@gilbertgt/dsh-plan-orchestrator 1.0.0

package/lib/github-Cy4Pm35G.js

@@ -0,0 +1,577 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { createHash, randomUUID } from "node:crypto";
+import { dirname, join, posix, resolve, sep } from "node:path";
+import { lstat, mkdir, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+//#region src/contract/plan-artifact.ts
+const TOP = /* @__PURE__ */ new Set([
+	"planModeVersion",
+	"summary",
+	"complexity",
+	"decisionLocks",
+	"tasks",
+	"validationStrategy",
+	"validationCommands",
+	"risks",
+	"outOfScope"
+]);
+const TASK = /* @__PURE__ */ new Set([
+	"id",
+	"title",
+	"objective",
+	"read",
+	"modify",
+	"decisionLocks",
+	"requiredChanges",
+	"acceptanceCriteria",
+	"validation",
+	"dependsOn",
+	"parallelSafe"
+]);
+const VCMD = /* @__PURE__ */ new Set([
+	"id",
+	"taskIds",
+	"command",
+	"timeoutMs"
+]);
+const glob = /[*?\[\]{}!]/;
+const drive = /^[A-Za-z]:[\\/]/;
+const bytes = (s) => Buffer.byteLength(s, "utf8");
+const SAFE_VALIDATION_TOKEN = /^[A-Za-z0-9_./:@+=,-]+$/;
+const MANAGERS = /* @__PURE__ */ new Set([
+	"npm",
+	"pnpm",
+	"yarn",
+	"bun"
+]);
+const stringArray = (v, field) => {
+	if (!Array.isArray(v) || v.some((x) => typeof x !== "string")) throw new Error(`${field} must be a string array`);
+	return [...v];
+};
+function strictKeys(value, allowed, where) {
+	const unknown = Object.keys(value).filter((k) => !allowed.has(k));
+	if (unknown.length) throw new Error(`${where} has unknown field(s): ${unknown.join(", ")}`);
+}
+/**
+* Validation is intentionally not an arbitrary shell surface. The Planner may
+* select an existing project package script, but it cannot inject redirection,
+* pipes, command substitution, inline interpreters, download-and-execute tools,
+* or an arbitrary executable into the host validation phase.
+*/
+function parseValidationCommand(command) {
+	if (typeof command !== "string" || !command.trim() || command.includes("\0") || bytes(command) > 2048) throw new Error("validation command invalid");
+	const tokens = command.trim().split(/\s+/);
+	if (tokens.some((token) => !SAFE_VALIDATION_TOKEN.test(token))) throw new Error("validation command may contain only conservative package-script tokens");
+	const manager = tokens.shift().toLowerCase().replace(/\.(?:cmd|exe)$/i, "");
+	if (!MANAGERS.has(manager)) throw new Error("validation command must use npm, pnpm, yarn, or bun package scripts");
+	const action = tokens.shift();
+	let script;
+	if (action === "test") {
+		if (manager === "bun") throw new Error("bun validation must use bun run <script>; bun test is a direct runner, not a package script");
+		script = "test";
+	} else if (action === "run") script = tokens.shift();
+	if (!script || !/^[A-Za-z0-9_.:@/-]{1,128}$/.test(script) || script === "." || script === ".." || script.includes("../")) throw new Error("validation command must select one existing package script");
+	let args = [];
+	if (tokens.length) {
+		if (tokens[0] !== "--") throw new Error("validation command arguments must follow --");
+		args = tokens.slice(1);
+		if (args.some((arg) => arg === "--" || !SAFE_VALIDATION_TOKEN.test(arg))) throw new Error("validation command arguments invalid");
+	}
+	return {
+		manager,
+		script,
+		args
+	};
+}
+function normalizeOwnedPath(raw) {
+	if (!raw || raw.includes("\0") || raw.includes("\\")) throw new Error(`invalid owned path: ${JSON.stringify(raw)}`);
+	if (raw.startsWith("/") || drive.test(raw) || glob.test(raw) || raw.endsWith("/")) throw new Error(`owned path must be an exact repository-relative file: ${raw}`);
+	const normalized = posix.normalize(raw);
+	if (normalized === "." || normalized === ".." || normalized.startsWith("../") || normalized.includes("/../")) throw new Error(`owned path escapes repository: ${raw}`);
+	if (normalized !== raw) throw new Error(`owned path must be canonical: ${raw}`);
+	return normalized;
+}
+function schedulerPathIdentity(path, platform = process.platform) {
+	return platform === "win32" || platform === "darwin" ? path.toLocaleLowerCase("en-US") : path;
+}
+function validatePlanArtifact(input, requireExplicitOwnership = true) {
+	if (!input || typeof input !== "object" || Array.isArray(input)) throw new Error("PlanArtifact must be a JSON object");
+	const x = input;
+	strictKeys(x, TOP, "PlanArtifact");
+	if (x.planModeVersion !== 1) throw new Error("planModeVersion must equal 1");
+	if (typeof x.summary !== "string" || !x.summary.trim()) throw new Error("summary is required");
+	if (![
+		"small",
+		"medium",
+		"large"
+	].includes(String(x.complexity))) throw new Error("invalid complexity");
+	const decisionLocks = stringArray(x.decisionLocks, "decisionLocks"), validationStrategy = stringArray(x.validationStrategy, "validationStrategy");
+	const risks = stringArray(x.risks, "risks"), outOfScope = stringArray(x.outOfScope, "outOfScope");
+	if (!Array.isArray(x.tasks) || x.tasks.length === 0) throw new Error("tasks must be non-empty");
+	const ids = /* @__PURE__ */ new Set();
+	const tasks = x.tasks.map((raw, i) => {
+		if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new Error(`tasks[${i}] must be an object`);
+		const t = raw;
+		strictKeys(t, TASK, `tasks[${i}]`);
+		for (const key of [
+			"id",
+			"title",
+			"objective"
+		]) if (typeof t[key] !== "string" || !t[key].trim()) throw new Error(`tasks[${i}].${key} is required`);
+		if (ids.has(t.id)) throw new Error(`duplicate task id: ${t.id}`);
+		ids.add(t.id);
+		const read = stringArray(t.read, `tasks[${i}].read`).map(normalizeOwnedPath);
+		const modify = stringArray(t.modify, `tasks[${i}].modify`).map(normalizeOwnedPath);
+		if (requireExplicitOwnership && modify.length === 0) throw new Error(`tasks[${i}].modify must be non-empty`);
+		if (new Set(modify).size !== modify.length) throw new Error(`tasks[${i}].modify contains duplicates`);
+		const acceptanceCriteria = stringArray(t.acceptanceCriteria, `tasks[${i}].acceptanceCriteria`);
+		if (!acceptanceCriteria.length) throw new Error(`tasks[${i}].acceptanceCriteria must be non-empty`);
+		if (typeof t.parallelSafe !== "boolean") throw new Error(`tasks[${i}].parallelSafe must be boolean`);
+		return {
+			id: t.id,
+			title: t.title,
+			objective: t.objective,
+			read,
+			modify,
+			decisionLocks: stringArray(t.decisionLocks, `tasks[${i}].decisionLocks`),
+			requiredChanges: stringArray(t.requiredChanges, `tasks[${i}].requiredChanges`),
+			acceptanceCriteria,
+			validation: stringArray(t.validation, `tasks[${i}].validation`),
+			dependsOn: stringArray(t.dependsOn, `tasks[${i}].dependsOn`),
+			parallelSafe: t.parallelSafe
+		};
+	});
+	for (const t of tasks) for (const dep of t.dependsOn) if (!ids.has(dep) || dep === t.id) throw new Error(`task ${t.id} has invalid dependency ${dep}`);
+	assertAcyclic(tasks);
+	if (!Array.isArray(x.validationCommands) || x.validationCommands.length > 4) throw new Error("validationCommands may contain at most 4 commands");
+	const commandIds = /* @__PURE__ */ new Set();
+	const validationCommands = x.validationCommands.map((raw, i) => {
+		if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new Error(`validationCommands[${i}] must be object`);
+		const c = raw;
+		strictKeys(c, VCMD, `validationCommands[${i}]`);
+		if (typeof c.id !== "string" || !c.id.trim() || commandIds.has(c.id)) throw new Error(`invalid/duplicate validation command id`);
+		commandIds.add(c.id);
+		const taskIds = stringArray(c.taskIds, `validationCommands[${i}].taskIds`);
+		if (!taskIds.length || taskIds.some((id) => !ids.has(id))) throw new Error(`validationCommands[${i}] references unknown task`);
+		if (typeof c.command !== "string" || !c.command.trim() || c.command.includes("\0") || bytes(c.command) > 2048) throw new Error(`validationCommands[${i}].command invalid`);
+		try {
+			parseValidationCommand(c.command);
+		} catch (error) {
+			throw new Error(`validationCommands[${i}].command unsafe: ${error.message}`);
+		}
+		if (!Number.isSafeInteger(c.timeoutMs) || c.timeoutMs < 1 || c.timeoutMs > 6e5) throw new Error(`validationCommands[${i}].timeoutMs invalid`);
+		return {
+			id: c.id,
+			taskIds,
+			command: c.command,
+			timeoutMs: c.timeoutMs
+		};
+	});
+	return {
+		planModeVersion: 1,
+		summary: x.summary,
+		complexity: x.complexity,
+		decisionLocks,
+		tasks,
+		validationStrategy,
+		validationCommands,
+		risks,
+		outOfScope
+	};
+}
+function assertAcyclic(tasks) {
+	const byId = new Map(tasks.map((t) => [t.id, t]));
+	const state = /* @__PURE__ */ new Map();
+	const visit = (id) => {
+		const s = state.get(id) ?? 0;
+		if (s === 1) throw new Error(`dependency cycle includes ${id}`);
+		if (s === 2) return;
+		state.set(id, 1);
+		for (const d of byId.get(id).dependsOn) visit(d);
+		state.set(id, 2);
+	};
+	for (const t of tasks) visit(t.id);
+}
+function extractPlanArtifact(markdown, requireExplicitOwnership = true) {
+	const fences = [...markdown.matchAll(/```json\s*\n([\s\S]*?)\n```/gi)];
+	if (fences.length !== 1) throw new Error(`plan markdown must contain exactly one JSON candidate fence; found ${fences.length}`);
+	let parsed;
+	try {
+		parsed = JSON.parse(fences[0][1]);
+	} catch (e) {
+		throw new Error(`invalid PlanArtifact JSON: ${e.message}`);
+	}
+	const artifact = validatePlanArtifact(parsed, requireExplicitOwnership);
+	return {
+		artifact,
+		hash: createHash("sha256").update(JSON.stringify(artifact)).digest("hex")
+	};
+}
+//#endregion
+//#region src/git/repository.ts
+const execFileP = promisify(execFile);
+async function git(cwd, args, opts = {}) {
+	const r = await execFileP("git", args, {
+		cwd,
+		encoding: "buffer",
+		maxBuffer: opts.maxBuffer ?? 32 * 1024 * 1024,
+		windowsHide: true
+	});
+	return {
+		stdout: r.stdout,
+		stderr: r.stderr
+	};
+}
+function decodeUtf8Strict(buf) {
+	return new TextDecoder("utf-8", { fatal: true }).decode(buf);
+}
+function splitNul(buf) {
+	const text = decodeUtf8Strict(buf);
+	if (!text) return [];
+	const parts = text.split("\0");
+	if (parts.at(-1) === "") parts.pop();
+	return parts;
+}
+async function repoRoot(cwd) {
+	return decodeUtf8Strict((await git(cwd, ["rev-parse", "--show-toplevel"])).stdout).trim();
+}
+async function fullHead(cwd) {
+	const h = decodeUtf8Strict((await git(cwd, [
+		"rev-parse",
+		"--verify",
+		"HEAD"
+	])).stdout).trim();
+	if (!/^[0-9a-f]{40}$/.test(h)) throw new Error("HEAD is not a full SHA");
+	return h;
+}
+function assertRepoPath(root, path) {
+	const b = resolve(root), t = resolve(b, path);
+	if (t !== b && !t.startsWith(b + sep)) throw new Error(`path escapes repository: ${path}`);
+	return t;
+}
+function inside(root, target) {
+	return target === root || target.startsWith(root + sep);
+}
+async function nearestExisting(path) {
+	let current = path;
+	while (true) try {
+		await lstat(current);
+		return current;
+	} catch (e) {
+		if (e?.code !== "ENOENT") throw e;
+		const parent = dirname(current);
+		if (parent === current) throw new Error(`no existing ancestor for ${path}`);
+		current = parent;
+	}
+}
+/** Resolve existing symlink-bearing ancestors so an apparently in-repo target cannot escape through a junction/symlink. */
+async function assertRepoPathConfined(root, path) {
+	const lexical = assertRepoPath(root, path);
+	if (!inside(await realpath(resolve(root)), await realpath(await nearestExisting(lexical)))) throw new Error(`path escapes repository through symlink/junction: ${path}`);
+	return lexical;
+}
+async function assertRepoPathsConfined(root, paths) {
+	for (const path of paths) await assertRepoPathConfined(root, path);
+}
+async function changedPaths(cwd) {
+	const tracked = splitNul((await git(cwd, [
+		"diff",
+		"--name-only",
+		"-z",
+		"HEAD",
+		"--"
+	])).stdout);
+	const staged = splitNul((await git(cwd, [
+		"diff",
+		"--cached",
+		"--name-only",
+		"-z",
+		"HEAD",
+		"--"
+	])).stdout);
+	const untracked = splitNul((await git(cwd, [
+		"ls-files",
+		"--others",
+		"--exclude-standard",
+		"-z"
+	])).stdout);
+	return [.../* @__PURE__ */ new Set([
+		...tracked,
+		...staged,
+		...untracked
+	])];
+}
+//#endregion
+//#region src/recovery/store.ts
+const stateRoot = () => resolve(process.env.DSH_HOME ? join(process.env.DSH_HOME, "state", "plan-orchestrator") : join(homedir(), ".dsh", "state", "plan-orchestrator"));
+function confined(root, ...parts) {
+	const base = resolve(root), target = resolve(base, ...parts);
+	if (target !== base && !target.startsWith(base + sep)) throw new Error("artifact path escapes plugin root");
+	return target;
+}
+async function atomicJson(path, value) {
+	await mkdir(dirname(path), { recursive: true });
+	const tmp = `${path}.${randomUUID()}.tmp`;
+	const body = JSON.stringify(value, null, 2) + "\n";
+	await writeFile(tmp, body, {
+		encoding: "utf8",
+		mode: 384
+	});
+	await rename(tmp, path);
+	return createHash("sha256").update(body).digest("hex");
+}
+async function readJson(path) {
+	return JSON.parse(await readFile(path, "utf8"));
+}
+var RunStore = class {
+	root;
+	constructor(root = stateRoot()) {
+		this.root = root;
+	}
+	sessionDir(sessionId) {
+		return confined(this.root, "sessions", safe(sessionId));
+	}
+	runDir(sessionId, runId) {
+		return confined(this.root, "sessions", safe(sessionId), safe(runId));
+	}
+	manifestPath(sessionId, runId) {
+		return join(this.runDir(sessionId, runId), "manifest.json");
+	}
+	async writeManifest(m) {
+		m.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+		return atomicJson(this.manifestPath(m.sessionId, m.runId), m);
+	}
+	async readManifest(sessionId, runId) {
+		return readJson(this.manifestPath(sessionId, runId));
+	}
+	async listSessionManifests(sessionId) {
+		const dir = this.sessionDir(sessionId);
+		let names = [];
+		try {
+			names = await readdir(dir);
+		} catch (e) {
+			if (e?.code === "ENOENT") return [];
+			throw e;
+		}
+		const out = [];
+		for (const name of names) try {
+			const p = join(dir, name, "manifest.json");
+			if ((await stat(p)).isFile()) out.push(await readJson(p));
+		} catch {}
+		return out.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
+	}
+	async removeRun(sessionId, runId) {
+		return rm(this.runDir(sessionId, runId), {
+			recursive: true,
+			force: true
+		});
+	}
+};
+function safe(v) {
+	if (!/^[A-Za-z0-9._-]{1,200}$/.test(v)) return createHash("sha256").update(v).digest("hex");
+	return v;
+}
+//#endregion
+//#region src/git/ownership.ts
+function assertOwnedPaths(changed, allowed, platform = process.platform) {
+	const set = new Set(allowed.map((p) => schedulerPathIdentity(p, platform)));
+	const outside = changed.filter((p) => !set.has(schedulerPathIdentity(p, platform)));
+	if (outside.length) throw new Error(`ownership violation: ${outside.join(", ")}`);
+	return true;
+}
+function disjointOwnership(a, b, platform = process.platform) {
+	const set = new Set(a.map((p) => schedulerPathIdentity(p, platform)));
+	return !b.some((p) => set.has(schedulerPathIdentity(p, platform)));
+}
+//#endregion
+//#region src/validation/receipts.ts
+const hashBytes = (bytes) => createHash("sha256").update(bytes).digest("hex");
+function verifyReceiptHash(receipt, stdout, stderr) {
+	return hashBytes(stdout) === receipt.stdout.sha256 && hashBytes(stderr) === receipt.stderr.sha256;
+}
+//#endregion
+//#region src/validation/review-handoff.ts
+function receiptIndex(receipts) {
+	return receipts.map((receipt) => ({
+		commandId: receipt.commandId,
+		command: receipt.command,
+		status: receipt.status,
+		exitCode: receipt.exitCode,
+		start: receipt.start,
+		end: receipt.end,
+		timeoutMs: receipt.timeoutMs,
+		boundHead: receipt.boundHead,
+		ownershipFingerprint: receipt.ownershipFingerprint,
+		stdout: {
+			sha256: receipt.stdout.sha256,
+			bytes: receipt.stdout.bytes,
+			truncated: receipt.stdout.truncated
+		},
+		stderr: {
+			sha256: receipt.stderr.sha256,
+			bytes: receipt.stderr.bytes,
+			truncated: receipt.stderr.truncated
+		},
+		complete: receipt.complete
+	}));
+}
+async function assertTrustedReceipts(receipts, expectedHead, expectedOwnershipFingerprint) {
+	for (const receipt of receipts) {
+		if (receipt.boundHead !== expectedHead) throw new Error(`stale validation receipt ${receipt.commandId}: HEAD ${receipt.boundHead}`);
+		if (expectedOwnershipFingerprint !== void 0 && receipt.ownershipFingerprint !== expectedOwnershipFingerprint) throw new Error(`stale validation receipt ${receipt.commandId}: ownership fingerprint changed`);
+		if (receipt.status !== "PASS" || !receipt.complete || receipt.stdout.truncated || receipt.stderr.truncated) throw new Error(`validation receipt ${receipt.commandId} is not a complete PASS`);
+		if (receipt.stdout.bytes > 16 * 1024 * 1024 || receipt.stderr.bytes > 16 * 1024 * 1024) throw new Error(`validation receipt ${receipt.commandId} exceeds hard stream cap`);
+		const [stdout, stderr] = await Promise.all([readFile(receipt.stdout.path), readFile(receipt.stderr.path)]);
+		if (stdout.length !== receipt.stdout.bytes || stderr.length !== receipt.stderr.bytes || !verifyReceiptHash(receipt, stdout, stderr)) throw new Error(`tampered validation receipt ${receipt.commandId}`);
+	}
+	return true;
+}
+//#endregion
+//#region src/external/github.ts
+const exec = promisify(execFile);
+async function ghRaw(cwd, args) {
+	const r = await exec("gh", args, {
+		cwd,
+		encoding: "utf8",
+		windowsHide: true,
+		maxBuffer: 8 * 1024 * 1024
+	});
+	return String(r.stdout ?? "");
+}
+async function gh(cwd, args) {
+	const raw = await ghRaw(cwd, args);
+	return JSON.parse(raw || "null");
+}
+async function ghRepository(cwd) {
+	await exec("gh", ["auth", "status"], {
+		cwd,
+		encoding: "utf8",
+		windowsHide: true
+	});
+	return gh(cwd, [
+		"repo",
+		"view",
+		"--json",
+		"nameWithOwner,defaultBranchRef"
+	]);
+}
+async function ghPreflight(cwd, repository) {
+	const actual = await ghRepository(cwd);
+	if (actual?.nameWithOwner !== repository) throw new Error(`repository mismatch: ${actual?.nameWithOwner} != ${repository}`);
+	return actual;
+}
+async function fetchIssue(cwd, issue) {
+	return gh(cwd, [
+		"issue",
+		"view",
+		String(issue),
+		"--json",
+		"number,state,url,body,author,comments"
+	]);
+}
+async function ghRepositoryPermission(cwd, repository, login) {
+	if (!/^[A-Za-z0-9-]{1,100}$/.test(login)) return void 0;
+	if (!/^[-A-Za-z0-9_.]+\/[-A-Za-z0-9_.]+$/.test(repository)) return void 0;
+	try {
+		const permission = (await ghRaw(cwd, [
+			"api",
+			`repos/${repository}/collaborators/${login}/permission`,
+			"--jq",
+			".permission"
+		])).trim();
+		return [
+			"admin",
+			"maintain",
+			"write",
+			"triage",
+			"read"
+		].includes(permission) ? permission : void 0;
+	} catch {
+		return;
+	}
+}
+function canAuthorExternalControl(permission) {
+	return permission === "admin" || permission === "maintain" || permission === "write";
+}
+async function trustedIssueTexts(cwd, repository, issue, permissionLookup = ghRepositoryPermission) {
+	const sources = [{
+		body: String(issue?.body ?? ""),
+		login: String(issue?.author?.login ?? "")
+	}, ...(issue?.comments ?? []).map((comment) => ({
+		body: String(comment?.body ?? ""),
+		login: String(comment?.author?.login ?? "")
+	}))];
+	const cache = /* @__PURE__ */ new Map();
+	const trusted = [];
+	for (const source of sources) {
+		if (!source.login || !source.body) continue;
+		let allowed = cache.get(source.login);
+		if (allowed === void 0) {
+			allowed = canAuthorExternalControl(await permissionLookup(cwd, repository, source.login));
+			cache.set(source.login, allowed);
+		}
+		if (allowed) trusted.push(source.body);
+	}
+	return trusted;
+}
+async function ensureBaseCommit(cwd, sha) {
+	await git(cwd, [
+		"cat-file",
+		"-e",
+		`${sha}^{commit}`
+	]);
+	return sha;
+}
+async function branchExists(cwd, branch) {
+	try {
+		await git(cwd, [
+			"show-ref",
+			"--verify",
+			"--quiet",
+			`refs/heads/${branch}`
+		]);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function prepareIssueBranch(cwd, branch, baseCommit) {
+	const root = await repoRoot(cwd), dirty = await changedPaths(root);
+	if (dirty.length) throw new Error(`external issue mode requires a clean working tree; dirty: ${dirty.join(", ")}`);
+	await ensureBaseCommit(root, baseCommit);
+	if (await branchExists(root, branch)) {
+		await git(root, ["switch", branch]);
+		if (await fullHead(root) !== baseCommit) throw new Error(`existing ${branch} is not at trusted baseCommit; continuation requires remote completion/recovery evidence`);
+	} else await git(root, [
+		"switch",
+		"-c",
+		branch,
+		baseCommit
+	]);
+	return root;
+}
+async function remotePr(cwd, pr) {
+	return gh(cwd, [
+		"pr",
+		"view",
+		String(pr),
+		"--json",
+		"number,state,url,headRefOid,headRefName"
+	]);
+}
+async function openPrForBranch(cwd, branch) {
+	const rows = await gh(cwd, [
+		"pr",
+		"list",
+		"--head",
+		branch,
+		"--state",
+		"open",
+		"--json",
+		"number,state,url,headRefOid,headRefName"
+	]);
+	return Array.isArray(rows) ? rows[0] : void 0;
+}
+//#endregion
+export { validatePlanArtifact as A, git as C, normalizeOwnedPath as D, extractPlanArtifact as E, parseValidationCommand as O, fullHead as S, splitNul as T, readJson as _, openPrForBranch as a, changedPaths as b, trustedIssueTexts as c, hashBytes as d, assertOwnedPaths as f, confined as g, atomicJson as h, ghRepository as i, schedulerPathIdentity as k, assertTrustedReceipts as l, RunStore as m, ghPreflight as n, prepareIssueBranch as o, disjointOwnership as p, ghRaw as r, remotePr as s, fetchIssue as t, receiptIndex as u, stateRoot as v, repoRoot as w, decodeUtf8Strict as x, assertRepoPathsConfined as y };