@mcoda/codali 0.1.135-codali.2 → 0.1.135-codali.4

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## Unreleased
 
+- Retry transient Windows state-file replacement conflicts without deleting the
+  previous state or suppressing permanent errors. Retain file durability checks.
+- Resolve native macOS Git within the selected developer installation so sandboxed
+  repository inspection works without launching the Xcode wrapper.
+
+## 0.1.135-codali.3 - 2026-10-26
+
+- Allow bounded Git diff/status inspection within the final validation budget;
+  keep edits blocked and require actual test evidence before verifying code.
+- Disable terminal echo before displaying the API-key prompt, preventing fast
+  input from being echoed. Verify masked entry, backspace, cancellation, key
+  rotation, logout, credential-cache refresh and bounded piped input.
+
+- Tagged candidate; publication was cancelled after Windows CI exposed a
+  transient state-file replacement failure addressed above.
+
 ## 0.1.135-codali.2 - 2026-10-26
 
 - Keep core tool definitions available across task handoffs, while requiring a

package/dist/cli/TerminalCredentials.js

@@ -81,9 +81,9 @@ export const readTerminalCredential = async (fromStdin) => {
                 }
             }
         };
-        process.stderr.write("mSwarm API key: ");
         process.stdin.setRawMode(true);
-        process.stdin.resume();
         process.stdin.on("data", onData);
+        process.stdin.resume();
+        process.stderr.write("mSwarm API key: ");
     });
 };

package/dist/runtime/SessionController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionController.d.ts","sourceRoot":"","sources":["../../src/runtime/SessionController.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAG1D,OAAO,KAAK,EAAE,SAAS,EAAY,MAAM,yBAAyB,CAAC;AAInE,OAAO,KAAK,EAAE,QAAQ,EAAsD,MAAM,+BAA+B,CAAC;AAClH,OAAO,EAAwD,KAAK,WAAW,EAAE,KAAK,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC5J,OAAO,EAAE,cAAc,EAA8D,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAK7K,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAsB,KAAK,cAAc,EAAiD,MAAM,uBAAuB,CAAC;AAqB/H,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAErE,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAIrG,OAAO,KAAK,EAAE,oBAAoB,EAA8C,MAAM,eAAe,CAAC;AAEtG,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,CAAC,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5H;AACD,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,2BAA2B,CAAC;IACtC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,KAAK,CAAC,EAAE,cAAc,EAAE,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AASD,UAAU,YAAY;IAAG,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CAAE;AAgBnM,qBAAa,iBAAiB;IA2FhB,OAAO,CAAC,QAAQ,CAAC,OAAO;IA1FpC,OAAO,CAAC,cAAc,CAAS;IAC/B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,QAAQ,eAAsB;IACvC,QAAQ,CAAC,SAAS,8DAAoB;IACtC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,CAAC,MAAM,CAAC,CAAkB;IACjC,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,QAAQ,CAAyB;IACzC,OAAO,CAAC,QAAQ,CAAwC;IACxD,OAAO,CAAC,QAAQ,CAA6B;IAC7C,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,cAAc,CAAC,CAAoB;IAC3C,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,gBAAgB,CAAC,CAAU;IACnC,OAAO,CAAC,KAAK,CAA+G;IAC5H,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,gBAAgB,CAA4B;IACpD,OAAO,CAAC,gBAAgB,CAAC,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,CAAoB;IACrC,OAAO,CAAC,gBAAgB,CAAC,CAAoB;IAC7C,OAAO,CAAC,YAAY,CAAM;IAC1B,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,MAAM,CAAC,CAAe;IAC9B,OAAO,CAAC,aAAa,CAAC,CAAgB;IACtC,OAAO,CAAC,WAAW,CAAgB;IACnC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,aAAa,CAAM;IAC3B,OAAO,CAAC,mBAAmB,CAAQ;IACnC,OAAO,CAAC,gBAAgB,CAA6B;IACrD,OAAO,CAAC,eAAe,CAAyB;IAChD,OAAO,CAAC,iBAAiB,CAAC,CAAoB;IAC9C,OAAO,CAAC,cAAc,CAAgB;IACtC,OAAO,CAAC,eAAe,CAAiB;IACxC,OAAO,CAAC,aAAa,CAAyG;IAC9H,OAAO,CAAC,UAAU,CAAC,CAAa;IAChC,OAAO,CAAC,YAAY,CAA4b;IAEhd,OAAO,KAAK,SAAS,GAAkG;IACvH,OAAO,CAAC,iBAAiB;YAWX,gBAAgB;YAuBhB,eAAe;YAKf,UAAU;gBASK,OAAO,EAAE,wBAAwB;IAoB9D,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,iBAAiB;YAWX,kBAAkB;IA8BhC,IAAI,IAAI,IAAI,OAAO,CAA0B;IAC7C,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAOjC,aAAa,IAAI,YAAY;IAC7B,UAAU,IAAI,aAAa;IAI3B,OAAO,CAAC,eAAe;IAIjB,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YAEvC,kBAAkB;YASlB,IAAI;YAmBJ,MAAM;YAKN,gBAAgB;YAchB,gBAAgB;YAOhB,YAAY;YAoDZ,uBAAuB;IAW/B,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBvC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgCvC,MAAM,IAAI,IAAI;IAER,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOzC,UAAU,CAAC,IAAI,SAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpD,OAAO,CAAC,eAAe;IAqBjB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAExB,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAKtC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC;IAwBvB,mBAAmB,CAAC,QAAQ,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBzE,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBxC,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ3F,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC;YAEf,MAAM;IAOpB,OAAO,CAAC,kBAAkB;IAS1B,OAAO,CAAC,eAAe;IAWvB,OAAO,CAAC,iBAAiB;YAKX,iBAAiB;IAU/B,OAAO,CAAC,QAAQ;YAsHF,UAAU;YAoDV,SAAS;IAwEvB,OAAO,CAAC,eAAe;IAuCvB,OAAO,CAAC,UAAU;IAElB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,SAAS;IAuDjB,OAAO,CAAC,UAAU;YAaJ,MAAM;IA0Dd,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CAwG7E"}
+{"version":3,"file":"SessionController.d.ts","sourceRoot":"","sources":["../../src/runtime/SessionController.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAG1D,OAAO,KAAK,EAAE,SAAS,EAAY,MAAM,yBAAyB,CAAC;AAInE,OAAO,KAAK,EAAE,QAAQ,EAAsD,MAAM,+BAA+B,CAAC;AAClH,OAAO,EAAwD,KAAK,WAAW,EAAE,KAAK,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC5J,OAAO,EAAE,cAAc,EAA8D,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAK7K,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAsB,KAAK,cAAc,EAAiD,MAAM,uBAAuB,CAAC;AAqB/H,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAErE,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAIrG,OAAO,KAAK,EAAE,oBAAoB,EAA8C,MAAM,eAAe,CAAC;AAEtG,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,CAAC,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5H;AACD,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,2BAA2B,CAAC;IACtC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,KAAK,CAAC,EAAE,cAAc,EAAE,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AASD,UAAU,YAAY;IAAG,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CAAE;AAgBnM,qBAAa,iBAAiB;IA2FhB,OAAO,CAAC,QAAQ,CAAC,OAAO;IA1FpC,OAAO,CAAC,cAAc,CAAS;IAC/B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,QAAQ,eAAsB;IACvC,QAAQ,CAAC,SAAS,8DAAoB;IACtC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,CAAC,MAAM,CAAC,CAAkB;IACjC,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,QAAQ,CAAyB;IACzC,OAAO,CAAC,QAAQ,CAAwC;IACxD,OAAO,CAAC,QAAQ,CAA6B;IAC7C,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,cAAc,CAAC,CAAoB;IAC3C,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,gBAAgB,CAAC,CAAU;IACnC,OAAO,CAAC,KAAK,CAA+G;IAC5H,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,gBAAgB,CAA4B;IACpD,OAAO,CAAC,gBAAgB,CAAC,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,CAAoB;IACrC,OAAO,CAAC,gBAAgB,CAAC,CAAoB;IAC7C,OAAO,CAAC,YAAY,CAAM;IAC1B,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,MAAM,CAAC,CAAe;IAC9B,OAAO,CAAC,aAAa,CAAC,CAAgB;IACtC,OAAO,CAAC,WAAW,CAAgB;IACnC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,aAAa,CAAM;IAC3B,OAAO,CAAC,mBAAmB,CAAQ;IACnC,OAAO,CAAC,gBAAgB,CAA6B;IACrD,OAAO,CAAC,eAAe,CAAyB;IAChD,OAAO,CAAC,iBAAiB,CAAC,CAAoB;IAC9C,OAAO,CAAC,cAAc,CAAgB;IACtC,OAAO,CAAC,eAAe,CAAiB;IACxC,OAAO,CAAC,aAAa,CAAyG;IAC9H,OAAO,CAAC,UAAU,CAAC,CAAa;IAChC,OAAO,CAAC,YAAY,CAA4b;IAEhd,OAAO,KAAK,SAAS,GAAkG;IACvH,OAAO,CAAC,iBAAiB;YAWX,gBAAgB;YAuBhB,eAAe;YAKf,UAAU;gBASK,OAAO,EAAE,wBAAwB;IAoB9D,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,iBAAiB;YAWX,kBAAkB;IA8BhC,IAAI,IAAI,IAAI,OAAO,CAA0B;IAC7C,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAOjC,aAAa,IAAI,YAAY;IAC7B,UAAU,IAAI,aAAa;IAI3B,OAAO,CAAC,eAAe;IAIjB,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YAEvC,kBAAkB;YASlB,IAAI;YAmBJ,MAAM;YAKN,gBAAgB;YAchB,gBAAgB;YAOhB,YAAY;YAoDZ,uBAAuB;IAW/B,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBvC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgCvC,MAAM,IAAI,IAAI;IAER,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOzC,UAAU,CAAC,IAAI,SAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpD,OAAO,CAAC,eAAe;IAqBjB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAExB,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAKtC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC;IAwBvB,mBAAmB,CAAC,QAAQ,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBzE,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBxC,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ3F,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC;YAEf,MAAM;IAOpB,OAAO,CAAC,kBAAkB;IAS1B,OAAO,CAAC,eAAe;IAWvB,OAAO,CAAC,iBAAiB;YAKX,iBAAiB;IAU/B,OAAO,CAAC,QAAQ;YAsHF,UAAU;YAqDV,SAAS;IAwEvB,OAAO,CAAC,eAAe;IAuCvB,OAAO,CAAC,UAAU;IAElB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,SAAS;IAuDjB,OAAO,CAAC,UAAU;YAaJ,MAAM;IA0Dd,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CAwG7E"}

package/dist/runtime/SessionController.js

@@ -27,7 +27,7 @@ import { ManagedDocdex } from "../docdex/ManagedDocdex.js";
 import { ConfiguredEmbeddings } from "../providers/ConfiguredEmbeddings.js";
 import { runCodaliTask } from "./CodaliRuntime.js";
 import { WorkspaceLock } from "./WorkspaceLock.js";
-import { isVerificationCommand } from "./VerificationCommand.js";
+import { isVerificationCommand, isVerificationInspectionCommand } from "./VerificationCommand.js";
 import { assertRequestedTestEvidence } from "./RequestedTestEvidence.js";
 import { readReviewSource } from "./ReviewSource.js";
 import { taskReviewContext } from "./TaskReviewContext.js";
@@ -849,7 +849,8 @@ export class SessionController {
         const kind = permissionKind(tool);
         if (this.docdex && !this.docdexReady && (["write", "shell"].includes(kind) || tool.name.startsWith("docdex_")))
             throw new ToolExecutionError("docdex_unavailable", "Docdex index is unavailable for this turn. Record the blocker; recover the service before code changes.", { retryable: false });
-        if ((["write", "media"].includes(kind) || tool.name === "delegate_helper" || kind === "shell" && !isVerificationCommand(args)) && this.usage.tokens + this.validationReserve() > limits.maxTotalTokens)
+        const validationShell = isVerificationCommand(args) || tool.name === "run_shell" && isVerificationInspectionCommand(args);
+        if ((["write", "media"].includes(kind) || tool.name === "delegate_helper" || kind === "shell" && !validationShell) && this.usage.tokens + this.validationReserve() > limits.maxTotalTokens)
             throw new ToolExecutionError("tool_permission_denied", "Remaining budget is reserved for verification; checkpoint unfinished work or increase the effort budget");
         const data = argsObject(args);
         if (["write", "shell", "media"].includes(kind) || kind === "external" && !tool.readOnly) {

package/dist/runtime/VerificationCommand.d.ts

@@ -1,3 +1,5 @@
+/** Budget eligibility for inspection only; never substitutes for test evidence. */
+export declare const isVerificationInspectionCommand: (args: unknown) => boolean;
 /** Command-shape eligibility only; success, fresh input hashes and review remain mandatory. */
 export declare const isVerificationCommand: (args: unknown) => boolean;
 //# sourceMappingURL=VerificationCommand.d.ts.map

package/dist/runtime/VerificationCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"VerificationCommand.d.ts","sourceRoot":"","sources":["../../src/runtime/VerificationCommand.ts"],"names":[],"mappings":"AAEA,+FAA+F;AAC/F,eAAO,MAAM,qBAAqB,GAAI,MAAM,OAAO,KAAG,OA6BrD,CAAC"}
+{"version":3,"file":"VerificationCommand.d.ts","sourceRoot":"","sources":["../../src/runtime/VerificationCommand.ts"],"names":[],"mappings":"AAEA,mFAAmF;AACnF,eAAO,MAAM,+BAA+B,GAAI,MAAM,OAAO,KAAG,OAiB/D,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,qBAAqB,GAAI,MAAM,OAAO,KAAG,OA6BrD,CAAC"}

package/dist/runtime/VerificationCommand.js

@@ -1,4 +1,32 @@
 import path from "node:path";
+/** Budget eligibility for inspection only; never substitutes for test evidence. */
+export const isVerificationInspectionCommand = (args) => {
+    if (!args || typeof args !== "object" || Array.isArray(args))
+        return false;
+    const value = args;
+    if (value.command !== "git" || !Array.isArray(value.args) || value.args.some(arg => typeof arg !== "string"))
+        return false;
+    if (value.writePaths !== undefined && (!Array.isArray(value.writePaths) || value.writePaths.length !== 0))
+        return false;
+    const argv = value.args;
+    const flags = argv[0] === "diff"
+        ? ["--no-ext-diff", "--no-textconv", "--no-color", "--stat", "--name-only", "--name-status", "--check", "--cached", "--staged"]
+        : argv[0] === "status" ? ["--short", "--porcelain", "--porcelain=v1", "--porcelain=v2", "--branch"] : undefined;
+    if (!flags)
+        return false;
+    let paths = false;
+    for (const arg of argv.slice(1)) {
+        if (paths) {
+            if (!arg)
+                return false;
+        }
+        else if (arg === "--")
+            paths = true;
+        else if (!flags.includes(arg))
+            return false;
+    }
+    return true;
+};
 /** Command-shape eligibility only; success, fresh input hashes and review remain mandatory. */
 export const isVerificationCommand = (args) => {
     if (!args || typeof args !== "object" || Array.isArray(args))

package/dist/session/AtomicState.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AtomicState.d.ts","sourceRoot":"","sources":["../../src/session/AtomicState.ts"],"names":[],"mappings":"AAMA;mFACmF;AACnF,eAAO,MAAM,kBAAkB,GAAU,WAAW,MAAM,KAAG,OAAO,CAAC,IAAI,CAOxE,CAAC;AAEF,eAAO,MAAM,eAAe,GAAU,MAAM,MAAM,EAAE,OAAO,OAAO,KAAG,OAAO,CAAC,IAAI,CAehF,CAAC;AAIF,6FAA6F;AAC7F,eAAO,MAAM,YAAY,GAAU,CAAC,EAAE,MAAM,MAAM,EAAE,WAAW,MAAM,OAAO,CAAC,CAAC,CAAC,KAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CAK3I,CAAC;AACF,eAAO,MAAM,aAAa,GAAU,CAAC,EAAE,MAAM,MAAM,EAAE,WAAW,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,kBAAkB,KAAG,OAAO,CAAC,CAAC,CAS/G,CAAC"}
+{"version":3,"file":"AtomicState.d.ts","sourceRoot":"","sources":["../../src/session/AtomicState.ts"],"names":[],"mappings":"AAMA;mFACmF;AACnF,eAAO,MAAM,kBAAkB,GAAU,WAAW,MAAM,KAAG,OAAO,CAAC,IAAI,CAOxE,CAAC;AAEF,eAAO,MAAM,eAAe,GAAU,MAAM,MAAM,EAAE,OAAO,OAAO,KAAG,OAAO,CAAC,IAAI,CAyBhF,CAAC;AAIF,6FAA6F;AAC7F,eAAO,MAAM,YAAY,GAAU,CAAC,EAAE,MAAM,MAAM,EAAE,WAAW,MAAM,OAAO,CAAC,CAAC,CAAC,KAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CAK3I,CAAC;AACF,eAAO,MAAM,aAAa,GAAU,CAAC,EAAE,MAAM,MAAM,EAAE,WAAW,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,kBAAkB,KAAG,OAAO,CAAC,CAAC,CAS/G,CAAC"}

package/dist/session/AtomicState.js

@@ -28,7 +28,21 @@ export const atomicWriteJson = async (file, value) => {
         await handle.writeFile(`${JSON.stringify(value, null, 2)}\n`, "utf8");
         await handle.sync();
         await handle.close();
-        await fs.rename(temporary, file);
+        // A concurrent Windows reader or scanner can briefly deny replacement.
+        // Retry the same atomic rename; never remove the previous durable state.
+        for (let attempt = 0;; attempt++) {
+            try {
+                await fs.rename(temporary, file);
+                break;
+            }
+            catch (error) {
+                const code = error.code ?? "";
+                if (process.platform !== "win32" || !["EPERM", "EACCES", "EBUSY"].includes(code) || attempt >= 7)
+                    throw error;
+                await assertRegularStateFile(file);
+                await new Promise(resolve => setTimeout(resolve, Math.min(20 * 2 ** attempt, 160)));
+            }
+        }
         await syncStateDirectory(path.dirname(file));
     }
     finally {

package/dist/tools/shell/AsyncProcess.d.ts

@@ -11,6 +11,9 @@ export interface ProcessEnvironment {
     PYTHONUSERBASE?: string;
     SDKROOT?: string;
     DEVELOPER_DIR?: string;
+    GIT_CONFIG_NOSYSTEM?: string;
+    GIT_CONFIG_GLOBAL?: string;
+    GIT_ATTR_NOSYSTEM?: string;
 }
 export declare const runProcess: (command: string, args: string[], context: ToolContext, environment?: ProcessEnvironment) => Promise<ToolHandlerResult>;
 //# sourceMappingURL=AsyncProcess.d.ts.map

package/dist/tools/shell/AsyncProcess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AsyncProcess.d.ts","sourceRoot":"","sources":["../../../src/tools/shell/AsyncProcess.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsB,KAAK,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAG/F,eAAO,MAAM,sBAAsB,QAAO,MAAM,CAAC,UAGhD,CAAC;AAEF,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACpG,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1C;AAED,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,MAAM,MAAM,EAAE,EAAE,SAAS,WAAW,EAAE,cAAa,kBAAuB,KAAG,OAAO,CAAC,iBAAiB,CAgDjJ,CAAC"}
+{"version":3,"file":"AsyncProcess.d.ts","sourceRoot":"","sources":["../../../src/tools/shell/AsyncProcess.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsB,KAAK,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAG/F,eAAO,MAAM,sBAAsB,QAAO,MAAM,CAAC,UAGhD,CAAC;AAEF,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACpG,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IACzC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACtF;AAED,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,MAAM,MAAM,EAAE,EAAE,SAAS,WAAW,EAAE,cAAa,kBAAuB,KAAG,OAAO,CAAC,iBAAiB,CAgDjJ,CAAC"}

package/dist/tools/shell/AsyncProcess.js

@@ -14,7 +14,7 @@ export const runProcess = (command, args, context, environment = {}) => {
     return new Promise((resolve, reject) => {
         const group = process.platform !== "win32";
         const env = safeProcessEnvironment();
-        for (const key of ["HOME", "TMPDIR", "PATH", "CARGO_HOME", "XDG_CACHE_HOME", "PYTHONPYCACHEPREFIX", "PYTHONUSERBASE", "SDKROOT", "DEVELOPER_DIR"])
+        for (const key of ["HOME", "TMPDIR", "PATH", "CARGO_HOME", "XDG_CACHE_HOME", "PYTHONPYCACHEPREFIX", "PYTHONUSERBASE", "SDKROOT", "DEVELOPER_DIR", "GIT_CONFIG_NOSYSTEM", "GIT_CONFIG_GLOBAL", "GIT_ATTR_NOSYSTEM"])
             if (typeof environment[key] === "string")
                 env[key] = environment[key];
         const child = spawn(command, args, { cwd, env, detached: group, stdio: ["ignore", "pipe", "pipe"], windowsHide: true });

package/dist/tools/shell/HostToolchain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"HostToolchain.d.ts","sourceRoot":"","sources":["../../../src/tools/shell/HostToolchain.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,gBAAgB;IAAG,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;CAAE;AAC/E,MAAM,WAAW,WAAY,SAAQ,gBAAgB;IACnD,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC/D,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1D;AAgID;;kFAEkF;AAClF,eAAO,MAAM,qBAAqB,GAAI,eAAe,MAAM,EAAE,mBAAmC,KAAG,WAAW,EA0D7G,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,UAAU,WAAW,EAAE,KAAG,gBAAgB,EAM5E,CAAC"}
+{"version":3,"file":"HostToolchain.d.ts","sourceRoot":"","sources":["../../../src/tools/shell/HostToolchain.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,gBAAgB;IAAG,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;CAAE;AAC/E,MAAM,WAAW,WAAY,SAAQ,gBAAgB;IACnD,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC/D,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1D;AAkID;;kFAEkF;AAClF,eAAO,MAAM,qBAAqB,GAAI,eAAe,MAAM,EAAE,mBAAmC,KAAG,WAAW,EA0D7G,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,UAAU,WAAW,EAAE,KAAG,gBAAgB,EAM5E,CAAC"}

package/dist/tools/shell/HostToolchain.js

@@ -147,8 +147,10 @@ const darwinDeveloperTools = (workspace, home) => {
         const sdk = query("/usr/bin/xcrun", ["--sdk", "macosx", "--show-sdk-path"]);
         if (!within(sdk, developer) || !existsSync(path.join(sdk, "SDKSettings.plist")))
             return [];
-        return ["cc", "ar"].map(name => {
-            const executable = query("/usr/bin/xcrun", ["--find", name === "cc" ? "clang" : "ar"]);
+        // /usr/bin/git is an Apple launcher that may invoke xcodebuild and inspect
+        // files outside Developer. Select native Git within the same trusted root.
+        return ["cc", "ar", "git"].map(name => {
+            const executable = query("/usr/bin/xcrun", ["--find", name === "cc" ? "clang" : name]);
             if (!within(executable, developer) || !executableBinary(executable))
                 throw new Error("Developer tool escapes selected installation");
             return { name, executable, readOnlyRoot: developer, directory: true, environment: { SDKROOT: sdk, DEVELOPER_DIR: developer } };

package/dist/tools/shell/IsolatedExecutor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IsolatedExecutor.d.ts","sourceRoot":"","sources":["../../../src/tools/shell/IsolatedExecutor.ts"],"names":[],"mappings":"AAMA,OAAO,EAAsB,KAAK,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAA6C,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjG,MAAM,WAAW,cAAc;IAAG,SAAS,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,YAAY,GAAG,cAAc,GAAG,aAAa,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAAE;AAEhI,mFAAmF;AACnF,eAAO,MAAM,oBAAoB,GAAI,MAAM,MAAM,EAAE,SAAS,MAAM,EAAE,YAAY,MAAM,EAAE,EAAE,UAAU,WAAW,EAAE,EAAE,iBAAe,KAAG,MAyBpI,CAAC;AAQF,eAAO,MAAM,cAAc,QAAO,cAcjC,CAAC;AAEF,eAAO,MAAM,sBAAsB,GAAI,UAAS;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,cAAc,CAAA;CAAO,KAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAkD3L,CAAC"}
+{"version":3,"file":"IsolatedExecutor.d.ts","sourceRoot":"","sources":["../../../src/tools/shell/IsolatedExecutor.ts"],"names":[],"mappings":"AAMA,OAAO,EAAsB,KAAK,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAA6C,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjG,MAAM,WAAW,cAAc;IAAG,SAAS,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,YAAY,GAAG,cAAc,GAAG,aAAa,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAAE;AAEhI,mFAAmF;AACnF,eAAO,MAAM,oBAAoB,GAAI,MAAM,MAAM,EAAE,SAAS,MAAM,EAAE,YAAY,MAAM,EAAE,EAAE,UAAU,WAAW,EAAE,EAAE,iBAAe,KAAG,MA2BpI,CAAC;AAQF,eAAO,MAAM,cAAc,QAAO,cAcjC,CAAC;AAEF,eAAO,MAAM,sBAAsB,GAAI,UAAS;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,cAAc,CAAA;CAAO,KAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAoD3L,CAAC"}

package/dist/tools/shell/IsolatedExecutor.js

@@ -22,6 +22,8 @@ export const darwinSandboxProfile = (root, scratch, writePaths, runtimes, networ
         // realpath/lstat needs ancestor metadata, not directory contents or sibling files.
         ...[...ancestors].map(parent => `(allow file-read-metadata (literal ${quoted(parent)}))`),
         '(allow file-read* (subpath "/usr") (subpath "/bin") (subpath "/sbin") (subpath "/System") (subpath "/Library") (subpath "/private/etc") (subpath "/dev"))',
+        // Git and other native tools open the null device read/write for discarded IO.
+        '(allow file-write-data (literal "/dev/null"))',
         // Apple's /bin/sh reads this system selector before starting npm scripts.
         // Permit only that selector, not other private /var files or directories.
         '(allow file-read* (literal "/private/var/select/sh") (literal "/var/select/sh"))',
@@ -101,7 +103,7 @@ export const createIsolatedExecutor = (options = {}) => {
             for (const file of writePaths)
                 launch.push("--bind", file, file);
             launch.push("--chdir", cwd, "--dir", "/tmp/home", "--setenv", "HOME", "/tmp/home", "--setenv", "TMPDIR", "/tmp", "--setenv", "PATH", "/tmp/codali-bin:/usr/local/bin:/usr/bin:/bin");
-            for (const [key, value] of Object.entries({ CARGO_HOME: "/tmp/home/cargo", XDG_CACHE_HOME: "/tmp/home/cache", PYTHONPYCACHEPREFIX: "/tmp/home/pycache", PYTHONUSERBASE: "/tmp/home/python" }))
+            for (const [key, value] of Object.entries({ CARGO_HOME: "/tmp/home/cargo", XDG_CACHE_HOME: "/tmp/home/cache", PYTHONPYCACHEPREFIX: "/tmp/home/pycache", PYTHONUSERBASE: "/tmp/home/python", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_ATTR_NOSYSTEM: "1" }))
                 launch.push("--setenv", key, value);
             // Git hooks/config and private session state are not part of executable workspace access.
             for (const dir of [".git", ".mcoda"])
@@ -125,6 +127,8 @@ export const createIsolatedExecutor = (options = {}) => {
                 HOME: privateHome, TMPDIR: scratch, PATH: `${privateBin}:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin`,
                 CARGO_HOME: path.join(privateHome, "cargo"), XDG_CACHE_HOME: path.join(privateHome, "cache"),
                 PYTHONPYCACHEPREFIX: path.join(privateHome, "pycache"), PYTHONUSERBASE: path.join(privateHome, "python"),
+                // Host Git settings can invoke external helpers or read private paths.
+                GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_ATTR_NOSYSTEM: "1",
             });
         }
         finally {

package/package.json

@@ -8,8 +8,8 @@
     "url": "https://github.com/bekirdag/mcoda/issues"
   },
   "dependencies": {
-    "@mcoda/db": "0.1.135-codali.2",
-    "@mcoda/shared": "0.1.135-codali.2",
+    "@mcoda/db": "0.1.135-codali.4",
+    "@mcoda/shared": "0.1.135-codali.4",
     "@modelcontextprotocol/sdk": "1.30.0",
     "zod": "4.5.2"
   },
@@ -45,5 +45,5 @@
   },
   "type": "module",
   "types": "dist/index.d.ts",
-  "version": "0.1.135-codali.2"
+  "version": "0.1.135-codali.4"
 }