@leg3ndy/otto-bridge 0.9.2 → 1.0.1

package/dist/agentic_runtime/workspace/manager.js

@@ -0,0 +1,1044 @@
+import { readdir, readFile, stat } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { collectStructuredPatchTargets } from "../patch/structured_patch.js";
+const MAX_INSTRUCTION_CHARS = 12_000;
+const DEFAULT_REPO_MARKERS = [".git"];
+const DEFAULT_REPO_MANIFEST_PATHS = [
+    "AGENTS.md",
+    "README.md",
+    "package.json",
+    "pyproject.toml",
+    "requirements.txt",
+    "Cargo.toml",
+    "go.mod",
+];
+const DEFAULT_REPO_LOCKFILE_PATHS = [
+    "package-lock.json",
+    "pnpm-lock.yaml",
+    "yarn.lock",
+    "bun.lockb",
+    "poetry.lock",
+    "Pipfile.lock",
+    "Cargo.lock",
+    "go.sum",
+];
+const DEFAULT_IGNORED_DIRECTORY_NAMES = [
+    ".git",
+    ".next",
+    ".venv",
+    "__pycache__",
+    "build",
+    "coverage",
+    "dist",
+    "node_modules",
+    "venv",
+];
+const DEFAULT_KEY_FILE_PATTERNS = [
+    "AGENTS.md",
+    "README.md",
+    "package.json",
+    "package-lock.json",
+    "pnpm-lock.yaml",
+    "yarn.lock",
+    "bun.lockb",
+    "tsconfig.json",
+    "pyproject.toml",
+    "requirements.txt",
+    "poetry.lock",
+    "Pipfile.lock",
+    "Cargo.toml",
+    "Cargo.lock",
+    "go.mod",
+    "go.sum",
+];
+const WORKSPACE_INDEX_EXTENSION_LIMIT = 8;
+const WORKSPACE_INDEX_TOP_LEVEL_LIMIT = 16;
+const LOCKFILE_PACKAGE_MANAGER_MAP = {
+    "package-lock.json": "npm",
+    "pnpm-lock.yaml": "pnpm",
+    "yarn.lock": "yarn",
+    "bun.lockb": "bun",
+    "poetry.lock": "poetry",
+    "Pipfile.lock": "pipenv",
+    "Cargo.lock": "cargo",
+    "go.sum": "go",
+};
+const WORKSPACE_OBSERVE_ONLY_ACTIONS = new Set([
+    "filesystem_inspect",
+    "list_files",
+    "count_files",
+    "read_file",
+    "git_status",
+    "git_diff",
+]);
+const WORKSPACE_DEV_ASSIST_ACTIONS = new Set([
+    ...WORKSPACE_OBSERVE_ONLY_ACTIONS,
+    "run_shell",
+    "run_tests",
+    "git_clone",
+    "git_fetch",
+    "git_checkout",
+]);
+const WORKSPACE_CODING_ACTIONS = new Set([
+    "write_text_file",
+    "write_json_file",
+    "apply_patch",
+    "mkdir",
+    "move_file",
+]);
+const WORKSPACE_RELEASE_ACTIONS = new Set([
+    "trash_path",
+    "delete_file",
+    "git_add",
+    "git_commit",
+    "git_push",
+    "git_rebase",
+    "git_merge",
+    "git_tag",
+]);
+const WORKSPACE_POLICY_ALL_ACTIONS = new Set([
+    ...WORKSPACE_DEV_ASSIST_ACTIONS,
+    ...WORKSPACE_CODING_ACTIONS,
+    ...WORKSPACE_RELEASE_ACTIONS,
+]);
+const WORKSPACE_POLICY_ALLOWED_ACTIONS = {
+    observe_only: new Set([...WORKSPACE_OBSERVE_ONLY_ACTIONS]),
+    dev_assist: new Set([...WORKSPACE_DEV_ASSIST_ACTIONS]),
+    workspace_coding: new Set([...WORKSPACE_DEV_ASSIST_ACTIONS, ...WORKSPACE_CODING_ACTIONS]),
+    release_operator: new Set([...WORKSPACE_POLICY_ALL_ACTIONS]),
+};
+const WORKSPACE_POLICY_CONFIRM_ACTIONS = new Set([
+    "git_clone",
+    "git_fetch",
+    "git_checkout",
+    ...WORKSPACE_RELEASE_ACTIONS,
+]);
+const WORKSPACE_POLICY_TITLES = {
+    observe_only: "Observe Only",
+    dev_assist: "Dev Assist",
+    workspace_coding: "Workspace Coding",
+    release_operator: "Release Operator",
+};
+function asString(value) {
+    return typeof value === "string" ? value.trim() : "";
+}
+function uniqueStrings(values) {
+    return Array.from(new Set(values.map((item) => asString(item)).filter(Boolean)));
+}
+function clampInteger(value, fallback, min, max) {
+    const numeric = Number(value);
+    if (!Number.isFinite(numeric)) {
+        return fallback;
+    }
+    return Math.min(max, Math.max(min, Math.trunc(numeric)));
+}
+function clipInstructionText(value) {
+    if (value.length <= MAX_INSTRUCTION_CHARS) {
+        return value;
+    }
+    return `${value.slice(0, MAX_INSTRUCTION_CHARS)}\n\n[truncado: mostrando ${MAX_INSTRUCTION_CHARS} de ${value.length} caracteres.]`;
+}
+function toRelativePath(basePath, targetPath) {
+    const relativePath = path.relative(basePath, targetPath);
+    return relativePath || ".";
+}
+function uniqueRuntimeStrings(values, limit) {
+    const normalized = values
+        .map((item) => asString(item))
+        .filter(Boolean);
+    return Array.from(new Set(normalized)).slice(0, limit);
+}
+function normalizeWorkspaceMemory(value, workspaceId) {
+    if (!value) {
+        return undefined;
+    }
+    const jobCount = Number.isFinite(Number(value.job_count)) ? Number(value.job_count) : 0;
+    const summary = asString(value.summary)
+        || `Memoria curta do workspace ${workspaceId} com ${jobCount} job${jobCount === 1 ? "" : "s"} recente${jobCount === 1 ? "" : "s"}.`;
+    return {
+        memory_id: asString(value.memory_id) || `workspace_memory.${workspaceId}`,
+        workspace_id: asString(value.workspace_id) || workspaceId,
+        source: asString(value.source) || "device_job_history",
+        job_count: Math.max(0, jobCount),
+        recent_job_ids: uniqueRuntimeStrings(value.recent_job_ids || [], 12),
+        recent_action_types: uniqueRuntimeStrings(value.recent_action_types || [], 16),
+        recent_target_paths: uniqueRuntimeStrings(value.recent_target_paths || [], 16),
+        recent_artifact_kinds: uniqueRuntimeStrings(value.recent_artifact_kinds || [], 16),
+        latest_job_id: asString(value.latest_job_id) || undefined,
+        latest_job_status: asString(value.latest_job_status) || undefined,
+        latest_job_at: asString(value.latest_job_at) || undefined,
+        instruction_digest: asString(value.instruction_digest) || undefined,
+        repo_root: asString(value.repo_root) || undefined,
+        scoped_root_path: asString(value.scoped_root_path) || undefined,
+        summary,
+        status_counts: value.status_counts && typeof value.status_counts === "object" ? value.status_counts : undefined,
+        retention: value.retention ? {
+            max_job_count: Number.isFinite(Number(value.retention.max_job_count)) ? Number(value.retention.max_job_count) : undefined,
+            max_age_days: Number.isFinite(Number(value.retention.max_age_days)) ? Number(value.retention.max_age_days) : undefined,
+            filtered_job_count: Number.isFinite(Number(value.retention.filtered_job_count)) ? Number(value.retention.filtered_job_count) : undefined,
+            window_started_at: asString(value.retention.window_started_at) || undefined,
+            last_cleared_at: asString(value.retention.last_cleared_at) || undefined,
+            last_cleared_reason: asString(value.retention.last_cleared_reason) || undefined,
+        } : undefined,
+        usage_policy: value.usage_policy ? {
+            profile_id: asString(value.usage_policy.profile_id) || undefined,
+            summary_mode: asString(value.usage_policy.summary_mode) || undefined,
+            include_action_types: typeof value.usage_policy.include_action_types === "boolean" ? value.usage_policy.include_action_types : undefined,
+            include_target_paths: typeof value.usage_policy.include_target_paths === "boolean" ? value.usage_policy.include_target_paths : undefined,
+            include_artifact_kinds: typeof value.usage_policy.include_artifact_kinds === "boolean" ? value.usage_policy.include_artifact_kinds : undefined,
+            include_failed_jobs: typeof value.usage_policy.include_failed_jobs === "boolean" ? value.usage_policy.include_failed_jobs : undefined,
+            resettable: typeof value.usage_policy.resettable === "boolean" ? value.usage_policy.resettable : undefined,
+        } : undefined,
+    };
+}
+function inferWorkspacePolicyProfile(actionType, isDestructivePatch = false) {
+    if (WORKSPACE_RELEASE_ACTIONS.has(actionType) || (actionType === "apply_patch" && isDestructivePatch)) {
+        return "release_operator";
+    }
+    if (WORKSPACE_CODING_ACTIONS.has(actionType)) {
+        return "workspace_coding";
+    }
+    if (WORKSPACE_DEV_ASSIST_ACTIONS.has(actionType)) {
+        return "dev_assist";
+    }
+    return "observe_only";
+}
+function normalizeWorkspacePolicy(value, workspaceId, actionTypes, destructiveActionTypes) {
+    const normalizedActionTypes = uniqueRuntimeStrings(actionTypes, 48);
+    const explicitProfileId = asString(value?.profile_id).toLowerCase();
+    const inferredProfileId = normalizedActionTypes.reduce((current, actionType) => {
+        const next = inferWorkspacePolicyProfile(actionType, destructiveActionTypes.has(actionType));
+        const currentAllowed = WORKSPACE_POLICY_ALLOWED_ACTIONS[current] || WORKSPACE_POLICY_ALLOWED_ACTIONS.observe_only;
+        const nextAllowed = WORKSPACE_POLICY_ALLOWED_ACTIONS[next] || WORKSPACE_POLICY_ALLOWED_ACTIONS.observe_only;
+        return nextAllowed.size > currentAllowed.size ? next : current;
+    }, "observe_only");
+    const profileId = explicitProfileId && WORKSPACE_POLICY_ALLOWED_ACTIONS[explicitProfileId]
+        ? explicitProfileId
+        : inferredProfileId;
+    const allowedActionTypes = uniqueRuntimeStrings(value?.allowed_action_types?.length
+        ? value.allowed_action_types
+        : Array.from(WORKSPACE_POLICY_ALLOWED_ACTIONS[profileId] || []), 64);
+    const blockedActionTypes = uniqueRuntimeStrings(value?.blocked_action_types?.length
+        ? value.blocked_action_types
+        : Array.from(WORKSPACE_POLICY_ALL_ACTIONS).filter((item) => !allowedActionTypes.includes(item)), 64);
+    const requiresConfirmationActionTypes = uniqueRuntimeStrings(value?.requires_confirmation_action_types?.length
+        ? value.requires_confirmation_action_types
+        : normalizedActionTypes.filter((item) => WORKSPACE_POLICY_CONFIRM_ACTIONS.has(item) || destructiveActionTypes.has(item)), 32);
+    if (!profileId && normalizedActionTypes.length === 0) {
+        return undefined;
+    }
+    const allowShell = typeof value?.allow_shell === "boolean"
+        ? value.allow_shell
+        : !["observe_only"].includes(profileId);
+    const allowCodeWrite = typeof value?.allow_code_write === "boolean"
+        ? value.allow_code_write
+        : ["workspace_coding", "release_operator"].includes(profileId);
+    const allowDestructive = typeof value?.allow_destructive === "boolean"
+        ? value.allow_destructive
+        : profileId === "release_operator";
+    const allowRelease = typeof value?.allow_release === "boolean"
+        ? value.allow_release
+        : profileId === "release_operator";
+    const title = asString(value?.title) || WORKSPACE_POLICY_TITLES[profileId] || "Workspace Policy";
+    const summary = asString(value?.summary)
+        || `Policy ${profileId} carregada para o workspace ${workspaceId} com ${allowedActionTypes.length} action types permitidos.`;
+    return {
+        profile_id: profileId || "observe_only",
+        title,
+        summary,
+        allowed_action_types: allowedActionTypes,
+        blocked_action_types: blockedActionTypes,
+        requires_confirmation_action_types: requiresConfirmationActionTypes,
+        rationale: asString(value?.rationale) || (normalizedActionTypes.length > 0
+            ? `Perfil inferido a partir das actions do runtime: ${normalizedActionTypes.join(", ")}.`
+            : undefined),
+        allow_shell: allowShell,
+        allow_code_write: allowCodeWrite,
+        allow_destructive: allowDestructive,
+        allow_release: allowRelease,
+        enforced_by: uniqueRuntimeStrings(value?.enforced_by?.length ? value.enforced_by : ["bridge_workspace_runtime"], 8),
+    };
+}
+function isPathInsideRoot(candidatePath, rootPath) {
+    const relativePath = path.relative(rootPath, candidatePath);
+    return relativePath === "" || (!relativePath.startsWith("..") && !path.isAbsolute(relativePath));
+}
+function findBestMatchingRoot(candidatePath, roots) {
+    return roots
+        .filter((root) => isPathInsideRoot(candidatePath, root.resolved_path))
+        .sort((left, right) => right.resolved_path.length - left.resolved_path.length)[0];
+}
+function dirnameForTarget(target, resolvedPath) {
+    if (target.kind === "directory" || target.kind === "shell_cwd") {
+        return resolvedPath;
+    }
+    return path.dirname(resolvedPath);
+}
+function looksLikeFilePath(targetPath) {
+    const trimmed = targetPath.trim().replace(/[\\/]+$/, "");
+    if (!trimmed || trimmed === "~" || trimmed === "." || trimmed === path.sep) {
+        return false;
+    }
+    return path.basename(trimmed).includes(".");
+}
+function inferRuntimeWorkspaceContextFromActions(actions) {
+    const roots = [];
+    const targets = [];
+    const rootKeys = new Set();
+    let targetIndex = 1;
+    const pushRoot = (rootPath, kind, scopeReason, actionType) => {
+        const key = `${kind}:${rootPath}`;
+        if (rootKeys.has(key)) {
+            const existing = roots.find((item) => `${item.kind || ""}:${item.path}` === key);
+            if (existing) {
+                existing.action_types = uniqueStrings([...(existing.action_types || []), actionType]);
+            }
+            return;
+        }
+        rootKeys.add(key);
+        roots.push({
+            root_id: `workspace_root_${String(roots.length + 1).padStart(2, "0")}`,
+            path: rootPath,
+            kind,
+            scope_reason: scopeReason,
+            action_types: [actionType],
+            source: "bridge_action_fallback",
+        });
+    };
+    for (const action of actions) {
+        const actionType = asString(action.type).toLowerCase();
+        if (!actionType) {
+            continue;
+        }
+        if (actionType === "git_clone") {
+            const destinationPath = asString(action.destination_path)
+                || asString(action.destination)
+                || asString(action.path);
+            if (!destinationPath) {
+                continue;
+            }
+            const expandedDestinationPath = expandUserPathLike(destinationPath);
+            const parentPath = path.dirname(expandedDestinationPath);
+            pushRoot(parentPath, "declared_path", "git_clone_destination_parent", actionType);
+            targets.push({
+                target_id: `workspace_target_${String(targetIndex).padStart(2, "0")}`,
+                path: parentPath,
+                kind: "shell_cwd",
+                access_mode: "execute",
+                action_type: actionType,
+                source: "bridge_action_fallback",
+            });
+            targetIndex += 1;
+            targets.push({
+                target_id: `workspace_target_${String(targetIndex).padStart(2, "0")}`,
+                path: expandedDestinationPath,
+                kind: "directory",
+                access_mode: "write",
+                action_type: actionType,
+                source: "bridge_action_fallback",
+            });
+            targetIndex += 1;
+            continue;
+        }
+        if (actionType === "run_shell" || actionType === "git_status" || actionType === "git_diff" || actionType === "git_add" || actionType === "git_commit" || actionType === "git_push" || actionType === "git_fetch" || actionType === "git_checkout" || actionType === "git_rebase" || actionType === "git_merge" || actionType === "git_tag" || actionType === "run_tests" || actionType === "apply_patch") {
+            const cwd = asString(action.cwd) || ".";
+            const scopeReason = actionType === "run_shell"
+                ? "shell_cwd_scope"
+                : actionType === "apply_patch"
+                    ? "patch_workspace_scope"
+                    : actionType === "run_tests"
+                        ? "test_runner_scope"
+                        : "git_repo_scope";
+            pushRoot(cwd, "process_cwd", scopeReason, actionType);
+            if (actionType === "apply_patch") {
+                const patchTargets = collectStructuredPatchTargets(asString(action.patch) || "");
+                if (patchTargets.length > 0) {
+                    for (const patchTarget of patchTargets) {
+                        targets.push({
+                            target_id: `workspace_target_${String(targetIndex).padStart(2, "0")}`,
+                            path: patchTarget.path,
+                            kind: "path",
+                            access_mode: patchTarget.accessMode,
+                            action_type: actionType,
+                            source: "bridge_action_fallback",
+                        });
+                        targetIndex += 1;
+                    }
+                }
+                else {
+                    targets.push({
+                        target_id: `workspace_target_${String(targetIndex).padStart(2, "0")}`,
+                        path: cwd,
+                        kind: "path",
+                        access_mode: "write",
+                        action_type: actionType,
+                        source: "bridge_action_fallback",
+                    });
+                    targetIndex += 1;
+                }
+            }
+            else if (actionType === "git_add") {
+                targets.push({
+                    target_id: `workspace_target_${String(targetIndex).padStart(2, "0")}`,
+                    path: cwd,
+                    kind: "shell_cwd",
+                    access_mode: "execute",
+                    action_type: actionType,
+                    source: "bridge_action_fallback",
+                });
+                targetIndex += 1;
+                const rawPaths = Array.isArray(action.paths)
+                    ? action.paths || []
+                    : [];
+                for (const rawPath of rawPaths) {
+                    const targetPath = asString(rawPath);
+                    if (!targetPath) {
+                        continue;
+                    }
+                    targets.push({
+                        target_id: `workspace_target_${String(targetIndex).padStart(2, "0")}`,
+                        path: expandUserPathLike(targetPath, expandUserPathLike(cwd)),
+                        kind: "path",
+                        access_mode: "write",
+                        action_type: actionType,
+                        source: "bridge_action_fallback",
+                    });
+                    targetIndex += 1;
+                }
+            }
+            else {
+                targets.push({
+                    target_id: `workspace_target_${String(targetIndex).padStart(2, "0")}`,
+                    path: cwd,
+                    kind: "shell_cwd",
+                    access_mode: "execute",
+                    action_type: actionType,
+                    source: "bridge_action_fallback",
+                });
+                targetIndex += 1;
+            }
+            continue;
+        }
+        const targetPath = asString(action.path)
+            || (actionType === "move_file"
+                ? asString(action.source_path)
+                : "");
+        if (!targetPath) {
+            continue;
+        }
+        if (actionType === "read_file") {
+            pushRoot(path.dirname(targetPath), "declared_path", "file_parent_scope", actionType);
+            targets.push({
+                target_id: `workspace_target_${String(targetIndex).padStart(2, "0")}`,
+                path: targetPath,
+                kind: "file",
+                access_mode: "read",
+                action_type: actionType,
+                source: "bridge_action_fallback",
+            });
+            targetIndex += 1;
+            continue;
+        }
+        if (actionType === "write_text_file") {
+            const filename = asString(action.filename) || undefined;
+            const rootPath = filename
+                ? targetPath
+                : (looksLikeFilePath(targetPath) ? path.dirname(targetPath) : targetPath);
+            pushRoot(rootPath, "declared_path", "write_scope", actionType);
+            targets.push({
+                target_id: `workspace_target_${String(targetIndex).padStart(2, "0")}`,
+                path: targetPath,
+                kind: "file",
+                access_mode: "write",
+                action_type: actionType,
+                source: "bridge_action_fallback",
+                filename,
+            });
+            targetIndex += 1;
+            continue;
+        }
+        if (actionType === "write_json_file") {
+            const filename = asString(action.filename) || undefined;
+            const rootPath = filename
+                ? targetPath
+                : (looksLikeFilePath(targetPath) ? path.dirname(targetPath) : targetPath);
+            pushRoot(rootPath, "declared_path", "write_scope", actionType);
+            targets.push({
+                target_id: `workspace_target_${String(targetIndex).padStart(2, "0")}`,
+                path: targetPath,
+                kind: "file",
+                access_mode: "write",
+                action_type: actionType,
+                source: "bridge_action_fallback",
+                filename,
+            });
+            targetIndex += 1;
+            continue;
+        }
+        if (actionType === "mkdir") {
+            pushRoot(path.dirname(targetPath), "declared_path", "directory_target_parent", actionType);
+            targets.push({
+                target_id: `workspace_target_${String(targetIndex).padStart(2, "0")}`,
+                path: targetPath,
+                kind: "directory",
+                access_mode: "write",
+                action_type: actionType,
+                source: "bridge_action_fallback",
+            });
+            targetIndex += 1;
+            continue;
+        }
+        if (actionType === "move_file") {
+            const sourcePath = targetPath;
+            const destinationPath = asString(action.destination_path)
+                || asString(action.destination);
+            if (sourcePath) {
+                pushRoot(path.dirname(sourcePath), "declared_path", "move_source_parent", actionType);
+            }
+            if (destinationPath) {
+                pushRoot(path.dirname(destinationPath), "declared_path", "move_destination_parent", actionType);
+            }
+            if (sourcePath) {
+                targets.push({
+                    target_id: `workspace_target_${String(targetIndex).padStart(2, "0")}`,
+                    path: sourcePath,
+                    kind: "path",
+                    access_mode: "write",
+                    action_type: actionType,
+                    source: "bridge_action_fallback",
+                });
+                targetIndex += 1;
+            }
+            if (destinationPath) {
+                targets.push({
+                    target_id: `workspace_target_${String(targetIndex).padStart(2, "0")}`,
+                    path: destinationPath,
+                    kind: "path",
+                    access_mode: "write",
+                    action_type: actionType,
+                    source: "bridge_action_fallback",
+                });
+                targetIndex += 1;
+            }
+            continue;
+        }
+        if (actionType === "trash_path") {
+            pushRoot(path.dirname(targetPath), "declared_path", "delete_target_parent", actionType);
+            targets.push({
+                target_id: `workspace_target_${String(targetIndex).padStart(2, "0")}`,
+                path: targetPath,
+                kind: "path",
+                access_mode: "delete",
+                action_type: actionType,
+                source: "bridge_action_fallback",
+            });
+            targetIndex += 1;
+            continue;
+        }
+        if (actionType === "delete_file") {
+            pushRoot(path.dirname(targetPath), "declared_path", "delete_target_parent", actionType);
+            targets.push({
+                target_id: `workspace_target_${String(targetIndex).padStart(2, "0")}`,
+                path: targetPath,
+                kind: "path",
+                access_mode: "delete",
+                action_type: actionType,
+                source: "bridge_action_fallback",
+            });
+            targetIndex += 1;
+            continue;
+        }
+        if (actionType === "filesystem_inspect" || actionType === "list_files" || actionType === "count_files") {
+            pushRoot(targetPath, "declared_path", "filesystem_scope", actionType);
+            targets.push({
+                target_id: `workspace_target_${String(targetIndex).padStart(2, "0")}`,
+                path: targetPath,
+                kind: "directory",
+                access_mode: "enumerate",
+                action_type: actionType,
+                source: "bridge_action_fallback",
+            });
+            targetIndex += 1;
+        }
+    }
+    if (targets.length === 0) {
+        return undefined;
+    }
+    return {
+        workspace_id: "workspace_bridge_fallback",
+        roots,
+        targets,
+        instruction_bundle: {
+            resolver: "bridge_local_agents_md",
+            entrypoints: ["AGENTS.md"],
+            precedence: ["nearest_target_agents_md", "workspace_repo_agents_md", "monorepo_root_agents_md"],
+        },
+    };
+}
+export function expandUserPathLike(value, baseCwd = process.cwd()) {
+    const trimmed = asString(value);
+    if (!trimmed) {
+        return os.homedir();
+    }
+    if (trimmed === "~") {
+        return os.homedir();
+    }
+    if (trimmed.startsWith("~/")) {
+        return path.join(os.homedir(), trimmed.slice(2));
+    }
+    if (path.isAbsolute(trimmed)) {
+        return trimmed;
+    }
+    return path.resolve(baseCwd, trimmed);
+}
+async function findRepoRoot(startPath) {
+    let current = startPath;
+    while (true) {
+        try {
+            const gitStat = await stat(path.join(current, ".git"));
+            if (gitStat.isDirectory() || gitStat.isFile()) {
+                return current;
+            }
+        }
+        catch {
+            // Keep walking upwards.
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return undefined;
+        }
+        current = parent;
+    }
+}
+function resolveWorkspaceScanBasePath(roots, repoRoot) {
+    if (repoRoot) {
+        const matchingRoot = findBestMatchingRoot(repoRoot, roots);
+        if (matchingRoot) {
+            return {
+                basePath: repoRoot,
+                repoRootWithinWorkspace: true,
+            };
+        }
+    }
+    return {
+        basePath: roots[0]?.resolved_path || process.cwd(),
+        repoRootWithinWorkspace: false,
+    };
+}
+async function pathExists(candidatePath) {
+    try {
+        await stat(candidatePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function buildWorkspaceIndex(options) {
+    if (options.roots.length === 0) {
+        return undefined;
+    }
+    const descriptor = options.descriptor;
+    const { basePath } = resolveWorkspaceScanBasePath(options.roots, options.repoRoot);
+    const resolver = asString(descriptor?.resolver) || "bridge_workspace_scan";
+    const maxDepth = clampInteger(descriptor?.max_depth, 3, 1, 8);
+    const maxDirectories = clampInteger(descriptor?.max_directories, 48, 1, 256);
+    const maxFiles = clampInteger(descriptor?.max_files, 160, 1, 2000);
+    const ignoredDirectoryNames = new Set(uniqueStrings([
+        ...(descriptor?.ignored_directory_names || []),
+        ...DEFAULT_IGNORED_DIRECTORY_NAMES,
+    ]));
+    const keyFilePatterns = new Set(uniqueStrings([
+        ...(descriptor?.key_file_patterns || []),
+        ...DEFAULT_KEY_FILE_PATTERNS,
+    ]));
+    const queue = [{ directoryPath: basePath, depth: 0 }];
+    const topLevelEntries = [];
+    const keyFiles = new Set();
+    const extensionCounts = new Map();
+    let scannedDirectoryCount = 0;
+    let scannedFileCount = 0;
+    let truncated = false;
+    while (queue.length > 0) {
+        if (scannedDirectoryCount >= maxDirectories || scannedFileCount >= maxFiles) {
+            truncated = true;
+            break;
+        }
+        const next = queue.shift();
+        if (!next) {
+            break;
+        }
+        scannedDirectoryCount += 1;
+        let entries;
+        try {
+            entries = await readdir(next.directoryPath, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        entries.sort((left, right) => left.name.localeCompare(right.name));
+        for (const entry of entries) {
+            const candidatePath = path.join(next.directoryPath, entry.name);
+            const relativePath = toRelativePath(basePath, candidatePath);
+            if (next.depth === 0 && topLevelEntries.length < WORKSPACE_INDEX_TOP_LEVEL_LIMIT) {
+                topLevelEntries.push({
+                    path: relativePath,
+                    kind: entry.isDirectory() ? "directory" : "file",
+                });
+            }
+            if (entry.isDirectory()) {
+                if (ignoredDirectoryNames.has(entry.name)) {
+                    continue;
+                }
+                if (next.depth + 1 <= maxDepth) {
+                    queue.push({
+                        directoryPath: candidatePath,
+                        depth: next.depth + 1,
+                    });
+                }
+                else {
+                    truncated = true;
+                }
+                continue;
+            }
+            if (!entry.isFile()) {
+                continue;
+            }
+            scannedFileCount += 1;
+            if (keyFilePatterns.has(entry.name)) {
+                keyFiles.add(relativePath);
+            }
+            const extension = path.extname(entry.name).toLowerCase() || "[no_ext]";
+            extensionCounts.set(extension, (extensionCounts.get(extension) || 0) + 1);
+            if (scannedFileCount >= maxFiles) {
+                truncated = true;
+                break;
+            }
+        }
+    }
+    const dominantExtensions = Array.from(extensionCounts.entries())
+        .sort((left, right) => right[1] - left[1] || left[0].localeCompare(right[0]))
+        .slice(0, WORKSPACE_INDEX_EXTENSION_LIMIT)
+        .map(([extension, count]) => ({ extension, count }));
+    return {
+        resolver,
+        workspace_id: options.workspaceId,
+        base_path: basePath,
+        scanned_directory_count: scannedDirectoryCount,
+        scanned_file_count: scannedFileCount,
+        truncated,
+        top_level_entries: topLevelEntries,
+        key_files: Array.from(keyFiles).sort((left, right) => left.localeCompare(right)),
+        dominant_extensions: dominantExtensions,
+        summary: `Indexei ${scannedFileCount} arquivo${scannedFileCount === 1 ? "" : "s"} e ${scannedDirectoryCount} diretorio${scannedDirectoryCount === 1 ? "" : "s"} em ${path.basename(basePath) || basePath}.`,
+    };
+}
+export async function buildRepoManifest(options) {
+    if (options.roots.length === 0) {
+        return undefined;
+    }
+    const descriptor = options.descriptor;
+    const { basePath, repoRootWithinWorkspace } = resolveWorkspaceScanBasePath(options.roots, options.repoRoot);
+    const resolver = asString(descriptor?.resolver) || "bridge_workspace_repo_probe";
+    const markerPaths = uniqueStrings([...(descriptor?.marker_paths || []), ...DEFAULT_REPO_MARKERS]);
+    const manifestPaths = uniqueStrings([...(descriptor?.manifest_paths || []), ...DEFAULT_REPO_MANIFEST_PATHS]);
+    const lockfilePaths = uniqueStrings([...(descriptor?.lockfile_paths || []), ...DEFAULT_REPO_LOCKFILE_PATHS]);
+    const includeInstructionSources = descriptor?.include_instruction_sources !== false;
+    const detectedMarkers = [];
+    const manifestFiles = [];
+    const lockfiles = [];
+    for (const relativePath of markerPaths) {
+        if (await pathExists(path.join(basePath, relativePath))) {
+            detectedMarkers.push(relativePath);
+        }
+    }
+    for (const relativePath of manifestPaths) {
+        if (await pathExists(path.join(basePath, relativePath))) {
+            manifestFiles.push(relativePath);
+        }
+    }
+    for (const relativePath of lockfilePaths) {
+        if (await pathExists(path.join(basePath, relativePath))) {
+            lockfiles.push(relativePath);
+        }
+    }
+    const packageManagers = uniqueStrings(lockfiles.map((item) => LOCKFILE_PACKAGE_MANAGER_MAP[item] || ""))
+        .sort((left, right) => left.localeCompare(right));
+    const instructionSourcePaths = includeInstructionSources
+        ? uniqueStrings(options.instructionBundle?.sources.map((item) => toRelativePath(basePath, item.path)) || [])
+            .sort((left, right) => left.localeCompare(right))
+        : [];
+    const targetPaths = uniqueStrings(options.targets.map((target) => toRelativePath(basePath, target.resolved_path)))
+        .sort((left, right) => left.localeCompare(right));
+    const vcs = asString(descriptor?.vcs_hint) || (options.repoRoot ? "git" : "filesystem");
+    return {
+        resolver,
+        workspace_id: options.workspaceId,
+        scoped_root_path: basePath,
+        detected_repo_root: options.repoRoot || undefined,
+        repo_root_within_workspace: repoRootWithinWorkspace,
+        repo_name: path.basename(basePath) || basePath,
+        vcs,
+        detected_markers: detectedMarkers,
+        manifest_files: manifestFiles,
+        lockfiles,
+        package_managers: packageManagers,
+        instruction_source_paths: instructionSourcePaths,
+        target_paths: targetPaths,
+        summary: `Repo manifest para ${path.basename(basePath) || basePath} com ${manifestFiles.length} manifest${manifestFiles.length === 1 ? "" : "s"} e ${lockfiles.length} lockfile${lockfiles.length === 1 ? "" : "s"}.`,
+    };
+}
+export function buildWorkspaceMemory(options) {
+    const workspaceId = asString(options.workspaceId) || options.workspace?.workspaceId || "workspace_local_runtime";
+    const workspace = options.workspace || undefined;
+    const priorMemory = options.priorMemory;
+    const currentActionTypes = uniqueRuntimeStrings((options.actions || []).map((action) => asString(action.type).toLowerCase()), 16);
+    const currentTargetPaths = uniqueRuntimeStrings((workspace?.targets || []).map((target) => target.resolved_path || target.path), 16);
+    const currentArtifactKinds = uniqueRuntimeStrings((options.artifacts || []).map((artifact) => asString(artifact.kind).toLowerCase()), 16);
+    const recentJobIds = uniqueRuntimeStrings([options.jobId, ...(priorMemory?.recent_job_ids || [])], 12);
+    const recentActionTypes = uniqueRuntimeStrings([...currentActionTypes, ...(priorMemory?.recent_action_types || [])], 16);
+    const recentTargetPaths = uniqueRuntimeStrings([...currentTargetPaths, ...(priorMemory?.recent_target_paths || [])], 16);
+    const recentArtifactKinds = uniqueRuntimeStrings([...currentArtifactKinds, ...(priorMemory?.recent_artifact_kinds || [])], 16);
+    const jobCount = Math.max(recentJobIds.length, (priorMemory?.job_count || 0) + (options.jobId && options.jobId !== priorMemory?.latest_job_id ? 1 : 0));
+    const latestJobStatus = asString(options.jobStatus) || priorMemory?.latest_job_status || undefined;
+    const scopedRootPath = workspace?.repoManifest?.scoped_root_path
+        || priorMemory?.scoped_root_path
+        || workspace?.roots[0]?.resolved_path
+        || undefined;
+    const repoRoot = workspace?.repoManifest?.detected_repo_root
+        || workspace?.repoRoot
+        || priorMemory?.repo_root
+        || undefined;
+    const instructionDigest = workspace?.instructionBundle?.digest || priorMemory?.instruction_digest || undefined;
+    const updatedAt = asString(options.updatedAt) || new Date().toISOString();
+    return {
+        memory_id: `workspace_memory.${workspaceId}`,
+        workspace_id: workspaceId,
+        source: workspace ? "bridge_workspace_runtime" : (priorMemory?.source || "device_job_history"),
+        job_count: Math.max(0, jobCount),
+        recent_job_ids: recentJobIds,
+        recent_action_types: recentActionTypes,
+        recent_target_paths: recentTargetPaths,
+        recent_artifact_kinds: recentArtifactKinds,
+        latest_job_id: asString(options.jobId) || priorMemory?.latest_job_id || undefined,
+        latest_job_status: latestJobStatus,
+        latest_job_at: updatedAt,
+        instruction_digest: instructionDigest,
+        repo_root: repoRoot,
+        scoped_root_path: scopedRootPath,
+        summary: `Memoria curta do workspace ${workspaceId} com ${Math.max(0, jobCount)} job${jobCount === 1 ? "" : "s"} recente${jobCount === 1 ? "" : "s"}; ultima execucao ${latestJobStatus || "desconhecida"}.`,
+    };
+}
+async function buildInstructionBundle(options) {
+    const descriptor = options.descriptor;
+    const entrypoints = descriptor?.entrypoints?.length ? descriptor.entrypoints : ["AGENTS.md"];
+    const precedence = descriptor?.precedence?.length
+        ? descriptor.precedence
+        : ["nearest_target_agents_md", "workspace_repo_agents_md", "monorepo_root_agents_md"];
+    const resolver = asString(descriptor?.resolver) || "bridge_local_agents_md";
+    const discovered = [];
+    const seen = new Set();
+    const repoRoot = options.repoRoot;
+    for (const target of options.targets) {
+        let current = target.directory_path;
+        const upperBound = repoRoot || findBestMatchingRoot(current, options.roots)?.resolved_path || current;
+        while (true) {
+            for (const entrypoint of entrypoints) {
+                const candidate = path.join(current, entrypoint);
+                if (seen.has(candidate)) {
+                    continue;
+                }
+                try {
+                    const fileStat = await stat(candidate);
+                    if (!fileStat.isFile()) {
+                        continue;
+                    }
+                    const rawContent = await readFile(candidate, "utf8");
+                    seen.add(candidate);
+                    const scope = current === target.directory_path
+                        ? "nearest_target"
+                        : repoRoot && current === repoRoot
+                            ? "repo_root"
+                            : options.roots.some((root) => root.resolved_path === current)
+                                ? "workspace_root"
+                                : "ancestor";
+                    discovered.push({
+                        path: candidate,
+                        scope,
+                        content: clipInstructionText(rawContent),
+                        content_char_count: rawContent.length,
+                    });
+                }
+                catch {
+                    // Ignore missing entrypoints.
+                }
+            }
+            if (current === upperBound) {
+                break;
+            }
+            const parent = path.dirname(current);
+            if (parent === current) {
+                break;
+            }
+            current = parent;
+        }
+    }
+    if (discovered.length === 0) {
+        return undefined;
+    }
+    const digest = createHash("sha1")
+        .update(discovered.map((item) => `${item.path}:${item.content_char_count}:${item.content}`).join("\n"))
+        .digest("hex");
+    return {
+        resolver,
+        entrypoints,
+        precedence,
+        digest,
+        source_count: discovered.length,
+        sources: discovered,
+        summary: `Carreguei ${discovered.length} arquivo${discovered.length === 1 ? "" : "s"} ${entrypoints.join(", ")} para o workspace atual.`,
+    };
+}
+export async function resolveWorkspaceContext(options) {
+    const baseCwd = options.baseCwd || process.cwd();
+    const declared = options.workspaceContext || inferRuntimeWorkspaceContextFromActions(options.actions || []);
+    if (!declared || !Array.isArray(declared.roots) || declared.roots.length === 0) {
+        return null;
+    }
+    const resolvedRoots = declared.roots
+        .map((root, index) => {
+        const resolvedPath = expandUserPathLike(root.path, baseCwd);
+        return {
+            ...root,
+            root_id: asString(root.root_id) || `workspace_root_${String(index + 1).padStart(2, "0")}`,
+            resolved_path: resolvedPath,
+            action_types: root.action_types || [],
+        };
+    })
+        .filter((root) => Boolean(root.resolved_path));
+    if (resolvedRoots.length === 0) {
+        return null;
+    }
+    const resolvedTargets = [];
+    for (const [index, target] of (declared.targets || []).entries()) {
+        const expandedBasePath = expandUserPathLike(target.path, baseCwd);
+        const resolvedPath = target.filename
+            ? path.join(expandedBasePath, target.filename)
+            : expandedBasePath;
+        const directoryPath = dirnameForTarget(target, resolvedPath);
+        const matchedRoot = findBestMatchingRoot(resolvedPath, resolvedRoots)
+            || findBestMatchingRoot(directoryPath, resolvedRoots);
+        if (!matchedRoot) {
+            throw new Error(`O caminho ${target.path} fica fora do workspace permitido.`);
+        }
+        resolvedTargets.push({
+            ...target,
+            target_id: asString(target.target_id) || `workspace_target_${String(index + 1).padStart(2, "0")}`,
+            resolved_path: resolvedPath,
+            directory_path: directoryPath,
+            root_id: matchedRoot.root_id,
+        });
+    }
+    const repoRoot = await findRepoRoot(resolvedTargets[0]?.directory_path || resolvedRoots[0].resolved_path);
+    const workspaceId = asString(declared.workspace_id) || "workspace_local_runtime";
+    const runtimeActionTypes = uniqueStrings((options.actions || []).map((action) => asString(action.type).toLowerCase()));
+    const targetActionTypes = uniqueStrings((declared.targets || []).map((target) => asString(target.action_type).toLowerCase()));
+    const destructiveActionTypes = new Set();
+    for (const target of declared.targets || []) {
+        if (asString(target.access_mode).toLowerCase() === "delete" && asString(target.action_type)) {
+            destructiveActionTypes.add(asString(target.action_type).toLowerCase());
+        }
+    }
+    for (const action of options.actions || []) {
+        const actionType = asString(action.type).toLowerCase();
+        if (!actionType) {
+            continue;
+        }
+        if (actionType === "trash_path" || actionType === "delete_file") {
+            destructiveActionTypes.add(actionType);
+            continue;
+        }
+        if (actionType === "apply_patch") {
+            const patchTargets = collectStructuredPatchTargets(asString(action.patch) || "");
+            if (patchTargets.some((item) => item.accessMode === "delete")) {
+                destructiveActionTypes.add(actionType);
+            }
+        }
+    }
+    const workspaceMemory = normalizeWorkspaceMemory(declared.workspace_memory, workspaceId);
+    const workspacePolicy = normalizeWorkspacePolicy(declared.workspace_policy, workspaceId, [...targetActionTypes, ...runtimeActionTypes], destructiveActionTypes);
+    const instructionBundle = await buildInstructionBundle({
+        descriptor: declared.instruction_bundle,
+        roots: resolvedRoots,
+        targets: resolvedTargets,
+        repoRoot,
+    });
+    const workspaceIndex = await buildWorkspaceIndex({
+        workspaceId,
+        roots: resolvedRoots,
+        repoRoot,
+        descriptor: declared.workspace_index,
+    });
+    const repoManifest = await buildRepoManifest({
+        workspaceId,
+        roots: resolvedRoots,
+        targets: resolvedTargets,
+        repoRoot,
+        instructionBundle,
+        descriptor: declared.repo_manifest,
+    });
+    const defaultCwd = resolvedTargets.find((target) => target.kind === "shell_cwd")?.resolved_path
+        || resolvedRoots[0]?.resolved_path
+        || baseCwd;
+    return {
+        workspaceId,
+        roots: resolvedRoots,
+        targets: resolvedTargets,
+        repoRoot,
+        defaultCwd,
+        instructionBundle,
+        repoManifest,
+        workspaceIndex,
+        workspaceMemory,
+        workspacePolicy,
+        summary: `Workspace ${workspaceId} com ${resolvedRoots.length} root${resolvedRoots.length === 1 ? "" : "s"} e ${resolvedTargets.length} target${resolvedTargets.length === 1 ? "" : "s"}.`,
+    };
+}
+export function assertPathInsideWorkspace(workspace, targetPath, options) {
+    const resolvedPath = options?.filename
+        ? path.join(expandUserPathLike(targetPath, options?.baseCwd || workspace.defaultCwd), options.filename)
+        : expandUserPathLike(targetPath, options?.baseCwd || workspace.defaultCwd);
+    const matchedRoot = findBestMatchingRoot(resolvedPath, workspace.roots)
+        || findBestMatchingRoot(path.dirname(resolvedPath), workspace.roots);
+    if (!matchedRoot) {
+        throw new Error(`O caminho ${targetPath} fica fora do workspace permitido (${workspace.workspaceId}).`);
+    }
+    return resolvedPath;
+}
+export function assertCwdInsideWorkspace(workspace, cwd) {
+    const resolvedCwd = expandUserPathLike(cwd || workspace.defaultCwd, workspace.defaultCwd);
+    const matchedRoot = findBestMatchingRoot(resolvedCwd, workspace.roots);
+    if (!matchedRoot) {
+        throw new Error(`O diretorio ${cwd || workspace.defaultCwd} fica fora do workspace permitido (${workspace.workspaceId}).`);
+    }
+    return resolvedCwd;
+}
+export function assertActionAllowedByWorkspacePolicy(workspace, actionType) {
+    const normalizedActionType = asString(actionType).toLowerCase();
+    if (!normalizedActionType || !WORKSPACE_POLICY_ALL_ACTIONS.has(normalizedActionType) && normalizedActionType !== "apply_patch") {
+        return;
+    }
+    const workspacePolicy = workspace.workspacePolicy;
+    if (!workspacePolicy) {
+        return;
+    }
+    if (workspacePolicy.blocked_action_types.includes(normalizedActionType)) {
+        throw new Error(`A action ${normalizedActionType} foi bloqueada pela policy ${workspacePolicy.profile_id} do workspace ${workspace.workspaceId}.`);
+    }
+    if (!workspacePolicy.allowed_action_types.includes(normalizedActionType)) {
+        throw new Error(`A action ${normalizedActionType} nao esta permitida pela policy ${workspacePolicy.profile_id} do workspace ${workspace.workspaceId}.`);
+    }
+}