@claudexor/orchestrator 3.20.1 → 3.22.0

package/dist/secretDiff.d.ts

@@ -1,32 +1,72 @@
-import type { WorkspaceEnvelope } from "@claudexor/schema";
-import { revertWorkingTreePatch, type WorkspaceManager } from "@claudexor/workspace";
-export interface SecretDiffRefusal {
-    disposition: "discarded" | "reverted" | "manual_cleanup";
+import type { ArtifactStore } from "@claudexor/artifact-store";
+import { AnswerAssembly } from "@claudexor/core";
+import type { HarnessEvent, WorkspaceEnvelope } from "@claudexor/schema";
+import { type WorkspaceManager } from "@claudexor/workspace";
+import { secretLikeSummaryLine, type SecretLikeFinding } from "./persistedPatch.js";
+/** The candidate's changes could not be observed at all. This is the ONLY
+ * capture-time refusal left: secret-like content is never one (INV-062). */
+export interface CaptureRefusal {
+    disposition: "discarded" | "manual_cleanup";
     detail: string;
+    /** Failure phase; a directory result keeps its sensitive-resource phase. */
+    phase?: "workspace" | "artifact_security";
 }
-export declare function recordSecretDiffRefusal(refusal: SecretDiffRefusal | undefined, errors: string[], existingError: boolean): boolean;
-export declare function secretDiffNextActions(refusal: SecretDiffRefusal): string[];
-/** Keep a secret-bearing patch memory-only. Isolated bytes die with their
- * envelope; in-place bytes are removed only through the existing exact
- * postimage check, so a concurrent edit turns into manual cleanup rather than
- * a destructive rollback. */
-export declare function quarantineSecretDiff(input: {
+export declare function recordCaptureRefusal(refusal: CaptureRefusal | undefined, errors: string[], existingError: boolean): boolean;
+export declare function captureRefusalNextActions(refusal: CaptureRefusal): string[];
+/** Answer assembly that also counts secret-like matches in answer material
+ * BEFORE its first redaction. Harness events are redacted one by one on their
+ * way into the assembly, so a count taken on the assembled answer would
+ * always read zero. The count mirrors the assembly's own selection: a typed
+ * final wins verbatim, otherwise the narration parts add up. */
+export declare class CountedAnswerAssembly extends AnswerAssembly {
+    private finalMatches;
+    private partMatches;
+    private lastPart;
+    observeCounted(raw: HarnessEvent, safe: HarnessEvent): void;
+    secretLikeMatches(): number;
+}
+/** Read-only products have no patch or media findings. Their selected answer's
+ * pre-redaction count uses the same disclosure shape as a candidate capture. */
+export declare function answerSecretLikeFinding(answerMatches?: number): SecretLikeFinding | undefined;
+export interface CandidateCapture {
+    /** The EXACT candidate patch: apply, synthesis, digests and gates read it. */
     diff: string;
+    /** The saved copy, present only when it differs from the exact patch. */
+    persistedDiff?: string;
+    secretLike?: SecretLikeFinding;
+    captureRefusal?: CaptureRefusal;
+    /** Set when the private exact patch object of an isolated candidate could
+     * not be written: its envelope is kept and this is where the bytes still are. */
+    exactBytesRetainedAt?: string;
+}
+/** Disclosure fields of one attempt record (`attempt.yaml`). */
+export declare function attemptDisclosure(capture: CandidateCapture): Record<string, unknown>;
+/**
+ * Capture a candidate's changes and classify what a SAVED copy must hide.
+ * Nothing is rolled back, discarded or failed for secret-like content: the
+ * tree, the in-memory diff and the reviewer's verdict all keep the real bytes.
+ */
+export declare function captureCandidateWorkspace(input: {
+    wsm: WorkspaceManager;
+    envelope: WorkspaceEnvelope;
     inPlace: boolean;
-    repo: string;
-    binarySecretLike: boolean;
-    /** Secret-risk media that is not represented by `diff` cannot be removed by
-     * a successful text rollback and therefore requires truthful manual cleanup. */
-    secretOutsidePatch?: boolean;
-    gitBacked: boolean;
-    /** Test seam for the typed workspace rollback contract. */
-    revertPatch?: typeof revertWorkingTreePatch;
-}): Promise<{
-    diff: string;
-    refusal?: SecretDiffRefusal;
-}>;
-export declare function quarantineCandidateWorkspace(wsm: WorkspaceManager, envelope: WorkspaceEnvelope, inPlace: boolean, answerText?: string): ReturnType<typeof quarantineSecretDiff>;
-/** Fail-loud persistence fence for a final artifact: a secret-like token in
- * the winner's bytes must throw before anything is written (INV-062). */
-export declare function assertNoSecretLikeTokens(label: string, text: string): void;
+    /** Project root owning the private exact patch object store. */
+    projectRoot: string;
+    answerText?: string;
+    answerMatches: number;
+}): Promise<CandidateCapture>;
+/**
+ * Write a run's final patch: the saved copy to `final/patch.diff`, the exact
+ * bytes to the private exact patch object when the copy hides anything, and
+ * the disclosure fields for `work_product.yaml` meta. `patchSha256` is ALWAYS
+ * the digest of the exact patch, so a redacted copy can never pass the apply
+ * gate's digest binding on any route.
+ */
+export declare function persistFinalPatch(store: ArtifactStore, finalDir: string, run: Pick<CandidateCapture, "diff" | "persistedDiff" | "secretLike" | "exactBytesRetainedAt">): {
+    patchSha256: string;
+    meta: Record<string, unknown>;
+};
+export { secretLikeSummaryLine };
+/** `\n`-prefixed disclosure line for a summary template; "" when clean. */
+export declare function summaryDisclosure(finding: SecretLikeFinding | undefined): string;
 //# sourceMappingURL=secretDiff.d.ts.map

package/dist/secretDiff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secretDiff.d.ts","sourceRoot":"","sources":["../src/secretDiff.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAIrF,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,WAAW,GAAG,UAAU,GAAG,gBAAgB,CAAC;IACzD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,iBAAiB,GAAG,SAAS,EACtC,MAAM,EAAE,MAAM,EAAE,EAChB,aAAa,EAAE,OAAO,GACrB,OAAO,CAIT;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAI1E;AAED;;;6BAG6B;AAC7B,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,OAAO,CAAC;IAC1B;oFACgF;IAChF,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,SAAS,EAAE,OAAO,CAAC;IACnB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,OAAO,sBAAsB,CAAC;CAC7C,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,iBAAiB,CAAA;CAAE,CAAC,CAkEzD;AAED,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,EAAE,OAAO,EAChB,UAAU,CAAC,EAAE,MAAM,GAClB,UAAU,CAAC,OAAO,oBAAoB,CAAC,CA2CzC;AAYD;yEACyE;AACzE,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAI1E"}
+{"version":3,"file":"secretDiff.d.ts","sourceRoot":"","sources":["../src/secretDiff.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAsB,MAAM,iBAAiB,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAqC,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGhG,OAAO,EAIL,qBAAqB,EACrB,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAE7B;4EAC4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,WAAW,GAAG,gBAAgB,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,KAAK,CAAC,EAAE,WAAW,GAAG,mBAAmB,CAAC;CAC3C;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,MAAM,EAAE,MAAM,EAAE,EAChB,aAAa,EAAE,OAAO,GACrB,OAAO,CAIT;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,EAAE,CAI3E;AAED;;;;gEAIgE;AAChE,qBAAa,qBAAsB,SAAQ,cAAc;IACvD,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,QAAQ,CAAqB;IAErC,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAoB1D;IAED,iBAAiB,IAAI,MAAM,CAE1B;CACF;AAED;gFACgF;AAChF,wBAAgB,uBAAuB,CAAC,aAAa,SAAI,GAAG,iBAAiB,GAAG,SAAS,CAOxF;AAED,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;qFACiF;IACjF,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQpF;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,GAAG,EAAE,gBAAgB,CAAC;IACtB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA6D5B;AAMD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,eAAe,GAAG,YAAY,GAAG,sBAAsB,CAAC,GAC5F;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAgBxD;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAEjC,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GAAG,MAAM,CAGhF"}

package/dist/secretDiff.js

@@ -1,141 +1,171 @@
-import { realpathSync } from "node:fs";
-import { resolve, sep } from "node:path";
-import { summarizeDiffPaths } from "@claudexor/core";
-import { revertWorkingTreePatch } from "@claudexor/workspace";
-import { containsSecretLikeToken, redactSecrets } from "@claudexor/util";
+import { join } from "node:path";
+import { AnswerAssembly, summarizeDiffPaths } from "@claudexor/core";
+import { createRevertAnchorFromPatchOrNull } from "@claudexor/workspace";
+import { sensitiveResourcePolicy, sha256 } from "@claudexor/util";
 import { candidateOutputSecretRisk, rasterLinksInMarkdown } from "./candidateOutputs.js";
-export function recordSecretDiffRefusal(refusal, errors, existingError) {
+import { assertPersistableText, buildSecretLikeFinding, persistedPatchCopy, secretLikeSummaryLine, } from "./persistedPatch.js";
+export function recordCaptureRefusal(refusal, errors, existingError) {
     if (!refusal)
         return existingError;
-    errors.push("candidate output could not be proven secret-safe; refusing artifact persistence");
+    errors.push(refusal.detail);
     return true;
 }
-export function secretDiffNextActions(refusal) {
+export function captureRefusalNextActions(refusal) {
     return refusal.disposition === "manual_cleanup"
-        ? ["Inspect and clean the state named in the recovery receipt", "Retry the run"]
-        : ["Retry the run without writing secret material"];
+        ? ["Inspect the changed files in the project folder directly", "Retry the run"]
+        : ["Retry the run"];
 }
-/** Keep a secret-bearing patch memory-only. Isolated bytes die with their
- * envelope; in-place bytes are removed only through the existing exact
- * postimage check, so a concurrent edit turns into manual cleanup rather than
- * a destructive rollback. */
-export async function quarantineSecretDiff(input) {
-    if (!containsSecretLikeToken(input.diff) && !input.binarySecretLike) {
-        return { diff: input.diff };
+/** Answer assembly that also counts secret-like matches in answer material
+ * BEFORE its first redaction. Harness events are redacted one by one on their
+ * way into the assembly, so a count taken on the assembled answer would
+ * always read zero. The count mirrors the assembly's own selection: a typed
+ * final wins verbatim, otherwise the narration parts add up. */
+export class CountedAnswerAssembly extends AnswerAssembly {
+    finalMatches = null;
+    partMatches = 0;
+    lastPart;
+    observeCounted(raw, safe) {
+        this.observe(safe);
+        if (raw.type !== "message")
+            return;
+        const payload = raw.payload ?? {};
+        if (payload["auth_switched"] === true || payload["delta"] === true)
+            return;
+        if (payload["buffered"] === true)
+            return;
+        const text = raw.text ?? "";
+        const count = () => sensitiveResourcePolicy.inspectContent(text, "redact").matches;
+        if (raw.final === true) {
+            // The same acceptance as AnswerAssembly: an empty display final counts
+            // only when it carries the machine envelope (and then shows nothing).
+            const envelope = typeof payload["work_report_envelope"] === "string";
+            if (text.trim().length > 0 || envelope)
+                this.finalMatches = text.trim() ? count() : 0;
+            return;
+        }
+        // Narration repeats are shown once (pushUniqueText), so they count once.
+        const normalized = text.trim();
+        if (!normalized || normalized === this.lastPart)
+            return;
+        this.lastPart = normalized;
+        this.partMatches += count();
     }
-    if (!input.inPlace) {
-        return {
-            diff: "",
-            refusal: {
-                disposition: "discarded",
-                detail: "isolated candidate bytes that could not be proven secret-safe were discarded with the candidate envelope",
-            },
-        };
+    secretLikeMatches() {
+        return this.hasFinal() && this.finalMatches !== null ? this.finalMatches : this.partMatches;
     }
-    if (input.binarySecretLike && !input.diff.trim()) {
-        return {
-            diff: "",
-            refusal: {
-                disposition: "manual_cleanup",
-                detail: "candidate output could not be proven secret-safe or captured as an exact reversible patch; manual cleanup required",
-            },
-        };
-    }
-    let rollback;
-    try {
-        rollback = await (input.revertPatch ?? revertWorkingTreePatch)(input.repo, input.diff, {
-            isolateObjectWrites: input.gitBacked,
-            noIndex: !input.gitBacked,
-        });
-    }
-    catch (error) {
-        const rollbackCompleted = error instanceof Error &&
-            Object.prototype.hasOwnProperty.call(error, "cleanupError") &&
-            error.rollbackReverted === true;
-        return {
-            diff: "",
-            refusal: {
-                disposition: "manual_cleanup",
-                detail: rollbackCompleted
-                    ? "in-place bytes were rolled back, but Claudexor scratch cleanup could not be proven; manual cleanup of Claudexor temporary state is required"
-                    : "in-place output that could not be proven secret-safe could not be rolled back; manual cleanup required",
-            },
-        };
-    }
-    const manuallyClean = !rollback.reverted || input.gitBacked || input.secretOutsidePatch === true;
+}
+/** Read-only products have no patch or media findings. Their selected answer's
+ * pre-redaction count uses the same disclosure shape as a candidate capture. */
+export function answerSecretLikeFinding(answerMatches = 0) {
+    return buildSecretLikeFinding({
+        copy: { text: "", files: [], unattributedMatches: 0 },
+        binaryPaths: [],
+        mediaWithheld: [],
+        answerMatches,
+    });
+}
+/** Disclosure fields of one attempt record (`attempt.yaml`). */
+export function attemptDisclosure(capture) {
     return {
-        diff: "",
-        refusal: !manuallyClean
-            ? {
-                disposition: "reverted",
-                detail: "in-place bytes that could not be proven secret-safe were removed by an exact checked rollback",
-            }
-            : {
-                disposition: "manual_cleanup",
-                detail: redactSecrets(rollback.reverted && input.secretOutsidePatch
-                    ? `the exact reversible patch was removed, but candidate media outside that patch could not be proven removed; manual cleanup required${input.gitBacked ? "; inspect Git index, refs, and objects too" : ""}`
-                    : rollback.reverted && input.gitBacked
-                        ? "worktree bytes were removed; inspect Git index, refs, and objects for harness-written secret state"
-                        : (rollback.reason ??
-                            "candidate output could not be proven removed; manual cleanup required")),
-            },
+        ...(capture.captureRefusal ? { capture_refusal: capture.captureRefusal } : {}),
+        ...(capture.secretLike ? { secret_like: capture.secretLike } : {}),
+        ...(capture.exactBytesRetainedAt
+            ? { exact_bytes_retained_at: capture.exactBytesRetainedAt }
+            : {}),
     };
 }
-export async function quarantineCandidateWorkspace(wsm, envelope, inPlace, answerText) {
+/**
+ * Capture a candidate's changes and classify what a SAVED copy must hide.
+ * Nothing is rolled back, discarded or failed for secret-like content: the
+ * tree, the in-memory diff and the reviewer's verdict all keep the real bytes.
+ */
+export async function captureCandidateWorkspace(input) {
+    const { wsm, envelope, inPlace } = input;
     let captured;
     try {
         captured = await wsm.captureDiff(envelope);
     }
     catch (error) {
         const scratchCleanupUnproven = error instanceof Error && Object.prototype.hasOwnProperty.call(error, "cleanupError");
-        return {
-            diff: "",
-            refusal: {
-                disposition: inPlace || scratchCleanupUnproven ? "manual_cleanup" : "discarded",
-                detail: scratchCleanupUnproven
-                    ? "candidate output capture failed and private scratch cleanup could not be proven; manual cleanup of Claudexor temporary state is required"
-                    : inPlace
-                        ? "candidate output could not be captured safely; manual cleanup required"
-                        : "uncaptured isolated candidate output was discarded with the candidate envelope",
-            },
-        };
+        return refused(inPlace || scratchCleanupUnproven ? "manual_cleanup" : "discarded", scratchCleanupUnproven
+            ? "candidate output capture failed and private scratch cleanup could not be proven; manual cleanup of Claudexor temporary state is required"
+            : inPlace
+                ? "candidate output could not be captured; the changed files are untouched and need direct inspection"
+                : "uncaptured isolated candidate output was discarded with the candidate envelope");
+    }
+    if (captured.captureIncomplete) {
+        return refused(inPlace ? "manual_cleanup" : "discarded", inPlace
+            ? "candidate output could not be captured as a complete patch; the changed files are untouched and need direct inspection"
+            : "uncaptured isolated candidate output was discarded with the candidate envelope");
     }
-    const diffPaths = summarizeDiffPaths(captured.diff).paths;
-    const linkedPaths = rasterLinksInMarkdown(answerText ?? "");
-    const mediaRisk = candidateOutputSecretRisk({
+    const media = candidateOutputSecretRisk({
         worktreePath: envelope.worktree_path,
-        changedPaths: [...diffPaths, ...linkedPaths],
+        changedPaths: [
+            ...summarizeDiffPaths(captured.diff).paths,
+            ...rasterLinksInMarkdown(input.answerText ?? ""),
+        ],
         artifactRelativeDir: wsm.ownedArtifactRelativeDirectory(envelope),
     });
-    const diffIdentities = new Set(diffPaths.map((path) => candidatePathIdentity(envelope.worktree_path, path)));
-    const secretOutsidePatch = mediaRisk.artifactDirectoryUnsafe ||
-        mediaRisk.nonReversiblePaths.length > 0 ||
-        mediaRisk.riskyPaths.some((path) => !diffIdentities.has(candidatePathIdentity(envelope.worktree_path, path)));
-    return quarantineSecretDiff({
-        diff: captured.diff,
-        binarySecretLike: captured.binarySecretLike || mediaRisk.risky,
-        secretOutsidePatch,
-        repo: envelope.worktree_path,
-        inPlace,
-        gitBacked: Boolean(envelope.base_sha),
+    const copy = persistedPatchCopy(captured.diff, captured.binarySecretPaths);
+    const secretLike = buildSecretLikeFinding({
+        copy,
+        binaryPaths: captured.binarySecretPaths,
+        mediaWithheld: [
+            ...media.riskyPaths,
+            ...(media.artifactDirectoryUnsafe
+                ? [wsm.ownedArtifactRelativeDirectory(envelope) ?? ""]
+                : []),
+        ].filter(Boolean),
+        answerMatches: input.answerText ? input.answerMatches : 0,
     });
+    const redactedCopy = copy.text !== captured.diff;
+    // An isolated candidate's envelope is the only other holder of the exact
+    // bytes and is about to be removed, so its exact object is written NOW. If
+    // that write fails the envelope is kept: a deferred Apply then refuses typed
+    // while the bytes, the answer and the run state stay readable.
+    const retained = redactedCopy &&
+        !inPlace &&
+        createRevertAnchorFromPatchOrNull(input.projectRoot, captured.diff) === null;
+    if (retained)
+        wsm.retainEnvelope(envelope);
+    return {
+        diff: captured.diff,
+        ...(redactedCopy ? { persistedDiff: copy.text } : {}),
+        ...(secretLike ? { secretLike } : {}),
+        ...(retained ? { exactBytesRetainedAt: envelope.worktree_path } : {}),
+    };
 }
-function candidatePathIdentity(root, raw) {
-    const absolute = resolve(root, raw);
-    if (absolute !== resolve(root) && !absolute.startsWith(resolve(root) + sep))
-        return absolute;
-    try {
-        return realpathSync.native(absolute);
-    }
-    catch {
-        return absolute;
-    }
+function refused(disposition, detail) {
+    return { diff: "", captureRefusal: { disposition, detail } };
 }
-/** Fail-loud persistence fence for a final artifact: a secret-like token in
- * the winner's bytes must throw before anything is written (INV-062). */
-export function assertNoSecretLikeTokens(label, text) {
-    if (containsSecretLikeToken(text)) {
-        throw new Error(`${label} contains secret-like token; refusing to persist artifact`);
+/**
+ * Write a run's final patch: the saved copy to `final/patch.diff`, the exact
+ * bytes to the private exact patch object when the copy hides anything, and
+ * the disclosure fields for `work_product.yaml` meta. `patchSha256` is ALWAYS
+ * the digest of the exact patch, so a redacted copy can never pass the apply
+ * gate's digest binding on any route.
+ */
+export function persistFinalPatch(store, finalDir, run) {
+    const copy = run.persistedDiff ?? persistedPatchCopy(run.diff, []).text;
+    assertPersistableText("final patch copy", copy);
+    store.writeText(join(finalDir, "patch.diff"), copy);
+    const meta = run.secretLike ? { secret_like: run.secretLike } : {};
+    if (copy !== run.diff) {
+        meta["persisted_patch"] = "redacted";
+        // null: the exact bytes could not be stored; a deferred Apply answers
+        // patch_exact_bytes_unavailable instead of applying the copy.
+        const exactObject = createRevertAnchorFromPatchOrNull(store.repoRoot, run.diff);
+        meta["exact_patch_object"] = exactObject;
+        if (exactObject === null && run.exactBytesRetainedAt) {
+            meta["exact_bytes_retained_at"] = run.exactBytesRetainedAt;
+        }
     }
+    return { patchSha256: sha256(run.diff), meta };
+}
+export { secretLikeSummaryLine };
+/** `\n`-prefixed disclosure line for a summary template; "" when clean. */
+export function summaryDisclosure(finding) {
+    const line = secretLikeSummaryLine(finding);
+    return line ? `\n${line}` : "";
 }
 //# sourceMappingURL=secretDiff.js.map

package/dist/secretDiff.js.map

@@ -1 +1 @@
-{"version":3,"file":"secretDiff.js","sourceRoot":"","sources":["../src/secretDiff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,EAAE,sBAAsB,EAAyB,MAAM,sBAAsB,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAOzF,MAAM,UAAU,uBAAuB,CACrC,OAAsC,EACtC,MAAgB,EAChB,aAAsB;IAEtB,IAAI,CAAC,OAAO;QAAE,OAAO,aAAa,CAAC;IACnC,MAAM,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;IAC/F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAA0B;IAC9D,OAAO,OAAO,CAAC,WAAW,KAAK,gBAAgB;QAC7C,CAAC,CAAC,CAAC,2DAA2D,EAAE,eAAe,CAAC;QAChF,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC;AACxD,CAAC;AAED;;;6BAG6B;AAC7B,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAW1C;IACC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO;YACL,IAAI,EAAE,EAAE;YACR,OAAO,EAAE;gBACP,WAAW,EAAE,WAAW;gBACxB,MAAM,EACJ,0GAA0G;aAC7G;SACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACjD,OAAO;YACL,IAAI,EAAE,EAAE;YACR,OAAO,EAAE;gBACP,WAAW,EAAE,gBAAgB;gBAC7B,MAAM,EACJ,oHAAoH;aACvH;SACF,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,sBAAsB,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;YACrF,mBAAmB,EAAE,KAAK,CAAC,SAAS;YACpC,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,iBAAiB,GACrB,KAAK,YAAY,KAAK;YACtB,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC;YAC1D,KAAgD,CAAC,gBAAgB,KAAK,IAAI,CAAC;QAC9E,OAAO;YACL,IAAI,EAAE,EAAE;YACR,OAAO,EAAE;gBACP,WAAW,EAAE,gBAAgB;gBAC7B,MAAM,EAAE,iBAAiB;oBACvB,CAAC,CAAC,6IAA6I;oBAC/I,CAAC,CAAC,wGAAwG;aAC7G;SACF,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,CAAC;IACjG,OAAO;QACL,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,CAAC,aAAa;YACrB,CAAC,CAAC;gBACE,WAAW,EAAE,UAAU;gBACvB,MAAM,EACJ,+FAA+F;aAClG;YACH,CAAC,CAAC;gBACE,WAAW,EAAE,gBAAgB;gBAC7B,MAAM,EAAE,aAAa,CACnB,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,kBAAkB;oBAC3C,CAAC,CAAC,sIAAsI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,EAAE,EAAE;oBAC7M,CAAC,CAAC,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS;wBACpC,CAAC,CAAC,oGAAoG;wBACtG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;4BAChB,uEAAuE,CAAC,CAC/E;aACF;KACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAqB,EACrB,QAA2B,EAC3B,OAAgB,EAChB,UAAmB;IAEnB,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,sBAAsB,GAC1B,KAAK,YAAY,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QACxF,OAAO;YACL,IAAI,EAAE,EAAE;YACR,OAAO,EAAE;gBACP,WAAW,EAAE,OAAO,IAAI,sBAAsB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW;gBAC/E,MAAM,EAAE,sBAAsB;oBAC5B,CAAC,CAAC,0IAA0I;oBAC5I,CAAC,CAAC,OAAO;wBACP,CAAC,CAAC,wEAAwE;wBAC1E,CAAC,CAAC,gFAAgF;aACvF;SACF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;IAC1D,MAAM,WAAW,GAAG,qBAAqB,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,yBAAyB,CAAC;QAC1C,YAAY,EAAE,QAAQ,CAAC,aAAa;QACpC,YAAY,EAAE,CAAC,GAAG,SAAS,EAAE,GAAG,WAAW,CAAC;QAC5C,mBAAmB,EAAE,GAAG,CAAC,8BAA8B,CAAC,QAAQ,CAAC;KAClE,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAC7E,CAAC;IACF,MAAM,kBAAkB,GACtB,SAAS,CAAC,uBAAuB;QACjC,SAAS,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;QACvC,SAAS,CAAC,UAAU,CAAC,IAAI,CACvB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,qBAAqB,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CACnF,CAAC;IACJ,OAAO,oBAAoB,CAAC;QAC1B,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,IAAI,SAAS,CAAC,KAAK;QAC9D,kBAAkB;QAClB,IAAI,EAAE,QAAQ,CAAC,aAAa;QAC5B,OAAO;QACP,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACtC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,GAAW;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpC,IAAI,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7F,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED;yEACyE;AACzE,MAAM,UAAU,wBAAwB,CAAC,KAAa,EAAE,IAAY;IAClE,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2DAA2D,CAAC,CAAC;IACvF,CAAC;AACH,CAAC"}
+{"version":3,"file":"secretDiff.js","sourceRoot":"","sources":["../src/secretDiff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErE,OAAO,EAAE,iCAAiC,EAAyB,MAAM,sBAAsB,CAAC;AAChG,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,GAEtB,MAAM,qBAAqB,CAAC;AAW7B,MAAM,UAAU,oBAAoB,CAClC,OAAmC,EACnC,MAAgB,EAChB,aAAsB;IAEtB,IAAI,CAAC,OAAO;QAAE,OAAO,aAAa,CAAC;IACnC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAuB;IAC/D,OAAO,OAAO,CAAC,WAAW,KAAK,gBAAgB;QAC7C,CAAC,CAAC,CAAC,0DAA0D,EAAE,eAAe,CAAC;QAC/E,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;AACxB,CAAC;AAED;;;;gEAIgE;AAChE,MAAM,OAAO,qBAAsB,SAAQ,cAAc;IAC/C,YAAY,GAAkB,IAAI,CAAC;IACnC,WAAW,GAAG,CAAC,CAAC;IAChB,QAAQ,CAAqB;IAErC,cAAc,CAAC,GAAiB,EAAE,IAAkB;QAClD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO;QACnC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,eAAe,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI;YAAE,OAAO;QAC3E,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI;YAAE,OAAO;QACzC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,GAAW,EAAE,CAAC,uBAAuB,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC;QAC3F,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACvB,uEAAuE;YACvE,sEAAsE;YACtE,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,sBAAsB,CAAC,KAAK,QAAQ,CAAC;YACrE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ;gBAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,yEAAyE;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,IAAI,CAAC,QAAQ;YAAE,OAAO;QACxD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC;QAC3B,IAAI,CAAC,WAAW,IAAI,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,iBAAiB;QACf,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC9F,CAAC;CACF;AAED;gFACgF;AAChF,MAAM,UAAU,uBAAuB,CAAC,aAAa,GAAG,CAAC;IACvD,OAAO,sBAAsB,CAAC;QAC5B,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE;QACrD,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,EAAE;QACjB,aAAa;KACd,CAAC,CAAC;AACL,CAAC;AAcD,gEAAgE;AAChE,MAAM,UAAU,iBAAiB,CAAC,OAAyB;IACzD,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,OAAO,CAAC,oBAAoB;YAC9B,CAAC,CAAC,EAAE,uBAAuB,EAAE,OAAO,CAAC,oBAAoB,EAAE;YAC3D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAQ/C;IACC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IACzC,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,sBAAsB,GAC1B,KAAK,YAAY,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QACxF,OAAO,OAAO,CACZ,OAAO,IAAI,sBAAsB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW,EAClE,sBAAsB;YACpB,CAAC,CAAC,0IAA0I;YAC5I,CAAC,CAAC,OAAO;gBACP,CAAC,CAAC,oGAAoG;gBACtG,CAAC,CAAC,gFAAgF,CACvF,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAC/B,OAAO,OAAO,CACZ,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW,EACxC,OAAO;YACL,CAAC,CAAC,wHAAwH;YAC1H,CAAC,CAAC,gFAAgF,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,yBAAyB,CAAC;QACtC,YAAY,EAAE,QAAQ,CAAC,aAAa;QACpC,YAAY,EAAE;YACZ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK;YAC1C,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;SACjD;QACD,mBAAmB,EAAE,GAAG,CAAC,8BAA8B,CAAC,QAAQ,CAAC;KAClE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,sBAAsB,CAAC;QACxC,IAAI;QACJ,WAAW,EAAE,QAAQ,CAAC,iBAAiB;QACvC,aAAa,EAAE;YACb,GAAG,KAAK,CAAC,UAAU;YACnB,GAAG,CAAC,KAAK,CAAC,uBAAuB;gBAC/B,CAAC,CAAC,CAAC,GAAG,CAAC,8BAA8B,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACtD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,MAAM,CAAC,OAAO,CAAC;QACjB,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;KAC1D,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC;IACjD,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAM,QAAQ,GACZ,YAAY;QACZ,CAAC,OAAO;QACR,iCAAiC,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IAC/E,IAAI,QAAQ;QAAE,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,WAA0C,EAAE,MAAc;IACzE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAoB,EACpB,QAAgB,EAChB,GAA6F;IAE7F,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;IACxE,qBAAqB,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;IAChD,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,IAAI,GAA4B,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,iBAAiB,CAAC,GAAG,UAAU,CAAC;QACrC,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,WAAW,GAAG,iCAAiC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAChF,IAAI,CAAC,oBAAoB,CAAC,GAAG,WAAW,CAAC;QACzC,IAAI,WAAW,KAAK,IAAI,IAAI,GAAG,CAAC,oBAAoB,EAAE,CAAC;YACrD,IAAI,CAAC,yBAAyB,CAAC,GAAG,GAAG,CAAC,oBAAoB,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAEjC,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,OAAsC;IACtE,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACjC,CAAC"}

package/dist/session-capsule.d.ts

@@ -0,0 +1,29 @@
+import { SessionCapsule, type CredentialProfile } from "@claudexor/schema";
+import { type EnvMap, type HarnessContinuityCapability } from "@claudexor/core";
+export declare const SESSION_CAPSULE_FILE = "session-capsule.json";
+export declare function sessionCapsulePath(attemptDir: string): string;
+/** Atomic-enough write (temp + rename is overkill for a one-line JSON; a torn
+ * write fails `readSessionCapsule`'s parse and reads as "no capsule"). */
+export declare function writeSessionCapsule(attemptDir: string, capsule: SessionCapsule): void;
+/** The attempt's capsule, or null when none was written or it does not parse. */
+export declare function readSessionCapsule(attemptDir: string): SessionCapsule | null;
+/**
+ * The EnvMap the adapter's `locate`/`move` resolve a store from: the child's
+ * spec env plus the registry locator of the profile that holds the session.
+ * The engine names the row's `isolation_locator` under ONE neutral key; the
+ * adapter maps it onto its vendor variable (INV-135, no vendor paths here).
+ */
+export declare function storeEnvFor(specEnv: Record<string, string> | undefined, profile: Pick<CredentialProfile, "isolation_locator"> | null | undefined): EnvMap;
+/** The registry row of a profile id, or null for the engine default. */
+export declare function registryProfile(registry: readonly CredentialProfile[], profileId: string | null): CredentialProfile | null;
+/**
+ * Re-locate the capsule's holder file through the adapter (best-effort I/O).
+ * A located file refreshes `file`/`mtimeMs`/`sidecars`; a miss leaves the
+ * capsule as it was (a resume by id; only adapters with `continuity` have the
+ * engine compare the resumed session id). Never throws.
+ */
+export declare function relocateSessionCapsule(capsule: SessionCapsule, continuity: HarnessContinuityCapability | undefined, env: EnvMap): Promise<{
+    capsule: SessionCapsule;
+    located: boolean | null;
+}>;
+//# sourceMappingURL=session-capsule.d.ts.map

package/dist/session-capsule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-capsule.d.ts","sourceRoot":"","sources":["../src/session-capsule.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,cAAc,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAEL,KAAK,MAAM,EACX,KAAK,2BAA2B,EACjC,MAAM,iBAAiB,CAAC;AAEzB,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;0EAC0E;AAC1E,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,CAIrF;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAQ5E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAC3C,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,GAAG,IAAI,GAAG,SAAS,GACvE,MAAM,CAMR;AAED,wEAAwE;AACxE,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EACtC,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,iBAAiB,GAAG,IAAI,CAG1B;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,2BAA2B,GAAG,SAAS,EACnD,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;CAAE,CAAC,CAoB/D"}

package/dist/session-capsule.js

@@ -0,0 +1,86 @@
+/**
+ * Session capsule (A5): ONE durable record per attempt of the native vendor
+ * session — `attempts/<attemptId>/session-capsule.json` under the run dir.
+ *
+ * Written by the orchestrator when `started` reports a native session id (every
+ * try, every envelope kind, standalone runs included — the daemon's thread
+ * callback is not standalone persistence), re-located after the try settles
+ * (the vendor may write the history file after `started`) and refreshed after
+ * a move. The holder is the concrete file the adapter's `locate` found; a
+ * session has one holder at a time. Readers: the in-run continuation loop,
+ * the `continueFrom` run chain and the thread store's projection.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { SessionCapsule } from "@claudexor/schema";
+import { CONTINUITY_PROFILE_LOCATOR_ENV, } from "@claudexor/core";
+export const SESSION_CAPSULE_FILE = "session-capsule.json";
+export function sessionCapsulePath(attemptDir) {
+    return join(attemptDir, SESSION_CAPSULE_FILE);
+}
+/** Atomic-enough write (temp + rename is overkill for a one-line JSON; a torn
+ * write fails `readSessionCapsule`'s parse and reads as "no capsule"). */
+export function writeSessionCapsule(attemptDir, capsule) {
+    const path = sessionCapsulePath(attemptDir);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(SessionCapsule.parse(capsule), null, 2) + "\n");
+}
+/** The attempt's capsule, or null when none was written or it does not parse. */
+export function readSessionCapsule(attemptDir) {
+    const path = sessionCapsulePath(attemptDir);
+    if (!existsSync(path))
+        return null;
+    try {
+        return SessionCapsule.parse(JSON.parse(readFileSync(path, "utf8")));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The EnvMap the adapter's `locate`/`move` resolve a store from: the child's
+ * spec env plus the registry locator of the profile that holds the session.
+ * The engine names the row's `isolation_locator` under ONE neutral key; the
+ * adapter maps it onto its vendor variable (INV-135, no vendor paths here).
+ */
+export function storeEnvFor(specEnv, profile) {
+    const locator = profile?.isolation_locator ?? null;
+    return {
+        ...(specEnv ?? {}),
+        ...(locator ? { [CONTINUITY_PROFILE_LOCATOR_ENV]: locator } : {}),
+    };
+}
+/** The registry row of a profile id, or null for the engine default. */
+export function registryProfile(registry, profileId) {
+    if (profileId === null)
+        return null;
+    return registry.find((row) => row.profile_id === profileId) ?? null;
+}
+/**
+ * Re-locate the capsule's holder file through the adapter (best-effort I/O).
+ * A located file refreshes `file`/`mtimeMs`/`sidecars`; a miss leaves the
+ * capsule as it was (a resume by id; only adapters with `continuity` have the
+ * engine compare the resumed session id). Never throws.
+ */
+export async function relocateSessionCapsule(capsule, continuity, env) {
+    if (!continuity)
+        return { capsule, located: null };
+    try {
+        const found = await continuity.locate({ nativeSessionId: capsule.nativeSessionId, cwd: capsule.cwd }, env);
+        if (!found.found)
+            return { capsule, located: false };
+        return {
+            capsule: {
+                ...capsule,
+                file: found.file,
+                mtimeMs: found.mtimeMs,
+                sidecars: found.sidecars,
+            },
+            located: true,
+        };
+    }
+    catch {
+        return { capsule, located: false };
+    }
+}
+//# sourceMappingURL=session-capsule.js.map

package/dist/session-capsule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-capsule.js","sourceRoot":"","sources":["../src/session-capsule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAA0B,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EACL,8BAA8B,GAG/B,MAAM,iBAAiB,CAAC;AAEzB,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,OAAO,IAAI,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;AAChD,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,mBAAmB,CAAC,UAAkB,EAAE,OAAuB;IAC7E,MAAM,IAAI,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC5C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACrF,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,IAAI,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,OAA2C,EAC3C,OAAwE;IAExE,MAAM,OAAO,GAAG,OAAO,EAAE,iBAAiB,IAAI,IAAI,CAAC;IACnD,OAAO;QACL,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAClB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,8BAA8B,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAC7B,QAAsC,EACtC,SAAwB;IAExB,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAuB,EACvB,UAAmD,EACnD,GAAW;IAEX,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,CACnC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAC9D,GAAG,CACJ,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACrD,OAAO;YACL,OAAO,EAAE;gBACP,GAAG,OAAO;gBACV,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB;YACD,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;AACH,CAAC"}