@claudexor/workspace 4.6.1 → 4.7.0

package/dist/auxiliary-writable-roots.d.ts

@@ -0,0 +1,22 @@
+export type AuxiliaryWritableRootRejection = "filesystem_root" | "home" | "engine_state" | "execution_tree" | "source_project" | "git_metadata";
+export interface AuxiliaryWritableRootsContext {
+    /** Stable project (source) root. */
+    repoRoot: string;
+    /** Tree the harness executes in; the project root for envelope runs at admission time. */
+    executionRoot: string;
+    /** Configured credential-profile homes the engine owns (isolation locators). */
+    credentialHomes?: readonly string[];
+}
+/** Spelling-only admission for a boundary that defers the mutable existence fact. */
+export declare function assertAuxiliaryWritableRootSpelling(root: string): void;
+/** The canonical (realpath) directory a caller-spelled root names, or a typed refusal. */
+export declare function auxiliaryWritableRootDirectory(root: string): string;
+/**
+ * The run's canonical auxiliary grant: every caller-spelled root resolved to
+ * an existing directory, deduplicated, and refused when it would widen access
+ * to the filesystem root, HOME itself, Claudexor's own state, the execution
+ * tree or the source project, or their Git metadata. Omission and [] grant
+ * nothing.
+ */
+export declare function admitAuxiliaryWritableRoots(roots: readonly string[] | undefined, ctx: AuxiliaryWritableRootsContext): string[];
+//# sourceMappingURL=auxiliary-writable-roots.d.ts.map

package/dist/auxiliary-writable-roots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auxiliary-writable-roots.d.ts","sourceRoot":"","sources":["../src/auxiliary-writable-roots.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,8BAA8B,GACtC,iBAAiB,GACjB,MAAM,GACN,cAAc,GACd,gBAAgB,GAChB,gBAAgB,GAChB,cAAc,CAAC;AAWnB,MAAM,WAAW,6BAA6B;IAC5C,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,aAAa,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AA+CD,qFAAqF;AACrF,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEtE;AAiCD,0FAA0F;AAC1F,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAInE;AA0CD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACpC,GAAG,EAAE,6BAA6B,GACjC,MAAM,EAAE,CAyBV"}

package/dist/auxiliary-writable-roots.js

@@ -0,0 +1,178 @@
+/**
+ * Admission of `execution.auxiliaryWritableRoots`: exact caller-created service
+ * directories (download caches, outside-Git scratch) a writable Agent lane may
+ * also write. One owner for the filesystem rules, shared by the HTTP boundary
+ * (cheap shape/existence checks) and the engine's run admission (the complete
+ * canonical grant). Nothing here creates, cleans, or inventories directories.
+ */
+import { accessSync, constants, readFileSync, realpathSync, statSync } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { canonicalProjectRoot, claudexorOwnedRoot, userHomeDir } from "@claudexor/util";
+const REJECTION_TEXT = {
+    filesystem_root: "is a filesystem root",
+    home: "is the user home directory or one of its ancestors",
+    engine_state: "overlaps Claudexor's own control or credential state",
+    execution_tree: "overlaps the execution tree",
+    source_project: "overlaps the source project",
+    git_metadata: "overlaps Git metadata of the project or execution tree",
+};
+/** Missing future state directories have no identity yet; other read failures stay visible. */
+function directoryIdentity(path) {
+    try {
+        const stat = statSync(path, { bigint: true });
+        return stat.isDirectory() && stat.ino !== 0n ? `${stat.dev}:${stat.ino}` : null;
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT" || code === "ENOTDIR")
+            return null;
+        throw invalid(path, `cannot inspect directory identity (${code ?? "unreadable"})`, true);
+    }
+}
+/** `inner` is `outer` or lies below it, including aliases realpath leaves distinct. */
+function within(outer, inner) {
+    const rel = relative(outer, inner);
+    if (rel === "" || (!isAbsolute(rel) && rel !== ".." && !rel.startsWith(`..${sep}`)))
+        return true;
+    // macOS firmlinks preserve two realpath spellings for the same directory.
+    // Compare only this ancestry's identities, never scan directory contents.
+    const id = directoryIdentity(outer);
+    if (id === null)
+        return false;
+    for (let parent = inner;; parent = dirname(parent)) {
+        if (directoryIdentity(parent) === id)
+            return true;
+        if (dirname(parent) === parent)
+            return false;
+    }
+}
+function overlaps(a, b) {
+    return within(a, b) || within(b, a);
+}
+function invalid(root, detail, retryable) {
+    return Object.assign(new Error(`execution.auxiliaryWritableRoots entry ${JSON.stringify(root)} ${detail}`), {
+        status: 400,
+        code: "auxiliary_writable_root_invalid",
+        retryable,
+        requiredActions: [
+            "Create the directory yourself and pass its absolute path (the engine never provisions it), or remove the grant. For continueFrom, POST /v2/runs with a complete replacement execution group and auxiliaryWritableRoots: []; claudexor_run_continue inherits execution, so use HTTP or start a new run.",
+        ],
+        context: { root },
+    });
+}
+/** Spelling-only admission for a boundary that defers the mutable existence fact. */
+export function assertAuxiliaryWritableRootSpelling(root) {
+    if (!isAbsolute(root))
+        throw invalid(root, "is not an absolute path", false);
+}
+function canonicalDirectory(root) {
+    assertAuxiliaryWritableRootSpelling(root);
+    let real;
+    try {
+        real = realpathSync.native(root);
+    }
+    catch (error) {
+        const code = error.code ?? "unreadable";
+        throw invalid(root, code === "ENOENT" ? "does not exist" : `cannot be resolved (${code})`, true);
+    }
+    let directory = false;
+    try {
+        directory = statSync(real).isDirectory();
+    }
+    catch {
+        // Raced away or unreadable: refused below like any non-directory.
+    }
+    if (!directory)
+        throw invalid(root, "is not a directory", true);
+    return real;
+}
+function assertUsable(root, real) {
+    try {
+        accessSync(real, constants.R_OK | constants.W_OK | constants.X_OK);
+    }
+    catch {
+        throw invalid(root, "is not readable and writable by the engine user", true);
+    }
+}
+/** The canonical (realpath) directory a caller-spelled root names, or a typed refusal. */
+export function auxiliaryWritableRootDirectory(root) {
+    const real = canonicalDirectory(root);
+    assertUsable(root, real);
+    return real;
+}
+/** Git metadata a tree's `.git` names: the directory itself, or a worktree's gitdir and common dir. */
+function gitMetadataDirs(tree) {
+    const dotGit = join(tree, ".git");
+    try {
+        const stat = statSync(dotGit);
+        if (stat.isDirectory())
+            return [canonicalProjectRoot(dotGit)];
+        if (!stat.isFile())
+            return [];
+        const pointer = /^gitdir:\s*(.+)$/m.exec(readFileSync(dotGit, "utf8"))?.[1]?.trim();
+        if (!pointer)
+            return [];
+        const gitDir = canonicalProjectRoot(resolve(tree, pointer));
+        try {
+            const common = readFileSync(join(gitDir, "commondir"), "utf8").trim();
+            return common ? [gitDir, canonicalProjectRoot(resolve(gitDir, common))] : [gitDir];
+        }
+        catch {
+            return [gitDir];
+        }
+    }
+    catch {
+        return [];
+    }
+}
+function rejection(real, ctx) {
+    if (dirname(real) === real)
+        return "filesystem_root";
+    if (within(real, canonicalProjectRoot(userHomeDir())))
+        return "home";
+    const engineHomes = [claudexorOwnedRoot(), ...(ctx.credentialHomes ?? [])];
+    if (engineHomes.some((home) => overlaps(real, canonicalProjectRoot(home))))
+        return "engine_state";
+    const executionRoot = canonicalProjectRoot(ctx.executionRoot);
+    const projectRoot = canonicalProjectRoot(ctx.repoRoot);
+    // Service side effects must not enter the project's capture/apply footprint,
+    // even when a descendant already happens to be writable in a live run.
+    if (overlaps(real, executionRoot))
+        return "execution_tree";
+    if (overlaps(real, projectRoot))
+        return "source_project";
+    const gitDirs = [...gitMetadataDirs(executionRoot), ...gitMetadataDirs(projectRoot)];
+    if (gitDirs.some((gitDir) => overlaps(real, gitDir)))
+        return "git_metadata";
+    return null;
+}
+/**
+ * The run's canonical auxiliary grant: every caller-spelled root resolved to
+ * an existing directory, deduplicated, and refused when it would widen access
+ * to the filesystem root, HOME itself, Claudexor's own state, the execution
+ * tree or the source project, or their Git metadata. Omission and [] grant
+ * nothing.
+ */
+export function admitAuxiliaryWritableRoots(roots, ctx) {
+    const granted = [];
+    for (const root of roots ?? []) {
+        const real = canonicalDirectory(root);
+        const reason = rejection(real, ctx);
+        if (reason) {
+            throw Object.assign(new Error(`execution.auxiliaryWritableRoots entry ${JSON.stringify(root)} (${real}) ${REJECTION_TEXT[reason]}`), {
+                status: 400,
+                code: "auxiliary_writable_root_unsafe",
+                retryable: false,
+                requiredActions: [
+                    "Grant a dedicated service directory outside the project, the execution tree, their Git metadata, HOME itself, and Claudexor's own state. For continueFrom, replace the complete execution group through POST /v2/runs (auxiliaryWritableRoots: [] clears it), or start a new run; claudexor_run_continue inherits execution.",
+                ],
+                context: { root, canonicalRoot: real, reason },
+            });
+        }
+        assertUsable(root, real);
+        if (!granted.includes(real))
+            granted.push(real);
+    }
+    return granted;
+}
+//# sourceMappingURL=auxiliary-writable-roots.js.map

package/dist/auxiliary-writable-roots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auxiliary-writable-roots.js","sourceRoot":"","sources":["../src/auxiliary-writable-roots.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAUxF,MAAM,cAAc,GAAmD;IACrE,eAAe,EAAE,sBAAsB;IACvC,IAAI,EAAE,oDAAoD;IAC1D,YAAY,EAAE,sDAAsD;IACpE,cAAc,EAAE,6BAA6B;IAC7C,cAAc,EAAE,6BAA6B;IAC7C,YAAY,EAAE,wDAAwD;CACvE,CAAC;AAWF,+FAA+F;AAC/F,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,OAAO,CAAC,IAAI,EAAE,sCAAsC,IAAI,IAAI,YAAY,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,MAAM,CAAC,KAAa,EAAE,KAAa;IAC1C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjG,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9B,KAAK,IAAI,MAAM,GAAG,KAAK,GAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,OAAO,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,MAAc,EAAE,SAAkB;IAC/D,OAAO,MAAM,CAAC,MAAM,CAClB,IAAI,KAAK,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC,EACrF;QACE,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,iCAAiC;QACvC,SAAS;QACT,eAAe,EAAE;YACf,wSAAwS;SACzS;QACD,OAAO,EAAE,EAAE,IAAI,EAAE;KAClB,CACF,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mCAAmC,CAAC,IAAY;IAC9D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,OAAO,CAAC,IAAI,EAAE,yBAAyB,EAAE,KAAK,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,mCAAmC,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,IAAI,YAAY,CAAC;QACnE,MAAM,OAAO,CACX,IAAI,EACJ,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,uBAAuB,IAAI,GAAG,EACrE,IAAI,CACL,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;IACD,IAAI,CAAC,SAAS;QAAE,MAAM,OAAO,CAAC,IAAI,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,CAAC,IAAI,EAAE,iDAAiD,EAAE,IAAI,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,8BAA8B,CAAC,IAAY;IACzD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uGAAuG;AACvG,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACpF,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACtE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,IAAY,EACZ,GAAkC;IAElC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,iBAAiB,CAAC;IACrD,IAAI,MAAM,CAAC,IAAI,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACrE,MAAM,WAAW,GAAG,CAAC,kBAAkB,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3E,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,cAAc,CAAC;IAClG,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvD,6EAA6E;IAC7E,uEAAuE;IACvE,IAAI,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAC3D,IAAI,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACzD,MAAM,OAAO,GAAG,CAAC,GAAG,eAAe,CAAC,aAAa,CAAC,EAAE,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,cAAc,CAAC;IAC5E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAoC,EACpC,GAAkC;IAElC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACpC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,0CAA0C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,cAAc,CAAC,MAAM,CAAC,EAAE,CACrG,EACD;gBACE,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,gCAAgC;gBACtC,SAAS,EAAE,KAAK;gBAChB,eAAe,EAAE;oBACf,8TAA8T;iBAC/T;gBACD,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE;aAC/C,CACF,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/index.d.ts

@@ -15,5 +15,6 @@ export * from "./directory-workspace.js";
 export * from "./files-io.js";
 export * from "./files-apply.js";
 export * from "./continuation-sources.js";
+export * from "./auxiliary-writable-roots.js";
 export { readContinuationEvidence, readSessionCapsule, runFilesExpired, } from "./continuation-evidence.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAE1C,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,eAAe,GAChB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAE9C,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,eAAe,GAChB,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -15,5 +15,6 @@ export * from "./directory-workspace.js";
 export * from "./files-io.js";
 export * from "./files-apply.js";
 export * from "./continuation-sources.js";
+export * from "./auxiliary-writable-roots.js";
 export { readContinuationEvidence, readSessionCapsule, runFilesExpired, } from "./continuation-evidence.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAE1C,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,eAAe,GAChB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAE9C,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,eAAe,GAChB,MAAM,4BAA4B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claudexor/workspace",
-  "version": "4.6.1",
+  "version": "4.7.0",
   "license": "MIT",
   "description": "WorkspaceEnvelope manager: git worktree + scoped HOME/harness-config isolation + dirty policy.",
   "type": "module",
@@ -17,10 +17,10 @@
   ],
   "dependencies": {
     "yaml": "^2.9.1",
-    "@claudexor/schema": "4.6.1",
-    "@claudexor/util": "4.6.1",
-    "@claudexor/event-log": "4.6.1",
-    "@claudexor/core": "4.6.1"
+    "@claudexor/core": "4.7.0",
+    "@claudexor/schema": "4.7.0",
+    "@claudexor/util": "4.7.0",
+    "@claudexor/event-log": "4.7.0"
   },
   "repository": {
     "type": "git",