@illuminis/comprism 0.1.5 → 0.1.7

package/out/machine/executor/index.js

@@ -0,0 +1,367 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NativeExecutor = exports.NATIVE_CAPABILITIES = exports.guessTestCommand = exports.stopForeground = exports.stopEverything = void 0;
+/**
+ * The executor: one implementation of every action, for every native client.
+ *
+ * Specification: docs/modules/CODING_AGENT_BUILD_SPECIFICATION.md §7.1 and
+ * register item E2.
+ *
+ * The terminal runs this today. **The editor extension and the desktop app
+ * bundle this same file rather than writing their own**, and that is the point
+ * of it existing separately from the command line interface around it. Three
+ * implementations of "read a file" would be three different answers to what a
+ * file contains, and the one that differs is always the one nobody is looking at.
+ *
+ * It decides nothing. Whether an action is allowed, which model asked for it and
+ * what it cost are all the server's business. This performs and reports.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const files_1 = require("./files");
+const documents_1 = require("./documents");
+const hooks = __importStar(require("./hooks"));
+const browser_1 = require("./browser");
+const notebook_1 = require("./notebook");
+const diagnostics_1 = require("./diagnostics");
+const worktree_1 = require("./worktree");
+const paths_1 = require("./paths");
+const git_1 = require("./git");
+const toolservers_1 = require("./toolservers");
+const shell_1 = require("./shell");
+Object.defineProperty(exports, "guessTestCommand", { enumerable: true, get: function () { return shell_1.guessTestCommand; } });
+Object.defineProperty(exports, "stopEverything", { enumerable: true, get: function () { return shell_1.stopEverything; } });
+Object.defineProperty(exports, "stopForeground", { enumerable: true, get: function () { return shell_1.stopForeground; } });
+/** Everything a machine with a shell can do. Sent to the server on hello, and
+ *  the catalog offered to the model is narrowed to it, so a client is never
+ *  told about an action it cannot perform. */
+exports.NATIVE_CAPABILITIES = [
+    "read_file", "read_notebook", "read_pdf", "list_dir", "file_map", "glob", "grep",
+    // The project's own checker for a changed file (manual 5.11).
+    "read_diagnostics",
+    "write_file", "edit_file", "multi_edit", "create_dir", "delete_file",
+    "move_file", "apply_patch",
+    // Bytes, for a document the server built. Never offered to the model; the
+    // loop issues it after `make_document`, so a deck lands in the folder the
+    // person is standing in rather than behind a link in a web page they are not
+    // looking at.
+    "write_bytes",
+    "run_command", "run_tests", "run_background", "read_output", "stop_process",
+    "install_dependency",
+    "git_status", "git_diff", "git_log", "git_branch", "git_commit",
+    // Pushing is here because it needs the repository. Pull requests, reviews,
+    // checks and releases are NOT: they need the tenant's credential, so they run
+    // on the server and are never offered to a client.
+    "git_push",
+    "todo_write",
+    // A helper's own copy of the project (manual 5.26). Never offered to the
+    // model: the service opens, reads and removes copies for editing helpers.
+    "worktree_open", "worktree_diff", "worktree_close",
+    // Tool servers on this machine the person approved (manual 9.10). Never
+    // offered to the model: the service lists and calls them by name.
+    "tool_server_list", "tool_server_call",
+    // The hooks of plugins installed here (manual 9.15), handed over by the
+    // service at the start of a job. Never offered to the model.
+    "plugin_hooks",
+    // This machine runs the hooks the service names, with each action and at
+    // the moments of a job (manual 10.9). Never offered to the model.
+    "run_hooks",
+    // A whole file, byte for byte, for a checkpoint (manual 7.3). Never offered
+    // to the model: `read_file` pages a long file and trims its last line break.
+    "read_raw",
+];
+/** What a helper may do inside its own copy (manual 5.26). */
+const IN_COPY = new Set([
+    "read_file", "list_dir", "file_map", "glob", "grep",
+    "write_file", "edit_file", "multi_edit", "apply_patch", "create_dir", "git_status", "git_diff",
+]);
+/** How a package is added, per ecosystem.
+ *
+ *  Named rather than passed through as a raw command, because "install a
+ *  dependency" is a thing a person can meaningfully approve and
+ *  `npm i --silent --prefix ../.. something` is not. The approval is only worth
+ *  asking for if what is being approved is legible. */
+function installCommand(root, pkg, manager, dev) {
+    const has = (f) => fs.existsSync(`${root}/${f}`);
+    const m = manager
+        || (has("pnpm-lock.yaml") ? "pnpm" : has("yarn.lock") ? "yarn"
+            : has("package.json") ? "npm" : has("Cargo.toml") ? "cargo"
+                : has("go.mod") ? "go" : has("pyproject.toml") || has("requirements.txt") ? "pip" : "");
+    switch (m) {
+        case "npm": return `npm install ${dev ? "--save-dev " : ""}${pkg}`;
+        case "pnpm": return `pnpm add ${dev ? "-D " : ""}${pkg}`;
+        case "yarn": return `yarn add ${dev ? "-D " : ""}${pkg}`;
+        case "pip": return `python -m pip install ${pkg}`;
+        case "cargo": return `cargo add ${pkg}${dev ? " --dev" : ""}`;
+        case "go": return `go get ${pkg}`;
+        default: return null;
+    }
+}
+/** A file's exact contents and their SHA-256, for a checkpoint (manual 7.3).
+ *  Refused, never trimmed, when it is too large or not text. */
+function readRaw(root, rel) {
+    const crypto = require("crypto");
+    const base = fs.realpathSync(root);
+    const where = path.resolve(base, rel);
+    if (!where.startsWith(base + path.sep))
+        return { isError: true, content: `${rel} is outside this project.` };
+    let bytes;
+    try {
+        bytes = fs.readFileSync(where);
+    }
+    catch {
+        return { isError: true, content: `${rel} does not exist.`, facts: { missing: 1 } };
+    }
+    if (bytes.length > 400_000)
+        return { isError: true, content: `${rel} is too large to copy.`, facts: { too_large: 1 } };
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        return { isError: true, content: `${rel} is not text, so it cannot be copied.`, facts: { binary: 1 } };
+    }
+    return { isError: false, content: text, summary: `${bytes.length} bytes`,
+        facts: { sha256: crypto.createHash("sha256").update(bytes).digest("hex") } };
+}
+class NativeExecutor {
+    /** What this machine can do. The browser actions only where a browser is
+     *  installed (manual 10.16); the service offers them only when switched on. */
+    capabilities = (0, browser_1.findBrowser)() ? [...exports.NATIVE_CAPABILITIES, ...browser_1.BROWSER_ACTIONS] : exports.NATIVE_CAPABILITIES;
+    /** The job's browser, started on first use (10.16). */
+    browser;
+    /** Close what this job opened on the machine: its browser. */
+    close() {
+        this.browser?.close();
+        this.browser = undefined;
+    }
+    root;
+    onOutput;
+    /** The test command, once it has been worked out or supplied. Remembered so a
+     *  job that had to be told does not have to be told again. */
+    testCommand;
+    /** Whether the last test run passed. The grading signal the whole product
+     *  rests on, kept so a session can report it when the job ends. */
+    lastTestsPassed;
+    /** The operating system's sandbox, set when the service turns it on for a
+     *  job (manual 4.12). Absent, commands run with the person's own access. */
+    sandbox;
+    constructor(opts) {
+        this.root = fs.realpathSync(opts.root);
+        this.toolServers = new toolservers_1.ToolServers(this.root);
+        (0, paths_1.allowFolders)(this.root, opts.added ?? []);
+        this.onOutput = opts.onOutput;
+    }
+    /** One executor per helper copy, rooted there and nowhere else. */
+    inCopies = new Map();
+    /** Tool servers this job started (manual 9.10), stopped when it ends. */
+    toolServers;
+    async execute(name, a, plan) {
+        // An action for a helper's copy runs there, rooted in the copy, so it can
+        // never touch the person's own folder (manual 5.26).
+        if (typeof a._worktree === "string") {
+            const id = a._worktree;
+            const where = (0, worktree_1.worktreePath)(id);
+            if (!where)
+                return { isError: true, content: `There is no copy called ${id}.` };
+            if (!IN_COPY.has(name))
+                return { isError: true, content: `Refused: a helper cannot ${name} in its copy.` };
+            let inner = this.inCopies.get(id);
+            if (!inner) {
+                inner = new NativeExecutor({ root: where });
+                this.inCopies.set(id, inner);
+            }
+            const { _worktree: _dropped, ...rest } = a;
+            void _dropped;
+            return inner.execute(name, rest, plan);
+        }
+        // A tool server's list or call is carried, never gated by the project's
+        // own hooks: the service already decided whether it may happen.
+        if (name === "plugin_hooks") {
+            // An older service handing over plugin hooks in bulk. This machine runs
+            // the hooks the service names with each action instead, so nothing is
+            // kept here and nothing is matched here (manual 10.9).
+            const given = Array.isArray(a.hooks) ? a.hooks.length : 0;
+            return { isError: false, content: `${given} plugin hooks noted; the service names them per action` };
+        }
+        if (name === "read_raw") {
+            return readRaw(this.root, String(a.path ?? ""));
+        }
+        if (name === "run_hooks") {
+            // A moment of the job: job_start, job_end or waiting (manual 10.9).
+            const given = Array.isArray(a.hooks) ? a.hooks : [];
+            const done = await hooks.runHooks(this.root, given, {
+                when: String(a.when ?? ""), facts: (a.facts ?? {}),
+            });
+            const lines = hooks.reportLines(done);
+            return {
+                isError: done.failed.length > 0,
+                content: lines.join("\n") || "no hooks ran",
+                summary: done.failed.length ? `hook failed: ${done.failed.join("; ")}`
+                    : `${done.runs.length} ${String(a.when)} hook${done.runs.length === 1 ? "" : "s"} ran`,
+            };
+        }
+        if (name === "tool_server_list") {
+            return this.toolServers.list(String(a.server ?? ""), String(a.command ?? ""));
+        }
+        if (name === "tool_server_call") {
+            return this.toolServers.call(String(a.server ?? ""), String(a.command ?? ""), String(a.tool ?? ""), (a.arguments ?? {}));
+        }
+        // The hooks the service named for this action, run in its order (10.9).
+        // A `before` hook may REFUSE this action, and that is the one place a
+        // project's own script changes what happens. It can only ever refuse: there
+        // is no exit code that approves something the agent was not already allowed
+        // to do, because a permission system inside the repository would live
+        // exactly where an attacker who got that far already is.
+        const gate = await hooks.runHooks(this.root, plan?.before ?? [], { when: "before", action: name, args: a });
+        if (gate.refusedBy) {
+            return { isError: true, content: gate.detail ?? "A hook in this project refused it.",
+                summary: gate.detail };
+        }
+        const shell = {
+            root: this.root,
+            cwd: typeof a.cwd === "string" ? a.cwd : undefined,
+            timeoutMs: typeof a.timeout_s === "number" ? a.timeout_s * 1000 : undefined,
+            onOutput: this.onOutput,
+            sandbox: this.sandbox,
+        };
+        try {
+            const done = await this.perform(name, a, shell);
+            // And afterwards. A failure here is reported and nothing else: the action
+            // has already happened, and the overwhelming case is a formatter, which is
+            // worth knowing about and not worth losing the work over.
+            if (!done.isError) {
+                const ran = await hooks.runHooks(this.root, plan?.after ?? [], { when: "after", action: name, args: a });
+                const shown = hooks.reportLines(ran);
+                if (ran.failed.length) {
+                    // Said on the action's own line, so the person sees it, and told to
+                    // the model as what it is: the project's hook, not the file.
+                    return {
+                        ...done,
+                        summary: `${done.summary ? `${done.summary}; ` : ""}hook: ${ran.failed.join("; ")}`,
+                        // The service words the action line from these (manual 10.9).
+                        facts: { ...(done.facts ?? {}), hook_note: ran.failed.join("; ") },
+                        content: `${done.content}\n\n[CompletionPrism ran this project's after hooks for this `
+                            + `action, as its settings ask. They reported: ${ran.failed.join("; ")}. This note is `
+                            + `from the tool, not part of the result.]`,
+                    };
+                }
+                // Each hook's output, for the full view (manual 10.10).
+                if (shown.length)
+                    return { ...done, content: `${done.content}\n\n${shown.join("\n")}` };
+            }
+            return done;
+        }
+        catch (err) {
+            // Never thrown to the loop. A failure here is a RESULT the model reads and
+            // works around; an exception would end a job over something it could have
+            // handled itself, and the person would lose everything already done.
+            return {
+                isError: true,
+                content: `This action could not be completed: ${err?.message ?? err}`,
+            };
+        }
+    }
+    async browse(name, a) {
+        if (!this.browser)
+            this.browser = new browser_1.Browser(this.root);
+        return this.browser.perform(name, a);
+    }
+    async perform(name, a, shell) {
+        {
+            if (name.startsWith("browser_"))
+                return await this.browse(name, a);
+            switch (name) {
+                case "run_command":
+                    return await (0, shell_1.runCommand)(String(a.command ?? ""), shell);
+                case "run_tests": {
+                    const r = await (0, shell_1.runTests)({
+                        ...shell,
+                        command: a.command || this.testCommand,
+                        path: a.path,
+                    });
+                    if (r.command)
+                        this.testCommand = r.command;
+                    if (typeof r.passed === "boolean")
+                        this.lastTestsPassed = r.passed;
+                    return r;
+                }
+                case "run_background":
+                    return (0, shell_1.startBackground)(String(a.command ?? ""), shell);
+                case "read_output":
+                    return (0, shell_1.readOutput)(String(a.process_id ?? ""));
+                case "stop_process":
+                    return (0, shell_1.stopProcess)(String(a.process_id ?? ""));
+                case "install_dependency": {
+                    const cmd = installCommand(this.root, String(a.package ?? ""), a.manager, Boolean(a.dev));
+                    if (!cmd) {
+                        return {
+                            isError: true,
+                            content: "I could not work out how this project installs packages. Tell " +
+                                "me which package manager it uses.",
+                        };
+                    }
+                    return await (0, shell_1.runCommand)(cmd, shell);
+                }
+                case "apply_patch":
+                    return await (0, documents_1.applyPatch)(String(a.patch ?? ""), shell);
+                case "read_pdf":
+                    return await (0, documents_1.readPdf)(this.root, String(a.path ?? ""), a.pages, shell);
+                case "read_notebook":
+                    return (0, notebook_1.readNotebook)(this.root, String(a.path ?? ""), a.include_output !== false);
+                case "read_diagnostics":
+                    return await (0, diagnostics_1.readDiagnostics)(this.root, a.path, a.severity, shell);
+                case "worktree_open": return await (0, worktree_1.openWorktree)(String(a.id ?? ""), shell);
+                case "worktree_diff": return await (0, worktree_1.diffWorktree)(String(a.id ?? ""), shell);
+                case "worktree_close": {
+                    this.inCopies.delete(String(a.id ?? ""));
+                    return await (0, worktree_1.closeWorktree)(String(a.id ?? ""), shell);
+                }
+                case "git_status": return await (0, git_1.gitStatus)(shell);
+                case "git_diff": return await (0, git_1.gitDiff)({ ...shell, path: a.path, staged: Boolean(a.staged) });
+                case "git_log": return await (0, git_1.gitLog)({ ...shell, path: a.path, limit: a.limit });
+                case "git_branch": return await (0, git_1.gitBranch)(String(a.name ?? ""), shell);
+                case "git_commit": return await (0, git_1.gitCommit)(String(a.message ?? ""), { ...shell, paths: a.paths });
+                case "git_push": return await (0, git_1.gitPush)(String(a.branch ?? ""), {
+                    ...shell, createRemote: Boolean(a.create_remote),
+                });
+                default:
+                    return (0, files_1.performFileAction)(this.root, name, a);
+            }
+        }
+    }
+}
+exports.NativeExecutor = NativeExecutor;

package/out/machine/executor/notebook.d.ts

@@ -0,0 +1,2 @@
+import { RunResult } from "./shell";
+export declare function readNotebook(root: string, path: string, includeOutput?: boolean): RunResult;

package/out/machine/executor/notebook.js

@@ -0,0 +1,147 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readNotebook = readNotebook;
+/**
+ * Reading a Jupyter notebook.
+ *
+ * Specification: docs/modules/CODING_AGENT_BUILD_SPECIFICATION.md, register
+ * item D4.
+ *
+ * A notebook is JSON on disk, and reading it with `read_file` gives you that
+ * JSON: source split into one string per line, escaped newlines, and base64
+ * images that can run to hundreds of kilobytes. A model handed that spends a
+ * fortune reading almost nothing.
+ *
+ * So this reads the cells. Code, markdown, and what each cell actually printed,
+ * because in a notebook the output IS the state: a cell that raised is the
+ * whole reason somebody is looking, and a variable's value three cells up is
+ * often the only record of what the data looked like.
+ *
+ * **Images are named, never included.** A plot is the point of many cells and
+ * it is also a quarter of a megabyte of base64. The cell says a plot was
+ * produced, which is the useful fact, at a cost of nine words.
+ */
+const fs = __importStar(require("fs"));
+const paths_1 = require("./paths");
+/** What one notebook may contribute. Beyond this it is cut and says so. */
+const MAX_CHARS = 60_000;
+/** What one cell's output may contribute. A cell that printed a whole dataframe
+ *  is common, and the first thirty lines of it say the same thing as all of it. */
+const MAX_OUTPUT_CHARS = 2_000;
+/** Source arrives as one string per line, with the newlines still on them. */
+function text(source) {
+    if (Array.isArray(source))
+        return source.join("");
+    return String(source ?? "");
+}
+function outputOf(cell) {
+    const parts = [];
+    for (const out of cell.outputs ?? []) {
+        const kind = String(out.output_type ?? "");
+        if (kind === "stream") {
+            parts.push(text(out.text));
+            continue;
+        }
+        if (kind === "error") {
+            // The most valuable thing in the file. A traceback is usually the reason
+            // somebody opened the notebook at all, so it is never trimmed away first.
+            const name = String(out.ename ?? "error");
+            const message = String(out.evalue ?? "");
+            const trace = Array.isArray(out.traceback) ? out.traceback.join("\n") : "";
+            parts.push(`${name}: ${message}\n${trace}`);
+            continue;
+        }
+        if (kind === "execute_result" || kind === "display_data") {
+            const data = (out.data ?? {});
+            if (data["text/plain"]) {
+                parts.push(text(data["text/plain"]));
+            }
+            // Named, not included. A plot is the point of the cell and also a quarter
+            // of a megabyte of base64; "a plot was produced" is the useful fact.
+            for (const mime of Object.keys(data)) {
+                if (mime.startsWith("image/"))
+                    parts.push(`[${mime} produced, not shown]`);
+            }
+        }
+    }
+    const joined = parts.join("\n").trim();
+    if (joined.length <= MAX_OUTPUT_CHARS)
+        return joined;
+    return `${joined.slice(0, MAX_OUTPUT_CHARS)}\n[... output truncated]`;
+}
+function readNotebook(root, path, includeOutput = true) {
+    let raw;
+    try {
+        raw = fs.readFileSync((0, paths_1.resolveInside)(root, path, true), "utf8");
+    }
+    catch (err) {
+        return { isError: true, content: `Could not read ${path}: ${err.message}` };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return {
+            isError: true,
+            content: `${path} is not a readable notebook. It may be corrupt, or it may not be a notebook at all.`,
+        };
+    }
+    const cells = parsed.cells ?? [];
+    if (!cells.length) {
+        return { content: `${path} has no cells in it.`, summary: "empty notebook" };
+    }
+    const lines = [`${path}: ${cells.length} cells`];
+    let used = lines[0].length;
+    for (let i = 0; i < cells.length; i += 1) {
+        const cell = cells[i];
+        const kind = cell.cell_type ?? "code";
+        // Numbered, because that is how a person refers to a cell and how an edit
+        // will have to name one later.
+        const header = `\n--- cell ${i + 1} (${kind}) ---`;
+        const source = text(cell.source).trimEnd();
+        const output = includeOutput && kind === "code" ? outputOf(cell) : "";
+        const block = [header, source, output ? `\n[output]\n${output}` : ""]
+            .filter(Boolean).join("\n");
+        if (used + block.length > MAX_CHARS) {
+            lines.push(`\n[... ${cells.length - i} more cells not read. Ask for a range if you need them.]`);
+            break;
+        }
+        lines.push(block);
+        used += block.length;
+    }
+    return { content: lines.join("\n"), summary: `read ${path} (${cells.length} cells)` };
+}

package/out/machine/executor/paths.d.ts

@@ -0,0 +1,20 @@
+export declare class OutsideWorkspace extends Error {
+    readonly attempted: string;
+    /** `real` is where the path actually leads, when that differs from what was
+     *  asked for: a link is refused by naming its real location (manual 2.4). */
+    constructor(attempted: string, real?: string);
+}
+export declare function allowFolders(root: string, added: string[]): void;
+/** Every folder a job in `root` may touch, the project first. */
+export declare function allowedFolders(root: string): string[];
+export declare function isSecret(p: string): boolean;
+/**
+ * An absolute path inside the workspace, or a refusal.
+ *
+ * `mustExist` is false when the caller is about to CREATE the thing. A file that
+ * does not exist yet cannot be resolved, so the check is applied to the deepest
+ * parent that does exist: creating `src/new/deep/file.ts` is inside the project
+ * exactly when `src` is, and demanding the leaf exist first would make it
+ * impossible to write a new file at all.
+ */
+export declare function resolveInside(root: string, rel: string, mustExist?: boolean): string;