@claudexor/workspace 4.6.2 → 4.8.1

package/dist/anchor-store.d.ts

@@ -2,7 +2,7 @@
  * snapshot commits can be collected. The patch digest is the immutable ID. */
 export declare function createRevertAnchor(repo: string, preTurnSha: string, postTurnSha: string): Promise<string>;
 export declare function createRevertAnchorFromPatchOrNull(repo: string, patch: string): string | null;
-export declare function readRevertAnchor(repo: string, id: string): string;
+export declare function readRevertAnchor(repo: string, id: string, maxBytes?: number): string;
 /** The typed refusal every consumer of a saved patch shares when the saved
  * copy is display-only and its exact bytes cannot be produced (INV-062). */
 export declare const PATCH_EXACT_BYTES_UNAVAILABLE = "patch_exact_bytes_unavailable";
@@ -29,6 +29,7 @@ export declare function resolveExactPatch(input: {
     savedCopy: string;
     meta: Record<string, unknown> | null | undefined;
     roots: readonly (string | null | undefined)[];
+    maxBytes?: number;
 }): ExactPatchResolution;
 /** Revert is an optional recovery affordance; never advertise it until the
  * immutable anchor has finalized successfully. */

package/dist/anchor-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anchor-store.d.ts","sourceRoot":"","sources":["../src/anchor-store.ts"],"names":[],"mappings":"AAaA;8EAC8E;AAC9E,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAGjB;AAOD,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM5F;AAiBD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAIjE;AAED;4EAC4E;AAC5E,eAAO,MAAM,6BAA6B,kCAAkC,CAAC;AAE7E,MAAM,MAAM,oBAAoB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;IACjD,KAAK,EAAE,SAAS,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC;CAC/C,GAAG,oBAAoB,CAuBvB;AAED;kDACkD;AAClD,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,WAAW,EAAE,MAAM,GAAG,IAAI,GACzB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOxB"}
+{"version":3,"file":"anchor-store.d.ts","sourceRoot":"","sources":["../src/anchor-store.ts"],"names":[],"mappings":"AAmBA;8EAC8E;AAC9E,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAGjB;AAOD,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM5F;AAiBD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAMpF;AAED;4EAC4E;AAC5E,eAAO,MAAM,6BAA6B,kCAAkC,CAAC;AAE7E,MAAM,MAAM,oBAAoB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;IACjD,KAAK,EAAE,SAAS,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,oBAAoB,CAwBvB;AAED;kDACkD;AAClD,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,WAAW,EAAE,MAAM,GAAG,IAAI,GACzB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOxB"}

package/dist/anchor-store.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { fsyncDirectory, projectRuntimeDir, sha256, writePatchObject } from "@claudexor/util";
+import { fsyncDirectory, projectRuntimeDir, sha256, writePatchObject, readFileUtf8BoundedSync, } from "@claudexor/util";
 import { WorkspaceError } from "@claudexor/core";
 import { diffTrees } from "./git.js";
 const ANCHOR_ID = /^sha256:[0-9a-f]{64}$/;
@@ -41,8 +41,9 @@ function persistRevertAnchor(repo, patch) {
     writePatchObject(projectRuntimeDir(repo), target, patch);
     return id;
 }
-export function readRevertAnchor(repo, id) {
-    const patch = readFileSync(objectPath(repo, id), "utf8");
+export function readRevertAnchor(repo, id, maxBytes) {
+    const path = objectPath(repo, id);
+    const patch = maxBytes === undefined ? readFileSync(path, "utf8") : readFileUtf8BoundedSync(path, maxBytes);
     if (sha256(patch) !== id)
         throw new WorkspaceError(`revert anchor ${id} is corrupt`);
     return patch;
@@ -74,9 +75,11 @@ export function resolveExactPatch(input) {
         if (!root)
             continue;
         try {
-            return { ok: true, patch: readRevertAnchor(root, id), fromExactObject: true };
+            return { ok: true, patch: readRevertAnchor(root, id, input.maxBytes), fromExactObject: true };
         }
-        catch {
+        catch (error) {
+            if (error.code?.startsWith("artifact_read_"))
+                throw error;
             // Try the next recorded root; absence everywhere is the typed refusal below.
         }
     }

package/dist/anchor-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"anchor-store.js","sourceRoot":"","sources":["../src/anchor-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,MAAM,SAAS,GAAG,uBAAuB,CAAC;AAE1C,SAAS,UAAU,CAAC,IAAY,EAAE,EAAU;IAC1C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,0BAA0B,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AACrF,CAAC;AAED;8EAC8E;AAC9E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,UAAkB,EAClB,WAAmB;IAEnB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IAC7D,OAAO,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,yEAAyE;AACzE,SAAS,2BAA2B,CAAC,IAAY,EAAE,KAAa;IAC9D,OAAO,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,IAAY,EAAE,KAAa;IAC3E,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,KAAa;IACtD,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;QAC5E,CAAC;QACD,cAAc,CAAC,SAAS,CAAC,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,gBAAgB,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACzD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,EAAU;IACvD,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IACrF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;4EAC4E;AAC5E,MAAM,CAAC,MAAM,6BAA6B,GAAG,+BAA+B,CAAC;AAK7E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAIjC;IACC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAAC,KAAK,UAAU;QAChD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IACtE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC5C,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC;QAC7D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,oGAAoG;SACvG,CAAC;IACJ,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;QAChF,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;QAC/E,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EACJ,iGAAiG;KACpG,CAAC;AACJ,CAAC;AAED;kDACkD;AAClD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,UAAyB,EACzB,WAA0B;IAE1B,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,CAAC;QACH,OAAO,MAAM,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"anchor-store.js","sourceRoot":"","sources":["../src/anchor-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,MAAM,EACN,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,MAAM,SAAS,GAAG,uBAAuB,CAAC;AAE1C,SAAS,UAAU,CAAC,IAAY,EAAE,EAAU;IAC1C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,0BAA0B,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AACrF,CAAC;AAED;8EAC8E;AAC9E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,UAAkB,EAClB,WAAmB;IAEnB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IAC7D,OAAO,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,yEAAyE;AACzE,SAAS,2BAA2B,CAAC,IAAY,EAAE,KAAa;IAC9D,OAAO,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,IAAY,EAAE,KAAa;IAC3E,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,KAAa;IACtD,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;QAC5E,CAAC;QACD,cAAc,CAAC,SAAS,CAAC,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,gBAAgB,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACzD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,EAAU,EAAE,QAAiB;IAC1E,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,KAAK,GACT,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChG,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IACrF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;4EAC4E;AAC5E,MAAM,CAAC,MAAM,6BAA6B,GAAG,+BAA+B,CAAC;AAK7E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAKjC;IACC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAAC,KAAK,UAAU;QAChD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IACtE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC5C,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC;QAC7D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,oGAAoG;SACvG,CAAC;IACJ,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA2B,CAAC,IAAI,EAAE,UAAU,CAAC,gBAAgB,CAAC;gBAAE,MAAM,KAAK,CAAC;YACjF,6EAA6E;QAC/E,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EACJ,iGAAiG;KACpG,CAAC;AACJ,CAAC;AAED;kDACkD;AAClD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,UAAyB,EACzB,WAA0B;IAE1B,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,CAAC;QACH,OAAO,MAAM,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/auxiliary-writable-roots.d.ts

@@ -0,0 +1,22 @@
+export type AuxiliaryWritableRootRejection = "filesystem_root" | "home" | "engine_state" | "execution_tree" | "source_project" | "git_metadata";
+export interface AuxiliaryWritableRootsContext {
+    /** Stable project (source) root. */
+    repoRoot: string;
+    /** Tree the harness executes in; the project root for envelope runs at admission time. */
+    executionRoot: string;
+    /** Configured credential-profile homes the engine owns (isolation locators). */
+    credentialHomes?: readonly string[];
+}
+/** Spelling-only admission for a boundary that defers the mutable existence fact. */
+export declare function assertAuxiliaryWritableRootSpelling(root: string): void;
+/** The canonical (realpath) directory a caller-spelled root names, or a typed refusal. */
+export declare function auxiliaryWritableRootDirectory(root: string): string;
+/**
+ * The run's canonical auxiliary grant: every caller-spelled root resolved to
+ * an existing directory, deduplicated, and refused when it would widen access
+ * to the filesystem root, HOME itself, Claudexor's own state, the execution
+ * tree or the source project, or their Git metadata. Omission and [] grant
+ * nothing.
+ */
+export declare function admitAuxiliaryWritableRoots(roots: readonly string[] | undefined, ctx: AuxiliaryWritableRootsContext): string[];
+//# sourceMappingURL=auxiliary-writable-roots.d.ts.map

package/dist/auxiliary-writable-roots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auxiliary-writable-roots.d.ts","sourceRoot":"","sources":["../src/auxiliary-writable-roots.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,8BAA8B,GACtC,iBAAiB,GACjB,MAAM,GACN,cAAc,GACd,gBAAgB,GAChB,gBAAgB,GAChB,cAAc,CAAC;AAWnB,MAAM,WAAW,6BAA6B;IAC5C,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,aAAa,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AA+CD,qFAAqF;AACrF,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEtE;AAiCD,0FAA0F;AAC1F,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAInE;AA0CD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACpC,GAAG,EAAE,6BAA6B,GACjC,MAAM,EAAE,CAyBV"}

package/dist/auxiliary-writable-roots.js

@@ -0,0 +1,178 @@
+/**
+ * Admission of `execution.auxiliaryWritableRoots`: exact caller-created service
+ * directories (download caches, outside-Git scratch) a writable Agent lane may
+ * also write. One owner for the filesystem rules, shared by the HTTP boundary
+ * (cheap shape/existence checks) and the engine's run admission (the complete
+ * canonical grant). Nothing here creates, cleans, or inventories directories.
+ */
+import { accessSync, constants, readFileSync, realpathSync, statSync } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { canonicalProjectRoot, claudexorOwnedRoot, userHomeDir } from "@claudexor/util";
+const REJECTION_TEXT = {
+    filesystem_root: "is a filesystem root",
+    home: "is the user home directory or one of its ancestors",
+    engine_state: "overlaps Claudexor's own control or credential state",
+    execution_tree: "overlaps the execution tree",
+    source_project: "overlaps the source project",
+    git_metadata: "overlaps Git metadata of the project or execution tree",
+};
+/** Missing future state directories have no identity yet; other read failures stay visible. */
+function directoryIdentity(path) {
+    try {
+        const stat = statSync(path, { bigint: true });
+        return stat.isDirectory() && stat.ino !== 0n ? `${stat.dev}:${stat.ino}` : null;
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT" || code === "ENOTDIR")
+            return null;
+        throw invalid(path, `cannot inspect directory identity (${code ?? "unreadable"})`, true);
+    }
+}
+/** `inner` is `outer` or lies below it, including aliases realpath leaves distinct. */
+function within(outer, inner) {
+    const rel = relative(outer, inner);
+    if (rel === "" || (!isAbsolute(rel) && rel !== ".." && !rel.startsWith(`..${sep}`)))
+        return true;
+    // macOS firmlinks preserve two realpath spellings for the same directory.
+    // Compare only this ancestry's identities, never scan directory contents.
+    const id = directoryIdentity(outer);
+    if (id === null)
+        return false;
+    for (let parent = inner;; parent = dirname(parent)) {
+        if (directoryIdentity(parent) === id)
+            return true;
+        if (dirname(parent) === parent)
+            return false;
+    }
+}
+function overlaps(a, b) {
+    return within(a, b) || within(b, a);
+}
+function invalid(root, detail, retryable) {
+    return Object.assign(new Error(`execution.auxiliaryWritableRoots entry ${JSON.stringify(root)} ${detail}`), {
+        status: 400,
+        code: "auxiliary_writable_root_invalid",
+        retryable,
+        requiredActions: [
+            "Create the directory yourself and pass its absolute path (the engine never provisions it), or remove the grant. For continueFrom, POST /v2/runs with a complete replacement execution group and auxiliaryWritableRoots: []; claudexor_run_continue inherits execution, so use HTTP or start a new run.",
+        ],
+        context: { root },
+    });
+}
+/** Spelling-only admission for a boundary that defers the mutable existence fact. */
+export function assertAuxiliaryWritableRootSpelling(root) {
+    if (!isAbsolute(root))
+        throw invalid(root, "is not an absolute path", false);
+}
+function canonicalDirectory(root) {
+    assertAuxiliaryWritableRootSpelling(root);
+    let real;
+    try {
+        real = realpathSync.native(root);
+    }
+    catch (error) {
+        const code = error.code ?? "unreadable";
+        throw invalid(root, code === "ENOENT" ? "does not exist" : `cannot be resolved (${code})`, true);
+    }
+    let directory = false;
+    try {
+        directory = statSync(real).isDirectory();
+    }
+    catch {
+        // Raced away or unreadable: refused below like any non-directory.
+    }
+    if (!directory)
+        throw invalid(root, "is not a directory", true);
+    return real;
+}
+function assertUsable(root, real) {
+    try {
+        accessSync(real, constants.R_OK | constants.W_OK | constants.X_OK);
+    }
+    catch {
+        throw invalid(root, "is not readable and writable by the engine user", true);
+    }
+}
+/** The canonical (realpath) directory a caller-spelled root names, or a typed refusal. */
+export function auxiliaryWritableRootDirectory(root) {
+    const real = canonicalDirectory(root);
+    assertUsable(root, real);
+    return real;
+}
+/** Git metadata a tree's `.git` names: the directory itself, or a worktree's gitdir and common dir. */
+function gitMetadataDirs(tree) {
+    const dotGit = join(tree, ".git");
+    try {
+        const stat = statSync(dotGit);
+        if (stat.isDirectory())
+            return [canonicalProjectRoot(dotGit)];
+        if (!stat.isFile())
+            return [];
+        const pointer = /^gitdir:\s*(.+)$/m.exec(readFileSync(dotGit, "utf8"))?.[1]?.trim();
+        if (!pointer)
+            return [];
+        const gitDir = canonicalProjectRoot(resolve(tree, pointer));
+        try {
+            const common = readFileSync(join(gitDir, "commondir"), "utf8").trim();
+            return common ? [gitDir, canonicalProjectRoot(resolve(gitDir, common))] : [gitDir];
+        }
+        catch {
+            return [gitDir];
+        }
+    }
+    catch {
+        return [];
+    }
+}
+function rejection(real, ctx) {
+    if (dirname(real) === real)
+        return "filesystem_root";
+    if (within(real, canonicalProjectRoot(userHomeDir())))
+        return "home";
+    const engineHomes = [claudexorOwnedRoot(), ...(ctx.credentialHomes ?? [])];
+    if (engineHomes.some((home) => overlaps(real, canonicalProjectRoot(home))))
+        return "engine_state";
+    const executionRoot = canonicalProjectRoot(ctx.executionRoot);
+    const projectRoot = canonicalProjectRoot(ctx.repoRoot);
+    // Service side effects must not enter the project's capture/apply footprint,
+    // even when a descendant already happens to be writable in a live run.
+    if (overlaps(real, executionRoot))
+        return "execution_tree";
+    if (overlaps(real, projectRoot))
+        return "source_project";
+    const gitDirs = [...gitMetadataDirs(executionRoot), ...gitMetadataDirs(projectRoot)];
+    if (gitDirs.some((gitDir) => overlaps(real, gitDir)))
+        return "git_metadata";
+    return null;
+}
+/**
+ * The run's canonical auxiliary grant: every caller-spelled root resolved to
+ * an existing directory, deduplicated, and refused when it would widen access
+ * to the filesystem root, HOME itself, Claudexor's own state, the execution
+ * tree or the source project, or their Git metadata. Omission and [] grant
+ * nothing.
+ */
+export function admitAuxiliaryWritableRoots(roots, ctx) {
+    const granted = [];
+    for (const root of roots ?? []) {
+        const real = canonicalDirectory(root);
+        const reason = rejection(real, ctx);
+        if (reason) {
+            throw Object.assign(new Error(`execution.auxiliaryWritableRoots entry ${JSON.stringify(root)} (${real}) ${REJECTION_TEXT[reason]}`), {
+                status: 400,
+                code: "auxiliary_writable_root_unsafe",
+                retryable: false,
+                requiredActions: [
+                    "Grant a dedicated service directory outside the project, the execution tree, their Git metadata, HOME itself, and Claudexor's own state. For continueFrom, replace the complete execution group through POST /v2/runs (auxiliaryWritableRoots: [] clears it), or start a new run; claudexor_run_continue inherits execution.",
+                ],
+                context: { root, canonicalRoot: real, reason },
+            });
+        }
+        assertUsable(root, real);
+        if (!granted.includes(real))
+            granted.push(real);
+    }
+    return granted;
+}
+//# sourceMappingURL=auxiliary-writable-roots.js.map

package/dist/auxiliary-writable-roots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auxiliary-writable-roots.js","sourceRoot":"","sources":["../src/auxiliary-writable-roots.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAUxF,MAAM,cAAc,GAAmD;IACrE,eAAe,EAAE,sBAAsB;IACvC,IAAI,EAAE,oDAAoD;IAC1D,YAAY,EAAE,sDAAsD;IACpE,cAAc,EAAE,6BAA6B;IAC7C,cAAc,EAAE,6BAA6B;IAC7C,YAAY,EAAE,wDAAwD;CACvE,CAAC;AAWF,+FAA+F;AAC/F,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,OAAO,CAAC,IAAI,EAAE,sCAAsC,IAAI,IAAI,YAAY,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,MAAM,CAAC,KAAa,EAAE,KAAa;IAC1C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjG,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9B,KAAK,IAAI,MAAM,GAAG,KAAK,GAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,OAAO,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,MAAc,EAAE,SAAkB;IAC/D,OAAO,MAAM,CAAC,MAAM,CAClB,IAAI,KAAK,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC,EACrF;QACE,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,iCAAiC;QACvC,SAAS;QACT,eAAe,EAAE;YACf,wSAAwS;SACzS;QACD,OAAO,EAAE,EAAE,IAAI,EAAE;KAClB,CACF,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mCAAmC,CAAC,IAAY;IAC9D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,OAAO,CAAC,IAAI,EAAE,yBAAyB,EAAE,KAAK,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,mCAAmC,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,IAAI,YAAY,CAAC;QACnE,MAAM,OAAO,CACX,IAAI,EACJ,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,uBAAuB,IAAI,GAAG,EACrE,IAAI,CACL,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;IACD,IAAI,CAAC,SAAS;QAAE,MAAM,OAAO,CAAC,IAAI,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,CAAC,IAAI,EAAE,iDAAiD,EAAE,IAAI,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,8BAA8B,CAAC,IAAY;IACzD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uGAAuG;AACvG,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACpF,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACtE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,IAAY,EACZ,GAAkC;IAElC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,iBAAiB,CAAC;IACrD,IAAI,MAAM,CAAC,IAAI,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACrE,MAAM,WAAW,GAAG,CAAC,kBAAkB,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3E,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,cAAc,CAAC;IAClG,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvD,6EAA6E;IAC7E,uEAAuE;IACvE,IAAI,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAC3D,IAAI,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACzD,MAAM,OAAO,GAAG,CAAC,GAAG,eAAe,CAAC,aAAa,CAAC,EAAE,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,cAAc,CAAC;IAC5E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAoC,EACpC,GAAkC;IAElC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACpC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,0CAA0C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,cAAc,CAAC,MAAM,CAAC,EAAE,CACrG,EACD;gBACE,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,gCAAgC;gBACtC,SAAS,EAAE,KAAK;gBAChB,eAAe,EAAE;oBACf,8TAA8T;iBAC/T;gBACD,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE;aAC/C,CACF,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/continuation-evidence.d.ts

@@ -34,6 +34,13 @@ export declare function readContinuationEvidence(runDir: string): {
     } | null;
     attemptId: string;
     attempt: {
+        observed_model: string | null;
+        observed_model_catalog_match: {
+            label: string;
+            id: string;
+            source: "account_catalog";
+            profile_id: string | null;
+        } | null;
         request_refusal?: {
             scope: "turn_text";
             unit: "unicode_scalars";
@@ -48,6 +55,11 @@ export declare function readContinuationEvidence(runDir: string): {
             source: "claude_stdout";
             binary_path: string | null;
             installed_version: string | null;
+        } | {
+            kind: "credential_source_unconfirmed";
+            native_code: "grok_credential_source_unconfirmed";
+            source: "grok_init";
+            reported_source: string;
         } | undefined;
         effort_resolution?: {
             requested: string | null;
@@ -91,7 +103,6 @@ export declare function readContinuationEvidence(runDir: string): {
         } | undefined;
         attempt_id: string;
         harness_id: string;
-        observed_model: string | null;
         auth_mode: "api_key" | "local_session" | "unknown" | null;
         auth_source: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file" | null;
         profile_id: string | null;

package/dist/continuation-evidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"continuation-evidence.d.ts","sourceRoot":"","sources":["../src/continuation-evidence.ts"],"names":[],"mappings":"AAIA,OAAO,EAA8B,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAI/E,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAQvD;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAO5E;AAYD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2CtD"}
+{"version":3,"file":"continuation-evidence.d.ts","sourceRoot":"","sources":["../src/continuation-evidence.ts"],"names":[],"mappings":"AAIA,OAAO,EAA8B,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAI/E,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAQvD;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAO5E;AAYD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2CtD"}

package/dist/index.d.ts

@@ -15,5 +15,6 @@ export * from "./directory-workspace.js";
 export * from "./files-io.js";
 export * from "./files-apply.js";
 export * from "./continuation-sources.js";
+export * from "./auxiliary-writable-roots.js";
 export { readContinuationEvidence, readSessionCapsule, runFilesExpired, } from "./continuation-evidence.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAE1C,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,eAAe,GAChB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAE9C,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,eAAe,GAChB,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -15,5 +15,6 @@ export * from "./directory-workspace.js";
 export * from "./files-io.js";
 export * from "./files-apply.js";
 export * from "./continuation-sources.js";
+export * from "./auxiliary-writable-roots.js";
 export { readContinuationEvidence, readSessionCapsule, runFilesExpired, } from "./continuation-evidence.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAE1C,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,eAAe,GAChB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAE9C,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,eAAe,GAChB,MAAM,4BAA4B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claudexor/workspace",
-  "version": "4.6.2",
+  "version": "4.8.1",
   "license": "MIT",
   "description": "WorkspaceEnvelope manager: git worktree + scoped HOME/harness-config isolation + dirty policy.",
   "type": "module",
@@ -17,10 +17,10 @@
   ],
   "dependencies": {
     "yaml": "^2.9.1",
-    "@claudexor/schema": "4.6.2",
-    "@claudexor/core": "4.6.2",
-    "@claudexor/util": "4.6.2",
-    "@claudexor/event-log": "4.6.2"
+    "@claudexor/core": "4.8.1",
+    "@claudexor/schema": "4.8.1",
+    "@claudexor/event-log": "4.8.1",
+    "@claudexor/util": "4.8.1"
   },
   "repository": {
     "type": "git",