX,aAAa,EACb,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,2BAA2B,EAC3B,iBAAiB,EACjB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,EAC1B,gCAAgC,EAChC,wBAAwB,EACxB,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,YAAY,EACZ,uBAAuB,EACvB,8BAA8B,EAC9B,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,UAAU,EACV,oBAAoB,EACpB,aAAa,EACb,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,QAAQ,EACR,uBAAuB,EACvB,eAAe,EACf,YAAY,EACZ,cAAc,EACd,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,uBAAuB,EACvB,kBAAkB,GAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACN,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,GACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAEhG,YAAY,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EACN,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,aAAa,EACb,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,EACjB,6BAA6B,EAC7B,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EAClC,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,MAAM,EACN,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,cAAc,EACd,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,kBAAkB,GAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,mCAAmC,CAAC;AAClD,cAAc,qCAAqC,CAAC;AACpD,cAAc,uCAAuC,CAAC;AACtD,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AACzD,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,YAAY,EACX,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,gBAAgB,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EACN,kBAAkB,EAClB,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACxB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AACvG,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,EACN,uBAAuB,EACvB,4BAA4B,EAC5B,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,GAC1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACN,mBAAmB,EACnB,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,qCAAqC,EAC1C,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,gCAAgC,EACrC,KAAK,+BAA+B,EACpC,KAAK,iCAAiC,EAEtC,kBAAkB,EAClB,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC1B,cAAc,EAEd,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,KAAK,cAAc,EACnB,+BAA+B,EAC/B,8BAA8B,GAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,EACN,0BAA0B,EAC1B,+BAA+B,EAC/B,KAAK,mCAAmC,EACxC,KAAK,iCAAiC,GACtC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACN,gCAAgC,EAChC,KAAK,uCAAuC,GAC5C,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACN,KAAK,qCAAqC,EAC1C,KAAK,oCAAoC,EACzC,wCAAwC,EACxC,KAAK,+CAA+C,EACpD,mCAAmC,GACnC,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EACN,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAC/B,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,sBAAsB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,GACnC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACN,KAAK,yBAAyB,EAC9B,8BAA8B,EAC9B,KAAK,kCAAkC,EACvC,KAAK,iCAAiC,EACtC,iCAAiC,GACjC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAC7G,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EACjC,+BAA+B,EAC/B,KAAK,aAAa,EAClB,6BAA6B,EAC7B,KAAK,aAAa,EAClB,KAAK,6BAA6B,EAClC,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,eAAe,EACf,KAAK,4BAA4B,GACjC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACN,6BAA6B,EAC7B,2BAA2B,EAC3B,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,EAC3B,+BAA+B,EAC/B,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACN,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,UAAU,EACV,iBAAiB,EACjB,2BAA2B,EAC3B,wBAAwB,EACxB,KAAK,KAAK,EACV,KAAK,gBAAgB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EACN,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,+BAA+B,GAC/B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACN,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,kCAAkC,EAClC,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,+BAA+B,EAC/B,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EACjC,4BAA4B,EAC5B,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,4BAA4B,EACjC,0BAA0B,EAC1B,KAAK,kCAAkC,EACvC,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,0BAA0B,EAC1B,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,YAAY,EACZ,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,qBAAqB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACN,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,KAAK,cAAc,GACnB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACN,OAAO,EACP,aAAa,EACb,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,QAAQ,GACR,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,KAAK,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE9G,OAAO,EAAE,KAAK,WAAW,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EACN,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,YAAY,EACZ,UAAU,GACV,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACN,cAAc,EACd,yBAAyB,EACzB,sBAAsB,EACtB,cAAc,EACd,6BAA6B,EAC7B,iCAAiC,EACjC,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,0BAA0B,EAC1B,eAAe,EACf,OAAO,EACP,OAAO,EACP,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,yBAAyB,EACzB,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,EACtB,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,qBAAqB,EACrB,UAAU,EACV,SAAS,EACT,qBAAqB,EACrB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,oBAAoB,GACzB,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,SAAS,EACT,KAAK,EACL,KAAK,UAAU,GACf,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,KAAK,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE9F,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EACN,KAAK,qBAAqB,EAC1B,cAAc,EACd,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,YAAY,GACjB,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,mBAAmB,EACnB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,uBAAuB,EACvB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,sBAAsB,EACtB,8BAA8B,EAC9B,OAAO,EACP,2BAA2B,EAC3B,cAAc,EACd,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,YAAY,EACZ,kBAAkB,EAClB,KAAK,4BAA4B,EACjC,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,qBAAqB,EACrB,KAAK,iBAAiB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,cAAc,EACd,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,aAAa,EACb,KAAK,wBAAwB,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,KAAK,IAAI,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACN,YAAY,EACZ,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,eAAe,EACf,KAAK,YAAY,GACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,WAAW,EACX,KAAK,kBAAkB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,eAAe,GACpB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACN,+BAA+B,EAC/B,2BAA2B,GAC3B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE7F,YAAY,EACX,aAAa,EACb,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,2BAA2B,EAC3B,iBAAiB,EACjB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,EAC1B,gCAAgC,EAChC,wBAAwB,EACxB,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,YAAY,EACZ,uBAAuB,EACvB,8BAA8B,EAC9B,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,UAAU,EACV,oBAAoB,EACpB,aAAa,EACb,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,QAAQ,EACR,uBAAuB,EACvB,eAAe,EACf,YAAY,EACZ,cAAc,EACd,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,uBAAuB,EACvB,kBAAkB,GAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACN,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,GACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAEhG,YAAY,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EACN,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,aAAa,EACb,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,EACjB,6BAA6B,EAC7B,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EAClC,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,MAAM,EACN,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,cAAc,EACd,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,kBAAkB,GAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,mCAAmC,CAAC;AAClD,cAAc,qCAAqC,CAAC;AACpD,cAAc,uCAAuC,CAAC;AACtD,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AACzD,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,YAAY,EACX,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,gBAAgB,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EACN,kBAAkB,EAClB,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACxB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AACvG,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,EACN,uBAAuB,EACvB,4BAA4B,EAC5B,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,GAC1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACN,mBAAmB,EACnB,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,qCAAqC,EAC1C,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,gCAAgC,EACrC,KAAK,+BAA+B,EACpC,KAAK,iCAAiC,EAEtC,kBAAkB,EAClB,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC1B,cAAc,EAEd,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,KAAK,cAAc,EACnB,+BAA+B,EAC/B,8BAA8B,GAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,EACN,0BAA0B,EAC1B,+BAA+B,EAC/B,KAAK,mCAAmC,EACxC,KAAK,iCAAiC,GACtC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACN,gCAAgC,EAChC,KAAK,uCAAuC,GAC5C,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACN,KAAK,qCAAqC,EAC1C,KAAK,oCAAoC,EACzC,wCAAwC,EACxC,KAAK,+CAA+C,EACpD,mCAAmC,GACnC,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EACN,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAC/B,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,sBAAsB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,GACnC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACN,KAAK,yBAAyB,EAC9B,8BAA8B,EAC9B,KAAK,kCAAkC,EACvC,KAAK,iCAAiC,EACtC,iCAAiC,GACjC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAC7G,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EACjC,+BAA+B,EAC/B,KAAK,aAAa,EAClB,6BAA6B,EAC7B,KAAK,aAAa,EAClB,KAAK,6BAA6B,EAClC,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,eAAe,EACf,KAAK,4BAA4B,GACjC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACN,6BAA6B,EAC7B,2BAA2B,EAC3B,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,EAC3B,+BAA+B,EAC/B,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACN,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,UAAU,EACV,iBAAiB,EACjB,2BAA2B,EAC3B,wBAAwB,EACxB,KAAK,KAAK,EACV,KAAK,gBAAgB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EACN,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,+BAA+B,GAC/B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACN,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,kCAAkC,EAClC,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,+BAA+B,EAC/B,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EACjC,4BAA4B,EAC5B,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,4BAA4B,EACjC,0BAA0B,EAC1B,KAAK,kCAAkC,EACvC,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,0BAA0B,EAC1B,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,YAAY,EACZ,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,qBAAqB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACN,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,KAAK,cAAc,GACnB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACN,OAAO,EACP,aAAa,EACb,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,QAAQ,GACR,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,KAAK,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE9G,OAAO,EAAE,KAAK,WAAW,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EACN,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,YAAY,EACZ,UAAU,GACV,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACN,cAAc,EACd,yBAAyB,EACzB,sBAAsB,EACtB,cAAc,EACd,6BAA6B,EAC7B,iCAAiC,EACjC,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,0BAA0B,EAC1B,eAAe,EACf,OAAO,EACP,OAAO,EACP,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,yBAAyB,EACzB,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,EACtB,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,qBAAqB,EACrB,UAAU,EACV,SAAS,EACT,qBAAqB,EACrB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,oBAAoB,GACzB,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,SAAS,EACT,KAAK,EACL,KAAK,UAAU,GACf,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,KAAK,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE9F,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EACN,KAAK,qBAAqB,EAC1B,cAAc,EACd,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,YAAY,GACjB,MAAM,2BAA2B,CAAC"}

package/dist/index.js

@@ -8,6 +8,10 @@ export { getAgentDir, VERSION } from "./config.js";
 export { AgentSession, parseSkillBlock, } from "./core/agent-session.js";
 // Auth and model registry
 export { AuthStorage, FileAuthStorageBackend, InMemoryAuthStorageBackend, } from "./core/auth-storage.js";
+// Copied bundled extensions resolve runtime dependencies through this public module. Bun embeds
+// this surface; relative imports back into dist/core do not exist beside a compiled executable.
+export { encodeWorkerSessionAllowedPaths, PI_WORKER_ALLOWED_PATHS_ENV, } from "./core/autonomy/worker-session-private-scope.js";
+export { mapToolNamesForPlatform } from "./core/default-tool-surface.js";
 export { createEventBus } from "./core/event-bus.js";
 export { defineTool, ExtensionRunner, isBashToolResult, isEditToolResult, isFindToolResult, isGrepToolResult, isLsToolResult, isReadToolResult, isToolCallEventType, isWriteToolResult, wrapRegisteredTool, wrapRegisteredTools, } from "./core/extensions/index.js";
 export { createExtensionRuntime, discoverAndLoadExtensions } from "./core/extensions/loader.js";
@@ -21,6 +25,7 @@ export * from "./core/orchestration/policy-compiler.js";
 export * from "./core/orchestration/profile-registry.js";
 export * from "./core/orchestration/profile-store.js";
 export * from "./core/orchestration/task-runtime.js";
+export { orchestrationThinkingLevelSchema } from "./core/orchestration/thinking-level-schema.js";
 export { DefaultPackageManager } from "./core/package-manager.js";
 export { PI_ORCHESTRATION_AGENT_ID_ENV } from "./core/process-identity.js";
 export { ACTIVE_TURN_TTL_MS, AUTO_RELOAD_COORDINATOR_TTL_MS, describeReloadSession, getPendingReloadBlockers, getReloadCoordinationDir, isReloadSessionProcessAlive, } from "./core/reload-blockers.js";
@@ -38,11 +43,13 @@ export { BitwardenSecretsManagerCredentialStorage, BitwardenSecretsManagerStorag
 export { CredentialManager, CredentialManagerError, CredentialStorageError, } from "./core/secrets/credential-manager.js";
 export { CredentialMigrationSourceError, resolveCredentialMigrationSources, } from "./core/secrets/credential-migration-source.js";
 export { createPortableGitProjectKey, resolveCredentialProject } from "./core/secrets/credential-project.js";
+export { WORKER_FORBIDDEN_TOOLS } from "./core/session-role.js";
 export { getDirectoryResourceProfileInfo, matchesResourceProfilePattern, SettingsManager, } from "./core/settings-manager.js";
 export { DEFAULT_SKILL_IDLE_TIMEOUT_MS, MAX_ACTIVE_SKILL_BODY_BYTES, MAX_LOADED_SKILLS, MAX_PINNED_SKILLS, MIN_ACTIVE_SKILL_BODY_BYTES, resolveActiveSkillBodyByteLimit, SkillVaultController, } from "./core/skill-vault.js";
 // Skills
 export { loadSkills, loadSkillsFromDir, MAX_SKILL_FRONTMATTER_BYTES, readSkillFrontmatterFile, } from "./core/skills.js";
 export { createSyntheticSourceInfo } from "./core/source-info.js";
+export { POLICY_OWNED_RUNTIME_TOOL_NAMES } from "./core/tool-capability-policy.js";
 export { AskQuestionDialog, createAskQuestionToolDefinition, } from "./core/tools/ask-question.js";
 // Tools
 export { createBashToolDefinition, createEditToolDefinition, createFileFailureRecoveryAuthority, createFindToolDefinition, createGrepToolDefinition, createLocalBashOperations, createLsToolDefinition, createReadToolDefinition, createSecretStoreToolDefinition, createWriteToolDefinition, DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, FileMutationIntentController, FileMutationPreflightError, formatMiddleOmissionMarker, formatSize, truncateHead, truncateKnownHeadTail, truncateLine, truncateMiddle, truncateTail, withFileMutationQueue, } from "./core/tools/index.js";