@claudexor/schema 4.6.2 → 4.7.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/account-routing-evidence.d.ts +22 -0
- package/dist/account-routing-evidence.d.ts.map +1 -1
- package/dist/agent-capabilities.d.ts +32 -0
- package/dist/agent-capabilities.d.ts.map +1 -1
- package/dist/agent-capabilities.js +8 -0
- package/dist/agent-capabilities.js.map +1 -1
- package/dist/auxiliary-writable-roots.d.ts +30 -0
- package/dist/auxiliary-writable-roots.d.ts.map +1 -0
- package/dist/auxiliary-writable-roots.js +40 -0
- package/dist/auxiliary-writable-roots.js.map +1 -0
- package/dist/control-harness-list.d.ts +11 -0
- package/dist/control-harness-list.d.ts.map +1 -1
- package/dist/control-operation-responses.d.ts +12 -7
- package/dist/control-operation-responses.d.ts.map +1 -1
- package/dist/control-operation-responses.js +7 -2
- package/dist/control-operation-responses.js.map +1 -1
- package/dist/control-run-detail.d.ts +19 -19
- package/dist/control-run-execution.d.ts +3 -0
- package/dist/control-run-execution.d.ts.map +1 -1
- package/dist/control-run-execution.js +2 -0
- package/dist/control-run-execution.js.map +1 -1
- package/dist/control-run-failure.d.ts +4 -4
- package/dist/control-run-failure.d.ts.map +1 -1
- package/dist/control-run-failure.js +1 -0
- package/dist/control-run-failure.js.map +1 -1
- package/dist/control.d.ts +22 -5
- package/dist/control.d.ts.map +1 -1
- package/dist/credential-profile-snapshot.d.ts +44 -0
- package/dist/credential-profile-snapshot.d.ts.map +1 -1
- package/dist/harness-confinement.d.ts +18 -0
- package/dist/harness-confinement.d.ts.map +1 -1
- package/dist/harness-confinement.js +18 -0
- package/dist/harness-confinement.js.map +1 -1
- package/dist/harness.d.ts +16 -15
- package/dist/harness.d.ts.map +1 -1
- package/dist/harness.js +4 -17
- package/dist/harness.js.map +1 -1
- package/dist/index.d.ts +1 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -0
- package/dist/index.js.map +1 -1
- package/dist/mcp-run-result.d.ts +10 -10
- package/dist/readiness.d.ts +9 -0
- package/dist/readiness.d.ts.map +1 -1
- package/dist/task.d.ts +15 -0
- package/dist/task.d.ts.map +1 -1
- package/dist/task.js +3 -0
- package/dist/task.js.map +1 -1
- package/generated/AgentCapabilityCatalog.schema.json +17 -0
- package/generated/ControlCredentialProfilesQueryResponse.schema.json +5 -0
- package/generated/ControlCredentialProfilesResourcesResponse.schema.json +5 -0
- package/generated/ControlCredentialProfilesSnapshotResponse.schema.json +5 -0
- package/generated/ControlHarnessListResponse.schema.json +5 -0
- package/generated/ControlRunAgainDraft.schema.json +8 -0
- package/generated/ControlRunDetail.schema.json +1 -0
- package/generated/ControlRunListResponse.schema.json +1 -0
- package/generated/ControlRunStartRequest.schema.json +8 -0
- package/generated/ControlRunSummary.schema.json +1 -0
- package/generated/ControlThreadTurnRequest.schema.json +9 -1
- package/generated/HarnessManifest.schema.json +5 -0
- package/generated/HarnessStatusDto.schema.json +5 -0
- package/generated/McpAccountsToolResult.schema.json +5 -0
- package/generated/McpRunHandleResult.schema.json +1 -0
- package/generated/McpRunToolResult.schema.json +1 -0
- package/generated/RunFailure.schema.json +1 -0
- package/generated/TaskContract.schema.json +8 -0
- package/package.json +2 -2
package/dist/task.d.ts
CHANGED
|
@@ -561,12 +561,15 @@ export declare const TaskContract: z.ZodObject<{
|
|
|
561
561
|
requested_profile: z.ZodDefault<z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native", "external_sandbox_full"]>>;
|
|
562
562
|
/** Profile actually enforced by the engine (mode/trust clamps applied; never client-supplied). */
|
|
563
563
|
effective_profile: z.ZodDefault<z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native", "external_sandbox_full"]>>;
|
|
564
|
+
auxiliary_writable_roots: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
|
|
564
565
|
}, "strip", z.ZodTypeAny, {
|
|
565
566
|
requested_profile: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write";
|
|
566
567
|
effective_profile: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write";
|
|
568
|
+
auxiliary_writable_roots: string[];
|
|
567
569
|
}, {
|
|
568
570
|
requested_profile?: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | undefined;
|
|
569
571
|
effective_profile?: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | undefined;
|
|
572
|
+
auxiliary_writable_roots?: string[] | undefined;
|
|
570
573
|
}>>;
|
|
571
574
|
external_context: z.ZodDefault<z.ZodObject<{
|
|
572
575
|
policy: z.ZodDefault<z.ZodEnum<["off", "auto", "cached", "live"]>>;
|
|
@@ -729,6 +732,7 @@ export declare const TaskContract: z.ZodObject<{
|
|
|
729
732
|
access: {
|
|
730
733
|
requested_profile: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write";
|
|
731
734
|
effective_profile: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write";
|
|
735
|
+
auxiliary_writable_roots: string[];
|
|
732
736
|
};
|
|
733
737
|
external_context: {
|
|
734
738
|
policy: "auto" | "cached" | "live" | "off";
|
|
@@ -822,6 +826,7 @@ export declare const TaskContract: z.ZodObject<{
|
|
|
822
826
|
access?: {
|
|
823
827
|
requested_profile?: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | undefined;
|
|
824
828
|
effective_profile?: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | undefined;
|
|
829
|
+
auxiliary_writable_roots?: string[] | undefined;
|
|
825
830
|
} | undefined;
|
|
826
831
|
external_context?: {
|
|
827
832
|
policy?: "auto" | "cached" | "live" | "off" | undefined;
|
|
@@ -1173,12 +1178,15 @@ export declare const ActiveTaskContract: z.ZodObject<{
|
|
|
1173
1178
|
access: z.ZodDefault<z.ZodObject<{
|
|
1174
1179
|
requested_profile: z.ZodDefault<z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native"]>>;
|
|
1175
1180
|
effective_profile: z.ZodDefault<z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native"]>>;
|
|
1181
|
+
auxiliary_writable_roots: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
|
|
1176
1182
|
}, "strip", z.ZodTypeAny, {
|
|
1177
1183
|
requested_profile: "full" | "inherit_native" | "readonly" | "workspace_write";
|
|
1178
1184
|
effective_profile: "full" | "inherit_native" | "readonly" | "workspace_write";
|
|
1185
|
+
auxiliary_writable_roots: string[];
|
|
1179
1186
|
}, {
|
|
1180
1187
|
requested_profile?: "full" | "inherit_native" | "readonly" | "workspace_write" | undefined;
|
|
1181
1188
|
effective_profile?: "full" | "inherit_native" | "readonly" | "workspace_write" | undefined;
|
|
1189
|
+
auxiliary_writable_roots?: string[] | undefined;
|
|
1182
1190
|
}>>;
|
|
1183
1191
|
}, "strip", z.ZodTypeAny, {
|
|
1184
1192
|
schema_version: 2;
|
|
@@ -1272,6 +1280,7 @@ export declare const ActiveTaskContract: z.ZodObject<{
|
|
|
1272
1280
|
access: {
|
|
1273
1281
|
requested_profile: "full" | "inherit_native" | "readonly" | "workspace_write";
|
|
1274
1282
|
effective_profile: "full" | "inherit_native" | "readonly" | "workspace_write";
|
|
1283
|
+
auxiliary_writable_roots: string[];
|
|
1275
1284
|
};
|
|
1276
1285
|
}, {
|
|
1277
1286
|
schema_version: 2;
|
|
@@ -1365,6 +1374,7 @@ export declare const ActiveTaskContract: z.ZodObject<{
|
|
|
1365
1374
|
access?: {
|
|
1366
1375
|
requested_profile?: "full" | "inherit_native" | "readonly" | "workspace_write" | undefined;
|
|
1367
1376
|
effective_profile?: "full" | "inherit_native" | "readonly" | "workspace_write" | undefined;
|
|
1377
|
+
auxiliary_writable_roots?: string[] | undefined;
|
|
1368
1378
|
} | undefined;
|
|
1369
1379
|
}>;
|
|
1370
1380
|
export type ActiveTaskContract = z.infer<typeof ActiveTaskContract>;
|
|
@@ -2304,12 +2314,15 @@ export declare const FrozenTaskContractArtifact: z.ZodPipeline<z.ZodObject<{
|
|
|
2304
2314
|
requested_profile: z.ZodDefault<z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native", "external_sandbox_full"]>>;
|
|
2305
2315
|
/** Profile actually enforced by the engine (mode/trust clamps applied; never client-supplied). */
|
|
2306
2316
|
effective_profile: z.ZodDefault<z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native", "external_sandbox_full"]>>;
|
|
2317
|
+
auxiliary_writable_roots: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
|
|
2307
2318
|
}, "strip", z.ZodTypeAny, {
|
|
2308
2319
|
requested_profile: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write";
|
|
2309
2320
|
effective_profile: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write";
|
|
2321
|
+
auxiliary_writable_roots: string[];
|
|
2310
2322
|
}, {
|
|
2311
2323
|
requested_profile?: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | undefined;
|
|
2312
2324
|
effective_profile?: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | undefined;
|
|
2325
|
+
auxiliary_writable_roots?: string[] | undefined;
|
|
2313
2326
|
}>>;
|
|
2314
2327
|
external_context: z.ZodDefault<z.ZodObject<{
|
|
2315
2328
|
policy: z.ZodDefault<z.ZodEnum<["off", "auto", "cached", "live"]>>;
|
|
@@ -2472,6 +2485,7 @@ export declare const FrozenTaskContractArtifact: z.ZodPipeline<z.ZodObject<{
|
|
|
2472
2485
|
access: {
|
|
2473
2486
|
requested_profile: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write";
|
|
2474
2487
|
effective_profile: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write";
|
|
2488
|
+
auxiliary_writable_roots: string[];
|
|
2475
2489
|
};
|
|
2476
2490
|
external_context: {
|
|
2477
2491
|
policy: "auto" | "cached" | "live" | "off";
|
|
@@ -2565,6 +2579,7 @@ export declare const FrozenTaskContractArtifact: z.ZodPipeline<z.ZodObject<{
|
|
|
2565
2579
|
access?: {
|
|
2566
2580
|
requested_profile?: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | undefined;
|
|
2567
2581
|
effective_profile?: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | undefined;
|
|
2582
|
+
auxiliary_writable_roots?: string[] | undefined;
|
|
2568
2583
|
} | undefined;
|
|
2569
2584
|
external_context?: {
|
|
2570
2585
|
policy?: "auto" | "cached" | "live" | "off" | undefined;
|
package/dist/task.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"task.d.ts","sourceRoot":"","sources":["../src/task.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;
|
|
1
|
+
{"version":3,"file":"task.d.ts","sourceRoot":"","sources":["../src/task.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAoB3B,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;EAcmD,CAAC;AACtF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;EAY8C,CAAC;AAC5E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,uEAAuE;AACvE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMwC,CAAC;AAC9E,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAY2D,CAAC;AACpF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,uEAAuE;AACvE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAY6D,CAAC;AAC9F,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,eAAO,MAAM,qBAAqB;IAE9B;oFACgF;;;;;;;;;EASjF,CAAC;AACJ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,eAAO,MAAM,eAAe;IAExB;;;yDAGqD;;IAOrD;;;;;;wCAMoC;;IAOpC;mFAC+E;;IAO/E;mFAC+E;;QA/C/E;wFACgF;;;;;;;;;;;;;;;;;;;;;;;;;;EAsDxB,CAAC;AAC7D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,oBAAoB;;;;;;IA0B7B;;;;OAIG;;;;;;;;;;;;;;;;EAMsF,CAAC;AAC9F,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0CrB;;2DAEuD;;IAKvD;;;;;mFAK+E;;IAQ/E;;2CAEuC;;IAIvC;iFAC6E;;IAM7E;;qEAEiE;;;QAlKjE;;;6DAGqD;;QAOrD;;;;;;4CAMoC;;QAOpC;uFAC+E;;QAO/E;uFAC+E;;YA/C/E;4FACgF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAuM5E,kGAAkG;;;;;;;;;;;;;;;QAsBlG,gGAAgG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAwBpG;;mFAE+E;;;;IAS/E;;;kEAG8D;;;;;;;;QAhL9D;;;;WAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqLsF,CAAC;AAC9F,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;sEACsE;AACtE,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAnQ3B;;;6DAGqD;;QAOrD;;;;;;4CAMoC;;QAOpC;uFAC+E;;QAO/E;uFAC+E;;YA/C/E;4FACgF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA6N5E,gGAAgG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA1IpG;;;;WAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuMyD,CAAC;AACjE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA1JnC;;2DAEuD;;IAKvD;;;;;mFAK+E;;IAQ/E;;2CAEuC;;IAIvC;iFAC6E;;IAM7E;;qEAEiE;;;QAlKjE;;;6DAGqD;;QAOrD;;;;;;4CAMoC;;QAOpC;uFAC+E;;QAO/E;uFAC+E;;YA/C/E;4FACgF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAuM5E,kGAAkG;;;;;;;;;;;;;;;QAsBlG,gGAAgG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAwBpG;;mFAE+E;;;;IAS/E;;;kEAG8D;;;;;;;;QAhL9D;;;;WAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsN6E,CAAC;AACrF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}
|
package/dist/task.js
CHANGED
|
@@ -4,6 +4,7 @@ import { PaidBudget, RoutingGoal } from "./budget.js";
|
|
|
4
4
|
import { EffortHint } from "./harness.js";
|
|
5
5
|
import { ProcessingPreference } from "./processing.js";
|
|
6
6
|
import { PromptCacheTtl } from "./prompt-cache.js";
|
|
7
|
+
import { AuxiliaryWritableRoots } from "./auxiliary-writable-roots.js";
|
|
7
8
|
export const TestCommandInvocation = z
|
|
8
9
|
.object({
|
|
9
10
|
program: NonBlankString.describe("Executable invoked directly without an implicit shell."),
|
|
@@ -235,6 +236,7 @@ export const TaskContract = z
|
|
|
235
236
|
requested_profile: RecordedAccessProfile.default("workspace_write").describe("Access profile the caller requested."),
|
|
236
237
|
/** Profile actually enforced by the engine (mode/trust clamps applied; never client-supplied). */
|
|
237
238
|
effective_profile: RecordedAccessProfile.default("workspace_write").describe("Access profile actually enforced by the engine (mode/trust clamps applied; never client-supplied)."),
|
|
239
|
+
auxiliary_writable_roots: AuxiliaryWritableRoots,
|
|
238
240
|
})
|
|
239
241
|
.default({
|
|
240
242
|
requested_profile: "workspace_write",
|
|
@@ -300,6 +302,7 @@ export const ActiveTaskContract = TaskContract.extend({
|
|
|
300
302
|
.object({
|
|
301
303
|
requested_profile: AccessProfile.default("workspace_write"),
|
|
302
304
|
effective_profile: AccessProfile.default("workspace_write"),
|
|
305
|
+
auxiliary_writable_roots: AuxiliaryWritableRoots,
|
|
303
306
|
})
|
|
304
307
|
.default({ requested_profile: "workspace_write", effective_profile: "workspace_write" }),
|
|
305
308
|
}).describe("Immutable contract produced for a new active run.");
|
package/dist/task.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"task.js","sourceRoot":"","sources":["../src/task.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EACL,aAAa,EACb,cAAc,EACd,WAAW,EACX,WAAW,EACX,qBAAqB,EACrB,EAAE,EACF,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,qBAAqB,EACrB,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;
|
|
1
|
+
{"version":3,"file":"task.js","sourceRoot":"","sources":["../src/task.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EACL,aAAa,EACb,cAAc,EACd,WAAW,EACX,WAAW,EACX,qBAAqB,EACrB,EAAE,EACF,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,qBAAqB,EACrB,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,wDAAwD,CAAC;IAC1F,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACtF,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,8DAA8D,CAAC;IAC3E,YAAY,EAAE,CAAC;SACZ,KAAK,CAAC,cAAc,CAAC;SACrB,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CAAC,0EAA0E,CAAC;CACxF,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,wEAAwE,CAAC,CAAC;AAGtF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,aAAa,EAAE,WAAW,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IAChF,YAAY,EAAE,WAAW,CAAC,QAAQ,CAAC,qDAAqD,CAAC;IACzF,aAAa,EAAE,WAAW,CAAC,QAAQ,CAAC,6CAA6C,CAAC;IAClF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oDAAoD,CAAC;IACzF,gBAAgB,EAAE,WAAW,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IAClF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IAC3F,YAAY,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAC1F,aAAa,EAAE,aAAa,CAAC,QAAQ,CAAC,iDAAiD,CAAC;CACzF,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,8DAA8D,CAAC,CAAC;AAG5E,uEAAuE;AACvE,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC9D,aAAa,EAAE,qBAAqB,CAAC,QAAQ,CAC3C,6DAA6D,CAC9D;CACF,CAAC;KACC,MAAM,EAAE;KACR,QAAQ,CAAC,gEAAgE,CAAC,CAAC;AAG9E,MAAM,CAAC,MAAM,WAAW,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACtD,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IAC1F,cAAc,EAAE,CAAC;SACd,OAAO,EAAE;SACT,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CAAC,8DAA8D,CAAC;IAC3E,WAAW,EAAE,gBAAgB,CAAC,QAAQ,EAAE;SACrC,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,oDAAoD,CAAC;CAClE,CAAC;KACC,MAAM,EAAE;KACR,QAAQ,CAAC,sEAAsE,CAAC,CAAC;AAGpF,uEAAuE;AACvE,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC9D,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IAC1F,cAAc,EAAE,CAAC;SACd,OAAO,EAAE;SACT,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CAAC,8DAA8D,CAAC;IAC3E,WAAW,EAAE,wBAAwB,CAAC,QAAQ,EAAE;SAC7C,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,+DAA+D,CAAC;CAC7E,CAAC;KACC,MAAM,EAAE;KACR,QAAQ,CAAC,gFAAgF,CAAC,CAAC;AAG9F,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN;oFACgF;IAChF,IAAI,EAAE,cAAc,CAAC,QAAQ,CAC3B,kJAAkJ,CACnJ;IACD,MAAM,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC;CAC/F,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CACP,0FAA0F,CAC3F,CAAC;AAGJ,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN;;;yDAGqD;IACrD,eAAe,EAAE,CAAC;SACf,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CACP,0QAA0Q,CAC3Q;IACH;;;;;;wCAMoC;IACpC,UAAU,EAAE,CAAC;SACV,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CACP,2LAA2L,CAC5L;IACH;mFAC+E;IAC/E,oBAAoB,EAAE,CAAC;SACpB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CACP,wFAAwF,CACzF;IACH;mFAC+E;IAC/E,wBAAwB,EAAE,CAAC;SACxB,KAAK,CAAC,qBAAqB,CAAC;SAC5B,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CACP,qHAAqH,CACtH;CACJ,CAAC;KACD,QAAQ,CAAC,+CAA+C,CAAC,CAAC;AAG7D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,kBAAkB,EAAE,CAAC;SAClB,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,kEAAkE,CAAC;IAC/E,8BAA8B,EAAE,CAAC;SAC9B,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,yEAAyE,CAAC;IACtF,kCAAkC,EAAE,CAAC;SAClC,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,6EAA6E,CAAC;IAC1F,uCAAuC,EAAE,CAAC;SACvC,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,mFAAmF,CACpF;IACH,sCAAsC,EAAE,CAAC;SACtC,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,kGAAkG,CACnG;IACH;;;;OAIG;IACH,oCAAoC,EAAE,CAAC;SACpC,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,2EAA2E,CAAC;CACzF,CAAC;KACD,QAAQ,CAAC,gFAAgF,CAAC,CAAC;AAG9F;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,cAAc,EAAE,aAAa;IAC7B,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IACzD,UAAU,EAAE,YAAY,CAAC,QAAQ,CAAC,8BAA8B,CAAC;IACjE,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;QAC1E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAC7D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;QACjF,YAAY,EAAE,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC;KAC5C,CAAC;SACD,QAAQ,CAAC,iEAAiE,CAAC;IAC9E,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IAChF,gBAAgB,EAAE,CAAC;SAChB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,iKAAiK,CAClK;IACH,oBAAoB,EAAE,CAAC;SACpB,OAAO,EAAE;SACT,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CAAC,2DAA2D,CAAC;IACxE,WAAW,EAAE,CAAC;SACX,MAAM,CAAC;QACN,aAAa,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,qBAAqB,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACnD,CAAC;SACD,OAAO,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;SAC7D,QAAQ,CACP,6FAA6F,CAC9F;IACH,WAAW,EAAE,CAAC;SACX,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;QACjE,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,gDAAgD,CAAC;KAC9D,CAAC;SACD,QAAQ,CAAC,yCAAyC,CAAC;IACtD;;2DAEuD;IACvD,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,6EAA6E,CAAC;IAC1F;;;;;mFAK+E;IAC/E,aAAa,EAAE,CAAC;SACb,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;SACnB,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,mHAAmH,CACpH;IACH;;2CAEuC;IACvC,eAAe,EAAE,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CACtD,6HAA6H,CAC9H;IACD;iFAC6E;IAC7E,qBAAqB,EAAE,EAAE,CAAC,QAAQ,EAAE;SACjC,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,uGAAuG,CACxG;IACH;;qEAEiE;IACjE,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,+EAA+E,CAAC;IAC5F,WAAW,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC;aACR,KAAK,CAAC,mBAAmB,CAAC;aAC1B,OAAO,CAAC,EAAE,CAAC;aACX,QAAQ,CAAC,kDAAkD,CAAC;KAChE,CAAC;SACD,OAAO,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;SACzB,QAAQ,CAAC,uCAAuC,CAAC;IACpD,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,iBAAiB,EAAE,qBAAqB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAC1E,sCAAsC,CACvC;QACD,kGAAkG;QAClG,iBAAiB,EAAE,qBAAqB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAC1E,oGAAoG,CACrG;QACD,wBAAwB,EAAE,sBAAsB;KACjD,CAAC;SACD,OAAO,CAAC;QACP,iBAAiB,EAAE,iBAAiB;QACpC,iBAAiB,EAAE,iBAAiB;KACrC,CAAC;SACD,QAAQ,CAAC,8CAA8C,CAAC;IAC3D,gBAAgB,EAAE,CAAC;SAChB,MAAM,CAAC;QACN,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CACpD,wCAAwC,CACzC;QACD,YAAY,EAAE,CAAC;aACZ,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CACP,4GAA4G,CAC7G;QACH,gGAAgG;QAChG,cAAc,EAAE,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAC5D,wFAAwF,CACzF;KACF,CAAC;SACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;SACxE,QAAQ,CAAC,0CAA0C,CAAC;IACvD,sBAAsB,EAAE,CAAC;SACtB,MAAM,CAAC;QACN,GAAG,EAAE,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CACjD,6CAA6C,CAC9C;QACD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,gCAAgC,CAAC;QACjF,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;KAChF,CAAC;SACD,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;SAC7C,QAAQ,CAAC,2EAA2E,CAAC;IACxF,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,YAAY,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;QACzC,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;KACvD,CAAC;SACD,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CAAC,gEAAgE,CAAC;IAC7E;;mFAE+E;IAC/E,cAAc,EAAE,CAAC;SACd,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SAC9B,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CACP,yIAAyI,CAC1I;IACH,qBAAqB,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACtD,gBAAgB,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC3C;;;kEAG8D;IAC9D,eAAe,EAAE,CAAC;SACf,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC;SAC9B,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CACP,8KAA8K,CAC/K;IACH,WAAW,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9C,CAAC;KACD,QAAQ,CAAC,gFAAgF,CAAC,CAAC;AAG9F;sEACsE;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC3C,CAAC;SACD,OAAO,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5B,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,iBAAiB,EAAE,aAAa,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC3D,iBAAiB,EAAE,aAAa,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC3D,wBAAwB,EAAE,sBAAsB;KACjD,CAAC;SACD,OAAO,CAAC,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,CAAC;CAC3F,CAAC,CAAC,QAAQ,CAAC,mDAAmD,CAAC,CAAC;AAGjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;CAC1E,CAAC;KACD,WAAW,EAAE;KACb,IAAI,CAAC,YAAY,CAAC;KAClB,QAAQ,CAAC,uEAAuE,CAAC,CAAC"}
|
|
@@ -360,6 +360,23 @@
|
|
|
360
360
|
"description": "HOW workspace_write is confined (fs_sandbox | tool_policy | none) — fs_sandbox is the base sandbox; a native automatic reviewer may still admit individual actions outside it. tool_policy means an allowed shell is unconfined (no FS/network fence); consumers choosing lanes by confinement read THIS field, never a harness name.",
|
|
361
361
|
"default": "none"
|
|
362
362
|
},
|
|
363
|
+
"accessControl": {
|
|
364
|
+
"type": "object",
|
|
365
|
+
"properties": {
|
|
366
|
+
"auxiliaryWritableRoots": {
|
|
367
|
+
"type": "boolean",
|
|
368
|
+
"description": "True when this harness applies execution.auxiliaryWritableRoots natively under workspace_write, and a later run whose effective execution carries no list (a new thread turn without one) keeps no earlier grant; false lanes refuse an explicit pool and drop from an auto pool."
|
|
369
|
+
}
|
|
370
|
+
},
|
|
371
|
+
"required": [
|
|
372
|
+
"auxiliaryWritableRoots"
|
|
373
|
+
],
|
|
374
|
+
"additionalProperties": false,
|
|
375
|
+
"default": {
|
|
376
|
+
"auxiliaryWritableRoots": false
|
|
377
|
+
},
|
|
378
|
+
"description": "Negotiated access-control grants beyond the access profile. Engines that predate this row omit it (= no auxiliary writable roots)."
|
|
379
|
+
},
|
|
363
380
|
"delegation": {
|
|
364
381
|
"type": "object",
|
|
365
382
|
"properties": {
|
|
@@ -668,6 +668,11 @@
|
|
|
668
668
|
],
|
|
669
669
|
"description": "How workspace_write access is CONFINED for a harness: a filesystem/network base sandbox (codex seatbelt; the harness's native automatic reviewer may still admit individual actions outside it, so fs_sandbox does not mean every admitted action stays inside), a tool-permission policy with no FS/network fence (claude — an allowed shell is unconfined), or none (write intent is advisory).",
|
|
670
670
|
"default": "none"
|
|
671
|
+
},
|
|
672
|
+
"auxiliary_writable_roots": {
|
|
673
|
+
"type": "boolean",
|
|
674
|
+
"default": false,
|
|
675
|
+
"description": "The adapter applies HarnessRunSpec.auxiliary_writable_roots natively under workspace_write, and a later spec carrying none receives no earlier grant; false = such a lane refuses (explicit pool) or is filtered (auto pool)."
|
|
671
676
|
}
|
|
672
677
|
},
|
|
673
678
|
"additionalProperties": false,
|
|
@@ -647,6 +647,11 @@
|
|
|
647
647
|
],
|
|
648
648
|
"description": "How workspace_write access is CONFINED for a harness: a filesystem/network base sandbox (codex seatbelt; the harness's native automatic reviewer may still admit individual actions outside it, so fs_sandbox does not mean every admitted action stays inside), a tool-permission policy with no FS/network fence (claude — an allowed shell is unconfined), or none (write intent is advisory).",
|
|
649
649
|
"default": "none"
|
|
650
|
+
},
|
|
651
|
+
"auxiliary_writable_roots": {
|
|
652
|
+
"type": "boolean",
|
|
653
|
+
"default": false,
|
|
654
|
+
"description": "The adapter applies HarnessRunSpec.auxiliary_writable_roots natively under workspace_write, and a later spec carrying none receives no earlier grant; false = such a lane refuses (explicit pool) or is filtered (auto pool)."
|
|
650
655
|
}
|
|
651
656
|
},
|
|
652
657
|
"additionalProperties": false,
|
|
@@ -647,6 +647,11 @@
|
|
|
647
647
|
],
|
|
648
648
|
"description": "How workspace_write access is CONFINED for a harness: a filesystem/network base sandbox (codex seatbelt; the harness's native automatic reviewer may still admit individual actions outside it, so fs_sandbox does not mean every admitted action stays inside), a tool-permission policy with no FS/network fence (claude — an allowed shell is unconfined), or none (write intent is advisory).",
|
|
649
649
|
"default": "none"
|
|
650
|
+
},
|
|
651
|
+
"auxiliary_writable_roots": {
|
|
652
|
+
"type": "boolean",
|
|
653
|
+
"default": false,
|
|
654
|
+
"description": "The adapter applies HarnessRunSpec.auxiliary_writable_roots natively under workspace_write, and a later spec carrying none receives no earlier grant; false = such a lane refuses (explicit pool) or is filtered (auto pool)."
|
|
650
655
|
}
|
|
651
656
|
},
|
|
652
657
|
"additionalProperties": false,
|
|
@@ -275,6 +275,11 @@
|
|
|
275
275
|
],
|
|
276
276
|
"description": "How workspace_write access is CONFINED for a harness: a filesystem/network base sandbox (codex seatbelt; the harness's native automatic reviewer may still admit individual actions outside it, so fs_sandbox does not mean every admitted action stays inside), a tool-permission policy with no FS/network fence (claude — an allowed shell is unconfined), or none (write intent is advisory).",
|
|
277
277
|
"default": "none"
|
|
278
|
+
},
|
|
279
|
+
"auxiliary_writable_roots": {
|
|
280
|
+
"type": "boolean",
|
|
281
|
+
"default": false,
|
|
282
|
+
"description": "The adapter applies HarnessRunSpec.auxiliary_writable_roots natively under workspace_write, and a later spec carrying none receives no earlier grant; false = such a lane refuses (explicit pool) or is filtered (auto pool)."
|
|
278
283
|
}
|
|
279
284
|
},
|
|
280
285
|
"additionalProperties": false,
|
|
@@ -140,6 +140,14 @@
|
|
|
140
140
|
"minLength": 1
|
|
141
141
|
},
|
|
142
142
|
"description": "Agent-selected input footprint. Directory copies materialize this entire selection; direct runs need no whole-tree baseline."
|
|
143
|
+
},
|
|
144
|
+
"auxiliaryWritableRoots": {
|
|
145
|
+
"type": "array",
|
|
146
|
+
"items": {
|
|
147
|
+
"type": "string",
|
|
148
|
+
"minLength": 1
|
|
149
|
+
},
|
|
150
|
+
"description": "Exact existing absolute directories, created by the caller, that an Agent run with effective workspace_write may also write (service caches or scratch outside the execution tree). [] grants nothing extra; so does omission, except that a continueFrom successor omitting execution inherits its predecessor's whole execution group. Requires a lane whose capability_profile.access_control.auxiliary_writable_roots is true; the files are never part of the project result."
|
|
143
151
|
}
|
|
144
152
|
},
|
|
145
153
|
"additionalProperties": false,
|
|
@@ -912,6 +912,7 @@
|
|
|
912
912
|
"delegated_confinement_unavailable",
|
|
913
913
|
"delegated_evidence_incomplete",
|
|
914
914
|
"access_profile_incompatible",
|
|
915
|
+
"auxiliary_writable_roots_unsupported",
|
|
915
916
|
"retired_access_profile"
|
|
916
917
|
],
|
|
917
918
|
"description": "Machine-readable failure sub-code within a RunFailure category, including historical delegated-run failures and active access-profile refusals."
|
|
@@ -727,6 +727,7 @@
|
|
|
727
727
|
"delegated_confinement_unavailable",
|
|
728
728
|
"delegated_evidence_incomplete",
|
|
729
729
|
"access_profile_incompatible",
|
|
730
|
+
"auxiliary_writable_roots_unsupported",
|
|
730
731
|
"retired_access_profile"
|
|
731
732
|
],
|
|
732
733
|
"description": "Machine-readable failure sub-code within a RunFailure category, including historical delegated-run failures and active access-profile refusals."
|
|
@@ -132,6 +132,14 @@
|
|
|
132
132
|
"minLength": 1
|
|
133
133
|
},
|
|
134
134
|
"description": "Agent-selected input footprint. Directory copies materialize this entire selection; direct runs need no whole-tree baseline."
|
|
135
|
+
},
|
|
136
|
+
"auxiliaryWritableRoots": {
|
|
137
|
+
"type": "array",
|
|
138
|
+
"items": {
|
|
139
|
+
"type": "string",
|
|
140
|
+
"minLength": 1
|
|
141
|
+
},
|
|
142
|
+
"description": "Exact existing absolute directories, created by the caller, that an Agent run with effective workspace_write may also write (service caches or scratch outside the execution tree). [] grants nothing extra; so does omission, except that a continueFrom successor omitting execution inherits its predecessor's whole execution group. Requires a lane whose capability_profile.access_control.auxiliary_writable_roots is true; the files are never part of the project result."
|
|
135
143
|
}
|
|
136
144
|
},
|
|
137
145
|
"additionalProperties": false,
|
|
@@ -722,6 +722,7 @@
|
|
|
722
722
|
"delegated_confinement_unavailable",
|
|
723
723
|
"delegated_evidence_incomplete",
|
|
724
724
|
"access_profile_incompatible",
|
|
725
|
+
"auxiliary_writable_roots_unsupported",
|
|
725
726
|
"retired_access_profile"
|
|
726
727
|
],
|
|
727
728
|
"description": "Machine-readable failure sub-code within a RunFailure category, including historical delegated-run failures and active access-profile refusals."
|
|
@@ -458,10 +458,18 @@
|
|
|
458
458
|
],
|
|
459
459
|
"default": "envelope",
|
|
460
460
|
"description": "Run isolation: envelope (isolated worktree in the external per-project runtime namespace, the default) or live (the project tree itself)."
|
|
461
|
+
},
|
|
462
|
+
"auxiliaryWritableRoots": {
|
|
463
|
+
"type": "array",
|
|
464
|
+
"items": {
|
|
465
|
+
"type": "string",
|
|
466
|
+
"minLength": 1
|
|
467
|
+
},
|
|
468
|
+
"description": "Exact existing absolute directories, created by the caller, that an Agent run with effective workspace_write may also write (service caches or scratch outside the execution tree). [] grants nothing extra; so does omission, except that a continueFrom successor omitting execution inherits its predecessor's whole execution group. Requires a lane whose capability_profile.access_control.auxiliary_writable_roots is true; the files are never part of the project result."
|
|
461
469
|
}
|
|
462
470
|
},
|
|
463
471
|
"additionalProperties": false,
|
|
464
|
-
"description": "Directory geometry
|
|
472
|
+
"description": "Directory geometry and this turn's own auxiliary writable directories; project identity and execution root remain thread-owned, and an omitted list grants nothing."
|
|
465
473
|
},
|
|
466
474
|
"answersPlanRunId": {
|
|
467
475
|
"$ref": "#/definitions/ControlThreadTurnRequest/properties/planRunId",
|
|
@@ -252,6 +252,11 @@
|
|
|
252
252
|
],
|
|
253
253
|
"description": "How workspace_write access is CONFINED for a harness: a filesystem/network base sandbox (codex seatbelt; the harness's native automatic reviewer may still admit individual actions outside it, so fs_sandbox does not mean every admitted action stays inside), a tool-permission policy with no FS/network fence (claude — an allowed shell is unconfined), or none (write intent is advisory).",
|
|
254
254
|
"default": "none"
|
|
255
|
+
},
|
|
256
|
+
"auxiliary_writable_roots": {
|
|
257
|
+
"type": "boolean",
|
|
258
|
+
"default": false,
|
|
259
|
+
"description": "The adapter applies HarnessRunSpec.auxiliary_writable_roots natively under workspace_write, and a later spec carrying none receives no earlier grant; false = such a lane refuses (explicit pool) or is filtered (auto pool)."
|
|
255
260
|
}
|
|
256
261
|
},
|
|
257
262
|
"additionalProperties": false,
|
|
@@ -270,6 +270,11 @@
|
|
|
270
270
|
],
|
|
271
271
|
"description": "How workspace_write access is CONFINED for a harness: a filesystem/network base sandbox (codex seatbelt; the harness's native automatic reviewer may still admit individual actions outside it, so fs_sandbox does not mean every admitted action stays inside), a tool-permission policy with no FS/network fence (claude — an allowed shell is unconfined), or none (write intent is advisory).",
|
|
272
272
|
"default": "none"
|
|
273
|
+
},
|
|
274
|
+
"auxiliary_writable_roots": {
|
|
275
|
+
"type": "boolean",
|
|
276
|
+
"default": false,
|
|
277
|
+
"description": "The adapter applies HarnessRunSpec.auxiliary_writable_roots natively under workspace_write, and a later spec carrying none receives no earlier grant; false = such a lane refuses (explicit pool) or is filtered (auto pool)."
|
|
273
278
|
}
|
|
274
279
|
},
|
|
275
280
|
"additionalProperties": false,
|
|
@@ -833,6 +833,11 @@
|
|
|
833
833
|
],
|
|
834
834
|
"description": "How workspace_write access is CONFINED for a harness: a filesystem/network base sandbox (codex seatbelt; the harness's native automatic reviewer may still admit individual actions outside it, so fs_sandbox does not mean every admitted action stays inside), a tool-permission policy with no FS/network fence (claude — an allowed shell is unconfined), or none (write intent is advisory).",
|
|
835
835
|
"default": "none"
|
|
836
|
+
},
|
|
837
|
+
"auxiliary_writable_roots": {
|
|
838
|
+
"type": "boolean",
|
|
839
|
+
"default": false,
|
|
840
|
+
"description": "The adapter applies HarnessRunSpec.auxiliary_writable_roots natively under workspace_write, and a later spec carrying none receives no earlier grant; false = such a lane refuses (explicit pool) or is filtered (auto pool)."
|
|
836
841
|
}
|
|
837
842
|
},
|
|
838
843
|
"additionalProperties": false,
|
|
@@ -1068,6 +1068,7 @@
|
|
|
1068
1068
|
"delegated_confinement_unavailable",
|
|
1069
1069
|
"delegated_evidence_incomplete",
|
|
1070
1070
|
"access_profile_incompatible",
|
|
1071
|
+
"auxiliary_writable_roots_unsupported",
|
|
1071
1072
|
"retired_access_profile"
|
|
1072
1073
|
],
|
|
1073
1074
|
"description": "Machine-readable failure sub-code within a RunFailure category, including historical delegated-run failures and active access-profile refusals."
|
|
@@ -1052,6 +1052,7 @@
|
|
|
1052
1052
|
"delegated_confinement_unavailable",
|
|
1053
1053
|
"delegated_evidence_incomplete",
|
|
1054
1054
|
"access_profile_incompatible",
|
|
1055
|
+
"auxiliary_writable_roots_unsupported",
|
|
1055
1056
|
"retired_access_profile"
|
|
1056
1057
|
],
|
|
1057
1058
|
"description": "Machine-readable failure sub-code within a RunFailure category, including historical delegated-run failures and active access-profile refusals."
|
|
@@ -219,6 +219,7 @@
|
|
|
219
219
|
"delegated_confinement_unavailable",
|
|
220
220
|
"delegated_evidence_incomplete",
|
|
221
221
|
"access_profile_incompatible",
|
|
222
|
+
"auxiliary_writable_roots_unsupported",
|
|
222
223
|
"retired_access_profile"
|
|
223
224
|
],
|
|
224
225
|
"description": "Machine-readable failure sub-code within a RunFailure category, including historical delegated-run failures and active access-profile refusals."
|
|
@@ -412,6 +412,14 @@
|
|
|
412
412
|
"$ref": "#/definitions/TaskContract/properties/access/properties/requested_profile",
|
|
413
413
|
"default": "workspace_write",
|
|
414
414
|
"description": "Access profile actually enforced by the engine (mode/trust clamps applied; never client-supplied)."
|
|
415
|
+
},
|
|
416
|
+
"auxiliary_writable_roots": {
|
|
417
|
+
"type": "array",
|
|
418
|
+
"items": {
|
|
419
|
+
"type": "string"
|
|
420
|
+
},
|
|
421
|
+
"default": [],
|
|
422
|
+
"description": "Canonical auxiliary writable directories granted to this run's writable Agent lanes; empty = no extra engine grant. Read-only lanes never receive them."
|
|
415
423
|
}
|
|
416
424
|
},
|
|
417
425
|
"additionalProperties": false,
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@claudexor/schema",
|
|
3
|
-
"version": "4.
|
|
3
|
+
"version": "4.7.0",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"description": "Single source of truth for all Claudexor data shapes (Zod + generated JSON Schema).",
|
|
6
6
|
"type": "module",
|
|
@@ -20,7 +20,7 @@
|
|
|
20
20
|
"dependencies": {
|
|
21
21
|
"zod": "^4.6.5",
|
|
22
22
|
"zod-to-json-schema": "^3.24.1",
|
|
23
|
-
"@claudexor/util": "4.
|
|
23
|
+
"@claudexor/util": "4.7.0"
|
|
24
24
|
},
|
|
25
25
|
"repository": {
|
|
26
26
|
"type": "git",
|