@inflexa-ai/harness 0.1.1

package/dist/input-sanitization.js

@@ -0,0 +1,64 @@
+/**
+ * Input sanitization — two pure, always-on functions applied once to the
+ * incoming user message by the chat route (change 6). Never applied to
+ * assistant messages or tool results.
+ *
+ * Two pure functions, not a plug-in pipeline. What runs is exactly these two.
+ */
+/**
+ * C0/C1 control characters and DEL, excluding `\t` (U+0009) and `\n`
+ * (U+000A) which are legitimate whitespace in user prose.
+ */
+// eslint-disable-next-line no-control-regex -- matching control characters is the intent: this pattern strips invisible C0/C1 bytes and DEL from untrusted user input (see `normalizeUnicode` below).
+const CONTROL_CHARS = /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g;
+/**
+ * NFC-normalize and strip control characters.
+ *
+ * Unicode normalization collapses visually-identical decomposed sequences
+ * to a canonical form; control-char stripping removes invisible C0/C1 bytes
+ * that could smuggle formatting or terminal escapes.
+ */
+export function normalizeUnicode(text) {
+    return text.normalize("NFC").replace(CONTROL_CHARS, "");
+}
+/**
+ * Each entry redacts one structured, prefixed secret format. Every pattern
+ * has a prefix (`AKIA`, `sk-`, `gh*_`, `eyJ`, `Bearer`, a DB scheme) that
+ * cannot collide with a nucleotide or protein sequence — so none of these
+ * false-positive on biological data.
+ *
+ * The 40-char generic AWS secret pattern and the loose `key:value` "Generic
+ * Secret Assignment" pattern are intentionally absent — both are domain-blind
+ * and false-positive on nucleotide / protein sequences.
+ *
+ * Order matters: `sk-ant-` is redacted before the generic `sk-` so the
+ * Anthropic label wins; `sk-(?!ant-)` additionally excludes it by lookahead.
+ */
+const SECRET_PATTERNS = [
+    { name: "AWS Access Key", pattern: /\bAKIA[0-9A-Z]{16}\b/g },
+    { name: "Anthropic API Key", pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g },
+    { name: "OpenAI API Key", pattern: /\bsk-(?!ant-)[A-Za-z0-9_-]{20,}\b/g },
+    { name: "GitHub Token", pattern: /\bgh[psoru]_[A-Za-z0-9_]{36,}\b/g },
+    {
+        name: "JWT Token",
+        pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g,
+    },
+    { name: "Bearer Token", pattern: /\bBearer\s+[A-Za-z0-9_\-.~+/]+=*/gi },
+    {
+        name: "Connection String",
+        pattern: /\b(?:postgres|postgresql|mysql|mongodb|redis|amqp|mssql):\/\/[^\s"'`]+/gi,
+    },
+];
+/**
+ * Replace structured secret formats with `[REDACTED: <name>]`.
+ *
+ * Only prefixed formats are matched — a 40-nucleotide `ACGT…` string or a
+ * 40-residue protein sequence passes through unchanged.
+ */
+export function redactSecrets(text) {
+    let out = text;
+    for (const { name, pattern } of SECRET_PATTERNS) {
+        out = out.replace(pattern, `[REDACTED: ${name}]`);
+    }
+    return out;
+}

package/dist/lib/async-utils.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Shared async utilities — sleep and bounded-concurrency map.
+ */
+/** Promise-based delay. */
+export declare function sleep(ms: number): Promise<void>;
+/**
+ * Map over items with bounded concurrency.
+ * At most `concurrency` items are processed simultaneously.
+ */
+export declare function mapConcurrent<T, R>(items: T[], concurrency: number, fn: (item: T, index: number) => Promise<R>): Promise<R[]>;

package/dist/lib/async-utils.js

@@ -0,0 +1,24 @@
+/**
+ * Shared async utilities — sleep and bounded-concurrency map.
+ */
+/** Promise-based delay. */
+export function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Map over items with bounded concurrency.
+ * At most `concurrency` items are processed simultaneously.
+ */
+export async function mapConcurrent(items, concurrency, fn) {
+    const results = new Array(items.length);
+    let nextIndex = 0;
+    async function worker() {
+        while (nextIndex < items.length) {
+            const i = nextIndex++;
+            results[i] = await fn(items[i], i);
+        }
+    }
+    const workers = Array.from({ length: Math.min(concurrency, items.length) }, () => worker());
+    await Promise.all(workers);
+    return results;
+}

package/dist/lib/chrome.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Headless Chrome connection — process-lifetime singleton connected to the
+ * Chrome sidecar reachable at `CHROME_BROWSER_URL`. Used by the iterate-report
+ * preview-snapshot tool for visual validation.
+ *
+ * Connection is lazy and reconnect-on-disconnect; pages are gated through a
+ * semaphore so the sidecar isn't overwhelmed by concurrent reports.
+ */
+import type { Browser, BrowserContext, Page } from "puppeteer-core";
+export interface ChromeConfig {
+    readonly browserUrl?: string;
+    readonly maxPages?: number;
+}
+export declare function getBrowser(browserUrl?: string): Promise<Browser>;
+export declare function withPage<T>(cfg: ChromeConfig, fn: (page: Page, context: BrowserContext) => Promise<T>): Promise<T>;

package/dist/lib/chrome.js

@@ -0,0 +1,95 @@
+/**
+ * Headless Chrome connection — process-lifetime singleton connected to the
+ * Chrome sidecar reachable at `CHROME_BROWSER_URL`. Used by the iterate-report
+ * preview-snapshot tool for visual validation.
+ *
+ * Connection is lazy and reconnect-on-disconnect; pages are gated through a
+ * semaphore so the sidecar isn't overwhelmed by concurrent reports.
+ */
+import puppeteer from "puppeteer-core";
+let browser;
+let connecting;
+let semaphore;
+function createSemaphore(max) {
+    let active = 0;
+    const queue = [];
+    const release = () => {
+        active--;
+        const next = queue.shift();
+        if (next)
+            next();
+    };
+    return {
+        acquire() {
+            return new Promise((resolve) => {
+                const grant = () => {
+                    active++;
+                    resolve(release);
+                };
+                if (active < max)
+                    grant();
+                else
+                    queue.push(grant);
+            });
+        },
+    };
+}
+function getSemaphore(maxPages) {
+    if (!semaphore) {
+        const max = maxPages && maxPages > 0 ? maxPages : 4;
+        semaphore = createSemaphore(max);
+    }
+    return semaphore;
+}
+export async function getBrowser(browserUrl) {
+    if (browser && browser.connected)
+        return browser;
+    if (connecting)
+        return connecting;
+    const browserURL = browserUrl;
+    if (!browserURL) {
+        throw new Error("CHROME_BROWSER_URL is not set — Cortex requires the chrome sidecar to be reachable");
+    }
+    console.log(`[chrome] connecting to browser at ${browserURL}`);
+    connecting = puppeteer
+        .connect({ browserURL })
+        .then((b) => {
+        browser = b;
+        b.on("disconnected", () => {
+            console.log("[chrome] browser disconnected; will reconnect on next request");
+            if (browser === b)
+                browser = undefined;
+        });
+        console.log(`[chrome] connected (wsEndpoint=${b.wsEndpoint()})`);
+        return b;
+    })
+        .catch((err) => {
+        console.error("[chrome] failed to connect to browser:", err);
+        throw err;
+    })
+        .finally(() => {
+        connecting = undefined;
+    });
+    return connecting;
+}
+export async function withPage(cfg, fn) {
+    const release = await getSemaphore(cfg.maxPages).acquire();
+    let context;
+    try {
+        const b = await getBrowser(cfg.browserUrl);
+        context = await b.createBrowserContext();
+        const page = await context.newPage();
+        return await fn(page, context);
+    }
+    finally {
+        if (context) {
+            try {
+                await context.close();
+            }
+            catch (err) {
+                console.error("[chrome] error closing browser context:", err);
+            }
+        }
+        release();
+    }
+}

package/dist/lib/db-result.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Postgres data-access Result glue for cortex.
+ *
+ * The data-access layer (`state/`, `memory/`, vector-store, regulatory-corpus)
+ * models failure as values: every function returns `ResultAsync<T, DbError>`.
+ * The ONLY `try/catch` lives here, at the `pg` driver call — these three
+ * wrappers turn a driver throw into an `err(DbError)`; everything above them
+ * flows `ResultAsync`.
+ *
+ * House rules realized here (see `lib/result.ts`):
+ *  - Absence is NOT an error. A missing row stays in the ok channel as a data
+ *    variant (`ok(null)` / `ok([])`), never an `err`. `DbError` is reserved for
+ *    a genuine driver/connection/constraint failure.
+ *  - Control-flow exceptions (DBOS cancellation, `AbortError`) are NOT failures
+ *    and are never captured as a `DbError`: the single-statement wrappers below
+ *    only ever see driver throws, and `withTransaction` never catches a throw
+ *    that escapes `fn` — a control-flow exception propagates untouched to the
+ *    workflow-call seam (its `finally` only rolls back and releases).
+ *
+ * Consumers unwrap per their edge: HTTP routes `.match(...)`; DBOS step bodies
+ * `resultStep(runStep)` / `unwrapOrThrow`; tool `execute` bodies `unwrapOrThrow`
+ * (a throw becomes an `is_error` tool_result via dispatch).
+ */
+import { ResultAsync } from "neverthrow";
+import type { Pool, PoolClient } from "pg";
+/** A query/mutation/connection accepted by the data-access layer. */
+type Querier = Pool | PoolClient;
+/**
+ * A storage-layer failure. Absence is deliberately NOT modelled: single-row
+ * reads return `ok(T | null)` and mutations against a missing row return
+ * `ok(0 rows)`, so "not found" rides the ok channel. `DbError` is reserved for
+ * driver-level failures — a failed read, a failed write, a constraint trip, or
+ * a lost connection. `op` is a stable, human-readable label (e.g.
+ * `"runs.insertRun"`) used by `describeDbError` and in logs.
+ */
+export type DbError = {
+    readonly type: "query_failed";
+    readonly op: string;
+    readonly cause: unknown;
+} | {
+    readonly type: "mutation_failed";
+    readonly op: string;
+    readonly cause: unknown;
+} | {
+    readonly type: "connection_failed";
+    readonly op: string;
+    readonly cause: unknown;
+} | {
+    readonly type: "constraint_violation";
+    readonly op: string;
+    readonly constraint: string;
+    readonly cause: unknown;
+};
+/** A one-line, user-facing description of a `DbError` for logs and error bodies. */
+export declare function describeDbError(e: DbError): string;
+/**
+ * Wrap a read. A `pg` throw becomes `err(query_failed)` — or
+ * `err(connection_failed)` for a connection SQLSTATE. Absence is the body's
+ * concern: return `ok(null)` / `ok([])` from `fn` for a missing row.
+ *
+ * `fn` runs the driver call and returns the already-mapped value (`T`). Keep
+ * `fn` to the single `await querier.query(...)` plus its row-mapping; do not
+ * embed control-flow that could throw a non-driver error.
+ */
+export declare function tryQuery<T>(op: string, fn: () => Promise<T>): ResultAsync<T, DbError>;
+/**
+ * Wrap a write. A `pg` throw becomes `err(mutation_failed)`, mapped to
+ * `err(constraint_violation{constraint})` for SQLSTATE 23505/23503/23502/23514
+ * and `err(connection_failed)` for a connection SQLSTATE.
+ */
+export declare function tryMutation<T>(op: string, fn: () => Promise<T>): ResultAsync<T, DbError>;
+/**
+ * Run `fn`'s statements in one transaction against a dedicated `PoolClient`:
+ * `BEGIN`, run `fn(client)`, `COMMIT` on `ok`, `ROLLBACK` on `err`. `fn`
+ * receives the transaction's `client` — every statement inside MUST use it,
+ * not the pool.
+ *
+ * CRITICAL FOOTGUN: the `pg` driver rolls back a transaction only when its
+ * callback throws, but our mutations report failure by returning `err`. So
+ * `withTransaction` rolls back itself whenever `fn` does not reach `COMMIT`.
+ * Build the transaction body as a single `ResultAsync` chain whose first `err`
+ * short-circuits to `fn`'s result — do NOT `.match`/swallow a mid-transaction
+ * `err` inside `fn`, or that statement commits with the rest.
+ *
+ * `connect` / `BEGIN` / `COMMIT` driver errors become `err`. A throw that
+ * escapes `fn` itself is NEVER caught here — a control-flow exception (DBOS
+ * cancellation, `AbortError`) is DBOS's own signalling and must reach the
+ * workflow-call seam untouched; the `finally` only rolls back the open
+ * transaction and releases the connection so a cancelled tx never poisons the
+ * pool.
+ */
+export declare function withTransaction<T>(pool: Pool, op: string, fn: (client: PoolClient) => ResultAsync<T, DbError>): ResultAsync<T, DbError>;
+export type { Querier };

package/dist/lib/db-result.js

@@ -0,0 +1,197 @@
+/**
+ * Postgres data-access Result glue for cortex.
+ *
+ * The data-access layer (`state/`, `memory/`, vector-store, regulatory-corpus)
+ * models failure as values: every function returns `ResultAsync<T, DbError>`.
+ * The ONLY `try/catch` lives here, at the `pg` driver call — these three
+ * wrappers turn a driver throw into an `err(DbError)`; everything above them
+ * flows `ResultAsync`.
+ *
+ * House rules realized here (see `lib/result.ts`):
+ *  - Absence is NOT an error. A missing row stays in the ok channel as a data
+ *    variant (`ok(null)` / `ok([])`), never an `err`. `DbError` is reserved for
+ *    a genuine driver/connection/constraint failure.
+ *  - Control-flow exceptions (DBOS cancellation, `AbortError`) are NOT failures
+ *    and are never captured as a `DbError`: the single-statement wrappers below
+ *    only ever see driver throws, and `withTransaction` never catches a throw
+ *    that escapes `fn` — a control-flow exception propagates untouched to the
+ *    workflow-call seam (its `finally` only rolls back and releases).
+ *
+ * Consumers unwrap per their edge: HTTP routes `.match(...)`; DBOS step bodies
+ * `resultStep(runStep)` / `unwrapOrThrow`; tool `execute` bodies `unwrapOrThrow`
+ * (a throw becomes an `is_error` tool_result via dispatch).
+ */
+import { ResultAsync, err, ok } from "neverthrow";
+const _assertDomainError = true;
+/** pg SQLSTATE classes that mean "connection is gone", mapped to `connection_failed`. */
+const CONNECTION_SQLSTATE = new Set([
+    "08000", // connection_exception
+    "08003", // connection_does_not_exist
+    "08006", // connection_failure
+    "08001", // sqlclient_unable_to_establish_sqlconnection
+    "08004", // sqlserver_rejected_establishment_of_sqlconnection
+    "57P01", // admin_shutdown
+    "57P02", // crash_shutdown
+    "57P03", // cannot_connect_now
+]);
+/** pg SQLSTATE → the violated constraint kind, for `constraint_violation`. */
+const CONSTRAINT_SQLSTATE = {
+    "23505": "unique",
+    "23503": "foreign_key",
+    "23502": "not_null",
+    "23514": "check",
+};
+function sqlstate(cause) {
+    if (cause && typeof cause === "object" && "code" in cause) {
+        const code = cause.code;
+        return typeof code === "string" ? code : undefined;
+    }
+    return undefined;
+}
+/** pg surfaces the tripped constraint's name on `.constraint`. */
+function constraintName(cause) {
+    if (cause && typeof cause === "object" && "constraint" in cause) {
+        const name = cause.constraint;
+        if (typeof name === "string" && name.length > 0)
+            return name;
+    }
+    return "unknown";
+}
+/** A read throw → `connection_failed` for a connection SQLSTATE, else `query_failed`. */
+function readError(op, cause) {
+    const code = sqlstate(cause);
+    if (code && CONNECTION_SQLSTATE.has(code)) {
+        return { type: "connection_failed", op, cause };
+    }
+    return { type: "query_failed", op, cause };
+}
+/**
+ * A write throw → `constraint_violation` for a constraint SQLSTATE (carrying
+ * the constraint name), `connection_failed` for a connection SQLSTATE, else
+ * `mutation_failed`.
+ */
+function writeError(op, cause) {
+    const code = sqlstate(cause);
+    if (code && code in CONSTRAINT_SQLSTATE) {
+        return {
+            type: "constraint_violation",
+            op,
+            constraint: constraintName(cause),
+            cause,
+        };
+    }
+    if (code && CONNECTION_SQLSTATE.has(code)) {
+        return { type: "connection_failed", op, cause };
+    }
+    return { type: "mutation_failed", op, cause };
+}
+/** A one-line, user-facing description of a `DbError` for logs and error bodies. */
+export function describeDbError(e) {
+    switch (e.type) {
+        case "query_failed":
+            return `database read failed (${e.op})`;
+        case "mutation_failed":
+            return `database write failed (${e.op})`;
+        case "connection_failed":
+            return `database connection failed (${e.op})`;
+        case "constraint_violation":
+            return `database constraint "${e.constraint}" violated (${e.op})`;
+    }
+}
+/**
+ * Wrap a read. A `pg` throw becomes `err(query_failed)` — or
+ * `err(connection_failed)` for a connection SQLSTATE. Absence is the body's
+ * concern: return `ok(null)` / `ok([])` from `fn` for a missing row.
+ *
+ * `fn` runs the driver call and returns the already-mapped value (`T`). Keep
+ * `fn` to the single `await querier.query(...)` plus its row-mapping; do not
+ * embed control-flow that could throw a non-driver error.
+ */
+export function tryQuery(op, fn) {
+    return new ResultAsync((async () => {
+        try {
+            return ok(await fn());
+        }
+        catch (cause) {
+            return err(readError(op, cause));
+        }
+    })());
+}
+/**
+ * Wrap a write. A `pg` throw becomes `err(mutation_failed)`, mapped to
+ * `err(constraint_violation{constraint})` for SQLSTATE 23505/23503/23502/23514
+ * and `err(connection_failed)` for a connection SQLSTATE.
+ */
+export function tryMutation(op, fn) {
+    return new ResultAsync((async () => {
+        try {
+            return ok(await fn());
+        }
+        catch (cause) {
+            return err(writeError(op, cause));
+        }
+    })());
+}
+/**
+ * Best-effort `ROLLBACK`: on a poisoned/closed connection it may itself throw;
+ * the original failure is what matters (an aborted transaction never
+ * committed), and `release()` reclaims the connection regardless.
+ */
+async function rollbackQuietly(client) {
+    try {
+        await client.query("ROLLBACK");
+    }
+    catch {
+        /* connection already gone — release covers it */
+    }
+}
+/**
+ * Run `fn`'s statements in one transaction against a dedicated `PoolClient`:
+ * `BEGIN`, run `fn(client)`, `COMMIT` on `ok`, `ROLLBACK` on `err`. `fn`
+ * receives the transaction's `client` — every statement inside MUST use it,
+ * not the pool.
+ *
+ * CRITICAL FOOTGUN: the `pg` driver rolls back a transaction only when its
+ * callback throws, but our mutations report failure by returning `err`. So
+ * `withTransaction` rolls back itself whenever `fn` does not reach `COMMIT`.
+ * Build the transaction body as a single `ResultAsync` chain whose first `err`
+ * short-circuits to `fn`'s result — do NOT `.match`/swallow a mid-transaction
+ * `err` inside `fn`, or that statement commits with the rest.
+ *
+ * `connect` / `BEGIN` / `COMMIT` driver errors become `err`. A throw that
+ * escapes `fn` itself is NEVER caught here — a control-flow exception (DBOS
+ * cancellation, `AbortError`) is DBOS's own signalling and must reach the
+ * workflow-call seam untouched; the `finally` only rolls back the open
+ * transaction and releases the connection so a cancelled tx never poisons the
+ * pool.
+ */
+export function withTransaction(pool, op, fn) {
+    return new ResultAsync((async () => {
+        let client;
+        try {
+            client = await pool.connect();
+        }
+        catch (cause) {
+            return err(writeError(op, cause));
+        }
+        let committed = false;
+        try {
+            const begun = await tryMutation(`${op}:begin`, () => client.query("BEGIN"));
+            if (begun.isErr())
+                return err(begun.error);
+            const inner = await fn(client);
+            if (inner.isErr())
+                return err(inner.error);
+            const done = await tryMutation(`${op}:commit`, () => client.query("COMMIT"));
+            if (done.isErr())
+                return err(done.error);
+            committed = true;
+            return ok(inner.value);
+        }
+        finally {
+            if (!committed)
+                await rollbackQuietly(client);
+            client.release();
+        }
+    })());
+}

package/dist/lib/fs-helpers.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Shared filesystem helpers — deduplicated SHA-256 hashing and file existence checks.
+ */
+/**
+ * Compute SHA-256 hash of in-memory content.
+ * Returns `sha256:<hex>` format.
+ */
+export declare function computeSha256(content: Buffer | Uint8Array): string;
+/**
+ * Compute SHA-256 hash of a file on disk.
+ * Returns `sha256:<hex>` format.
+ */
+export declare function computeSha256File(filePath: string): Promise<string>;
+/**
+ * True when `hash` is a well-formed `algorithm:hex` content hash. The storage backend
+ * (`ValidateContentHash`) rejects any file row without one — and rolls back the
+ * whole activity transaction on the first bad row — so this gates what reaches
+ * registration. Inputs arrive hashless from the path-only provenance frame and
+ * are filled by `reconcileManifestWithDisk`; an empty hash past that point is
+ * an attestation invariant violation, not something to paper over.
+ */
+export declare function hasValidContentHash(hash: string | undefined): boolean;
+/**
+ * Check whether a file exists (access-based, no stat overhead).
+ */
+export declare function fileExists(filePath: string): Promise<boolean>;
+/**
+ * Write a file that MUST land physically inside the analysis workspace tree,
+ * refusing every symlink escape a sandbox step could have planted.
+ *
+ * The harness runs some post-step writes (a step's `output/summary.md`, a run's
+ * `synthesis.json`) in the HOST process, into the same `runs/{runId}/{stepId}`
+ * subtree the sandbox agent held read-write. A plain `fs.writeFile` follows
+ * symlinks, so a compromised agent that replaced the leaf — or an intermediate
+ * directory — with a symlink to `~/.ssh/authorized_keys` (or any host path)
+ * would have the harness write model-authored bytes straight through it. This
+ * relocation made that worse: the tree now lives in the user's own project
+ * folder, so a short relative symlink reaches their source.
+ *
+ * Two independent checks, because an escape can hide in either place:
+ *   1. `realpath` the materialized parent directory and require it to stay under
+ *      `realpath(workspaceRoot)` — catches a symlinked intermediate dir
+ *      (`output -> /elsewhere`).
+ *   2. Open the leaf with `O_NOFOLLOW` — a symlinked final component fails with
+ *      `ELOOP` instead of being followed. This is atomic, so it is not
+ *      TOCTOU-racy the way an `lstat`-then-open would be.
+ *
+ * Throws on any escape (a security-invariant violation, like `assertSafeId`) and
+ * on genuine I/O failure; the caller decides whether that is fatal or best-effort.
+ */
+/**
+ * How `absPath` — already lexically inside `confinementRoot` — relates to it
+ * once symlinks are followed:
+ *   - `in`      — resolves inside the root (a real file, or a symlink/hard link
+ *                 whose real location stays in-tree).
+ *   - `escaped` — resolves OUTSIDE the root via a symlink; the caller must refuse.
+ *   - `absent`  — does not fully exist (missing file, or a symlink to a missing
+ *                 target); nothing to leak, so the caller proceeds with its own
+ *                 not-found / fallback handling.
+ */
+export type WithinRootVerdict = "in" | "escaped" | "absent";
+/**
+ * Classify a path against a confinement root, following symlinks — the read-side
+ * companion to {@link writeFileWithinRoot}. The workspace read seam resolves
+ * agent-supplied paths lexically only; without this, a symlink an agent planted
+ * in its writable step dir (`ln -s ~/.ssh/id_rsa leak.txt`) would be read through
+ * by the host process, leaking arbitrary host-file content into the model context.
+ *
+ * Hard links classify as `in`: a hard link has no symlink target for `realpath`
+ * to follow, so it resolves to its own in-tree path — which is exactly why this
+ * blocks the symlink escape without breaking hard-linked staged inputs.
+ */
+export declare function classifyWithinRoot(confinementRoot: string, absPath: string): Promise<WithinRootVerdict>;
+export declare function writeFileWithinRoot(workspaceRoot: string, absPath: string, data: string | Uint8Array): Promise<void>;