@geminixiang/mikan 1.0.0-beta.44 → 1.0.0-beta.46

package/dist/workspace-projection/index.js

@@ -1,8 +1,48 @@
-import { dirname } from "node:path";
-import { lstatSync, mkdirSync, writeFileSync } from "node:fs";
-import { ensureDirExists } from "../utils/file-guards.js";
+import { dirname, join } from "node:path";
+import { lstatSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { atomicWritePrivateFile, ensureDirExists } from "../utils/file-guards.js";
 import { resolveConversationSettings } from "../config.js";
 import * as log from "../log.js";
+const CHANNEL_KIND_FILE = "channel-kind";
+const CHANNEL_KINDS = [
+    "public_channel",
+    "private_channel",
+    "im",
+    "external",
+];
+/**
+ * Record the platform's own channel kind for this conversation, as observed
+ * by the adapter at message intake. Stored under the host-only office state
+ * dir (never the sandbox-mounted workspace), so sandboxed code cannot
+ * promote its own conversation into the shared pool. Written only on change;
+ * the value is a snapshot as of the last message, which is exactly the
+ * freshness the projection needs — a conversation that never speaks again
+ * never needs a fresher value.
+ */
+export function recordPlatformChannelKind(office, kind) {
+    if (readPlatformChannelKind(office) === kind)
+        return;
+    ensureDirExists(office.stateDir);
+    atomicWritePrivateFile(join(office.stateDir, CHANNEL_KIND_FILE), kind + "\n");
+}
+/** The recorded platform channel kind, or undefined when never observed. */
+export function readPlatformChannelKind(office) {
+    const path = join(office.stateDir, CHANNEL_KIND_FILE);
+    let raw;
+    try {
+        raw = readFileSync(path, "utf-8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return undefined;
+        log.logWarning("Could not read platform channel kind; falling back to isolated workspace", `${path}: ${err instanceof Error ? err.message : String(err)}`);
+        return undefined;
+    }
+    const value = raw.trim();
+    return CHANNEL_KINDS.includes(value)
+        ? value
+        : undefined;
+}
 /**
  * The single policy seam for a managed office. It both materializes the
  * host-side roots and authorizes the prompt sources that describe them.
@@ -19,11 +59,26 @@ export function resolveWorkspaceProjection(office) {
         ensureDirectoryRoot(workspace.skillsDir, "Workspace skills");
         ensureDirectoryRoot(workspace.eventsDir, "Workspace events");
     }
+    // Private visibility only changes anything for shared-support: the shared
+    // MEMORY.md is the one file that leaks information between offices when
+    // writable, so a private office reads it but cannot write it (modeled on
+    // Claude Tag's private-channel memory). "full" mounts the whole workspace
+    // as one read-write bind with no separate memory file to gate, and
+    // "conversation" never sees workspace memory at all.
+    //
+    // The `readOnly` mount flag below is a kernel-enforced boundary only for
+    // backends with managed Workspace projection. Runner and actor execution
+    // resolution reject every other backend before the agent can start.
+    const globalMemoryReadOnly = shared && effective.visibility === "private";
     const mounts = effective.layout === "full"
         ? [{ source: workspace.root, target: "/workspace" }]
         : effective.layout === "shared-support"
             ? [
-                { source: workspace.memoryPath, target: "/workspace/MEMORY.md" },
+                {
+                    source: workspace.memoryPath,
+                    target: "/workspace/MEMORY.md",
+                    ...(globalMemoryReadOnly ? { readOnly: true } : {}),
+                },
                 { source: workspace.skillsDir, target: "/workspace/skills" },
                 { source: workspace.eventsDir, target: "/workspace/events" },
                 { source: office.dir, target: `/workspace/${office.key}` },
@@ -37,7 +92,11 @@ export function resolveWorkspaceProjection(office) {
             conversationMemoryPath: office.memoryPath,
             conversationSkillsDir: office.skillsDir,
             ...(effective.layout === "shared-support" || effective.layout === "full"
-                ? { globalMemoryPath: workspace.memoryPath, globalSkillsDir: workspace.skillsDir }
+                ? {
+                    globalMemoryPath: workspace.memoryPath,
+                    globalSkillsDir: workspace.skillsDir,
+                    ...(globalMemoryReadOnly ? { globalMemoryReadOnly: true } : {}),
+                }
                 : {}),
         },
     };
@@ -46,9 +105,12 @@ function resolveEffectiveWorkspace(office) {
     try {
         const settings = resolveConversationSettings(office).sandbox;
         if (settings?.workspace) {
-            return normalizeWorkspace(settings.workspace.doorPolicy, settings.workspace.layout);
+            return normalizeWorkspace(settings.workspace.doorPolicy, settings.workspace.layout, settings.workspace.visibility);
+        }
+        if (settings?.image?.workspaceMount) {
+            return legacyWorkspace(settings.image.workspaceMount);
         }
-        return legacyWorkspace(settings?.image?.workspaceMount);
+        return platformDerivedWorkspace(office);
     }
     catch (err) {
         // Settings are host-authoritative. A malformed file must not fall back to
@@ -57,18 +119,44 @@ function resolveEffectiveWorkspace(office) {
         throw new Error("Cannot resolve workspace projection: settings are malformed", { cause: err });
     }
 }
-function normalizeWorkspace(doorPolicy, layout) {
+/**
+ * No explicit workspace setting anywhere: follow the platform's own channel
+ * vocabulary (modeled on Claude Tag). A public channel's knowledge is shared
+ * workspace-wide read-write; a private channel reads the shared pool but
+ * writes only its own conversation memory; DMs, externally shared channels,
+ * and conversations whose kind was never observed stay fully isolated —
+ * platform-public is a necessary condition for sharing, never assumed.
+ * An admin's explicit setting (conversation or global) always wins over this.
+ */
+function platformDerivedWorkspace(office) {
+    switch (readPlatformChannelKind(office)) {
+        case "public_channel":
+            return { doorPolicy: "trusted", layout: "shared-support", visibility: "public" };
+        case "private_channel":
+            return { doorPolicy: "trusted", layout: "shared-support", visibility: "private" };
+        default:
+            return { doorPolicy: "isolated", layout: "conversation", visibility: "public" };
+    }
+}
+function normalizeWorkspace(doorPolicy, layout, visibility) {
     const policy = doorPolicy ?? "isolated";
-    if (policy === "isolated")
-        return { doorPolicy: policy, layout: "conversation" };
-    return { doorPolicy: policy, layout: layout === "full" ? "full" : "shared-support" };
+    if (policy === "isolated") {
+        return { doorPolicy: policy, layout: "conversation", visibility: "public" };
+    }
+    return {
+        doorPolicy: policy,
+        layout: layout === "full" ? "full" : "shared-support",
+        // Missing visibility defaults to "public": every office that predates this
+        // setting keeps today's read-write shared MEMORY.md behavior unchanged.
+        visibility: visibility ?? "public",
+    };
 }
 function legacyWorkspace(mode) {
     return mode === "full"
-        ? { doorPolicy: "trusted", layout: "full" }
+        ? { doorPolicy: "trusted", layout: "full", visibility: "public" }
         : mode === "private"
-            ? { doorPolicy: "trusted", layout: "shared-support" }
-            : { doorPolicy: "isolated", layout: "conversation" };
+            ? { doorPolicy: "trusted", layout: "shared-support", visibility: "public" }
+            : { doorPolicy: "isolated", layout: "conversation", visibility: "public" };
 }
 function ensureDirectoryRoot(path, label) {
     if (!exists(path)) {

package/dist/workspace-projection/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/workspace-projection/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAE3D,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AAMjC;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAc;IACvD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC7B,MAAM,SAAS,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAEpD,eAAe,CAAC,SAAS,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IACvD,MAAM,CAAC,MAAM,EAAE,CAAC;IAChB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,KAAK,gBAAgB,CAAC;IACrD,IAAI,MAAM,EAAE,CAAC;QACX,iBAAiB,CAAC,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;QAC5D,mBAAmB,CAAC,SAAS,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QAC7D,mBAAmB,CAAC,SAAS,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GACV,SAAS,CAAC,MAAM,KAAK,MAAM;QACzB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QACpD,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,gBAAgB;YACrC,CAAC,CAAC;gBACE,EAAE,MAAM,EAAE,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,sBAAsB,EAAE;gBAChE,EAAE,MAAM,EAAE,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE;gBAC5D,EAAE,MAAM,EAAE,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE;gBAC5D,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,MAAM,CAAC,GAAG,EAAE,EAAE;aAC3D;YACH,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAErE,OAAO;QACL,GAAG,SAAS;QACZ,MAAM;QACN,aAAa,EAAE;YACb,eAAe,EAAE,MAAM,CAAC,GAAG;YAC3B,sBAAsB,EAAE,MAAM,CAAC,UAAU;YACzC,qBAAqB,EAAE,MAAM,CAAC,SAAS;YACvC,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,gBAAgB,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM;gBACtE,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,UAAU,EAAE,eAAe,EAAE,SAAS,CAAC,SAAS,EAAE;gBAClF,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;QAC7D,IAAI,QAAQ,EAAE,SAAS,EAAE,CAAC;YACxB,OAAO,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,uDAAuD;QACvD,GAAG,CAAC,UAAU,CACZ,kEAAkE,EAClE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,6DAA6D,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,UAA2C,EAC3C,MAAmC;IAEnC,MAAM,MAAM,GAAG,UAAU,IAAI,UAAU,CAAC;IACxC,IAAI,MAAM,KAAK,UAAU;QAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACjF,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC;AACvF,CAAC;AAED,SAAS,eAAe,CACtB,IAAyC;IAEzC,OAAO,IAAI,KAAK,MAAM;QACpB,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;QAC3C,CAAC,CAAC,IAAI,KAAK,SAAS;YAClB,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE;YACrD,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,KAAa;IACtD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClB,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IACD,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAa;IACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClB,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/B,aAAa,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wCAAwC,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa;IAClD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6CAA6C,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACnE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { dirname } from \"node:path\";\nimport { lstatSync, mkdirSync, writeFileSync } from \"node:fs\";\nimport { ensureDirExists } from \"../utils/file-guards.js\";\nimport { resolveConversationSettings } from \"../config.js\";\nimport type { Office } from \"../office/index.js\";\nimport * as log from \"../log.js\";\nimport type { ImageWorkspaceMountMode, WorkspaceDoorPolicy, WorkspaceLayout } from \"../types.js\";\nimport type { WorkspaceProjection } from \"./types.js\";\n\nexport type { WorkspaceProjection } from \"./types.js\";\n\n/**\n * The single policy seam for a managed office. It both materializes the\n * host-side roots and authorizes the prompt sources that describe them.\n * Legacy image settings are deliberately translated here, never at callers.\n */\nexport function resolveWorkspaceProjection(office: Office): WorkspaceProjection {\n  const { workspace } = office;\n  const effective = resolveEffectiveWorkspace(office);\n\n  assertDirectory(workspace.root, \"Host workspace root\");\n  office.ensure();\n  const shared = effective.layout === \"shared-support\";\n  if (shared) {\n    ensureRegularFile(workspace.memoryPath, \"Workspace memory\");\n    ensureDirectoryRoot(workspace.skillsDir, \"Workspace skills\");\n    ensureDirectoryRoot(workspace.eventsDir, \"Workspace events\");\n  }\n\n  const mounts =\n    effective.layout === \"full\"\n      ? [{ source: workspace.root, target: \"/workspace\" }]\n      : effective.layout === \"shared-support\"\n        ? [\n            { source: workspace.memoryPath, target: \"/workspace/MEMORY.md\" },\n            { source: workspace.skillsDir, target: \"/workspace/skills\" },\n            { source: workspace.eventsDir, target: \"/workspace/events\" },\n            { source: office.dir, target: `/workspace/${office.key}` },\n          ]\n        : [{ source: office.dir, target: `/workspace/${office.key}` }];\n\n  return {\n    ...effective,\n    mounts,\n    promptSources: {\n      conversationDir: office.dir,\n      conversationMemoryPath: office.memoryPath,\n      conversationSkillsDir: office.skillsDir,\n      ...(effective.layout === \"shared-support\" || effective.layout === \"full\"\n        ? { globalMemoryPath: workspace.memoryPath, globalSkillsDir: workspace.skillsDir }\n        : {}),\n    },\n  };\n}\n\nfunction resolveEffectiveWorkspace(\n  office: Office,\n): Pick<WorkspaceProjection, \"doorPolicy\" | \"layout\"> {\n  try {\n    const settings = resolveConversationSettings(office).sandbox;\n    if (settings?.workspace) {\n      return normalizeWorkspace(settings.workspace.doorPolicy, settings.workspace.layout);\n    }\n    return legacyWorkspace(settings?.image?.workspaceMount);\n  } catch (err) {\n    // Settings are host-authoritative. A malformed file must not fall back to\n    // an unvalidated value from a mounted legacy location.\n    log.logWarning(\n      \"Refusing to resolve workspace projection from malformed settings\",\n      err instanceof Error ? err.message : String(err),\n    );\n    throw new Error(\"Cannot resolve workspace projection: settings are malformed\", { cause: err });\n  }\n}\n\nfunction normalizeWorkspace(\n  doorPolicy: WorkspaceDoorPolicy | undefined,\n  layout: WorkspaceLayout | undefined,\n): Pick<WorkspaceProjection, \"doorPolicy\" | \"layout\"> {\n  const policy = doorPolicy ?? \"isolated\";\n  if (policy === \"isolated\") return { doorPolicy: policy, layout: \"conversation\" };\n  return { doorPolicy: policy, layout: layout === \"full\" ? \"full\" : \"shared-support\" };\n}\n\nfunction legacyWorkspace(\n  mode: ImageWorkspaceMountMode | undefined,\n): Pick<WorkspaceProjection, \"doorPolicy\" | \"layout\"> {\n  return mode === \"full\"\n    ? { doorPolicy: \"trusted\", layout: \"full\" }\n    : mode === \"private\"\n      ? { doorPolicy: \"trusted\", layout: \"shared-support\" }\n      : { doorPolicy: \"isolated\", layout: \"conversation\" };\n}\n\nfunction ensureDirectoryRoot(path: string, label: string): void {\n  if (!exists(path)) {\n    mkdirSync(path, { recursive: true, mode: 0o700 });\n    return;\n  }\n  assertDirectory(path, label);\n}\n\nfunction ensureRegularFile(path: string, label: string): void {\n  if (!exists(path)) {\n    ensureDirExists(dirname(path));\n    writeFileSync(path, \"\", { mode: 0o600, flag: \"wx\" });\n    return;\n  }\n  let stats;\n  try {\n    stats = lstatSync(path);\n  } catch (err) {\n    throw new Error(`${label} cannot be inspected: ${path}`, { cause: err });\n  }\n  if (stats.isSymbolicLink() || !stats.isFile()) {\n    throw new Error(`${label} must be a regular non-symlink file: ${path}`);\n  }\n}\n\nfunction assertDirectory(path: string, label: string): void {\n  let stats;\n  try {\n    stats = lstatSync(path);\n  } catch (err) {\n    throw new Error(`${label} cannot be inspected: ${path}`, { cause: err });\n  }\n  if (stats.isSymbolicLink() || !stats.isDirectory()) {\n    throw new Error(`${label} must be a regular non-symlink directory: ${path}`);\n  }\n}\n\nfunction exists(path: string): boolean {\n  try {\n    lstatSync(path);\n    return true;\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return false;\n    throw err;\n  }\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/workspace-projection/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAE3D,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AAWjC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,aAAa,GAAmC;IACpD,gBAAgB;IAChB,iBAAiB;IACjB,IAAI;IACJ,UAAU;CACX,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,IAAyB;IACjF,IAAI,uBAAuB,CAAC,MAAM,CAAC,KAAK,IAAI;QAAE,OAAO;IACrD,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IACtD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACvE,GAAG,CAAC,UAAU,CACZ,0EAA0E,EAC1E,GAAG,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC/D,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,OAAQ,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACzD,CAAC,CAAE,KAA6B;QAChC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAc;IACvD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC7B,MAAM,SAAS,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAEpD,eAAe,CAAC,SAAS,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IACvD,MAAM,CAAC,MAAM,EAAE,CAAC;IAChB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,KAAK,gBAAgB,CAAC;IACrD,IAAI,MAAM,EAAE,CAAC;QACX,iBAAiB,CAAC,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;QAC5D,mBAAmB,CAAC,SAAS,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QAC7D,mBAAmB,CAAC,SAAS,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC/D,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,mEAAmE;IACnE,qDAAqD;IACrD,EAAE;IACF,yEAAyE;IACzE,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,oBAAoB,GAAG,MAAM,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC;IAC1E,MAAM,MAAM,GACV,SAAS,CAAC,MAAM,KAAK,MAAM;QACzB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QACpD,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,gBAAgB;YACrC,CAAC,CAAC;gBACE;oBACE,MAAM,EAAE,SAAS,CAAC,UAAU;oBAC5B,MAAM,EAAE,sBAAsB;oBAC9B,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC7D;gBACD,EAAE,MAAM,EAAE,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE;gBAC5D,EAAE,MAAM,EAAE,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE;gBAC5D,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,MAAM,CAAC,GAAG,EAAE,EAAE;aAC3D;YACH,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAErE,OAAO;QACL,GAAG,SAAS;QACZ,MAAM;QACN,aAAa,EAAE;YACb,eAAe,EAAE,MAAM,CAAC,GAAG;YAC3B,sBAAsB,EAAE,MAAM,CAAC,UAAU;YACzC,qBAAqB,EAAE,MAAM,CAAC,SAAS;YACvC,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,gBAAgB,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM;gBACtE,CAAC,CAAC;oBACE,gBAAgB,EAAE,SAAS,CAAC,UAAU;oBACtC,eAAe,EAAE,SAAS,CAAC,SAAS;oBACpC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChE;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;QAC7D,IAAI,QAAQ,EAAE,SAAS,EAAE,CAAC;YACxB,OAAO,kBAAkB,CACvB,QAAQ,CAAC,SAAS,CAAC,UAAU,EAC7B,QAAQ,CAAC,SAAS,CAAC,MAAM,EACzB,QAAQ,CAAC,SAAS,CAAC,UAAU,CAC9B,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;YACpC,OAAO,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,uDAAuD;QACvD,GAAG,CAAC,UAAU,CACZ,kEAAkE,EAClE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,6DAA6D,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAC/B,MAAc;IAEd,QAAQ,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,KAAK,gBAAgB;YACnB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;QACnF,KAAK,iBAAiB;YACpB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QACpF;YACE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACpF,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,UAA2C,EAC3C,MAAmC,EACnC,UAA2C;IAE3C,MAAM,MAAM,GAAG,UAAU,IAAI,UAAU,CAAC;IACxC,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB;QACrD,2EAA2E;QAC3E,wEAAwE;QACxE,UAAU,EAAE,UAAU,IAAI,QAAQ;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,IAAyC;IAEzC,OAAO,IAAI,KAAK,MAAM;QACpB,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE;QACjE,CAAC,CAAC,IAAI,KAAK,SAAS;YAClB,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE;YAC3E,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,KAAa;IACtD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClB,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IACD,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAa;IACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClB,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/B,aAAa,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wCAAwC,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa;IAClD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6CAA6C,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACnE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { dirname, join } from \"node:path\";\nimport { lstatSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { atomicWritePrivateFile, ensureDirExists } from \"../utils/file-guards.js\";\nimport { resolveConversationSettings } from \"../config.js\";\nimport type { Office } from \"../office/index.js\";\nimport * as log from \"../log.js\";\nimport type {\n  ImageWorkspaceMountMode,\n  WorkspaceDoorPolicy,\n  WorkspaceLayout,\n  WorkspaceVisibility,\n} from \"../types.js\";\nimport type { PlatformChannelKind, WorkspaceProjection } from \"./types.js\";\n\nexport type { PlatformChannelKind, WorkspaceProjection } from \"./types.js\";\n\nconst CHANNEL_KIND_FILE = \"channel-kind\";\nconst CHANNEL_KINDS: readonly PlatformChannelKind[] = [\n  \"public_channel\",\n  \"private_channel\",\n  \"im\",\n  \"external\",\n];\n\n/**\n * Record the platform's own channel kind for this conversation, as observed\n * by the adapter at message intake. Stored under the host-only office state\n * dir (never the sandbox-mounted workspace), so sandboxed code cannot\n * promote its own conversation into the shared pool. Written only on change;\n * the value is a snapshot as of the last message, which is exactly the\n * freshness the projection needs — a conversation that never speaks again\n * never needs a fresher value.\n */\nexport function recordPlatformChannelKind(office: Office, kind: PlatformChannelKind): void {\n  if (readPlatformChannelKind(office) === kind) return;\n  ensureDirExists(office.stateDir);\n  atomicWritePrivateFile(join(office.stateDir, CHANNEL_KIND_FILE), kind + \"\\n\");\n}\n\n/** The recorded platform channel kind, or undefined when never observed. */\nexport function readPlatformChannelKind(office: Office): PlatformChannelKind | undefined {\n  const path = join(office.stateDir, CHANNEL_KIND_FILE);\n  let raw: string;\n  try {\n    raw = readFileSync(path, \"utf-8\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return undefined;\n    log.logWarning(\n      \"Could not read platform channel kind; falling back to isolated workspace\",\n      `${path}: ${err instanceof Error ? err.message : String(err)}`,\n    );\n    return undefined;\n  }\n  const value = raw.trim();\n  return (CHANNEL_KINDS as readonly string[]).includes(value)\n    ? (value as PlatformChannelKind)\n    : undefined;\n}\n\n/**\n * The single policy seam for a managed office. It both materializes the\n * host-side roots and authorizes the prompt sources that describe them.\n * Legacy image settings are deliberately translated here, never at callers.\n */\nexport function resolveWorkspaceProjection(office: Office): WorkspaceProjection {\n  const { workspace } = office;\n  const effective = resolveEffectiveWorkspace(office);\n\n  assertDirectory(workspace.root, \"Host workspace root\");\n  office.ensure();\n  const shared = effective.layout === \"shared-support\";\n  if (shared) {\n    ensureRegularFile(workspace.memoryPath, \"Workspace memory\");\n    ensureDirectoryRoot(workspace.skillsDir, \"Workspace skills\");\n    ensureDirectoryRoot(workspace.eventsDir, \"Workspace events\");\n  }\n\n  // Private visibility only changes anything for shared-support: the shared\n  // MEMORY.md is the one file that leaks information between offices when\n  // writable, so a private office reads it but cannot write it (modeled on\n  // Claude Tag's private-channel memory). \"full\" mounts the whole workspace\n  // as one read-write bind with no separate memory file to gate, and\n  // \"conversation\" never sees workspace memory at all.\n  //\n  // The `readOnly` mount flag below is a kernel-enforced boundary only for\n  // backends with managed Workspace projection. Runner and actor execution\n  // resolution reject every other backend before the agent can start.\n  const globalMemoryReadOnly = shared && effective.visibility === \"private\";\n  const mounts =\n    effective.layout === \"full\"\n      ? [{ source: workspace.root, target: \"/workspace\" }]\n      : effective.layout === \"shared-support\"\n        ? [\n            {\n              source: workspace.memoryPath,\n              target: \"/workspace/MEMORY.md\",\n              ...(globalMemoryReadOnly ? { readOnly: true as const } : {}),\n            },\n            { source: workspace.skillsDir, target: \"/workspace/skills\" },\n            { source: workspace.eventsDir, target: \"/workspace/events\" },\n            { source: office.dir, target: `/workspace/${office.key}` },\n          ]\n        : [{ source: office.dir, target: `/workspace/${office.key}` }];\n\n  return {\n    ...effective,\n    mounts,\n    promptSources: {\n      conversationDir: office.dir,\n      conversationMemoryPath: office.memoryPath,\n      conversationSkillsDir: office.skillsDir,\n      ...(effective.layout === \"shared-support\" || effective.layout === \"full\"\n        ? {\n            globalMemoryPath: workspace.memoryPath,\n            globalSkillsDir: workspace.skillsDir,\n            ...(globalMemoryReadOnly ? { globalMemoryReadOnly: true } : {}),\n          }\n        : {}),\n    },\n  };\n}\n\nfunction resolveEffectiveWorkspace(\n  office: Office,\n): Pick<WorkspaceProjection, \"doorPolicy\" | \"layout\" | \"visibility\"> {\n  try {\n    const settings = resolveConversationSettings(office).sandbox;\n    if (settings?.workspace) {\n      return normalizeWorkspace(\n        settings.workspace.doorPolicy,\n        settings.workspace.layout,\n        settings.workspace.visibility,\n      );\n    }\n    if (settings?.image?.workspaceMount) {\n      return legacyWorkspace(settings.image.workspaceMount);\n    }\n    return platformDerivedWorkspace(office);\n  } catch (err) {\n    // Settings are host-authoritative. A malformed file must not fall back to\n    // an unvalidated value from a mounted legacy location.\n    log.logWarning(\n      \"Refusing to resolve workspace projection from malformed settings\",\n      err instanceof Error ? err.message : String(err),\n    );\n    throw new Error(\"Cannot resolve workspace projection: settings are malformed\", { cause: err });\n  }\n}\n\n/**\n * No explicit workspace setting anywhere: follow the platform's own channel\n * vocabulary (modeled on Claude Tag). A public channel's knowledge is shared\n * workspace-wide read-write; a private channel reads the shared pool but\n * writes only its own conversation memory; DMs, externally shared channels,\n * and conversations whose kind was never observed stay fully isolated —\n * platform-public is a necessary condition for sharing, never assumed.\n * An admin's explicit setting (conversation or global) always wins over this.\n */\nfunction platformDerivedWorkspace(\n  office: Office,\n): Pick<WorkspaceProjection, \"doorPolicy\" | \"layout\" | \"visibility\"> {\n  switch (readPlatformChannelKind(office)) {\n    case \"public_channel\":\n      return { doorPolicy: \"trusted\", layout: \"shared-support\", visibility: \"public\" };\n    case \"private_channel\":\n      return { doorPolicy: \"trusted\", layout: \"shared-support\", visibility: \"private\" };\n    default:\n      return { doorPolicy: \"isolated\", layout: \"conversation\", visibility: \"public\" };\n  }\n}\n\nfunction normalizeWorkspace(\n  doorPolicy: WorkspaceDoorPolicy | undefined,\n  layout: WorkspaceLayout | undefined,\n  visibility: WorkspaceVisibility | undefined,\n): Pick<WorkspaceProjection, \"doorPolicy\" | \"layout\" | \"visibility\"> {\n  const policy = doorPolicy ?? \"isolated\";\n  if (policy === \"isolated\") {\n    return { doorPolicy: policy, layout: \"conversation\", visibility: \"public\" };\n  }\n  return {\n    doorPolicy: policy,\n    layout: layout === \"full\" ? \"full\" : \"shared-support\",\n    // Missing visibility defaults to \"public\": every office that predates this\n    // setting keeps today's read-write shared MEMORY.md behavior unchanged.\n    visibility: visibility ?? \"public\",\n  };\n}\n\nfunction legacyWorkspace(\n  mode: ImageWorkspaceMountMode | undefined,\n): Pick<WorkspaceProjection, \"doorPolicy\" | \"layout\" | \"visibility\"> {\n  return mode === \"full\"\n    ? { doorPolicy: \"trusted\", layout: \"full\", visibility: \"public\" }\n    : mode === \"private\"\n      ? { doorPolicy: \"trusted\", layout: \"shared-support\", visibility: \"public\" }\n      : { doorPolicy: \"isolated\", layout: \"conversation\", visibility: \"public\" };\n}\n\nfunction ensureDirectoryRoot(path: string, label: string): void {\n  if (!exists(path)) {\n    mkdirSync(path, { recursive: true, mode: 0o700 });\n    return;\n  }\n  assertDirectory(path, label);\n}\n\nfunction ensureRegularFile(path: string, label: string): void {\n  if (!exists(path)) {\n    ensureDirExists(dirname(path));\n    writeFileSync(path, \"\", { mode: 0o600, flag: \"wx\" });\n    return;\n  }\n  let stats;\n  try {\n    stats = lstatSync(path);\n  } catch (err) {\n    throw new Error(`${label} cannot be inspected: ${path}`, { cause: err });\n  }\n  if (stats.isSymbolicLink() || !stats.isFile()) {\n    throw new Error(`${label} must be a regular non-symlink file: ${path}`);\n  }\n}\n\nfunction assertDirectory(path: string, label: string): void {\n  let stats;\n  try {\n    stats = lstatSync(path);\n  } catch (err) {\n    throw new Error(`${label} cannot be inspected: ${path}`, { cause: err });\n  }\n  if (stats.isSymbolicLink() || !stats.isDirectory()) {\n    throw new Error(`${label} must be a regular non-symlink directory: ${path}`);\n  }\n}\n\nfunction exists(path: string): boolean {\n  try {\n    lstatSync(path);\n    return true;\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return false;\n    throw err;\n  }\n}\n"]}

package/dist/workspace-projection/types.d.ts

@@ -1,14 +1,27 @@
-import type { ContainerMount, WorkspaceDoorPolicy, WorkspaceLayout } from "../types.js";
+import type { ContainerMount, WorkspaceDoorPolicy, WorkspaceLayout, WorkspaceVisibility } from "../types.js";
+/**
+ * The conversation's platform-native channel kind, using the platform's own
+ * vocabulary (Slack conversation types), not a mikan-invented one. Recorded
+ * at message intake and used to derive the workspace projection when no
+ * explicit workspace setting exists: public channels share workspace memory
+ * read-write, private channels read it without writing back, DMs and
+ * externally shared channels stay isolated.
+ */
+export type PlatformChannelKind = "public_channel" | "private_channel" | "im" | "external";
 interface WorkspacePromptSources {
     conversationDir: string;
     conversationMemoryPath: string;
     conversationSkillsDir: string;
     globalMemoryPath?: string;
     globalSkillsDir?: string;
+    /** True when globalMemoryPath is mounted read-only (shared-support + private visibility). */
+    globalMemoryReadOnly?: boolean;
 }
 export interface WorkspaceProjection {
     doorPolicy: WorkspaceDoorPolicy;
     layout: WorkspaceLayout;
+    /** Only meaningful for shared-support layout; "public" is the default and preserves prior read-write behavior. */
+    visibility: WorkspaceVisibility;
     mounts: ContainerMount[];
     promptSources: WorkspacePromptSources;
 }

package/dist/workspace-projection/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/workspace-projection/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAExF,UAAU,sBAAsB;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,mBAAmB,CAAC;IAChC,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,aAAa,EAAE,sBAAsB,CAAC;CACvC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/workspace-projection/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACpB,MAAM,aAAa,CAAC;AAErB;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,IAAI,GAAG,UAAU,CAAC;AAE3F,UAAU,sBAAsB;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6FAA6F;IAC7F,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,mBAAmB,CAAC;IAChC,MAAM,EAAE,eAAe,CAAC;IACxB,kHAAkH;IAClH,UAAU,EAAE,mBAAmB,CAAC;IAChC,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,aAAa,EAAE,sBAAsB,CAAC;CACvC"}

package/dist/workspace-projection/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/workspace-projection/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { ContainerMount, WorkspaceDoorPolicy, WorkspaceLayout } from \"../types.js\";\n\ninterface WorkspacePromptSources {\n  conversationDir: string;\n  conversationMemoryPath: string;\n  conversationSkillsDir: string;\n  globalMemoryPath?: string;\n  globalSkillsDir?: string;\n}\n\nexport interface WorkspaceProjection {\n  doorPolicy: WorkspaceDoorPolicy;\n  layout: WorkspaceLayout;\n  mounts: ContainerMount[];\n  promptSources: WorkspacePromptSources;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/workspace-projection/types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  ContainerMount,\n  WorkspaceDoorPolicy,\n  WorkspaceLayout,\n  WorkspaceVisibility,\n} from \"../types.js\";\n\n/**\n * The conversation's platform-native channel kind, using the platform's own\n * vocabulary (Slack conversation types), not a mikan-invented one. Recorded\n * at message intake and used to derive the workspace projection when no\n * explicit workspace setting exists: public channels share workspace memory\n * read-write, private channels read it without writing back, DMs and\n * externally shared channels stay isolated.\n */\nexport type PlatformChannelKind = \"public_channel\" | \"private_channel\" | \"im\" | \"external\";\n\ninterface WorkspacePromptSources {\n  conversationDir: string;\n  conversationMemoryPath: string;\n  conversationSkillsDir: string;\n  globalMemoryPath?: string;\n  globalSkillsDir?: string;\n  /** True when globalMemoryPath is mounted read-only (shared-support + private visibility). */\n  globalMemoryReadOnly?: boolean;\n}\n\nexport interface WorkspaceProjection {\n  doorPolicy: WorkspaceDoorPolicy;\n  layout: WorkspaceLayout;\n  /** Only meaningful for shared-support layout; \"public\" is the default and preserves prior read-write behavior. */\n  visibility: WorkspaceVisibility;\n  mounts: ContainerMount[];\n  promptSources: WorkspacePromptSources;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geminixiang/mikan",
-  "version": "1.0.0-beta.44",
+  "version": "1.0.0-beta.46",
   "description": "Multi-platform AI coding agent for Slack, Telegram, Discord, and GitHub",
   "keywords": [
     "agent",
@@ -59,13 +59,11 @@
     "test:e2e": "vitest --run --config .config/vitest.e2e.config.ts",
     "test:e2e:slack": "vitest --run --config .config/vitest.e2e.config.ts e2e/slack",
     "test:e2e:slack:coverage": "vitest --run --coverage --coverage.reportsDirectory=.workspace/coverage --config .config/vitest.e2e.config.ts e2e/slack",
-    "gondolin:image:build": "sh scripts/build-gondolin-image.sh",
     "docs:dev": "astro dev --config .config/astro.config.mjs",
     "docs:build": "astro build --config .config/astro.config.mjs",
     "docs:preview": "astro preview --config .config/astro.config.mjs"
   },
   "dependencies": {
-    "@earendil-works/gondolin": "0.12.0",
     "@earendil-works/pi-agent-core": "^0.84.3",
     "@earendil-works/pi-ai": "^0.84.3",
     "@modelcontextprotocol/sdk": "^1.30.0",
@@ -78,7 +76,6 @@
     "diff": "^9.0.0",
     "discord.js": "^14.26.4",
     "grammy": "^1.44.0",
-    "jiti": "^2.7.0",
     "markdown-it": "^14.2.0",
     "undici": "^8.5.0"
   },
@@ -99,7 +96,8 @@
     "remark-gfm": "^4.0.1",
     "shx": "^0.4.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.9"
+    "vitest": "^4.1.9",
+    "zod": "^4.0.0"
   },
   "overrides": {
     "@discordjs/rest": {

package/dist/adapters/github/cloudbuild.d.ts

@@ -1,19 +0,0 @@
-export type { CloudBuildLogOptions } from "./types.js";
-import type { CloudBuildLogOptions } from "./types.js";
-/** Check runs reported by this app slug are Cloud Build builds. */
-export declare const CLOUD_BUILD_APP_SLUG = "google-cloud-build";
-export declare function isCloudBuildId(value: string): boolean;
-/** GCP project (id or number) from a Cloud Build details_url, or null. */
-export declare function projectFromDetailsUrl(detailsUrl: string | null | undefined): string | null;
-export declare class CloudBuildLogUnavailableError extends Error {
-    readonly consoleUrl?: string | undefined;
-    constructor(message: string, consoleUrl?: string | undefined);
-}
-/**
- * Fetch one build's log text: builds.get → the `log-<id>.txt` object in the
- * build's logs bucket. Throws CloudBuildLogUnavailableError (with the console
- * url when known) whenever the log cannot be read — access denied, build not
- * found, or CLOUD_LOGGING_ONLY builds that write no GCS object.
- */
-export declare function fetchCloudBuildLog(options: CloudBuildLogOptions): Promise<string>;
-//# sourceMappingURL=cloudbuild.d.ts.map

package/dist/adapters/github/cloudbuild.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cloudbuild.d.ts","sourceRoot":"","sources":["../../../src/adapters/github/cloudbuild.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAevD,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AAIzD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAErD;AAED,0EAA0E;AAC1E,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAQ1F;AAQD,qBAAa,6BAA8B,SAAQ,KAAK;aAGpC,UAAU,CAAC,EAAE,MAAM;IAFrC,YACE,OAAO,EAAE,MAAM,EACC,UAAU,CAAC,EAAE,MAAM,YAAA,EAIpC;CACF;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyCvF"}

package/dist/adapters/github/cloudbuild.js

@@ -1,71 +0,0 @@
-/**
- * Host-side Cloud Build log retrieval for `github_checks`. Cloud Build's
- * GitHub App reports check runs whose `external_id` is the build UUID and
- * whose `details_url` carries the GCP project; with ADC on the host (e.g. a
- * WIF external_account file) the build's log object can be read from GCS.
- *
- * Required IAM for the ADC principal: roles/cloudbuild.builds.viewer on the
- * project and roles/storage.objectViewer on the logs bucket.
- */
-const CLOUDBUILD_API = "https://cloudbuild.googleapis.com/v1";
-const GCS_API = "https://storage.googleapis.com/storage/v1";
-/** Check runs reported by this app slug are Cloud Build builds. */
-export const CLOUD_BUILD_APP_SLUG = "google-cloud-build";
-const BUILD_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-export function isCloudBuildId(value) {
-    return BUILD_ID_PATTERN.test(value);
-}
-/** GCP project (id or number) from a Cloud Build details_url, or null. */
-export function projectFromDetailsUrl(detailsUrl) {
-    if (!detailsUrl)
-        return null;
-    try {
-        const project = new URL(detailsUrl).searchParams.get("project");
-        return project || null;
-    }
-    catch {
-        return null;
-    }
-}
-export class CloudBuildLogUnavailableError extends Error {
-    constructor(message, consoleUrl) {
-        super(message);
-        this.consoleUrl = consoleUrl;
-        this.name = "CloudBuildLogUnavailableError";
-    }
-}
-/**
- * Fetch one build's log text: builds.get → the `log-<id>.txt` object in the
- * build's logs bucket. Throws CloudBuildLogUnavailableError (with the console
- * url when known) whenever the log cannot be read — access denied, build not
- * found, or CLOUD_LOGGING_ONLY builds that write no GCS object.
- */
-export async function fetchCloudBuildLog(options) {
-    const fetchImpl = options.fetchImpl ?? fetch;
-    const token = await options.tokenProvider.getAccessToken();
-    const authHeaders = { Authorization: `Bearer ${token}` };
-    const buildResponse = await fetchImpl(`${CLOUDBUILD_API}/projects/${encodeURIComponent(options.project)}/builds/${encodeURIComponent(options.buildId)}`, { headers: authHeaders });
-    if (!buildResponse.ok) {
-        throw new CloudBuildLogUnavailableError(`Cloud Build builds.get failed with ${buildResponse.status} — check that the ADC ` +
-            `principal has roles/cloudbuild.builds.viewer on project ${options.project}.`);
-    }
-    const build = (await buildResponse.json());
-    if (!build.logsBucket) {
-        throw new CloudBuildLogUnavailableError("This build stores logs in Cloud Logging only (no GCS log object); read them in the console.", build.logUrl);
-    }
-    // logsBucket may be spelled gs://bucket or gs://bucket/some/prefix.
-    const bucketPath = build.logsBucket.replace(/^gs:\/\//, "");
-    const [bucket, ...prefixParts] = bucketPath.split("/");
-    const prefix = prefixParts.length > 0 ? `${prefixParts.join("/")}/` : "";
-    const objectName = encodeURIComponent(`${prefix}log-${options.buildId}.txt`);
-    const logResponse = await fetchImpl(`${GCS_API}/b/${bucket}/o/${objectName}?alt=media`, {
-        headers: authHeaders,
-    });
-    if (!logResponse.ok) {
-        throw new CloudBuildLogUnavailableError(`Cloud Build log object gs://${bucket}/${prefix}log-${options.buildId}.txt returned ` +
-            `${logResponse.status} — the ADC principal may lack roles/storage.objectViewer on the ` +
-            `logs bucket, or the build writes logs elsewhere.`, build.logUrl);
-    }
-    return logResponse.text();
-}
-//# sourceMappingURL=cloudbuild.js.map

package/dist/adapters/github/cloudbuild.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cloudbuild.js","sourceRoot":"","sources":["../../../src/adapters/github/cloudbuild.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH,MAAM,cAAc,GAAG,sCAAsC,CAAC;AAC9D,MAAM,OAAO,GAAG,2CAA2C,CAAC;AAE5D,mEAAmE;AACnE,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAEzD,MAAM,gBAAgB,GAAG,iEAAiE,CAAC;AAE3F,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,qBAAqB,CAAC,UAAqC;IACzE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChE,OAAO,OAAO,IAAI,IAAI,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAQD,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD,YACE,OAAe,EACC,UAAmB;QAEnC,KAAK,CAAC,OAAO,CAAC,CAAC;0BAFC,UAAU;QAG1B,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA6B;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;IAC3D,MAAM,WAAW,GAAG,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;IAEzD,MAAM,aAAa,GAAG,MAAM,SAAS,CACnC,GAAG,cAAc,aAAa,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EACjH,EAAE,OAAO,EAAE,WAAW,EAAE,CACzB,CAAC;IACF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,6BAA6B,CACrC,sCAAsC,aAAa,CAAC,MAAM,wBAAwB;YAChF,2DAA2D,OAAO,CAAC,OAAO,GAAG,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAoB,CAAC;IAE9D,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,IAAI,6BAA6B,CACrC,6FAA6F,EAC7F,KAAK,CAAC,MAAM,CACb,CAAC;IACJ,CAAC;IACD,oEAAoE;IACpE,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,MAAM,CAAC,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,MAAM,OAAO,OAAO,CAAC,OAAO,MAAM,CAAC,CAAC;IAE7E,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,MAAM,MAAM,MAAM,UAAU,YAAY,EAAE;QACtF,OAAO,EAAE,WAAW;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,6BAA6B,CACrC,+BAA+B,MAAM,IAAI,MAAM,OAAO,OAAO,CAAC,OAAO,gBAAgB;YACnF,GAAG,WAAW,CAAC,MAAM,kEAAkE;YACvF,kDAAkD,EACpD,KAAK,CAAC,MAAM,CACb,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC;AAC5B,CAAC","sourcesContent":["export type { CloudBuildLogOptions } from \"./types.js\";\nimport type { CloudBuildLogOptions } from \"./types.js\";\n\n/**\n * Host-side Cloud Build log retrieval for `github_checks`. Cloud Build's\n * GitHub App reports check runs whose `external_id` is the build UUID and\n * whose `details_url` carries the GCP project; with ADC on the host (e.g. a\n * WIF external_account file) the build's log object can be read from GCS.\n *\n * Required IAM for the ADC principal: roles/cloudbuild.builds.viewer on the\n * project and roles/storage.objectViewer on the logs bucket.\n */\n\nconst CLOUDBUILD_API = \"https://cloudbuild.googleapis.com/v1\";\nconst GCS_API = \"https://storage.googleapis.com/storage/v1\";\n\n/** Check runs reported by this app slug are Cloud Build builds. */\nexport const CLOUD_BUILD_APP_SLUG = \"google-cloud-build\";\n\nconst BUILD_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\nexport function isCloudBuildId(value: string): boolean {\n  return BUILD_ID_PATTERN.test(value);\n}\n\n/** GCP project (id or number) from a Cloud Build details_url, or null. */\nexport function projectFromDetailsUrl(detailsUrl: string | null | undefined): string | null {\n  if (!detailsUrl) return null;\n  try {\n    const project = new URL(detailsUrl).searchParams.get(\"project\");\n    return project || null;\n  } catch {\n    return null;\n  }\n}\n\ninterface CloudBuildBuild {\n  status?: string;\n  logsBucket?: string;\n  logUrl?: string;\n}\n\nexport class CloudBuildLogUnavailableError extends Error {\n  constructor(\n    message: string,\n    public readonly consoleUrl?: string,\n  ) {\n    super(message);\n    this.name = \"CloudBuildLogUnavailableError\";\n  }\n}\n\n/**\n * Fetch one build's log text: builds.get → the `log-<id>.txt` object in the\n * build's logs bucket. Throws CloudBuildLogUnavailableError (with the console\n * url when known) whenever the log cannot be read — access denied, build not\n * found, or CLOUD_LOGGING_ONLY builds that write no GCS object.\n */\nexport async function fetchCloudBuildLog(options: CloudBuildLogOptions): Promise<string> {\n  const fetchImpl = options.fetchImpl ?? fetch;\n  const token = await options.tokenProvider.getAccessToken();\n  const authHeaders = { Authorization: `Bearer ${token}` };\n\n  const buildResponse = await fetchImpl(\n    `${CLOUDBUILD_API}/projects/${encodeURIComponent(options.project)}/builds/${encodeURIComponent(options.buildId)}`,\n    { headers: authHeaders },\n  );\n  if (!buildResponse.ok) {\n    throw new CloudBuildLogUnavailableError(\n      `Cloud Build builds.get failed with ${buildResponse.status} — check that the ADC ` +\n        `principal has roles/cloudbuild.builds.viewer on project ${options.project}.`,\n    );\n  }\n  const build = (await buildResponse.json()) as CloudBuildBuild;\n\n  if (!build.logsBucket) {\n    throw new CloudBuildLogUnavailableError(\n      \"This build stores logs in Cloud Logging only (no GCS log object); read them in the console.\",\n      build.logUrl,\n    );\n  }\n  // logsBucket may be spelled gs://bucket or gs://bucket/some/prefix.\n  const bucketPath = build.logsBucket.replace(/^gs:\\/\\//, \"\");\n  const [bucket, ...prefixParts] = bucketPath.split(\"/\");\n  const prefix = prefixParts.length > 0 ? `${prefixParts.join(\"/\")}/` : \"\";\n  const objectName = encodeURIComponent(`${prefix}log-${options.buildId}.txt`);\n\n  const logResponse = await fetchImpl(`${GCS_API}/b/${bucket}/o/${objectName}?alt=media`, {\n    headers: authHeaders,\n  });\n  if (!logResponse.ok) {\n    throw new CloudBuildLogUnavailableError(\n      `Cloud Build log object gs://${bucket}/${prefix}log-${options.buildId}.txt returned ` +\n        `${logResponse.status} — the ADC principal may lack roles/storage.objectViewer on the ` +\n        `logs bucket, or the build writes logs elsewhere.`,\n      build.logUrl,\n    );\n  }\n  return logResponse.text();\n}\n"]}

package/dist/adapters/github/gcp-auth.d.ts

@@ -1,28 +0,0 @@
-export type { GcpTokenProviderOptions } from "./types.js";
-import type { GcpTokenProviderOptions } from "./types.js";
-export declare class GcpAuthError extends Error {
-    constructor(message: string, options?: {
-        cause?: unknown;
-    });
-}
-export declare class GcpTokenProvider {
-    private readonly credentialsPath;
-    private readonly fetchImpl;
-    private credentials;
-    private cached;
-    private inFlight;
-    constructor(options: GcpTokenProviderOptions);
-    /** A valid cloud-platform access token, cached until near expiry. */
-    getAccessToken(): Promise<string>;
-    private loadCredentials;
-    private mintToken;
-    private postForm;
-    /** WIF: read the subject token, exchange at STS, optionally impersonate. */
-    private mintExternalAccount;
-    private readSubjectToken;
-    /** Service-account key: self-signed RS256 JWT → assertion grant. */
-    private mintServiceAccount;
-    /** gcloud user ADC: refresh-token grant. */
-    private mintAuthorizedUser;
-}
-//# sourceMappingURL=gcp-auth.d.ts.map

package/dist/adapters/github/gcp-auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"gcp-auth.d.ts","sourceRoot":"","sources":["../../../src/adapters/github/gcp-auth.ts"],"names":[],"mappings":"AAEA,YAAY,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AA2D1D,qBAAa,YAAa,SAAQ,KAAK;IACrC,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAGzD;CACF;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,WAAW,CAA+B;IAClD,OAAO,CAAC,MAAM,CAAqD;IACnE,OAAO,CAAC,QAAQ,CAAgC;IAEhD,YAAY,OAAO,EAAE,uBAAuB,EAG3C;IAED,qEAAqE;IAC/D,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAStC;IAED,OAAO,CAAC,eAAe;YAqBT,SAAS;YAqBT,QAAQ;IAiBtB,4EAA4E;YAC9D,mBAAmB;YA4CnB,gBAAgB;IA+B9B,oEAAoE;YACtD,kBAAkB;IAiChC,4CAA4C;YAC9B,kBAAkB;CAkBjC"}