@guilz-dev/belay 0.6.0 → 0.8.0

package/dist/core/git-resource-identity.js

@@ -0,0 +1,284 @@
+import { lstatSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import path from 'node:path';
+function canonicalExistingPath(targetPath) {
+    try {
+        return realpathSync.native(targetPath);
+    }
+    catch {
+        return null;
+    }
+}
+function isDirectory(targetPath) {
+    try {
+        return statSync(targetPath).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function nearestExistingDirectory(targetPath) {
+    let current = path.resolve(targetPath);
+    while (true) {
+        try {
+            const stats = statSync(current);
+            const directory = stats.isDirectory() ? current : path.dirname(current);
+            const canonical = canonicalExistingPath(directory);
+            return canonical ? { status: 'resolved', directory: canonical } : { status: 'invalid' };
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== 'ENOENT' && code !== 'ENOTDIR') {
+                return { status: 'invalid' };
+            }
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return { status: 'invalid' };
+        }
+        current = parent;
+    }
+}
+function readSingleMetadataLine(metadataPath) {
+    try {
+        const value = readFileSync(metadataPath, 'utf8').trim();
+        if (!value || value.includes('\0') || value.includes('\n') || value.includes('\r')) {
+            return null;
+        }
+        return value;
+    }
+    catch {
+        return null;
+    }
+}
+function pathEntryStatus(targetPath) {
+    try {
+        lstatSync(targetPath);
+        return 'present';
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return 'absent';
+        }
+        return 'unreadable';
+    }
+}
+function resolveMetadataDirectory(value, baseDirectory) {
+    const candidate = path.isAbsolute(value) ? value : path.resolve(baseDirectory, value);
+    if (!isDirectory(candidate)) {
+        return null;
+    }
+    return canonicalExistingPath(candidate);
+}
+function hasValidCommonDirStructure(commonDir) {
+    return (hasValidHead(commonDir) &&
+        hasValidGitConfig(commonDir) &&
+        isDirectory(path.join(commonDir, 'objects')) &&
+        isDirectory(path.join(commonDir, 'refs')));
+}
+function hasValidHead(gitDir) {
+    const head = readSingleMetadataLine(path.join(gitDir, 'HEAD'));
+    return head !== null && (/^ref:\s+refs\/\S+$/.test(head) || /^[0-9a-f]{40,64}$/i.test(head));
+}
+function hasValidGitConfig(gitDir) {
+    const configPath = path.join(gitDir, 'config');
+    try {
+        return (statSync(configPath).isFile() && /^\s*\[core\]\s*$/im.test(readFileSync(configPath, 'utf8')));
+    }
+    catch {
+        return false;
+    }
+}
+function looksLikeBareBoundary(candidate) {
+    const markers = [
+        pathEntryStatus(path.join(candidate, 'HEAD')),
+        pathEntryStatus(path.join(candidate, 'config')),
+        pathEntryStatus(path.join(candidate, 'objects')),
+        pathEntryStatus(path.join(candidate, 'refs')),
+    ];
+    return markers.filter((status) => status !== 'absent').length >= 2;
+}
+function invalidInspection(boundaryPath, metadataRoots) {
+    return {
+        status: 'invalid',
+        boundaryPath,
+        metadataRoots: [...new Set(metadataRoots.map((root) => path.resolve(root)))],
+    };
+}
+function resolveBareIdentity(repositoryRoot) {
+    if (!looksLikeBareBoundary(repositoryRoot)) {
+        return null;
+    }
+    if (!hasValidCommonDirStructure(repositoryRoot)) {
+        return invalidInspection(repositoryRoot, [repositoryRoot]);
+    }
+    return {
+        status: 'resolved',
+        identity: {
+            repositoryRoot,
+            gitDir: repositoryRoot,
+            commonDir: repositoryRoot,
+            gitEntryPath: repositoryRoot,
+        },
+    };
+}
+function resolveLinkedIdentity(repositoryRoot, gitEntryPath) {
+    const forwardMetadata = readSingleMetadataLine(gitEntryPath);
+    const match = forwardMetadata?.match(/^gitdir:\s*(.+)$/);
+    const gitDirValue = match?.[1]?.trim();
+    if (!gitDirValue) {
+        return invalidInspection(repositoryRoot, [gitEntryPath]);
+    }
+    const gitDir = resolveMetadataDirectory(gitDirValue, repositoryRoot);
+    if (!gitDir) {
+        return invalidInspection(repositoryRoot, [gitEntryPath]);
+    }
+    const commonDirValue = readSingleMetadataLine(path.join(gitDir, 'commondir'));
+    const commonDir = commonDirValue ? resolveMetadataDirectory(commonDirValue, gitDir) : null;
+    const backpointerValue = readSingleMetadataLine(path.join(gitDir, 'gitdir'));
+    const backpointer = backpointerValue
+        ? canonicalExistingPath(path.isAbsolute(backpointerValue)
+            ? backpointerValue
+            : path.resolve(gitDir, backpointerValue))
+        : null;
+    const canonicalGitEntry = canonicalExistingPath(gitEntryPath);
+    const expectedWorktreesRoot = commonDir ? path.join(commonDir, 'worktrees') : null;
+    const linkedStructureValid = hasValidHead(gitDir) &&
+        commonDir !== null &&
+        hasValidCommonDirStructure(commonDir) &&
+        expectedWorktreesRoot !== null &&
+        path.dirname(gitDir) === expectedWorktreesRoot &&
+        backpointer !== null &&
+        canonicalGitEntry !== null &&
+        backpointer === canonicalGitEntry;
+    if (!linkedStructureValid || !commonDir || !canonicalGitEntry) {
+        return invalidInspection(repositoryRoot, [
+            gitEntryPath,
+            gitDir,
+            ...(commonDir ? [commonDir] : []),
+        ]);
+    }
+    return {
+        status: 'resolved',
+        identity: {
+            repositoryRoot,
+            gitDir,
+            commonDir,
+            gitEntryPath: canonicalGitEntry,
+        },
+    };
+}
+function inspectWorktreeBoundary(repositoryRoot) {
+    const gitEntryPath = path.join(repositoryRoot, '.git');
+    const entryStatus = pathEntryStatus(gitEntryPath);
+    if (entryStatus === 'absent') {
+        return null;
+    }
+    if (entryStatus === 'unreadable') {
+        return invalidInspection(repositoryRoot, [gitEntryPath]);
+    }
+    try {
+        if (lstatSync(gitEntryPath).isSymbolicLink()) {
+            return invalidInspection(repositoryRoot, [gitEntryPath]);
+        }
+        const entryStats = statSync(gitEntryPath);
+        if (entryStats.isFile()) {
+            return resolveLinkedIdentity(repositoryRoot, gitEntryPath);
+        }
+        if (!entryStats.isDirectory()) {
+            return invalidInspection(repositoryRoot, [gitEntryPath]);
+        }
+    }
+    catch {
+        return invalidInspection(repositoryRoot, [gitEntryPath]);
+    }
+    const gitDir = canonicalExistingPath(gitEntryPath);
+    const canonicalGitEntry = canonicalExistingPath(gitEntryPath);
+    if (!gitDir || !canonicalGitEntry || !hasValidCommonDirStructure(gitDir)) {
+        return invalidInspection(repositoryRoot, [gitEntryPath]);
+    }
+    return {
+        status: 'resolved',
+        identity: {
+            repositoryRoot,
+            gitDir,
+            commonDir: gitDir,
+            gitEntryPath: canonicalGitEntry,
+        },
+    };
+}
+/**
+ * Inspects the Git boundary containing a path without executing Git or a shell.
+ * Malformed or unreadable metadata is distinct from an absent Git boundary.
+ */
+export function inspectGitResourceIdentity(targetPath) {
+    const nearest = nearestExistingDirectory(targetPath);
+    if (nearest.status === 'invalid') {
+        return invalidInspection(path.resolve(targetPath), [path.resolve(targetPath)]);
+    }
+    let current = nearest.directory;
+    while (true) {
+        const worktree = inspectWorktreeBoundary(current);
+        if (worktree) {
+            return worktree;
+        }
+        const bare = resolveBareIdentity(current);
+        if (bare) {
+            return bare;
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return { status: 'absent' };
+        }
+        current = parent;
+    }
+}
+/** Resolves only structurally valid Git metadata; otherwise returns null. */
+export function resolveGitResourceIdentity(targetPath) {
+    const inspection = inspectGitResourceIdentity(targetPath);
+    return inspection.status === 'resolved' ? inspection.identity : null;
+}
+export function sameGitResourceIdentity(leftPath, rightPath) {
+    const left = resolveGitResourceIdentity(leftPath);
+    const right = resolveGitResourceIdentity(rightPath);
+    return left !== null && right !== null && left.commonDir === right.commonDir;
+}
+function canonicalTargetPath(targetPath) {
+    const resolved = path.resolve(targetPath);
+    let current = resolved;
+    const suffix = [];
+    while (true) {
+        const canonical = canonicalExistingPath(current);
+        if (canonical) {
+            return path.join(canonical, ...suffix);
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return resolved;
+        }
+        suffix.unshift(path.basename(current));
+        current = parent;
+    }
+}
+function pathWithin(root, targetPath) {
+    const relative = path.relative(root, targetPath);
+    return (relative === '' ||
+        (!path.isAbsolute(relative) && relative !== '..' && !relative.startsWith(`..${path.sep}`)));
+}
+/** Protects control data for any proven repository and any malformed Git boundary. */
+export function isGitMetadataPath(targetPath, _repositoryPath) {
+    const inspection = inspectGitResourceIdentity(targetPath);
+    const target = canonicalTargetPath(targetPath);
+    if (inspection.status === 'invalid') {
+        return inspection.metadataRoots.some((root) => {
+            const canonicalRoot = canonicalTargetPath(root);
+            return target === canonicalRoot || pathWithin(canonicalRoot, target);
+        });
+    }
+    if (inspection.status !== 'resolved') {
+        return false;
+    }
+    const { identity } = inspection;
+    return (target === identity.gitEntryPath ||
+        pathWithin(identity.gitDir, target) ||
+        pathWithin(identity.commonDir, target));
+}

package/dist/core/harvest.d.ts

@@ -1,7 +1,7 @@
 import type { CorpusCase } from '../corpus/types.js';
 import type { AuditRecord } from './audit-types.js';
 export declare const HARVEST_REPORT_SCHEMA_VERSION = 1;
-export type HarvestCandidateSource = 'deny_then_approve' | 'repeated_ask' | 'read_style_signal' | 'overrides_allow';
+export type HarvestCandidateSource = 'deny_then_approve' | 'repeated_ask' | 'read_style_signal';
 export type HarvestReviewOutcome = 'provably-benign' | 'accepted-benign' | 'reject';
 export interface HarvestCandidate {
     kind: 'shell';
@@ -35,12 +35,8 @@ export declare function filterRecordsForHarvest(records: AuditRecord[], options?
     since?: string;
     until?: string;
 }): AuditRecord[];
-export declare function extractHarvestCandidates(records: AuditRecord[], options?: {
-    allowPatterns?: string[];
-}): HarvestCandidate[];
-export declare function buildHarvestReport(records: AuditRecord[], options?: {
-    allowPatterns?: string[];
-}): HarvestReport;
+export declare function extractHarvestCandidates(records: AuditRecord[]): HarvestCandidate[];
+export declare function buildHarvestReport(records: AuditRecord[]): HarvestReport;
 export declare function applyHarvestReview(cases: CorpusCase[], params: {
     command: string;
     outcome: HarvestReviewOutcome;

package/dist/core/harvest.js

@@ -1,6 +1,5 @@
 import { computeRepeatedFingerprintAsks, isAvailabilityCausedAsk } from './audit-analysis.js';
 import { buildApprovalRoundTrips, filterAuditRecords, inferWouldBlock, isApprovalRecorded, isShellGateRecord, parseTimestamp, } from './audit-query.js';
-import { matchesCustomCommand } from './custom-command-match.js';
 export const HARVEST_REPORT_SCHEMA_VERSION = 1;
 const READ_STYLE_COMMAND_PATTERN = /^\s*(git\s+status|git\s+diff|git\s+log|git\s+show|ls\b|cat\b|head\b|tail\b|find\b|rg\b|grep\b|fd\b|bat\b|less\b|more\b|pwd\b|whoami\b|env\b|printenv\b|npm\s+(test|run\s+test)|pnpm\s+(test|run\s+test)|yarn\s+test)/;
 function shellRecords(records) {
@@ -145,7 +144,7 @@ export function filterRecordsForHarvest(records, options = {}) {
     });
     return augmentHarvestRoundTripPairs(scoped, timeFiltered);
 }
-export function extractHarvestCandidates(records, options = {}) {
+export function extractHarvestCandidates(records) {
     const shellOnly = shellRecords(records);
     const classifierAsks = shellOnly.filter((record) => inferWouldBlock(record) && !isAvailabilityCausedAsk(record));
     const map = new Map();
@@ -187,28 +186,6 @@ export function extractHarvestCandidates(records, options = {}) {
             source: 'read_style_signal',
         });
     }
-    // Current overrides.allow match on past would-blocks — not a changelog of new additions.
-    const allowPatterns = options.allowPatterns ?? [];
-    for (const record of classifierAsks) {
-        if (!record.fingerprint) {
-            continue;
-        }
-        const command = commandFromRecord(record);
-        if (!command) {
-            continue;
-        }
-        for (const pattern of allowPatterns) {
-            if (matchesCustomCommand(command, command, pattern)) {
-                upsertCandidate(map, {
-                    fingerprint: record.fingerprint,
-                    command,
-                    reason: record.reason ?? 'unknown',
-                    source: 'overrides_allow',
-                });
-                break;
-            }
-        }
-    }
     return [...map.values()].sort((left, right) => {
         if (right.askCount !== left.askCount) {
             return right.askCount - left.askCount;
@@ -216,11 +193,11 @@ export function extractHarvestCandidates(records, options = {}) {
         return left.command.localeCompare(right.command);
     });
 }
-export function buildHarvestReport(records, options = {}) {
+export function buildHarvestReport(records) {
     return {
         schemaVersion: HARVEST_REPORT_SCHEMA_VERSION,
         scope: 'shell',
-        candidates: extractHarvestCandidates(records, options),
+        candidates: extractHarvestCandidates(records),
         availabilityQueue: extractAvailabilityQueue(records),
     };
 }
@@ -265,7 +242,7 @@ export function applyHarvestReview(cases, params) {
         ...(reason ? { reason } : {}),
     };
     const followUp = category === 'provably-benign'
-        ? 'Next: run `pnpm corpus` and confirm hard gates pass before `pnpm build` refreshes the standing-allow catalog.'
+        ? 'Next: run `pnpm corpus` and confirm the CI-only hard gates pass. Corpus labels never grant runtime shell authority.'
         : 'Next: run `pnpm corpus` to verify corpus evaluation (accepted-benign is soft-gated).';
     return {
         cases: [...cases, nextCase],

package/dist/core/index.d.ts

@@ -3,7 +3,7 @@ export type { ApprovalReplayHint, ReplayActionContext, ReplayAdapterId, } from '
 /** @deprecated Use `buildRetryInstructionForConfig` */
 export { approvalFlow, buildApprovalRecordedMessage, buildReplayEnvelopeFields, buildReplayHint, buildRetryInstructionForConfig, buildRetryInstructionForConfig as buildRetryInstruction, canAutoReplay, getExecutionLeaseMs, replayShellCommand, validateReplayEnvelope, } from './approval-replay.js';
 export type { ApprovalStore } from './approval-service.js';
-export { consumeApprovedAfterCliReplay, createGateApprovalStore, gateApprovalStoreFromDeps, recordApproval, } from './approval-service.js';
+export { claimApprovedForReplay, consumeApprovedAfterCliReplay, createGateApprovalStore, gateApprovalStoreFromDeps, recordApproval, } from './approval-service.js';
 export type { AuditMetricsReport } from './audit-metrics.js';
 export { computeAuditMetrics, parseAuditNdjson } from './audit-metrics.js';
 export { classifySubagent } from './classify-subagent.js';
@@ -14,8 +14,12 @@ export { canonicalStringify, hashValue, shellFingerprint, subagentFingerprint, t
 export type { GatedAction, GatedActionKind, GatePermissionResponse, GateVerdict, } from './gate-contract.js';
 export { classifyResultToGateVerdict, GATE_CONTRACT_VERSION, isGatedAction, unnormalizedGateVerdict, } from './gate-contract.js';
 export { classifyGatedAction, GateNormalizationError, gateEnabledForAction, normalizeGatedAction, } from './gate-engine.js';
+export type { GitResourceIdentity, GitResourceIdentityInspection, } from './git-resource-identity.js';
+export { inspectGitResourceIdentity, isGitMetadataPath, resolveGitResourceIdentity, sameGitResourceIdentity, } from './git-resource-identity.js';
 export { matchesSensitivePath } from './glob.js';
 export { canonicalPath, hasOutsideRepoPath, normalizeToken, pathWithinRoot, relativeWithinRepo, resolveMutationTarget, } from './path-utils.js';
+export type { RecoveryBackend, RecoveryCheckpointEntry, RecoveryCheckpointEntryV1, RecoveryCheckpointEntryV2, RecoveryCheckpointManifest, RecoveryCheckpointManifestV1, RecoveryCheckpointManifestV2, RecoveryCheckpointState, RecoveryCheckpointSummary, RecoveryFileSnapshotV1, RecoveryFileSnapshotV2, RecoveryProofV1, RecoveryReceiptV1, } from './recovery/index.js';
+export { listRecoveryCheckpoints, RECOVERY_CHECKPOINT_CORRUPT, RECOVERY_CHECKPOINT_QUOTA, RECOVERY_RESTORE_CONFLICT, recoveryCheckpointStorageBytes, recoveryRestoreBinding, restoreRecoveryCheckpoint, showRecoveryCheckpoint, } from './recovery/index.js';
 export { fingerprintReplayPayload, subagentFingerprintSource } from './replay-scrub.js';
 export { scrubString, scrubValue } from './scrub.js';
 export { findCommandSubstitutions, MAX_SUBSTITUTION_DEPTH } from './shell-substitution.js';

package/dist/core/index.js

@@ -1,7 +1,7 @@
 export { APPROVAL_EXECUTION_LEASE_MS, approvalCommandMatch, compactApprovals, createApprovalRecord, createApprovalRecordWithEnvelope, isExecutionLeaseExpired, isExpired, mergeApprovalStates, nowIso, } from './approval.js';
 /** @deprecated Use `buildRetryInstructionForConfig` */
 export { approvalFlow, buildApprovalRecordedMessage, buildReplayEnvelopeFields, buildReplayHint, buildRetryInstructionForConfig, buildRetryInstructionForConfig as buildRetryInstruction, canAutoReplay, getExecutionLeaseMs, replayShellCommand, validateReplayEnvelope, } from './approval-replay.js';
-export { consumeApprovedAfterCliReplay, createGateApprovalStore, gateApprovalStoreFromDeps, recordApproval, } from './approval-service.js';
+export { claimApprovedForReplay, consumeApprovedAfterCliReplay, createGateApprovalStore, gateApprovalStoreFromDeps, recordApproval, } from './approval-service.js';
 export { computeAuditMetrics, parseAuditNdjson } from './audit-metrics.js';
 export { classifySubagent } from './classify-subagent.js';
 export { classifyToolUse } from './classify-tool.js';
@@ -10,8 +10,10 @@ export { matchesCustomCommand } from './custom-command-match.js';
 export { canonicalStringify, hashValue, shellFingerprint, subagentFingerprint, toolFingerprint, } from './fingerprint.js';
 export { classifyResultToGateVerdict, GATE_CONTRACT_VERSION, isGatedAction, unnormalizedGateVerdict, } from './gate-contract.js';
 export { classifyGatedAction, GateNormalizationError, gateEnabledForAction, normalizeGatedAction, } from './gate-engine.js';
+export { inspectGitResourceIdentity, isGitMetadataPath, resolveGitResourceIdentity, sameGitResourceIdentity, } from './git-resource-identity.js';
 export { matchesSensitivePath } from './glob.js';
 export { canonicalPath, hasOutsideRepoPath, normalizeToken, pathWithinRoot, relativeWithinRepo, resolveMutationTarget, } from './path-utils.js';
+export { listRecoveryCheckpoints, RECOVERY_CHECKPOINT_CORRUPT, RECOVERY_CHECKPOINT_QUOTA, RECOVERY_RESTORE_CONFLICT, recoveryCheckpointStorageBytes, recoveryRestoreBinding, restoreRecoveryCheckpoint, showRecoveryCheckpoint, } from './recovery/index.js';
 export { fingerprintReplayPayload, subagentFingerprintSource } from './replay-scrub.js';
 export { scrubString, scrubValue } from './scrub.js';
 export { findCommandSubstitutions, MAX_SUBSTITUTION_DEPTH } from './shell-substitution.js';

package/dist/core/judge-cloud-consent.js

@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto';
-import { loadApprovalState, saveApprovalState } from '../config-io.js';
+import { loadApprovalState, pendingApprovalsPath, saveApprovalState } from '../config-io.js';
 import { compactApprovals, createApprovalRecord } from './approval.js';
+import { mutateApprovalStateWithRetry } from './capability/approval-state-mutation.js';
 import { JUDGE_CLOUD_CONSENT_REASON } from './capability/reasons.js';
 export { JUDGE_CLOUD_CONSENT_REASON };
 export function judgeCloudConsentFingerprint(providerId, endpoint) {
@@ -10,18 +11,8 @@ export async function ensurePendingJudgeCloudConsentApproval(params) {
     const { repoRoot, config, providerId, endpoint } = params;
     const normalizedEndpoint = endpoint.trim();
     const fingerprint = judgeCloudConsentFingerprint(providerId, normalizedEndpoint);
-    const pending = await loadApprovalState(repoRoot, 'pending-approvals.json', config);
-    const compacted = compactApprovals(pending);
-    const existing = compacted.approvals.find((approval) => approval.kind === 'capability' &&
-        approval.reason === JUDGE_CLOUD_CONSENT_REASON &&
-        approval.fingerprint === fingerprint &&
-        approval.repoRoot === repoRoot);
-    if (existing) {
-        await saveApprovalState(repoRoot, 'pending-approvals.json', compacted, config);
-        return { approvalId: existing.approvalId, created: false };
-    }
     const approvalId = `belay_${randomUUID().replaceAll('-', '').slice(0, 12)}`;
-    const approval = createApprovalRecord({
+    const candidate = createApprovalRecord({
         kind: 'capability',
         fingerprint,
         repoRoot,
@@ -32,7 +23,30 @@ export async function ensurePendingJudgeCloudConsentApproval(params) {
         input: `belay judge use ${providerId} --endpoint ${normalizedEndpoint}`,
         inputKind: 'shell',
     });
-    compacted.approvals.push(approval);
-    await saveApprovalState(repoRoot, 'pending-approvals.json', compacted, config);
-    return { approvalId, created: true };
+    const outcome = await mutateApprovalStateWithRetry({
+        load: async () => ({
+            filePath: pendingApprovalsPath(repoRoot, config),
+            state: await loadApprovalState(repoRoot, 'pending-approvals.json', config),
+        }),
+        write: async (_filePath, state) => saveApprovalState(repoRoot, 'pending-approvals.json', state, config),
+        mutate: (state) => {
+            const compacted = compactApprovals(state);
+            const existing = compacted.approvals.find((approval) => approval.kind === 'capability' &&
+                approval.reason === JUDGE_CLOUD_CONSENT_REASON &&
+                approval.fingerprint === fingerprint &&
+                approval.repoRoot === repoRoot);
+            if (existing) {
+                return {
+                    state: compacted,
+                    result: { approvalId: existing.approvalId, created: false },
+                };
+            }
+            compacted.approvals.push(candidate);
+            return { state: compacted, result: { approvalId, created: true } };
+        },
+    });
+    if (!outcome) {
+        throw new Error('Failed to persist cloud judge consent approval');
+    }
+    return outcome;
 }

package/dist/core/network-endpoint.d.ts

@@ -0,0 +1,10 @@
+export interface NetworkEndpoint {
+    host: string;
+    port?: number;
+    protocol: string;
+}
+export interface NetworkEndpointParseOptions {
+    allowHostedGitShorthand?: boolean;
+    allowScpStyle?: boolean;
+}
+export declare function parseNetworkEndpoint(spec: string, options?: NetworkEndpointParseOptions): NetworkEndpoint | null;

package/dist/core/network-endpoint.js

@@ -0,0 +1,51 @@
+const SUPPORTED_URL_PROTOCOLS = new Set(['http:', 'https:', 'ssh:', 'git:']);
+const NON_NETWORK_COLON_PREFIXES = new Set([
+    'catalog',
+    'exec',
+    'file',
+    'link',
+    'npm',
+    'patch',
+    'portal',
+    'workspace',
+]);
+const HOSTED_GIT_PREFIXES = {
+    bitbucket: 'bitbucket.org',
+    github: 'github.com',
+    gitlab: 'gitlab.com',
+};
+export function parseNetworkEndpoint(spec, options = {}) {
+    const normalized = spec.trim().replace(/^git\+/, '');
+    if (options.allowHostedGitShorthand) {
+        const hostedGit = normalized.match(/^([a-z]+):(.+)$/i);
+        const hostedGitHost = hostedGit?.[1]
+            ? HOSTED_GIT_PREFIXES[hostedGit[1].toLowerCase()]
+            : undefined;
+        if (hostedGitHost && hostedGit?.[2]) {
+            return { host: hostedGitHost, protocol: 'git' };
+        }
+    }
+    try {
+        const url = new URL(normalized);
+        if (SUPPORTED_URL_PROTOCOLS.has(url.protocol) && url.hostname) {
+            return {
+                host: url.hostname,
+                ...(url.port ? { port: Number(url.port) } : {}),
+                protocol: url.protocol.slice(0, -1),
+            };
+        }
+    }
+    catch { }
+    if (!options.allowScpStyle || /^[A-Za-z]:[\\/]/.test(normalized)) {
+        return null;
+    }
+    const scpStyle = normalized.match(/^(?:([^@/\s:]+)@)?([^:/\s]+):(.+)$/);
+    if (!scpStyle) {
+        return null;
+    }
+    const [, , host, remotePath] = scpStyle;
+    if (!host || !remotePath || NON_NETWORK_COLON_PREFIXES.has(host.toLowerCase())) {
+        return null;
+    }
+    return { host: host.toLowerCase(), protocol: 'ssh' };
+}

package/dist/core/path-utils.js

@@ -1,5 +1,6 @@
-import { existsSync, realpathSync, statSync } from 'node:fs';
+import { existsSync, realpathSync } from 'node:fs';
 import path from 'node:path';
+import { inspectGitResourceIdentity } from './git-resource-identity.js';
 import { isFdDuplication, isRedirectOperator } from './shell-tokenizer.js';
 /**
  * Resolve symlinks for the longest existing prefix of `targetPath`, then append
@@ -65,9 +66,42 @@ export function relativeWithinRepo(repoRoot, targetPath) {
 }
 export function resolveWorkspaceRootMatch(repoRoot, trustedRoots = [], targetPath) {
     const canonicalRepoRoot = canonicalPath(repoRoot);
-    const repoRelative = relativeWithinRoot(repoRoot, targetPath);
-    if (repoRelative !== null) {
-        return { kind: 'repo', root: canonicalRepoRoot, relativePath: repoRelative };
+    const repoInspection = inspectGitResourceIdentity(repoRoot);
+    const targetInspection = inspectGitResourceIdentity(targetPath);
+    if (repoInspection.status === 'resolved') {
+        if (targetInspection.status === 'resolved') {
+            if (repoInspection.identity.commonDir === targetInspection.identity.commonDir) {
+                const relativePath = relativeWithinRoot(targetInspection.identity.repositoryRoot, targetPath);
+                if (relativePath !== null) {
+                    return {
+                        kind: 'repo',
+                        root: targetInspection.identity.repositoryRoot,
+                        relativePath,
+                    };
+                }
+            }
+            return null;
+        }
+        if (targetInspection.status === 'invalid') {
+            return null;
+        }
+        if (relativeWithinRoot(repoRoot, targetPath) !== null) {
+            return null;
+        }
+    }
+    else if (repoInspection.status === 'invalid') {
+        if (relativeWithinRoot(repoRoot, targetPath) !== null || targetInspection.status !== 'absent') {
+            return null;
+        }
+    }
+    else if (targetInspection.status === 'absent') {
+        const repoRelative = relativeWithinRoot(repoRoot, targetPath);
+        if (repoRelative !== null) {
+            return { kind: 'repo', root: canonicalRepoRoot, relativePath: repoRelative };
+        }
+    }
+    else {
+        return null;
     }
     const normalizedTrustedRoots = [...new Set(trustedRoots.map((root) => path.resolve(root)))]
         .filter((root) => root !== canonicalRepoRoot)
@@ -137,24 +171,9 @@ export function hasOutsideRepoPath(tokens, cwd, repoRoot) {
     });
 }
 export function containingGitRoot(targetPath) {
-    const resolved = canonicalPath(targetPath);
-    let current = resolved;
-    try {
-        if (!statSync(current).isDirectory()) {
-            current = path.dirname(current);
-        }
-    }
-    catch {
-        current = path.dirname(current);
-    }
-    while (true) {
-        if (existsSync(path.join(current, '.git'))) {
-            return current;
-        }
-        const parent = path.dirname(current);
-        if (parent === current) {
-            return null;
-        }
-        current = parent;
+    const inspection = inspectGitResourceIdentity(targetPath);
+    if (inspection.status === 'resolved') {
+        return inspection.identity.repositoryRoot;
     }
+    return inspection.status === 'invalid' ? inspection.boundaryPath : null;
 }

package/dist/core/process-runner.d.ts

@@ -0,0 +1,10 @@
+import { type SpawnOptionsWithoutStdio } from 'node:child_process';
+export interface ShellRunResult {
+    exitCode: number | null;
+    signal: string | null;
+    timedOut: boolean;
+    stdout?: string;
+    stderr?: string;
+}
+export declare function windowsProcessTreeKillArgs(pid: number): string[];
+export declare function runProcessWithBoundedOutput(file: string, args: string[], options: SpawnOptionsWithoutStdio, timeoutMs: number): Promise<ShellRunResult>;