@dynamicagents/plugins 0.11.1 → 0.13.0

package/dist/computer/paths.d.ts

@@ -1,16 +1,16 @@
 /**
  * Which paths these tools act on, and the sentence a refused one gets.
  *
- * Two lists that look alike and mean opposite things. `node_modules` is *absent*
- * — physics, decided by `computerd` — so its note explains a file that is really
- * there and names the tool that can reach it. `.git` is present, readable, and
- * refused anyway — policy, decided here — so its note names where repository work
- * belongs. Two reasons want two sentences, which is why they are not one list.
+ * Each refused directory is also skipped by every walk, though the walk steps
+ * over more than it refuses — see {@link WALK_SKIPS}. `.git` is refused as
+ * policy: a model that edits `.git/HEAD` corrupts a checkout in a way that
+ * surfaces much later. `node_modules` is refused as a fact: it lives on the
+ * container's disk (see `../workspace/container-deps.ts`), so these tools, which read
+ * the workspace, would find it empty.
  *
  * Everything here is a string comparison: no filesystem, no `await`, which is
  * what lets {@link guardPath} run before a tool opens the workspace at all.
  */
-export declare function isContainerOnly(path: string): boolean;
 /**
  * Is this path inside git's internal state?
  *
@@ -18,33 +18,58 @@ export declare function isContainerOnly(path: string): boolean;
  * checkout in a way that surfaces much later as an inexplicable git failure.
  *
  * Exact segment rather than substring, so `.gitignore`, `.gitattributes` and
- * `.github/` are untouched — the same trap `node_modules_old` sets one function up.
+ * `.github/` are untouched.
  */
 export declare function isGitInternal(path: string): boolean;
 /**
- * The path check every file tool makes, before it opens anything.
+ * Where a session's own state lives inside a workspace, as a directory name.
  *
- * Returns the sentence to hand back, or `undefined` to proceed. Two string
- * comparisons — no `stat`, no round trip — which is why all six tools can afford
- * to call it before the workspace is opened.
+ * Every Claude Code session keeps its `CLAUDE_CONFIG_DIR` in a directory of
+ * this name at the workspace root — the Durable Object's storage, so a
+ * conversation outlives its container and a later session can continue it. See
+ * {@link file://../claude-code/run.ts SESSION_CONFIG_DIR}.
+ *
+ * **Spelled here as well as in the plugin that sets the variable**, because the
+ * module that has to step over it is the walk below, and neither may import the
+ * other: `/computer` reaching into `/claude-code` would pull a whole plugin into
+ * every agent that installs the file tools, and `/claude-code` reaches no other
+ * subpath — `verify:exports` refuses both. A spec in `/claude-code` holds the
+ * two spellings to one.
+ */
+export declare const SESSION_STATE_DIR = ".claude-sessions";
+/**
+ * What every walk steps over, as directory names. Both the workspace's `glob`
+ * and the `grep` tool hand these to the store as `**\/<name>` exclusions, which
+ * prunes them: no directory named here is descended into, so none costs a read.
+ *
+ * {@link SESSION_STATE_DIR} is here for a reason the refused directories do not
+ * share: a transcript is a verbatim record of everything a session read, so a
+ * walk that descended into it would answer a `grep` for a line of source with
+ * the session that quoted it.
+ */
+export declare const WALK_SKIPS: readonly [".git", "node_modules", ".claude-sessions"];
+/**
+ * The path check every file tool and every workspace call makes, before it
+ * opens anything.
+ *
+ * Returns the sentence to hand back, or `undefined` to proceed. One string
+ * comparison — no `stat`, no round trip — which is why every file tool can
+ * afford to call it before the workspace is opened.
  *
  * ## A redirect, not a boundary
  *
- * `node_modules` is a fact about the substrate and the note names the tool that
- * can see it; `.git` is a rule about where repository work belongs and the note
- * names the tools it belongs to. Both catch the case that actually happens — a
- * model reaching into `.git/HEAD` to fix a merge, or reading a dependency's
- * source and finding nothing there.
+ * The note names the tools repository work belongs to, because the case that
+ * actually happens is a model reaching into `.git/HEAD` to fix a merge.
  *
- * It is not containment, and this is the only place worth saying so. `sb_exec`
- * is in the same tool family, granted per family rather than per tool, so every
- * agent holding these six also holds a shell that reads and writes `.git`
- * directly.
+ * It is not containment, and this is the only place worth saying so. An agent
+ * that can write files here almost always holds `bash` too, which reads and
+ * writes `.git` directly.
  *
  * Symlinks are not resolved, for the same reason: a tracked
  * `docs/notes.md -> ../.git/config` only matters to an agent given these tools
- * *without* the shell, which the family granularity makes unbuildable. If that
- * ever becomes buildable, the **write** path is the half to restore —
+ * *without* the shell. A read-only install — `restrictTools` down to `grep`,
+ * with Think's writing tools left out — is that agent, and it cannot write. If a writing agent
+ * without the shell ever exists, the **write** path is the half to restore —
  * `.git/config` is an input to the credentialed push, and a planted hook runs
  * under a container-side `repo_commit`. Reading `.git` discloses nothing that is
  * not already readable, so the read half is not worth an `lstat` per call. The

package/dist/computer/paths.js

@@ -1,35 +1,19 @@
 /**
  * Which paths these tools act on, and the sentence a refused one gets.
  *
- * Two lists that look alike and mean opposite things. `node_modules` is *absent*
- * — physics, decided by `computerd` — so its note explains a file that is really
- * there and names the tool that can reach it. `.git` is present, readable, and
- * refused anyway — policy, decided here — so its note names where repository work
- * belongs. Two reasons want two sentences, which is why they are not one list.
+ * Each refused directory is also skipped by every walk, though the walk steps
+ * over more than it refuses — see {@link WALK_SKIPS}. `.git` is refused as
+ * policy: a model that edits `.git/HEAD` corrupts a checkout in a way that
+ * surfaces much later. `node_modules` is refused as a fact: it lives on the
+ * container's disk (see `../workspace/container-deps.ts`), so these tools, which read
+ * the workspace, would find it empty.
  *
  * Everything here is a string comparison: no filesystem, no `await`, which is
  * what lets {@link guardPath} run before a tool opens the workspace at all.
  */
-/**
- * Whether a path sits under a directory the workspace never receives.
- *
- * Only `node_modules` today, and it is not configurable here because it is not
- * our choice: `computerd` applies its own `DEFAULT_IGNORE` container-side, and
- * this list exists to *predict* that so a read can explain itself rather than
- * reporting a missing file. A dependency the model can plainly see in a `ls` but
- * cannot read is the kind of thing that sends it hunting for the wrong bug.
- */
-const CONTAINER_ONLY_SEGMENTS = ["node_modules"];
-export function isContainerOnly(path) {
-    return path
-        .split("/")
-        .some((segment) => CONTAINER_ONLY_SEGMENTS.includes(segment));
-}
-/** The sentence a container-only path gets instead of "not found". */
-function containerOnlyNote(path, verb) {
-    return (`${path} is inside node_modules, which lives only in the container and is ` +
-        `not part of the durable workspace — ${verb} cannot see it. Use \`sb_exec\` ` +
-        `(for example \`cat ${path}\`) to read it through the shell instead.`);
+/** Whether any segment of `path` is exactly `segment`. */
+function hasSegment(path, segment) {
+    return path.split("/").includes(segment);
 }
 /**
  * Is this path inside git's internal state?
@@ -38,10 +22,43 @@ function containerOnlyNote(path, verb) {
  * checkout in a way that surfaces much later as an inexplicable git failure.
  *
  * Exact segment rather than substring, so `.gitignore`, `.gitattributes` and
- * `.github/` are untouched — the same trap `node_modules_old` sets one function up.
+ * `.github/` are untouched.
  */
 export function isGitInternal(path) {
-    return path.split("/").includes(".git");
+    return hasSegment(path, ".git");
+}
+/**
+ * Where a session's own state lives inside a workspace, as a directory name.
+ *
+ * Every Claude Code session keeps its `CLAUDE_CONFIG_DIR` in a directory of
+ * this name at the workspace root — the Durable Object's storage, so a
+ * conversation outlives its container and a later session can continue it. See
+ * {@link file://../claude-code/run.ts SESSION_CONFIG_DIR}.
+ *
+ * **Spelled here as well as in the plugin that sets the variable**, because the
+ * module that has to step over it is the walk below, and neither may import the
+ * other: `/computer` reaching into `/claude-code` would pull a whole plugin into
+ * every agent that installs the file tools, and `/claude-code` reaches no other
+ * subpath — `verify:exports` refuses both. A spec in `/claude-code` holds the
+ * two spellings to one.
+ */
+export const SESSION_STATE_DIR = ".claude-sessions";
+/**
+ * What every walk steps over, as directory names. Both the workspace's `glob`
+ * and the `grep` tool hand these to the store as `**\/<name>` exclusions, which
+ * prunes them: no directory named here is descended into, so none costs a read.
+ *
+ * {@link SESSION_STATE_DIR} is here for a reason the refused directories do not
+ * share: a transcript is a verbatim record of everything a session read, so a
+ * walk that descended into it would answer a `grep` for a line of source with
+ * the session that quoted it.
+ */
+export const WALK_SKIPS = [".git", "node_modules", SESSION_STATE_DIR];
+/** The sentence a `node_modules` path gets. */
+function dependencyTreeNote(path, verb) {
+    return (`${path} is inside node_modules, which lives on the container's disk rather ` +
+        `than in the workspace ${verb} works on. Use bash there — ` +
+        `\`cat\`, \`ls\`, \`rg\`.`);
 }
 /**
  * The sentence a `.git` path gets.
@@ -49,9 +66,9 @@ export function isGitInternal(path) {
  * Names a route deliberately: a refusal with no destination is worse than no
  * refusal, because the model retries and then works around it.
  *
- * What it must never name is `sb_exec`. That hands back the exact capability
+ * What it must never name is `bash`. That hands back the exact capability
  * being withheld, in the one place the model is already looking for a way around
- * it, with the tool's own authority behind it. `sb_exec` is unguarded because a
+ * it, with the tool's own authority behind it. `bash` is unguarded because a
  * shell takes an opaque command string and pattern-matching git out of one is
  * neither reliable nor this guard's job — a fact about the implementation, not a
  * route to advertise.
@@ -60,34 +77,32 @@ function gitInternalNote(path, verb) {
     return (`${path} is inside .git — git's internal state, which ${verb} does not touch. ` +
         `Reading it tells you less than the repository tools do, and writing it ` +
         `corrupts the checkout. Repository work goes through the repo tools ` +
-        `(\`repo_status\`, \`repo_diff\`, \`repo_commit\`, \`repo_push\`), which the ` +
-        `main agent holds. If this task needs git state you cannot get that way, say ` +
-        `so in your result rather than reaching into .git yourself.`);
+        `(\`repo_status\`, \`repo_diff\`, \`repo_commit\`, \`repo_push\`). If this ` +
+        `task needs git state you cannot get that way, say so in your result rather ` +
+        `than reaching into .git yourself.`);
 }
 /**
- * The path check every file tool makes, before it opens anything.
+ * The path check every file tool and every workspace call makes, before it
+ * opens anything.
  *
- * Returns the sentence to hand back, or `undefined` to proceed. Two string
- * comparisons — no `stat`, no round trip — which is why all six tools can afford
- * to call it before the workspace is opened.
+ * Returns the sentence to hand back, or `undefined` to proceed. One string
+ * comparison — no `stat`, no round trip — which is why every file tool can
+ * afford to call it before the workspace is opened.
  *
  * ## A redirect, not a boundary
  *
- * `node_modules` is a fact about the substrate and the note names the tool that
- * can see it; `.git` is a rule about where repository work belongs and the note
- * names the tools it belongs to. Both catch the case that actually happens — a
- * model reaching into `.git/HEAD` to fix a merge, or reading a dependency's
- * source and finding nothing there.
+ * The note names the tools repository work belongs to, because the case that
+ * actually happens is a model reaching into `.git/HEAD` to fix a merge.
  *
- * It is not containment, and this is the only place worth saying so. `sb_exec`
- * is in the same tool family, granted per family rather than per tool, so every
- * agent holding these six also holds a shell that reads and writes `.git`
- * directly.
+ * It is not containment, and this is the only place worth saying so. An agent
+ * that can write files here almost always holds `bash` too, which reads and
+ * writes `.git` directly.
  *
  * Symlinks are not resolved, for the same reason: a tracked
  * `docs/notes.md -> ../.git/config` only matters to an agent given these tools
- * *without* the shell, which the family granularity makes unbuildable. If that
- * ever becomes buildable, the **write** path is the half to restore —
+ * *without* the shell. A read-only install — `restrictTools` down to `grep`,
+ * with Think's writing tools left out — is that agent, and it cannot write. If a writing agent
+ * without the shell ever exists, the **write** path is the half to restore —
  * `.git/config` is an input to the credentialed push, and a planted hook runs
  * under a container-side `repo_commit`. Reading `.git` discloses nothing that is
  * not already readable, so the read half is not worth an `lstat` per call. The
@@ -96,9 +111,9 @@ function gitInternalNote(path, verb) {
  * segment.
  */
 export function guardPath(path, verb) {
-    if (isContainerOnly(path))
-        return containerOnlyNote(path, verb);
     if (isGitInternal(path))
         return gitInternalNote(path, verb);
+    if (hasSegment(path, "node_modules"))
+        return dependencyTreeNote(path, verb);
     return undefined;
 }

package/dist/computer/proxy.d.ts

@@ -0,0 +1,45 @@
+import type { WorkspaceLike } from "@cloudflare/think";
+import type { WorkspaceHost } from "../workspace/open.js";
+import type { ComputerConfig } from "./index.js";
+/**
+ * The container's workspace, as the agent's own `this.workspace`.
+ *
+ * Think's `read`, `write`, `edit` and `delete` run against whatever an agent's
+ * workspace is, and `computer()`'s tools replace only the ones it names. So an
+ * agent with a container and Think's default workspace would run `bash` in the
+ * container and `write` in its own SQLite, and nothing would say so. An agent
+ * that installs `computer` sets this instead:
+ *
+ * ```ts
+ * override workspace = computerWorkspace(config, () => this.pluginContext().runtime());
+ * ```
+ *
+ * and `computer(config).tools(ctx)` refuses to start without it — and reaches
+ * the workspace through it, so the tools and Think's file tools cannot resolve
+ * two different ones.
+ *
+ * Built on the workspace's own filesystem, not on `@cloudflare/computer`'s
+ * Think adapter: that one's `glob` and `readDir` read every entry, and its
+ * `writeFile` knows nothing of the paths and the states this plugin refuses.
+ */
+/**
+ * Where a {@link computerWorkspace} sends each call, carried on it under
+ * {@link ROUTE}. `computer()`'s tools route through this rather than through
+ * their own config, which is what makes a workspace built from another config,
+ * or without its runtime, a wrong workspace for both rather than a split.
+ */
+export interface WorkspaceRoute {
+    /** The workspace the running turn names. Read per call. */
+    name(): string;
+    host(name: string): DurableObjectStub<WorkspaceHost>;
+}
+/** The route of a workspace {@link computerWorkspace} built, or `undefined`. */
+export declare function workspaceRoute(workspace: unknown): WorkspaceRoute | undefined;
+/** Whether `workspace` is one {@link computerWorkspace} built. */
+export declare function isComputerWorkspace(workspace: unknown): boolean;
+/**
+ * @param runtime The running sub-agent's `runtime()`, read per call — how a
+ *   sub-agent's file tools reach the workspace its parent prepared. A parent's
+ *   is `undefined`, and {@link ComputerConfig.workspaceName} names it.
+ */
+export declare function computerWorkspace(config: ComputerConfig, runtime?: () => unknown): WorkspaceLike;

package/dist/computer/proxy.js

@@ -0,0 +1,234 @@
+var __addDisposableResource = (this && this.__addDisposableResource) || function (env, value, async) {
+    if (value !== null && value !== void 0) {
+        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+        var dispose, inner;
+        if (async) {
+            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+            dispose = value[Symbol.asyncDispose];
+        }
+        if (dispose === void 0) {
+            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+            dispose = value[Symbol.dispose];
+            if (async) inner = dispose;
+        }
+        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+        if (inner) dispose = function() { try { inner.call(this); } catch (e) { return Promise.reject(e); } };
+        env.stack.push({ value: value, dispose: dispose, async: async });
+    }
+    else if (async) {
+        env.stack.push({ async: true });
+    }
+    return value;
+};
+var __disposeResources = (this && this.__disposeResources) || (function (SuppressedError) {
+    return function (env) {
+        function fail(e) {
+            env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+            env.hasError = true;
+        }
+        var r, s = 0;
+        function next() {
+            while (r = env.stack.pop()) {
+                try {
+                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+                    if (r.dispose) {
+                        var result = r.dispose.call(r.value);
+                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) { fail(e); return next(); });
+                    }
+                    else s |= 1;
+                }
+                catch (e) {
+                    fail(e);
+                }
+            }
+            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+            if (env.hasError) throw env.error;
+        }
+        return next();
+    };
+})(typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
+import { withFileLock } from "./file-lock.js";
+import { writeGate } from "./gate.js";
+import { openWorkspaceFs, workspaceNameFromRuntime } from "../workspace/open.js";
+import { guardPath, WALK_SKIPS } from "./paths.js";
+/**
+ * The key the route is carried under. `Symbol.for`, so a second copy of this
+ * module in one bundle still recognises the first's workspaces.
+ */
+const ROUTE = Symbol.for("@dynamicagents/plugins/computer:workspace");
+/**
+ * The most one `glob` returns. Its caller is Think's `find`, which shows 200
+ * and says when there were more — so one past that is all it can use, and
+ * reading the rest of a large checkout into the object would buy nothing.
+ */
+const GLOB_LIMIT = 201;
+/** The route of a workspace {@link computerWorkspace} built, or `undefined`. */
+export function workspaceRoute(workspace) {
+    if (typeof workspace !== "object" || workspace === null)
+        return undefined;
+    return workspace[ROUTE];
+}
+/** Whether `workspace` is one {@link computerWorkspace} built. */
+export function isComputerWorkspace(workspace) {
+    return workspaceRoute(workspace) !== undefined;
+}
+/**
+ * Missing, as the filesystem says it across the boundary. The code does not
+ * always survive RPC, so the message is read too.
+ */
+function isMissing(err) {
+    if (!err || typeof err !== "object")
+        return false;
+    const { code, message } = err;
+    if (code === "ENOENT")
+        return true;
+    return typeof message === "string" && /ENOENT|no such/i.test(message);
+}
+/** `null` for a path that is not there, which is what Think's tools expect. */
+async function orNull(read) {
+    try {
+        return await read;
+    }
+    catch (err) {
+        if (isMissing(err))
+            return null;
+        throw err;
+    }
+}
+/**
+ * `stat`, with a missing path answered as `null`.
+ *
+ * Asked of the stub's own `statOrNull` where it has one, the way
+ * {@link file://../workspace/read.ts pathExists} asks for `exists`: Think's
+ * `read` stats before it reads, so a missing file is an ordinary answer here,
+ * and a `stat` that throws across the boundary leaves the object an unhandled
+ * rejection to log for it.
+ */
+function statOrNull(fs, path) {
+    // Called as a method, never through `.call`: on an RPC stub `.call` is read
+    // as a remote method.
+    const remote = fs;
+    if (typeof remote.statOrNull === "function")
+        return remote.statOrNull(path);
+    return orNull(fs.stat(path));
+}
+async function drain(stream) {
+    return new Uint8Array(await new Response(stream).arrayBuffer());
+}
+function fileInfo(entry) {
+    const type = entry.isDirectory ? "directory" : "file";
+    return {
+        path: entry.path,
+        name: entry.path.slice(entry.path.lastIndexOf("/") + 1),
+        type,
+        // Generic on purpose: Think's `read` sniffs a generic type from the bytes,
+        // and an extension is not evidence of what a file holds.
+        mimeType: type === "directory" ? "inode/directory" : "application/octet-stream",
+        size: entry.size ?? 0,
+        createdAt: entry.mtime ?? 0,
+        updatedAt: entry.mtime ?? 0
+    };
+}
+/** The directory a glob walks from, and the pattern relative to it. */
+function splitGlob(pattern, cwd) {
+    const absolute = pattern.startsWith("/") ? pattern : `${cwd}/${pattern}`;
+    const wildcard = absolute.search(/[*?[{]/);
+    const cut = wildcard === -1
+        ? absolute.lastIndexOf("/")
+        : absolute.lastIndexOf("/", wildcard);
+    return {
+        dir: cut <= 0 ? "/" : absolute.slice(0, cut),
+        rest: absolute.slice(cut + 1)
+    };
+}
+/**
+ * @param runtime The running sub-agent's `runtime()`, read per call — how a
+ *   sub-agent's file tools reach the workspace its parent prepared. A parent's
+ *   is `undefined`, and {@link ComputerConfig.workspaceName} names it.
+ */
+export function computerWorkspace(config, runtime) {
+    const cwd = config.cwd ?? "/workspace";
+    // Resolved per call, never memoized: the name belongs to the turn, and a
+    // stale one would route this caller's writes into another's files.
+    const named = () => workspaceNameFromRuntime(runtime?.()) ?? config.workspaceName();
+    const host = (name) => config.binding.get(config.binding.idFromName(name));
+    /**
+     * One call, against the workspace this turn names. Opened without starting a
+     * container — see `WorkspaceHost.__getWorkspaceFsStub`.
+     */
+    const withFs = async (path, verb, body) => {
+        const env_1 = { stack: [], error: void 0, hasError: false };
+        try {
+            const refusal = guardPath(path, verb);
+            if (refusal)
+                throw new Error(refusal);
+            const name = named();
+            const ws = __addDisposableResource(env_1, await openWorkspaceFs(host(name)), false);
+            return await body(ws.fs, name);
+        }
+        catch (e_1) {
+            env_1.error = e_1;
+            env_1.hasError = true;
+        }
+        finally {
+            __disposeResources(env_1);
+        }
+    };
+    /**
+     * A write, refused while the workspace cannot keep it. Thrown rather than
+     * returned: Think's tools report a thrown error to the model, and a write
+     * that returned would read as one that landed.
+     */
+    const withWritableFs = (path, verb, body) => withFs(path, verb, async (fs, name) => {
+        // Fails open, for the reason the tools' own write gate does: a read of
+        // another Durable Object's state must not take out a working tool.
+        const lost = await host(name)
+            .advisories()
+            .then(writeGate, () => undefined);
+        if (lost)
+            throw new Error(lost);
+        return body(fs, name);
+    });
+    const workspace = {
+        readFile: (path) => 
+        // Whole, never truncated: Think's `edit` writes back what it read.
+        withFs(path, "read", (fs) => orNull(fs.readFile(path, "utf8"))),
+        readFileBytes: (path) => withFs(path, "read", async (fs) => {
+            const stream = await orNull(fs.readFile(path));
+            return stream === null ? null : drain(stream);
+        }),
+        stat: (path) => withFs(path, "read", async (fs) => {
+            const stat = await statOrNull(fs, path);
+            return stat === null ? null : fileInfo({ ...stat, path });
+        }),
+        readDir: (dir = cwd, opts) => withFs(dir, "list", async (fs) => (await fs.readdir(dir, opts)).map((entry) => fileInfo({
+            ...entry,
+            path: dir === "/" ? `/${entry.name}` : `${dir}/${entry.name}`
+        }))),
+        // Pruned rather than filtered: at a repository root either skipped
+        // directory outnumbers everything else.
+        glob: (pattern) => {
+            const { dir, rest } = splitGlob(pattern, cwd);
+            return withFs(dir, "find", async (fs) => (await fs.find(dir, rest, {
+                limit: GLOB_LIMIT,
+                exclude: WALK_SKIPS.map((segment) => `**/${segment}`)
+            })).map((entry) => fileInfo({ path: entry.path, isDirectory: entry.type === "dir" })));
+        },
+        // Locked per file, so a write never lands inside the `edit` tool's read and
+        // write of the same file — see `./file-lock.ts`.
+        writeFile: (path, content) => withWritableFs(path, "write", (fs, name) => withFileLock(name, path, () => fs.writeFile(path, content))),
+        mkdir: (path, opts) => withWritableFs(path, "write", (fs) => fs.mkdir(path, opts)),
+        // Locked too: a delete landing between an edit's read and its write would
+        // be undone by the write, and both would report success.
+        rm: (path, opts) => withWritableFs(path, "delete", (fs, name) => withFileLock(name, path, () => fs.rm(path, opts)))
+        // No `writeFileBytes`. Think writes through it on its own account —
+        // evicted media, projected skills — and none of that belongs in a
+        // repository's checkout. Without it Think skips both, with a warning.
+    };
+    const route = { name: named, host };
+    Object.defineProperty(workspace, ROUTE, { value: route });
+    return workspace;
+}

package/dist/computer/render.d.ts

@@ -1,28 +1,10 @@
 import type { WorkspaceClient, WorkspaceRuntimeStatus } from "@cloudflare/computer";
-/**
- * Middle-out truncation, so both the first error and the final summary survive.
- *
- * The guard is not defensive padding. Without it a `max` at or below the marker's
- * own length makes `half` zero or negative, and `slice(-0)` is `slice(0)` — the
- * *whole* string — so the function returns more than it was given: 500 characters
- * in, 543 out at `max: 80`. A silent inversion of the one thing it does,
- * reachable from a public config field.
- */
-export declare function truncateOutput(text: string, max: number): string;
-/**
- * A byte count in the form a model can act on.
- *
- * A listing that says a file is 4.2 MB tells the model the read it is about to do
- * comes back with a hole in the middle — the one thing it cannot infer from the
- * truncated result itself.
- */
-export declare function humanBytes(bytes: number): string;
 /**
  * One `fs.grep` hit, derived from the client rather than imported.
  *
  * `@cloudflare/computer` declares `WorkspaceGrepMatch` but does not re-export it,
  * so there is no name to import. Reading it back off the method keeps this correct
- * by construction — the same structural approach {@link readBounded} takes to `fs`.
+ * by construction.
  */
 type GrepMatch = Awaited<ReturnType<WorkspaceClient["fs"]["grep"]>>[number];
 /**
@@ -70,8 +52,6 @@ export declare function renderGrepMatches(matches: GrepMatch[], maxChars: number
     shown: number;
     capped: boolean;
 };
-/** Elapsed time in the shape a sentence wants. */
-export declare function humanMs(ms: number): string;
 /**
  * Render a completed command the way a terminal would, minus the noise.
  *
@@ -100,24 +80,33 @@ export declare function renderResult(result: {
     stdout: string;
     stderr: string;
     status?: WorkspaceRuntimeStatus;
+    sync?: {
+        status: "complete" | "pending";
+    };
 }, maxChars: number): string;
 /**
- * Why a command has nothing to show for itself.
- *
- * {@link renderResult} states a non-`completed` status on its verdict line;
- * {@link computerExec} has no verdict line, only the four fields its caller
- * branches on. A *killed* process writes nothing, so without this a `git clone`
- * that hit the ten-minute ceiling reaches the model through
- * `@dynamicagents/plugins/repo` as `clone failed:` with an empty reason — which reads
- * like a bug in the plugin rather than a limit it can work within.
- *
- * Only `cancelled`. A `failed` status is an ordinary non-zero exit, where the
- * command's own stderr is the better explanation and this would be noise on top
- * of it.
- *
- * Both plausible causes are named because the exit code cannot separate them:
- * 137 is SIGKILL, which is what the timeout sends *and* what the kernel sends a
- * container that ran out of memory.
+ * The command ran; its changes have not landed in the workspace yet.
+ *
+ * Every command is bracketed by a sync, and the pull afterwards is what moves
+ * what it wrote from the container into the Durable Object. That pull can fail
+ * while the command itself succeeds — a transport that dropped, a container
+ * replaced underneath — and the runtime reports it in `sync` rather than in the
+ * exit code, because the command genuinely did run.
+ *
+ * Worth a sentence to the model because the *next* thing it does is usually read
+ * what it just wrote, and the file tools read the workspace rather than the
+ * container. Without this the file looks unchanged and the obvious conclusion is
+ * that the command did not work, which is the one conclusion that is wrong.
+ *
+ * Recovery is deliberately not the model's, and is not automatic either: the
+ * runtime schedules no retry of its own, so an outstanding pull lands when the
+ * host drives one or when a later command's own bracket carries it. What the
+ * model is told therefore stops short of "it will be there in a moment" — it is
+ * told the read may be stale, that re-running the command is the wrong fix
+ * because it would repeat the side effects, and to say so in its result if the
+ * workspace still disagrees with what it wrote.
  */
-export declare function cancelledNote(status: WorkspaceRuntimeStatus | undefined, exitCode: number, timeoutMs: number): string | undefined;
+export declare function syncPendingNote(sync: {
+    status: "complete" | "pending";
+} | undefined): string | undefined;
 export {};