@cerbur/clutch-dsh-worktree 0.1.6 → 0.1.7

package/lib/host/worktree-permission.d.ts

@@ -0,0 +1,38 @@
+import { type WorktreePermissionApprovalPolicy, type WorktreePermissionPort, type WorktreePermissionSandboxMode } from '../manage/worktree-permission.js';
+interface PermissionEvent {
+    readonly type: string;
+    readonly data?: unknown;
+}
+interface PermissionSession {
+    readonly id: string;
+    readonly events: readonly PermissionEvent[];
+    append(type: string, data: unknown): unknown;
+}
+interface PermissionPresetSpec {
+    readonly sandbox: WorktreePermissionSandboxMode;
+    readonly approval: WorktreePermissionApprovalPolicy;
+}
+interface PermissionPresetService {
+    readonly names: readonly string[];
+    current(events: readonly PermissionEvent[]): string;
+    resolve(name: string): PermissionPresetSpec;
+    set(session: PermissionSession, name: string): void;
+}
+interface SandboxPolicyService {
+    readonly defaultMode?: WorktreePermissionSandboxMode;
+}
+export interface DshWorktreePermissionAdapterOptions {
+    readonly sessions: {
+        get(sessionId: string): unknown;
+    };
+    readonly permissionPresets?: PermissionPresetService;
+    readonly sandboxPolicy?: SandboxPolicyService;
+}
+/**
+ * Adapt the optional public DSH permission services to the Worktree Manager
+ * port. No DSH package is imported at runtime, so an older bundle without the
+ * optional service can remain loadable and report an unverified capability.
+ */
+export declare function createDshWorktreePermissionAdapter(options: DshWorktreePermissionAdapterOptions): WorktreePermissionPort;
+export {};
+//# sourceMappingURL=worktree-permission.d.ts.map

package/lib/host/worktree-permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree-permission.d.ts","sourceRoot":"","sources":["../../src/host/worktree-permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,gCAAgC,EAErC,KAAK,sBAAsB,EAG3B,KAAK,6BAA6B,EACnC,MAAM,kCAAkC,CAAC;AAE1C,UAAU,eAAe;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAC;IAC5C,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;CAC9C;AAED,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,OAAO,EAAE,6BAA6B,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;CACrD;AAED,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,GAAG,MAAM,CAAC;IACpD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CAAC;IAC5C,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrD;AAED,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,6BAA6B,CAAC;CACtD;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,QAAQ,EAAE;QACjB,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;KACjC,CAAC;IACF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;IACrD,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;CAC/C;AAwGD;;;;GAIG;AACH,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,mCAAmC,GAC3C,sBAAsB,CA0FxB"}

package/lib/host/worktree-permission.js

@@ -0,0 +1,156 @@
+import { decideWorktreePermission, WORKTREE_FULL_ACCESS_PRESET, } from '../manage/worktree-permission.js';
+const WORKSPACE_WRITE_PRESET = 'workspace-write';
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function stringValue(value) {
+    return typeof value === 'string' ? value : undefined;
+}
+function lastEventValue(events, type, key) {
+    for (let index = events.length - 1; index >= 0; index -= 1) {
+        const event = events[index];
+        if (event.type !== type || !isRecord(event.data))
+            continue;
+        const value = stringValue(event.data[key]);
+        if (value !== undefined)
+            return value;
+    }
+    return undefined;
+}
+function hasFullThenRestriction(events) {
+    let fullSeen = false;
+    for (const event of events) {
+        if (event.type !== 'permission/preset' || !isRecord(event.data))
+            continue;
+        const preset = stringValue(event.data.preset);
+        if (preset === WORKTREE_FULL_ACCESS_PRESET) {
+            fullSeen = true;
+        }
+        else if (fullSeen && preset !== undefined) {
+            return true;
+        }
+    }
+    return false;
+}
+function readCurrentState(session, permissionPresets, sandboxPolicy, pluginApplied) {
+    const preset = permissionPresets?.current(session.events);
+    let presetSpec;
+    if (preset !== undefined && preset !== 'custom') {
+        try {
+            presetSpec = permissionPresets?.resolve(preset);
+        }
+        catch {
+            presetSpec = undefined;
+        }
+    }
+    const sandboxMode = lastEventValue(session.events, 'sandbox/mode', 'mode') ??
+        presetSpec?.sandbox ??
+        sandboxPolicy?.defaultMode;
+    const approvalPolicy = lastEventValue(session.events, 'approval/policy', 'policy') ??
+        presetSpec?.approval;
+    const pluginChangedThisRuntime = pluginApplied.has(session.id);
+    const currentIsRestricted = pluginChangedThisRuntime && sandboxMode !== 'danger-full-access' ||
+        hasFullThenRestriction(session.events) ||
+        (preset !== undefined &&
+            preset !== WORKSPACE_WRITE_PRESET &&
+            preset !== WORKTREE_FULL_ACCESS_PRESET &&
+            preset !== 'danger-full-access');
+    return {
+        ...(preset === undefined ? {} : { preset }),
+        ...(sandboxMode === undefined ? {} : { sandboxMode }),
+        ...(approvalPolicy === undefined ? {} : { approvalPolicy }),
+        explicitUserOverride: currentIsRestricted,
+    };
+}
+function resultFromCurrent(status, current, retryable) {
+    return {
+        status,
+        ...(current.preset === undefined ? {} : { preset: current.preset }),
+        ...(current.sandboxMode === undefined ? {} : { sandboxMode: current.sandboxMode }),
+        ...(current.approvalPolicy === undefined ? {} : { approvalPolicy: current.approvalPolicy }),
+        retryable,
+    };
+}
+function serviceAvailable(permissionPresets) {
+    return (permissionPresets !== undefined &&
+        Array.isArray(permissionPresets.names) &&
+        typeof permissionPresets.current === 'function' &&
+        typeof permissionPresets.resolve === 'function' &&
+        typeof permissionPresets.set === 'function');
+}
+/**
+ * Adapt the optional public DSH permission services to the Worktree Manager
+ * port. No DSH package is imported at runtime, so an older bundle without the
+ * optional service can remain loadable and report an unverified capability.
+ */
+export function createDshWorktreePermissionAdapter(options) {
+    const pluginApplied = new Set();
+    const apply = (input, binding) => {
+        const session = options.sessions.get(input.sessionId);
+        if (!isPermissionSession(session)) {
+            return { status: 'unverified', retryable: true };
+        }
+        const permissionPresets = options.permissionPresets;
+        const current = readCurrentState(session, permissionPresets, options.sandboxPolicy, pluginApplied);
+        const hasService = serviceAvailable(permissionPresets);
+        const decision = decideWorktreePermission({
+            binding,
+            current,
+            capability: {
+                permissionService: hasService,
+                fullPreset: hasService && permissionPresets.names.includes(WORKTREE_FULL_ACCESS_PRESET),
+                workspaceWrite: hasService && permissionPresets.names.includes(WORKSPACE_WRITE_PRESET),
+            },
+        });
+        if (binding === 'active' &&
+            decision.kind === 'apply-full' &&
+            input.confirmed !== true) {
+            return { status: 'confirmation-required', retryable: false };
+        }
+        switch (decision.kind) {
+            case 'apply-full':
+                if (!hasService)
+                    return resultFromCurrent('unverified', current, true);
+                permissionPresets.set(session, decision.preset);
+                pluginApplied.add(session.id);
+                return resultFromCurrent('full-applied', readCurrentState(session, permissionPresets, options.sandboxPolicy, pluginApplied), false);
+            case 'preserve-user-restriction':
+                return resultFromCurrent('user-restricted', current, false);
+            case 'unverified':
+                return resultFromCurrent('unverified', current, true);
+            case 'fallback-workspace-write':
+                if (!hasService)
+                    return resultFromCurrent('unverified', current, true);
+                permissionPresets.set(session, WORKSPACE_WRITE_PRESET);
+                return resultFromCurrent('fallback-workspace-write', readCurrentState(session, permissionPresets, options.sandboxPolicy, pluginApplied), true);
+            case 'normalize-workspace-write':
+                if (!hasService || !permissionPresets.names.includes(WORKSPACE_WRITE_PRESET)) {
+                    return resultFromCurrent('unverified', current, true);
+                }
+                permissionPresets.set(session, WORKSPACE_WRITE_PRESET);
+                pluginApplied.delete(session.id);
+                return resultFromCurrent('normalized-workspace-write', readCurrentState(session, permissionPresets, options.sandboxPolicy, pluginApplied), false);
+            case 'no-op':
+                return resultFromCurrent(binding === 'active' && isFullAccessState(current) ? 'already-full' : 'no-op', current, false);
+        }
+    };
+    return {
+        ensure(input) {
+            return Promise.resolve(apply(input, 'active'));
+        },
+        normalize(input) {
+            return Promise.resolve(apply(input, 'detached'));
+        },
+    };
+}
+function isPermissionSession(value) {
+    return (isRecord(value) &&
+        typeof value.id === 'string' &&
+        Array.isArray(value.events) &&
+        typeof value.append === 'function');
+}
+function isFullAccessState(current) {
+    return (current.preset === WORKTREE_FULL_ACCESS_PRESET ||
+        current.sandboxMode === 'danger-full-access');
+}
+//# sourceMappingURL=worktree-permission.js.map

package/lib/host/worktree-permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree-permission.js","sourceRoot":"","sources":["../../src/host/worktree-permission.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,2BAA2B,GAO5B,MAAM,kCAAkC,CAAC;AAqC1C,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAEjD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CACrB,MAAkC,EAClC,IAAY,EACZ,GAAW;IAEX,KAAK,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAkC;IAChE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1E,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,2BAA2B,EAAE,CAAC;YAC3C,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;aAAM,IAAI,QAAQ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CACvB,OAA0B,EAC1B,iBAAsD,EACtD,aAA+C,EAC/C,aAAkC;IAElC,MAAM,MAAM,GAAG,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,UAA4C,CAAC;IACjD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,UAAU,GAAG,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,SAAS,CAAC;QACzB,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GACd,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAA+C;QACrG,UAAU,EAAE,OAAO;QACnB,aAAa,EAAE,WAAW,CAAC;IAC7B,MAAM,cAAc,GACjB,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,QAAQ,CAAkD;QAC7G,UAAU,EAAE,QAAQ,CAAC;IACvB,MAAM,wBAAwB,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/D,MAAM,mBAAmB,GACvB,wBAAwB,IAAI,WAAW,KAAK,oBAAoB;QAChE,sBAAsB,CAAC,OAAO,CAAC,MAAM,CAAC;QACtC,CAAC,MAAM,KAAK,SAAS;YACnB,MAAM,KAAK,sBAAsB;YACjC,MAAM,KAAK,2BAA2B;YACtC,MAAM,KAAK,oBAAoB,CAAC,CAAC;IACrC,OAAO;QACL,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3D,oBAAoB,EAAE,mBAAmB;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,MAA0C,EAC1C,OAAuC,EACvC,SAAkB;IAElB,OAAO;QACL,MAAM;QACN,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3F,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,iBAAsD;IAEtD,OAAO,CACL,iBAAiB,KAAK,SAAS;QAC/B,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC;QACtC,OAAO,iBAAiB,CAAC,OAAO,KAAK,UAAU;QAC/C,OAAO,iBAAiB,CAAC,OAAO,KAAK,UAAU;QAC/C,OAAO,iBAAiB,CAAC,GAAG,KAAK,UAAU,CAC5C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kCAAkC,CAChD,OAA4C;IAE5C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAExC,MAAM,KAAK,GAAG,CACZ,KAAgC,EAChC,OAA8B,EACJ,EAAE;QAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACnD,CAAC;QACD,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACpD,MAAM,OAAO,GAAG,gBAAgB,CAC9B,OAAO,EACP,iBAAiB,EACjB,OAAO,CAAC,aAAa,EACrB,aAAa,CACd,CAAC;QACF,MAAM,UAAU,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,wBAAwB,CAAC;YACxC,OAAO;YACP,OAAO;YACP,UAAU,EAAE;gBACV,iBAAiB,EAAE,UAAU;gBAC7B,UAAU,EAAE,UAAU,IAAI,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,2BAA2B,CAAC;gBACvF,cAAc,EAAE,UAAU,IAAI,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC;aACvF;SACF,CAAC,CAAC;QAEH,IACE,OAAO,KAAK,QAAQ;YACpB,QAAQ,CAAC,IAAI,KAAK,YAAY;YAC9B,KAAK,CAAC,SAAS,KAAK,IAAI,EACxB,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC/D,CAAC;QAED,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtB,KAAK,YAAY;gBACf,IAAI,CAAC,UAAU;oBAAE,OAAO,iBAAiB,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;gBACvE,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAChD,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC9B,OAAO,iBAAiB,CAAC,cAAc,EAAE,gBAAgB,CACvD,OAAO,EACP,iBAAiB,EACjB,OAAO,CAAC,aAAa,EACrB,aAAa,CACd,EAAE,KAAK,CAAC,CAAC;YACZ,KAAK,2BAA2B;gBAC9B,OAAO,iBAAiB,CAAC,iBAAiB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YAC9D,KAAK,YAAY;gBACf,OAAO,iBAAiB,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACxD,KAAK,0BAA0B;gBAC7B,IAAI,CAAC,UAAU;oBAAE,OAAO,iBAAiB,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;gBACvE,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;gBACvD,OAAO,iBAAiB,CAAC,0BAA0B,EAAE,gBAAgB,CACnE,OAAO,EACP,iBAAiB,EACjB,OAAO,CAAC,aAAa,EACrB,aAAa,CACd,EAAE,IAAI,CAAC,CAAC;YACX,KAAK,2BAA2B;gBAC9B,IAAI,CAAC,UAAU,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;oBAC7E,OAAO,iBAAiB,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;gBACxD,CAAC;gBACD,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;gBACvD,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACjC,OAAO,iBAAiB,CAAC,4BAA4B,EAAE,gBAAgB,CACrE,OAAO,EACP,iBAAiB,EACjB,OAAO,CAAC,aAAa,EACrB,aAAa,CACd,EAAE,KAAK,CAAC,CAAC;YACZ,KAAK,OAAO;gBACV,OAAO,iBAAiB,CACtB,OAAO,KAAK,QAAQ,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,EAC7E,OAAO,EACP,KAAK,CACN,CAAC;QACN,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,MAAM,CAAC,KAAK;YACV,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,SAAS,CAAC,KAAK;YACb,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;QACnD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;QAC5B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC3B,OAAO,KAAK,CAAC,MAAM,KAAK,UAAU,CACnC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAuC;IAChE,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,2BAA2B;QAC9C,OAAO,CAAC,WAAW,KAAK,oBAAoB,CAC7C,CAAC;AACJ,CAAC"}

package/lib/index.d.ts

@@ -10,14 +10,15 @@
  * @packageDocumentation
  */
 export { WORKTREE_ERROR_CODES, WORKTREE_REMOTE_METHODS, createWorktreeError, } from './contract/index.js';
-export type { BranchRecord, BindingStatus, JsonPrimitive, JsonValue, SessionBinding, WorktreeError, WorktreeErrorCode, WorktreeErrorDetails, WorktreeManager, WorktreeImportCandidate, WorktreeRemoteManager, WorktreeRemoteMethod, WorktreeRemoteResult, WorktreeRecord, WorktreeStatus, WorktreeSource, WorktreeId, WorkspaceId, SessionId, } from './contract/index.js';
+export { WORKTREE_FULL_ACCESS_PRESET } from './contract/index.js';
+export type { BranchRecord, BindingStatus, JsonPrimitive, JsonValue, SessionBinding, WorktreeError, WorktreeErrorCode, WorktreeErrorDetails, WorktreeManager, WorktreeImportCandidate, WorktreeRemoteManager, WorktreeRemoteMethod, WorktreeRemoteResult, WorktreeRecord, WorktreeStatus, WorktreeSource, WorktreeId, WorkspaceId, SessionId, WorktreePermissionApprovalPolicy, WorktreePermissionBinding, WorktreePermissionCapability, WorktreePermissionCurrentState, WorktreePermissionDecision, WorktreePermissionDecisionInput, WorktreePermissionManager, WorktreePermissionNormalizationRequest, WorktreePermissionPort, WorktreePermissionRequest, WorktreePermissionResult, WorktreePermissionSandboxMode, WorktreePermissionStatus, } from './contract/index.js';
 export { LocalGitAdapter } from './provider/git.js';
 export { WorkspaceShardedSidecarRepository, validateSidecarSnapshot, } from './provider/sidecar.js';
 export { SIDECAR_SCHEMA_VERSION, WorktreeProviderError, isWorktreeProviderError, providerError, } from './provider/types.js';
 export type { DshReadAdapter, DshSessionSummary, DshWorkspaceSummary, GitWorktreeAdapter, GitWorktreeInfo, SidecarMutation, SidecarSnapshot, SidecarStore, } from './provider/types.js';
 export { WorktreeManagerImpl, createWorktreeManager } from './manage/index.js';
 export type { RuntimeCwdInput, WorktreeManagerOptions, WorktreeManagerService, } from './manage/index.js';
-export { DshHostReadAdapter, WorktreeRemoteService, createWorktreeRemoteProjection, } from './host/index.js';
-export type { DshHostReadContext, WorktreeHostConfig } from './host/index.js';
+export { DshHostReadAdapter, WorktreeRemoteService, createWorktreeRemoteProjection, createDshWorktreePermissionAdapter, createWorktreePermissionManager, } from './host/index.js';
+export type { DshHostReadContext, DshWorktreePermissionAdapterOptions, WorktreeHostConfig, WorktreePermissionManagerOptions, } from './host/index.js';
 export { WorktreeRemoteService as default } from './host/index.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,YAAY,EACZ,aAAa,EACb,aAAa,EACb,SAAS,EACT,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,cAAc,EACd,UAAU,EACV,WAAW,EACX,SAAS,GACV,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,iCAAiC,EACjC,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,eAAe,EACf,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,YAAY,EACV,eAAe,EACf,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,8BAA8B,GAC/B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAK9E,OAAO,EAAE,qBAAqB,IAAI,OAAO,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,YAAY,EACV,YAAY,EACZ,aAAa,EACb,aAAa,EACb,SAAS,EACT,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,cAAc,EACd,UAAU,EACV,WAAW,EACX,SAAS,EACT,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAC5B,8BAA8B,EAC9B,0BAA0B,EAC1B,+BAA+B,EAC/B,yBAAyB,EACzB,sCAAsC,EACtC,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,iCAAiC,EACjC,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,eAAe,EACf,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,YAAY,EACV,eAAe,EACf,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,8BAA8B,EAC9B,kCAAkC,EAClC,+BAA+B,GAChC,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,kBAAkB,EAClB,mCAAmC,EACnC,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EAAE,qBAAqB,IAAI,OAAO,EAAE,MAAM,iBAAiB,CAAC"}

package/lib/index.js

@@ -10,11 +10,12 @@
  * @packageDocumentation
  */
 export { WORKTREE_ERROR_CODES, WORKTREE_REMOTE_METHODS, createWorktreeError, } from './contract/index.js';
+export { WORKTREE_FULL_ACCESS_PRESET } from './contract/index.js';
 export { LocalGitAdapter } from './provider/git.js';
 export { WorkspaceShardedSidecarRepository, validateSidecarSnapshot, } from './provider/sidecar.js';
 export { SIDECAR_SCHEMA_VERSION, WorktreeProviderError, isWorktreeProviderError, providerError, } from './provider/types.js';
 export { WorktreeManagerImpl, createWorktreeManager } from './manage/index.js';
-export { DshHostReadAdapter, WorktreeRemoteService, createWorktreeRemoteProjection, } from './host/index.js';
+export { DshHostReadAdapter, WorktreeRemoteService, createWorktreeRemoteProjection, createDshWorktreePermissionAdapter, createWorktreePermissionManager, } from './host/index.js';
 // bundle patch 以默认导出装载同一个 Cordis 服务；命名导出保留给显式 Host 组合。
 // The bundle patch loads the same Cordis service through the default export; the named
 // export remains available to explicit Host compositions.

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAsB7B,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,iCAAiC,EACjC,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAW7B,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAM/E,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,8BAA8B,GAC/B,MAAM,iBAAiB,CAAC;AAGzB,uDAAuD;AACvD,uFAAuF;AACvF,0DAA0D;AAC1D,OAAO,EAAE,qBAAqB,IAAI,OAAO,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAmClE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,iCAAiC,EACjC,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAW7B,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAM/E,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,8BAA8B,EAC9B,kCAAkC,EAClC,+BAA+B,GAChC,MAAM,iBAAiB,CAAC;AAQzB,uDAAuD;AACvD,uFAAuF;AACvF,0DAA0D;AAC1D,OAAO,EAAE,qBAAqB,IAAI,OAAO,EAAE,MAAM,iBAAiB,CAAC"}

package/lib/manage/worktree-permission.d.ts

@@ -0,0 +1,3 @@
+/** Compatibility barrel for the browser-safe Worktree permission contract. */
+export * from '../contract/worktree-permission.js';
+//# sourceMappingURL=worktree-permission.d.ts.map

package/lib/manage/worktree-permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree-permission.d.ts","sourceRoot":"","sources":["../../src/manage/worktree-permission.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,cAAc,oCAAoC,CAAC"}

package/lib/manage/worktree-permission.js

@@ -0,0 +1,3 @@
+/** Compatibility barrel for the browser-safe Worktree permission contract. */
+export * from '../contract/worktree-permission.js';
+//# sourceMappingURL=worktree-permission.js.map

package/lib/manage/worktree-permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree-permission.js","sourceRoot":"","sources":["../../src/manage/worktree-permission.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,cAAc,oCAAoC,CAAC"}

package/lib/typert.host.js

@@ -10,6 +10,8 @@ const JsonValueRemoteCodec$schema6 = z.union([z.literal(null), z.string(), z.num
 const JsonValueRemoteCodec$schema7 = z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema7)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema7)).readonly()])
 const JsonValueRemoteCodec$schema8 = z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema8)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema8)).readonly()])
 const JsonValueRemoteCodec$schema9 = z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema9)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema9)).readonly()])
+const JsonValueRemoteCodec$schema10 = z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema10)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema10)).readonly()])
+const JsonValueRemoteCodec$schema11 = z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema11)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema11)).readonly()])
 const _cerbur_clutch_dsh_worktree_worktreeManager_bindSession_parameter_0$schema = z.object({
   'workspaceId': z.string().readonly(),
   'worktreeId': z.string().readonly(),
@@ -18,9 +20,9 @@ const _cerbur_clutch_dsh_worktree_worktreeManager_bindSession_parameter_0$schema
 const _cerbur_clutch_dsh_worktree_worktreeManager_bindSession_result$schema = z.union([z.object({
   'ok': z.literal(false).readonly(),
   'error': z.object({
-  'code': z.union([z.literal("WORKSPACE_NOT_FOUND"), z.literal("WORKSPACE_NOT_GIT_REPOSITORY"), z.literal("GIT_NOT_INSTALLED"), z.literal("WORKTREE_REQUIRES_INITIAL_COMMIT"), z.literal("WORKTREE_BRANCH_CONFLICT"), z.literal("WORKTREE_NOT_FOUND"), z.literal("WORKTREE_ORDER_INVALID"), z.literal("WORKTREE_REMOVED"), z.literal("WORKTREE_IMPORT_INVALID"), z.literal("WORKTREE_ALREADY_MANAGED"), z.literal("SESSION_NOT_FOUND"), z.literal("SESSION_CWD_MISMATCH"), z.literal("SESSION_ALREADY_BOUND"), z.literal("SIDECAR_UNAVAILABLE"), z.literal("SIDECAR_CORRUPT"), z.literal("SIDECAR_SYNC_REQUIRED"), z.literal("GIT_OPERATION_FAILED")]).readonly(),
+  'code': z.union([z.literal("WORKSPACE_NOT_FOUND"), z.literal("WORKSPACE_NOT_GIT_REPOSITORY"), z.literal("GIT_NOT_INSTALLED"), z.literal("WORKTREE_REQUIRES_INITIAL_COMMIT"), z.literal("WORKTREE_BRANCH_CONFLICT"), z.literal("WORKTREE_NOT_FOUND"), z.literal("WORKTREE_ORDER_INVALID"), z.literal("WORKTREE_REMOVED"), z.literal("WORKTREE_IMPORT_INVALID"), z.literal("WORKTREE_ALREADY_MANAGED"), z.literal("SESSION_NOT_FOUND"), z.literal("SESSION_CWD_MISMATCH"), z.literal("SESSION_ALREADY_BOUND"), z.literal("SIDECAR_UNAVAILABLE"), z.literal("SIDECAR_CORRUPT"), z.literal("SIDECAR_SYNC_REQUIRED"), z.literal("GIT_OPERATION_FAILED"), z.literal("WORKTREE_PERMISSION_BINDING_REQUIRED")]).readonly(),
   'message': z.string().readonly(),
-  'details': z.record(z.string(), z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema5)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema5)).readonly()])).readonly().readonly(),
+  'details': z.record(z.string(), z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema9)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema9)).readonly()])).readonly().readonly(),
 }).readonly(),
 }), z.object({
   'ok': z.literal(true).readonly(),
@@ -39,9 +41,9 @@ const _cerbur_clutch_dsh_worktree_worktreeManager_createWorktree_parameter_0$sch
 const _cerbur_clutch_dsh_worktree_worktreeManager_createWorktree_result$schema = z.union([z.object({
   'ok': z.literal(false).readonly(),
   'error': z.object({
-  'code': z.union([z.literal("WORKSPACE_NOT_FOUND"), z.literal("WORKSPACE_NOT_GIT_REPOSITORY"), z.literal("GIT_NOT_INSTALLED"), z.literal("WORKTREE_REQUIRES_INITIAL_COMMIT"), z.literal("WORKTREE_BRANCH_CONFLICT"), z.literal("WORKTREE_NOT_FOUND"), z.literal("WORKTREE_ORDER_INVALID"), z.literal("WORKTREE_REMOVED"), z.literal("WORKTREE_IMPORT_INVALID"), z.literal("WORKTREE_ALREADY_MANAGED"), z.literal("SESSION_NOT_FOUND"), z.literal("SESSION_CWD_MISMATCH"), z.literal("SESSION_ALREADY_BOUND"), z.literal("SIDECAR_UNAVAILABLE"), z.literal("SIDECAR_CORRUPT"), z.literal("SIDECAR_SYNC_REQUIRED"), z.literal("GIT_OPERATION_FAILED")]).readonly(),
+  'code': z.union([z.literal("WORKSPACE_NOT_FOUND"), z.literal("WORKSPACE_NOT_GIT_REPOSITORY"), z.literal("GIT_NOT_INSTALLED"), z.literal("WORKTREE_REQUIRES_INITIAL_COMMIT"), z.literal("WORKTREE_BRANCH_CONFLICT"), z.literal("WORKTREE_NOT_FOUND"), z.literal("WORKTREE_ORDER_INVALID"), z.literal("WORKTREE_REMOVED"), z.literal("WORKTREE_IMPORT_INVALID"), z.literal("WORKTREE_ALREADY_MANAGED"), z.literal("SESSION_NOT_FOUND"), z.literal("SESSION_CWD_MISMATCH"), z.literal("SESSION_ALREADY_BOUND"), z.literal("SIDECAR_UNAVAILABLE"), z.literal("SIDECAR_CORRUPT"), z.literal("SIDECAR_SYNC_REQUIRED"), z.literal("GIT_OPERATION_FAILED"), z.literal("WORKTREE_PERMISSION_BINDING_REQUIRED")]).readonly(),
   'message': z.string().readonly(),
-  'details': z.record(z.string(), z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema9)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema9)).readonly()])).readonly().readonly(),
+  'details': z.record(z.string(), z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema4)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema4)).readonly()])).readonly().readonly(),
 }).readonly(),
 }), z.object({
   'ok': z.literal(true).readonly(),
@@ -55,6 +57,31 @@ const _cerbur_clutch_dsh_worktree_worktreeManager_createWorktree_result$schema =
   'health': z.union([z.undefined(), z.literal("ready"), z.literal("repair")]).readonly().optional(),
 }).readonly(),
 })])
+const _cerbur_clutch_dsh_worktree_worktreeManager_ensureWorktreePermission_parameter_0$schema = z.object({
+  'workspaceId': z.string().readonly(),
+  'worktreeId': z.string().readonly(),
+  'sessionId': z.string().readonly(),
+  'binding': z.union([z.undefined(), z.literal("active"), z.literal("detached"), z.literal("main"), z.literal("unbound")]).readonly().optional(),
+  'confirmed': z.union([z.undefined(), z.literal(false), z.literal(true)]).readonly().optional(),
+})
+const _cerbur_clutch_dsh_worktree_worktreeManager_ensureWorktreePermission_result$schema = z.union([z.object({
+  'ok': z.literal(false).readonly(),
+  'error': z.object({
+  'code': z.union([z.literal("WORKSPACE_NOT_FOUND"), z.literal("WORKSPACE_NOT_GIT_REPOSITORY"), z.literal("GIT_NOT_INSTALLED"), z.literal("WORKTREE_REQUIRES_INITIAL_COMMIT"), z.literal("WORKTREE_BRANCH_CONFLICT"), z.literal("WORKTREE_NOT_FOUND"), z.literal("WORKTREE_ORDER_INVALID"), z.literal("WORKTREE_REMOVED"), z.literal("WORKTREE_IMPORT_INVALID"), z.literal("WORKTREE_ALREADY_MANAGED"), z.literal("SESSION_NOT_FOUND"), z.literal("SESSION_CWD_MISMATCH"), z.literal("SESSION_ALREADY_BOUND"), z.literal("SIDECAR_UNAVAILABLE"), z.literal("SIDECAR_CORRUPT"), z.literal("SIDECAR_SYNC_REQUIRED"), z.literal("GIT_OPERATION_FAILED"), z.literal("WORKTREE_PERMISSION_BINDING_REQUIRED")]).readonly(),
+  'message': z.string().readonly(),
+  'details': z.record(z.string(), z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema10)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema10)).readonly()])).readonly().readonly(),
+}).readonly(),
+}), z.object({
+  'ok': z.literal(true).readonly(),
+  'value': z.object({
+  'status': z.union([z.literal("full-applied"), z.literal("already-full"), z.literal("confirmation-required"), z.literal("fallback-workspace-write"), z.literal("user-restricted"), z.literal("unverified"), z.literal("normalized-workspace-write"), z.literal("no-op")]).readonly(),
+  'preset': z.union([z.undefined(), z.string()]).readonly().optional(),
+  'sandboxMode': z.union([z.undefined(), z.literal("read-only"), z.literal("workspace-write"), z.literal("danger-full-access")]).readonly().optional(),
+  'approvalPolicy': z.union([z.undefined(), z.literal("ask"), z.literal("never")]).readonly().optional(),
+  'sessionIds': z.union([z.undefined(), z.array(z.string())]).readonly().optional(),
+  'retryable': z.boolean().readonly(),
+}).readonly(),
+})])
 const _cerbur_clutch_dsh_worktree_worktreeManager_importWorktree_parameter_0$schema = z.object({
   'workspaceId': z.string().readonly(),
   'absolutePath': z.string().readonly(),
@@ -62,9 +89,9 @@ const _cerbur_clutch_dsh_worktree_worktreeManager_importWorktree_parameter_0$sch
 const _cerbur_clutch_dsh_worktree_worktreeManager_importWorktree_result$schema = z.union([z.object({
   'ok': z.literal(false).readonly(),
   'error': z.object({
-  'code': z.union([z.literal("WORKSPACE_NOT_FOUND"), z.literal("WORKSPACE_NOT_GIT_REPOSITORY"), z.literal("GIT_NOT_INSTALLED"), z.literal("WORKTREE_REQUIRES_INITIAL_COMMIT"), z.literal("WORKTREE_BRANCH_CONFLICT"), z.literal("WORKTREE_NOT_FOUND"), z.literal("WORKTREE_ORDER_INVALID"), z.literal("WORKTREE_REMOVED"), z.literal("WORKTREE_IMPORT_INVALID"), z.literal("WORKTREE_ALREADY_MANAGED"), z.literal("SESSION_NOT_FOUND"), z.literal("SESSION_CWD_MISMATCH"), z.literal("SESSION_ALREADY_BOUND"), z.literal("SIDECAR_UNAVAILABLE"), z.literal("SIDECAR_CORRUPT"), z.literal("SIDECAR_SYNC_REQUIRED"), z.literal("GIT_OPERATION_FAILED")]).readonly(),
+  'code': z.union([z.literal("WORKSPACE_NOT_FOUND"), z.literal("WORKSPACE_NOT_GIT_REPOSITORY"), z.literal("GIT_NOT_INSTALLED"), z.literal("WORKTREE_REQUIRES_INITIAL_COMMIT"), z.literal("WORKTREE_BRANCH_CONFLICT"), z.literal("WORKTREE_NOT_FOUND"), z.literal("WORKTREE_ORDER_INVALID"), z.literal("WORKTREE_REMOVED"), z.literal("WORKTREE_IMPORT_INVALID"), z.literal("WORKTREE_ALREADY_MANAGED"), z.literal("SESSION_NOT_FOUND"), z.literal("SESSION_CWD_MISMATCH"), z.literal("SESSION_ALREADY_BOUND"), z.literal("SIDECAR_UNAVAILABLE"), z.literal("SIDECAR_CORRUPT"), z.literal("SIDECAR_SYNC_REQUIRED"), z.literal("GIT_OPERATION_FAILED"), z.literal("WORKTREE_PERMISSION_BINDING_REQUIRED")]).readonly(),
   'message': z.string().readonly(),
-  'details': z.record(z.string(), z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema)).readonly()])).readonly().readonly(),
+  'details': z.record(z.string(), z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema5)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema5)).readonly()])).readonly().readonly(),
 }).readonly(),
 }), z.object({
   'ok': z.literal(true).readonly(),
@@ -86,9 +113,9 @@ const _cerbur_clutch_dsh_worktree_worktreeManager_insertWorktreeBefore_parameter
 const _cerbur_clutch_dsh_worktree_worktreeManager_insertWorktreeBefore_result$schema = z.union([z.object({
   'ok': z.literal(false).readonly(),
   'error': z.object({
-  'code': z.union([z.literal("WORKSPACE_NOT_FOUND"), z.literal("WORKSPACE_NOT_GIT_REPOSITORY"), z.literal("GIT_NOT_INSTALLED"), z.literal("WORKTREE_REQUIRES_INITIAL_COMMIT"), z.literal("WORKTREE_BRANCH_CONFLICT"), z.literal("WORKTREE_NOT_FOUND"), z.literal("WORKTREE_ORDER_INVALID"), z.literal("WORKTREE_REMOVED"), z.literal("WORKTREE_IMPORT_INVALID"), z.literal("WORKTREE_ALREADY_MANAGED"), z.literal("SESSION_NOT_FOUND"), z.literal("SESSION_CWD_MISMATCH"), z.literal("SESSION_ALREADY_BOUND"), z.literal("SIDECAR_UNAVAILABLE"), z.literal("SIDECAR_CORRUPT"), z.literal("SIDECAR_SYNC_REQUIRED"), z.literal("GIT_OPERATION_FAILED")]).readonly(),
+  'code': z.union([z.literal("WORKSPACE_NOT_FOUND"), z.literal("WORKSPACE_NOT_GIT_REPOSITORY"), z.literal("GIT_NOT_INSTALLED"), z.literal("WORKTREE_REQUIRES_INITIAL_COMMIT"), z.literal("WORKTREE_BRANCH_CONFLICT"), z.literal("WORKTREE_NOT_FOUND"), z.literal("WORKTREE_ORDER_INVALID"), z.literal("WORKTREE_REMOVED"), z.literal("WORKTREE_IMPORT_INVALID"), z.literal("WORKTREE_ALREADY_MANAGED"), z.literal("SESSION_NOT_FOUND"), z.literal("SESSION_CWD_MISMATCH"), z.literal("SESSION_ALREADY_BOUND"), z.literal("SIDECAR_UNAVAILABLE"), z.literal("SIDECAR_CORRUPT"), z.literal("SIDECAR_SYNC_REQUIRED"), z.literal("GIT_OPERATION_FAILED"), z.literal("WORKTREE_PERMISSION_BINDING_REQUIRED")]).readonly(),
   'message': z.string().readonly(),
-  'details': z.record(z.string(), z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema3)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema3)).readonly()])).readonly().readonly(),
+  'details': z.record(z.string(), z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema7)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema7)).readonly()])).readonly().readonly(),
 }).readonly(),
 }), z.object({
   'ok': z.literal(true).readonly(),
@@ -100,9 +127,9 @@ const _cerbur_clutch_dsh_worktree_worktreeManager_listBindings_parameter_0$schem
 const _cerbur_clutch_dsh_worktree_worktreeManager_listBindings_result$schema = z.union([z.object({
   'ok': z.literal(false).readonly(),
   'error': z.object({
-  'code': z.union([z.literal("WORKSPACE_NOT_FOUND"), z.literal("WORKSPACE_NOT_GIT_REPOSITORY"), z.literal("GIT_NOT_INSTALLED"), z.literal("WORKTREE_REQUIRES_INITIAL_COMMIT"), z.literal("WORKTREE_BRANCH_CONFLICT"), z.literal("WORKTREE_NOT_FOUND"), z.literal("WORKTREE_ORDER_INVALID"), z.literal("WORKTREE_REMOVED"), z.literal("WORKTREE_IMPORT_INVALID"), z.literal("WORKTREE_ALREADY_MANAGED"), z.literal("SESSION_NOT_FOUND"), z.literal("SESSION_CWD_MISMATCH"), z.literal("SESSION_ALREADY_BOUND"), z.literal("SIDECAR_UNAVAILABLE"), z.literal("SIDECAR_CORRUPT"), z.literal("SIDECAR_SYNC_REQUIRED"), z.literal("GIT_OPERATION_FAILED")]).readonly(),
+  'code': z.union([z.literal("WORKSPACE_NOT_FOUND"), z.literal("WORKSPACE_NOT_GIT_REPOSITORY"), z.literal("GIT_NOT_INSTALLED"), z.literal("WORKTREE_REQUIRES_INITIAL_COMMIT"), z.literal("WORKTREE_BRANCH_CONFLICT"), z.literal("WORKTREE_NOT_FOUND"), z.literal("WORKTREE_ORDER_INVALID"), z.literal("WORKTREE_REMOVED"), z.literal("WORKTREE_IMPORT_INVALID"), z.literal("WORKTREE_ALREADY_MANAGED"), z.literal("SESSION_NOT_FOUND"), z.literal("SESSION_CWD_MISMATCH"), z.literal("SESSION_ALREADY_BOUND"), z.literal("SIDECAR_UNAVAILABLE"), z.literal("SIDECAR_CORRUPT"), z.literal("SIDECAR_SYNC_REQUIRED"), z.literal("GIT_OPERATION_FAILED"), z.literal("WORKTREE_PERMISSION_BINDING_REQUIRED")]).readonly(),
   'message': z.string().readonly(),
-  'details': z.record(z.string(), z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema4)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema4)).readonly()])).readonly().readonly(),
+  'details': z.record(z.string(), z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema8)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema8)).readonly()])).readonly().readonly(),
 }).readonly(),
 }), z.object({
   'ok': z.literal(true).readonly(),
@@ -119,9 +146,9 @@ const _cerbur_clutch_dsh_worktree_worktreeManager_listBranches_parameter_0$schem
 const _cerbur_clutch_dsh_worktree_worktreeManager_listBranches_result$schema = z.union([z.object({
   'ok': z.literal(false).readonly(),
   'error': z.object({
-  'code': z.union([z.literal("WORKSPACE_NOT_FOUND"), z.literal("WORKSPACE_NOT_GIT_REPOSITORY"), z.literal("GIT_NOT_INSTALLED"), z.literal("WORKTREE_REQUIRES_INITIAL_COMMIT"), z.literal("WORKTREE_BRANCH_CONFLICT"), z.literal("WORKTREE_NOT_FOUND"), z.literal("WORKTREE_ORDER_INVALID"), z.literal("WORKTREE_REMOVED"), z.literal("WORKTREE_IMPORT_INVALID"), z.literal("WORKTREE_ALREADY_MANAGED"), z.literal("SESSION_NOT_FOUND"), z.literal("SESSION_CWD_MISMATCH"), z.literal("SESSION_ALREADY_BOUND"), z.literal("SIDECAR_UNAVAILABLE"), z.literal("SIDECAR_CORRUPT"), z.literal("SIDECAR_SYNC_REQUIRED"), z.literal("GIT_OPERATION_FAILED")]).readonly(),
+  'code': z.union([z.literal("WORKSPACE_NOT_FOUND"), z.literal("WORKSPACE_NOT_GIT_REPOSITORY"), z.literal("GIT_NOT_INSTALLED"), z.literal("WORKTREE_REQUIRES_INITIAL_COMMIT"), z.literal("WORKTREE_BRANCH_CONFLICT"), z.literal("WORKTREE_NOT_FOUND"), z.literal("WORKTREE_ORDER_INVALID"), z.literal("WORKTREE_REMOVED"), z.literal("WORKTREE_IMPORT_INVALID"), z.literal("WORKTREE_ALREADY_MANAGED"), z.literal("SESSION_NOT_FOUND"), z.literal("SESSION_CWD_MISMATCH"), z.literal("SESSION_ALREADY_BOUND"), z.literal("SIDECAR_UNAVAILABLE"), z.literal("SIDECAR_CORRUPT"), z.literal("SIDECAR_SYNC_REQUIRED"), z.literal("GIT_OPERATION_FAILED"), z.literal("WORKTREE_PERMISSION_BINDING_REQUIRED")]).readonly(),
   'message': z.string().readonly(),
-  'details': z.record(z.string(), z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema8)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema8)).readonly()])).readonly().readonly(),
+  'details': z.record(z.string(), z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema3)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema3)).readonly()])).readonly().readonly(),
 }).readonly(),
 }), z.object({
   'ok': z.literal(true).readonly(),
@@ -137,9 +164,9 @@ const _cerbur_clutch_dsh_worktree_worktreeManager_listImportCandidates_parameter
 const _cerbur_clutch_dsh_worktree_worktreeManager_listImportCandidates_result$schema = z.union([z.object({
   'ok': z.literal(false).readonly(),
   'error': z.object({
-  'code': z.union([z.literal("WORKSPACE_NOT_FOUND"), z.literal("WORKSPACE_NOT_GIT_REPOSITORY"), z.literal("GIT_NOT_INSTALLED"), z.literal("WORKTREE_REQUIRES_INITIAL_COMMIT"), z.literal("WORKTREE_BRANCH_CONFLICT"), z.literal("WORKTREE_NOT_FOUND"), z.literal("WORKTREE_ORDER_INVALID"), z.literal("WORKTREE_REMOVED"), z.literal("WORKTREE_IMPORT_INVALID"), z.literal("WORKTREE_ALREADY_MANAGED"), z.literal("SESSION_NOT_FOUND"), z.literal("SESSION_CWD_MISMATCH"), z.literal("SESSION_ALREADY_BOUND"), z.literal("SIDECAR_UNAVAILABLE"), z.literal("SIDECAR_CORRUPT"), z.literal("SIDECAR_SYNC_REQUIRED"), z.literal("GIT_OPERATION_FAILED")]).readonly(),
+  'code': z.union([z.literal("WORKSPACE_NOT_FOUND"), z.literal("WORKSPACE_NOT_GIT_REPOSITORY"), z.literal("GIT_NOT_INSTALLED"), z.literal("WORKTREE_REQUIRES_INITIAL_COMMIT"), z.literal("WORKTREE_BRANCH_CONFLICT"), z.literal("WORKTREE_NOT_FOUND"), z.literal("WORKTREE_ORDER_INVALID"), z.literal("WORKTREE_REMOVED"), z.literal("WORKTREE_IMPORT_INVALID"), z.literal("WORKTREE_ALREADY_MANAGED"), z.literal("SESSION_NOT_FOUND"), z.literal("SESSION_CWD_MISMATCH"), z.literal("SESSION_ALREADY_BOUND"), z.literal("SIDECAR_UNAVAILABLE"), z.literal("SIDECAR_CORRUPT"), z.literal("SIDECAR_SYNC_REQUIRED"), z.literal("GIT_OPERATION_FAILED"), z.literal("WORKTREE_PERMISSION_BINDING_REQUIRED")]).readonly(),
   'message': z.string().readonly(),
-  'details': z.record(z.string(), z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema7)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema7)).readonly()])).readonly().readonly(),
+  'details': z.record(z.string(), z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema2)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema2)).readonly()])).readonly().readonly(),
 }).readonly(),
 }), z.object({
   'ok': z.literal(true).readonly(),
@@ -154,9 +181,9 @@ const _cerbur_clutch_dsh_worktree_worktreeManager_listWorktrees_parameter_0$sche
 const _cerbur_clutch_dsh_worktree_worktreeManager_listWorktrees_result$schema = z.union([z.object({
   'ok': z.literal(false).readonly(),
   'error': z.object({
-  'code': z.union([z.literal("WORKSPACE_NOT_FOUND"), z.literal("WORKSPACE_NOT_GIT_REPOSITORY"), z.literal("GIT_NOT_INSTALLED"), z.literal("WORKTREE_REQUIRES_INITIAL_COMMIT"), z.literal("WORKTREE_BRANCH_CONFLICT"), z.literal("WORKTREE_NOT_FOUND"), z.literal("WORKTREE_ORDER_INVALID"), z.literal("WORKTREE_REMOVED"), z.literal("WORKTREE_IMPORT_INVALID"), z.literal("WORKTREE_ALREADY_MANAGED"), z.literal("SESSION_NOT_FOUND"), z.literal("SESSION_CWD_MISMATCH"), z.literal("SESSION_ALREADY_BOUND"), z.literal("SIDECAR_UNAVAILABLE"), z.literal("SIDECAR_CORRUPT"), z.literal("SIDECAR_SYNC_REQUIRED"), z.literal("GIT_OPERATION_FAILED")]).readonly(),
+  'code': z.union([z.literal("WORKSPACE_NOT_FOUND"), z.literal("WORKSPACE_NOT_GIT_REPOSITORY"), z.literal("GIT_NOT_INSTALLED"), z.literal("WORKTREE_REQUIRES_INITIAL_COMMIT"), z.literal("WORKTREE_BRANCH_CONFLICT"), z.literal("WORKTREE_NOT_FOUND"), z.literal("WORKTREE_ORDER_INVALID"), z.literal("WORKTREE_REMOVED"), z.literal("WORKTREE_IMPORT_INVALID"), z.literal("WORKTREE_ALREADY_MANAGED"), z.literal("SESSION_NOT_FOUND"), z.literal("SESSION_CWD_MISMATCH"), z.literal("SESSION_ALREADY_BOUND"), z.literal("SIDECAR_UNAVAILABLE"), z.literal("SIDECAR_CORRUPT"), z.literal("SIDECAR_SYNC_REQUIRED"), z.literal("GIT_OPERATION_FAILED"), z.literal("WORKTREE_PERMISSION_BINDING_REQUIRED")]).readonly(),
   'message': z.string().readonly(),
-  'details': z.record(z.string(), z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema6)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema6)).readonly()])).readonly().readonly(),
+  'details': z.record(z.string(), z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema)).readonly()])).readonly().readonly(),
 }).readonly(),
 }), z.object({
   'ok': z.literal(true).readonly(),
@@ -170,6 +197,28 @@ const _cerbur_clutch_dsh_worktree_worktreeManager_listWorktrees_result$schema =
   'health': z.union([z.undefined(), z.literal("ready"), z.literal("repair")]).readonly().optional(),
 })).readonly(),
 })])
+const _cerbur_clutch_dsh_worktree_worktreeManager_normalizeDetachedWorktreePermissions_parameter_0$schema = z.object({
+  'workspaceId': z.string().readonly(),
+  'worktreeId': z.string().readonly(),
+})
+const _cerbur_clutch_dsh_worktree_worktreeManager_normalizeDetachedWorktreePermissions_result$schema = z.union([z.object({
+  'ok': z.literal(false).readonly(),
+  'error': z.object({
+  'code': z.union([z.literal("WORKSPACE_NOT_FOUND"), z.literal("WORKSPACE_NOT_GIT_REPOSITORY"), z.literal("GIT_NOT_INSTALLED"), z.literal("WORKTREE_REQUIRES_INITIAL_COMMIT"), z.literal("WORKTREE_BRANCH_CONFLICT"), z.literal("WORKTREE_NOT_FOUND"), z.literal("WORKTREE_ORDER_INVALID"), z.literal("WORKTREE_REMOVED"), z.literal("WORKTREE_IMPORT_INVALID"), z.literal("WORKTREE_ALREADY_MANAGED"), z.literal("SESSION_NOT_FOUND"), z.literal("SESSION_CWD_MISMATCH"), z.literal("SESSION_ALREADY_BOUND"), z.literal("SIDECAR_UNAVAILABLE"), z.literal("SIDECAR_CORRUPT"), z.literal("SIDECAR_SYNC_REQUIRED"), z.literal("GIT_OPERATION_FAILED"), z.literal("WORKTREE_PERMISSION_BINDING_REQUIRED")]).readonly(),
+  'message': z.string().readonly(),
+  'details': z.record(z.string(), z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema11)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema11)).readonly()])).readonly().readonly(),
+}).readonly(),
+}), z.object({
+  'ok': z.literal(true).readonly(),
+  'value': z.object({
+  'status': z.union([z.literal("full-applied"), z.literal("already-full"), z.literal("confirmation-required"), z.literal("fallback-workspace-write"), z.literal("user-restricted"), z.literal("unverified"), z.literal("normalized-workspace-write"), z.literal("no-op")]).readonly(),
+  'preset': z.union([z.undefined(), z.string()]).readonly().optional(),
+  'sandboxMode': z.union([z.undefined(), z.literal("read-only"), z.literal("workspace-write"), z.literal("danger-full-access")]).readonly().optional(),
+  'approvalPolicy': z.union([z.undefined(), z.literal("ask"), z.literal("never")]).readonly().optional(),
+  'sessionIds': z.union([z.undefined(), z.array(z.string())]).readonly().optional(),
+  'retryable': z.boolean().readonly(),
+}).readonly(),
+})])
 const _cerbur_clutch_dsh_worktree_worktreeManager_removeWorktree_parameter_0$schema = z.object({
   'workspaceId': z.string().readonly(),
   'worktreeId': z.string().readonly(),
@@ -177,9 +226,9 @@ const _cerbur_clutch_dsh_worktree_worktreeManager_removeWorktree_parameter_0$sch
 const _cerbur_clutch_dsh_worktree_worktreeManager_removeWorktree_result$schema = z.union([z.object({
   'ok': z.literal(false).readonly(),
   'error': z.object({
-  'code': z.union([z.literal("WORKSPACE_NOT_FOUND"), z.literal("WORKSPACE_NOT_GIT_REPOSITORY"), z.literal("GIT_NOT_INSTALLED"), z.literal("WORKTREE_REQUIRES_INITIAL_COMMIT"), z.literal("WORKTREE_BRANCH_CONFLICT"), z.literal("WORKTREE_NOT_FOUND"), z.literal("WORKTREE_ORDER_INVALID"), z.literal("WORKTREE_REMOVED"), z.literal("WORKTREE_IMPORT_INVALID"), z.literal("WORKTREE_ALREADY_MANAGED"), z.literal("SESSION_NOT_FOUND"), z.literal("SESSION_CWD_MISMATCH"), z.literal("SESSION_ALREADY_BOUND"), z.literal("SIDECAR_UNAVAILABLE"), z.literal("SIDECAR_CORRUPT"), z.literal("SIDECAR_SYNC_REQUIRED"), z.literal("GIT_OPERATION_FAILED")]).readonly(),
+  'code': z.union([z.literal("WORKSPACE_NOT_FOUND"), z.literal("WORKSPACE_NOT_GIT_REPOSITORY"), z.literal("GIT_NOT_INSTALLED"), z.literal("WORKTREE_REQUIRES_INITIAL_COMMIT"), z.literal("WORKTREE_BRANCH_CONFLICT"), z.literal("WORKTREE_NOT_FOUND"), z.literal("WORKTREE_ORDER_INVALID"), z.literal("WORKTREE_REMOVED"), z.literal("WORKTREE_IMPORT_INVALID"), z.literal("WORKTREE_ALREADY_MANAGED"), z.literal("SESSION_NOT_FOUND"), z.literal("SESSION_CWD_MISMATCH"), z.literal("SESSION_ALREADY_BOUND"), z.literal("SIDECAR_UNAVAILABLE"), z.literal("SIDECAR_CORRUPT"), z.literal("SIDECAR_SYNC_REQUIRED"), z.literal("GIT_OPERATION_FAILED"), z.literal("WORKTREE_PERMISSION_BINDING_REQUIRED")]).readonly(),
   'message': z.string().readonly(),
-  'details': z.record(z.string(), z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema2)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema2)).readonly()])).readonly().readonly(),
+  'details': z.record(z.string(), z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema6)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema6)).readonly()])).readonly().readonly(),
 }).readonly(),
 }), z.object({
   'ok': z.literal(true).readonly(),
@@ -215,7 +264,7 @@ export const TYPERT = {
         typeSymbol: '@cerbur/clutch-dsh-worktree/contract#WorktreeRemoteResult',
         schema: _cerbur_clutch_dsh_worktree_worktreeManager_bindSession_result$schema,
       },
-      sourceLocation: {"file":"packages/clutch-dsh-worktree/src/host/service.ts","line":133,"column":3},
+      sourceLocation: {"file":"packages/clutch-dsh-worktree/src/host/service.ts","line":167,"column":3},
     },
     {
       id: '@cerbur/clutch-dsh-worktree#worktreeManager/createWorktree',
@@ -240,7 +289,32 @@ export const TYPERT = {
         typeSymbol: '@cerbur/clutch-dsh-worktree/contract#WorktreeRemoteResult',
         schema: _cerbur_clutch_dsh_worktree_worktreeManager_createWorktree_result$schema,
       },
-      sourceLocation: {"file":"packages/clutch-dsh-worktree/src/host/service.ts","line":92,"column":3},
+      sourceLocation: {"file":"packages/clutch-dsh-worktree/src/host/service.ts","line":126,"column":3},
+    },
+    {
+      id: '@cerbur/clutch-dsh-worktree#worktreeManager/ensureWorktreePermission',
+      service: 'worktreeManager',
+      namespace: 'worktreeManager',
+      method: 'ensureWorktreePermission',
+      invocation: { kind: 'direct' },
+      parameters: [
+        {
+          name: 'input',
+          wire: 'input',
+          source: 'json',
+          codec: {
+            mode: 'strict',
+            typeSymbol: '@cerbur/clutch-dsh-worktree/contract#WorktreePermissionRequest',
+            schema: _cerbur_clutch_dsh_worktree_worktreeManager_ensureWorktreePermission_parameter_0$schema,
+          },
+        },
+      ],
+      result: {
+        mode: 'strict',
+        typeSymbol: '@cerbur/clutch-dsh-worktree/contract#WorktreeRemoteResult',
+        schema: _cerbur_clutch_dsh_worktree_worktreeManager_ensureWorktreePermission_result$schema,
+      },
+      sourceLocation: {"file":"packages/clutch-dsh-worktree/src/host/service.ts","line":176,"column":3},
     },
     {
       id: '@cerbur/clutch-dsh-worktree#worktreeManager/importWorktree',
@@ -265,7 +339,7 @@ export const TYPERT = {
         typeSymbol: '@cerbur/clutch-dsh-worktree/contract#WorktreeRemoteResult',
         schema: _cerbur_clutch_dsh_worktree_worktreeManager_importWorktree_result$schema,
       },
-      sourceLocation: {"file":"packages/clutch-dsh-worktree/src/host/service.ts","line":101,"column":3},
+      sourceLocation: {"file":"packages/clutch-dsh-worktree/src/host/service.ts","line":135,"column":3},
     },
     {
       id: '@cerbur/clutch-dsh-worktree#worktreeManager/insertWorktreeBefore',
@@ -290,7 +364,7 @@ export const TYPERT = {
         typeSymbol: '@cerbur/clutch-dsh-worktree/contract#WorktreeRemoteResult',
         schema: _cerbur_clutch_dsh_worktree_worktreeManager_insertWorktreeBefore_result$schema,
       },
-      sourceLocation: {"file":"packages/clutch-dsh-worktree/src/host/service.ts","line":117,"column":3},
+      sourceLocation: {"file":"packages/clutch-dsh-worktree/src/host/service.ts","line":151,"column":3},
     },
     {
       id: '@cerbur/clutch-dsh-worktree#worktreeManager/listBindings',
@@ -315,7 +389,7 @@ export const TYPERT = {
         typeSymbol: '@cerbur/clutch-dsh-worktree/contract#WorktreeRemoteResult',
         schema: _cerbur_clutch_dsh_worktree_worktreeManager_listBindings_result$schema,
       },
-      sourceLocation: {"file":"packages/clutch-dsh-worktree/src/host/service.ts","line":126,"column":3},
+      sourceLocation: {"file":"packages/clutch-dsh-worktree/src/host/service.ts","line":160,"column":3},
     },
     {
       id: '@cerbur/clutch-dsh-worktree#worktreeManager/listBranches',
@@ -340,7 +414,7 @@ export const TYPERT = {
         typeSymbol: '@cerbur/clutch-dsh-worktree/contract#WorktreeRemoteResult',
         schema: _cerbur_clutch_dsh_worktree_worktreeManager_listBranches_result$schema,
       },
-      sourceLocation: {"file":"packages/clutch-dsh-worktree/src/host/service.ts","line":85,"column":3},
+      sourceLocation: {"file":"packages/clutch-dsh-worktree/src/host/service.ts","line":119,"column":3},
     },
     {
       id: '@cerbur/clutch-dsh-worktree#worktreeManager/listImportCandidates',
@@ -365,7 +439,7 @@ export const TYPERT = {
         typeSymbol: '@cerbur/clutch-dsh-worktree/contract#WorktreeRemoteResult',
         schema: _cerbur_clutch_dsh_worktree_worktreeManager_listImportCandidates_result$schema,
       },
-      sourceLocation: {"file":"packages/clutch-dsh-worktree/src/host/service.ts","line":78,"column":3},
+      sourceLocation: {"file":"packages/clutch-dsh-worktree/src/host/service.ts","line":112,"column":3},
     },
     {
       id: '@cerbur/clutch-dsh-worktree#worktreeManager/listWorktrees',
@@ -390,7 +464,32 @@ export const TYPERT = {
         typeSymbol: '@cerbur/clutch-dsh-worktree/contract#WorktreeRemoteResult',
         schema: _cerbur_clutch_dsh_worktree_worktreeManager_listWorktrees_result$schema,
       },
-      sourceLocation: {"file":"packages/clutch-dsh-worktree/src/host/service.ts","line":71,"column":3},
+      sourceLocation: {"file":"packages/clutch-dsh-worktree/src/host/service.ts","line":105,"column":3},
+    },
+    {
+      id: '@cerbur/clutch-dsh-worktree#worktreeManager/normalizeDetachedWorktreePermissions',
+      service: 'worktreeManager',
+      namespace: 'worktreeManager',
+      method: 'normalizeDetachedWorktreePermissions',
+      invocation: { kind: 'direct' },
+      parameters: [
+        {
+          name: 'input',
+          wire: 'input',
+          source: 'json',
+          codec: {
+            mode: 'strict',
+            typeSymbol: '@cerbur/clutch-dsh-worktree/contract#WorktreePermissionNormalizationRequest',
+            schema: _cerbur_clutch_dsh_worktree_worktreeManager_normalizeDetachedWorktreePermissions_parameter_0$schema,
+          },
+        },
+      ],
+      result: {
+        mode: 'strict',
+        typeSymbol: '@cerbur/clutch-dsh-worktree/contract#WorktreeRemoteResult',
+        schema: _cerbur_clutch_dsh_worktree_worktreeManager_normalizeDetachedWorktreePermissions_result$schema,
+      },
+      sourceLocation: {"file":"packages/clutch-dsh-worktree/src/host/service.ts","line":183,"column":3},
     },
     {
       id: '@cerbur/clutch-dsh-worktree#worktreeManager/removeWorktree',
@@ -415,7 +514,7 @@ export const TYPERT = {
         typeSymbol: '@cerbur/clutch-dsh-worktree/contract#WorktreeRemoteResult',
         schema: _cerbur_clutch_dsh_worktree_worktreeManager_removeWorktree_result$schema,
       },
-      sourceLocation: {"file":"packages/clutch-dsh-worktree/src/host/service.ts","line":109,"column":3},
+      sourceLocation: {"file":"packages/clutch-dsh-worktree/src/host/service.ts","line":143,"column":3},
     },
   ],
   model: {