@midhunxavier/code-flow 0.0.0-stage → 0.1.0-preview.3

package/src/env.js

@@ -0,0 +1,44 @@
+import { dirname, isAbsolute, join, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+const INSTALL_DIR = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const SECRET_VARS = /* @__PURE__ */ new Set(["CODEFLOW_TOKEN", "CODEFLOW_SSH_HOST", "CODEFLOW_TEAM_CAPABILITY", "CODEFLOW_TEAM_ENDPOINT", "CODEFLOW_INTEGRATIONS_JSON", "CODEFLOW_INTEGRATIONS_FILE", "CODEFLOW_NOTIFICATIONS_JSON", "CODEFLOW_NOTIFICATIONS_FILE"]);
+function registerPrivateEnvNames(names) {
+  for (const name of names) if (/^[A-Z_][A-Z0-9_]{0,99}$/.test(name)) SECRET_VARS.add(name);
+}
+function privateEnvironmentValues() {
+  return [...SECRET_VARS].map((name) => process.env[name]).filter((value) => !!value && value.length >= 8);
+}
+function childEnv(extra = {}) {
+  const env = { ...process.env };
+  for (const key of SECRET_VARS) delete env[key];
+  for (const key of Object.keys(env)) {
+    if (key.startsWith("npm_config_") && key !== "npm_config_local_prefix") continue;
+    if (key.startsWith("npm_") || key === "INIT_CWD") delete env[key];
+  }
+  const merged = { ...env, ...extra };
+  merged.PATH = cleanPath(merged.PATH ?? "");
+  return merged;
+}
+function cleanPath(path, installDir = INSTALL_DIR) {
+  const sepChar = process.platform === "win32" ? ";" : ":";
+  const ancestors = /* @__PURE__ */ new Set();
+  for (let dir = installDir; ; dir = dirname(dir)) {
+    ancestors.add(join(dir, "node_modules", ".bin"));
+    if (dirname(dir) === dir) break;
+  }
+  const cleaned = path.split(sepChar).filter((entry) => {
+    if (!isAbsolute(entry)) return false;
+    const normalized = resolve(entry);
+    if (ancestors.has(normalized)) return false;
+    return !normalized.includes(`${sep}@npmcli${sep}run-script${sep}`);
+  }).join(sepChar);
+  if (cleaned) return cleaned;
+  const systemRoot = process.env.SystemRoot ?? process.env.SYSTEMROOT ?? "";
+  return process.platform === "win32" ? join(isAbsolute(systemRoot) ? systemRoot : "C:\\Windows", "System32") : "/usr/bin:/bin";
+}
+export {
+  childEnv,
+  cleanPath,
+  privateEnvironmentValues,
+  registerPrivateEnvNames
+};

package/src/execution-budget.js

@@ -0,0 +1,8 @@
+const DEFAULT_EXECUTION_BUDGET = { maxSteps: 200, maxMinutes: 240 };
+function coordinatorInvocationLimit(invocations) {
+  return Math.max(1, Math.floor(invocations / 4));
+}
+export {
+  DEFAULT_EXECUTION_BUDGET,
+  coordinatorInvocationLimit
+};

package/src/experience.js

@@ -0,0 +1,50 @@
+import { runPassed } from "./run-status.js";
+import { confidenceInterval } from "./stats.js";
+function taskIntent(value) {
+  return typeof value === "string" && ["bug", "feature", "review", "explore"].includes(value) ? value : void 0;
+}
+const median = (values) => {
+  const sorted = [...values].sort((a, b) => a - b);
+  return sorted.length ? (sorted[Math.floor((sorted.length - 1) / 2)] + sorted[Math.floor(sorted.length / 2)]) / 2 : void 0;
+};
+function outcomeMetrics(runs) {
+  const ended = runs.filter((run) => run.status !== "running");
+  const verified = ended.filter(runPassed);
+  const rated = ended.filter((run) => run.outcome);
+  const reworked = ended.filter((run) => run.humanRework?.length);
+  return {
+    completed: ended.length,
+    verified: verified.length,
+    rated: rated.length,
+    accepted: rated.filter((run) => run.outcome?.decision === "accepted").length,
+    shipped: ended.filter((run) => run.merges.length).length,
+    medianVerifiedMs: median(verified.flatMap((run) => run.endedAt ? [Math.max(0, run.endedAt - run.createdAt)] : [])),
+    reworkSamples: reworked.length,
+    medianReworkMinutes: median(reworked.map((run) => run.humanRework.reduce((sum, item) => sum + item.minutes, 0)))
+  };
+}
+function workflowRecommendations(runs, repo, intent) {
+  const comparable = runs.filter((run) => run.repo === repo && run.status !== "running" && (!intent || run.intent === intent));
+  const groups = /* @__PURE__ */ new Map();
+  for (const run of comparable) groups.set(run.pattern, [...groups.get(run.pattern) ?? [], run]);
+  return [...groups].map(([pattern, samples]) => {
+    const metrics = outcomeMetrics(samples);
+    return { pattern, ...metrics, confidence: confidenceInterval(metrics.verified, samples.length), runIds: samples.slice(-10).map((run) => run.id) };
+  }).sort((a, b) => b.confidence.low - a.confidence.low || b.completed - a.completed || a.pattern.localeCompare(b.pattern));
+}
+function progressSummary(run, steps) {
+  const questions = run.team?.messages.filter((message) => message.kind === "question" && message.recipient === "user" && message.status === "open") ?? [];
+  if (run.awaiting) return { title: "Your plan decision is needed", detail: run.awaiting.title };
+  if (questions.length) return { title: `${questions.length} question${questions.length === 1 ? "" : "s"} need your answer`, detail: questions[0].body };
+  if (run.pauseRequested) return { title: "Pausing at a safe checkpoint", detail: "Current work is retained. Resume dispatch when you're ready." };
+  const active = steps.filter((step) => step.status === "running" && !step.sideOf);
+  if (active.length) return { title: active.every((step) => step.kind === "check") ? "Checking the result" : "Work in progress", detail: active.map((step) => step.title).join(" \xB7 ") };
+  if (run.status === "running") return { title: "Preparing the next step", detail: "Waiting for a provider slot, a dependency, or the next workflow action." };
+  return { title: runPassed(run) ? "Checks passed" : "Work has stopped", detail: run.error ?? run.stopReason ?? "Review the result and its recorded evidence." };
+}
+export {
+  outcomeMetrics,
+  progressSummary,
+  taskIntent,
+  workflowRecommendations
+};

package/src/extensions.js

@@ -0,0 +1,144 @@
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, rename, unlink } from "node:fs/promises";
+import { isAbsolute, join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { CODEFLOW_HOME } from "./config.js";
+import { registerPrivateEnvNames } from "./env.js";
+import { redactExport } from "./privacy.js";
+const EXTENSION_API = { major: 1, minor: 0, capabilities: ["provider-adapter", "workflow-pattern"] };
+const bindings = /* @__PURE__ */ new Map();
+function extensionBindings(pattern, roles) {
+  const used = [...new Set([pattern, ...Object.values(roles).flat()].filter((id) => id.startsWith("plugin:")))];
+  const result = used.map((id) => {
+    const binding = bindings.get(id);
+    if (!binding) throw new Error(`Restore the pinned extension for ${id} before running this workflow`);
+    return binding;
+  });
+  return [...new Map(result.map((value) => [value.id, value])).values()].sort((a, b) => a.id.localeCompare(b.id)).map((value) => ({ ...value }));
+}
+function assertExtensionBindings(run) {
+  const current = extensionBindings(run.pattern, run.roles);
+  if (JSON.stringify(current) !== JSON.stringify(run.extensions ?? [])) throw new Error("This run's provider/workflow extension version changed; restore its exact SHA-256 pin or create a new run");
+}
+const object = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+const identifier = /^[a-z][a-z0-9-]{0,40}$/;
+const bounded = (value, max) => typeof value === "string" && !!value.trim() && value.length <= max && !/[\x00-\x08\x0e-\x1f]/.test(value);
+async function readBundle(path, ceiling) {
+  const file = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const info = await file.stat();
+    if (!info.isFile() || info.size > ceiling) throw new Error("Extension file exceeds its regular-file bound");
+    const buffer = Buffer.alloc(ceiling + 1);
+    let read = 0;
+    while (read <= ceiling) {
+      const next = await file.read(buffer, read, buffer.length - read, read);
+      if (!next.bytesRead) break;
+      read += next.bytesRead;
+    }
+    if (read > ceiling) throw new Error("Extension file grew beyond its bound");
+    return buffer.subarray(0, read);
+  } finally {
+    await file.close();
+  }
+}
+function negotiateExtension(manifest) {
+  if (manifest.api.major !== EXTENSION_API.major || manifest.api.minimumMinor > EXTENSION_API.minor) throw new Error(`Extension requires API ${manifest.api.major}.${manifest.api.minimumMinor}; host supports ${EXTENSION_API.major}.${EXTENSION_API.minor}`);
+  const missing = manifest.requires.filter((name) => !EXTENSION_API.capabilities.includes(name));
+  if (missing.length) throw new Error(`Unsupported extension capabilities: ${missing.join(", ")}`);
+  return { major: EXTENSION_API.major, minor: EXTENSION_API.minor };
+}
+function parseManifests(value) {
+  if (!object(value) || value.version !== 1 || !Array.isArray(value.extensions) || value.extensions.length > 16) throw new Error("Configure version 1 with at most 16 explicit extensions");
+  const ids = /* @__PURE__ */ new Set();
+  return value.extensions.map((raw) => {
+    if (!object(raw) || Object.keys(raw).some((key) => !["id", "version", "module", "sha256", "api", "requires"].includes(key)) || typeof raw.id !== "string" || !identifier.test(raw.id) || ids.has(raw.id) || typeof raw.version !== "string" || !/^\d+\.\d+\.\d+(?:-[\w.-]+)?$/.test(raw.version) || !bounded(raw.module, 4e3) || !isAbsolute(raw.module) || !/\.mjs$/.test(raw.module) || typeof raw.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(raw.sha256) || !object(raw.api) || Object.keys(raw.api).some((key) => !["major", "minimumMinor"].includes(key)) || !Number.isInteger(raw.api.major) || !Number.isInteger(raw.api.minimumMinor) || raw.api.minimumMinor < 0 || !Array.isArray(raw.requires) || raw.requires.length > 16 || raw.requires.some((item) => !bounded(item, 100))) throw new Error("Invalid extension identity, pinned bundle, version or capability requirements");
+    ids.add(raw.id);
+    return structuredClone(raw);
+  });
+}
+class Extensions {
+  constructor(options) {
+    this.options = options;
+  }
+  statuses = [];
+  list() {
+    return redactExport(structuredClone(this.statuses));
+  }
+  async load() {
+    const environment = this.options.environment ?? process.env;
+    registerPrivateEnvNames(["CODEFLOW_EXTENSIONS_FILE", "CODEFLOW_EXTENSIONS_JSON"]);
+    if (environment.CODEFLOW_EXTENSIONS_FILE && environment.CODEFLOW_EXTENSIONS_JSON) throw new Error("Choose one extension configuration source");
+    let text = environment.CODEFLOW_EXTENSIONS_JSON;
+    if (environment.CODEFLOW_EXTENSIONS_FILE) {
+      const path = environment.CODEFLOW_EXTENSIONS_FILE;
+      if (!isAbsolute(path)) throw new Error("Extension configuration must have an absolute path");
+      text = (await readBundle(path, 128 * 1024)).toString("utf8");
+    }
+    if (!text) return;
+    if (Buffer.byteLength(text) > 128 * 1024) throw new Error("Extension configuration exceeds 128 KiB");
+    const manifests = parseManifests(JSON.parse(text));
+    for (const manifest of manifests) {
+      const status = { id: manifest.id, version: manifest.version, sha256: manifest.sha256, state: "rejected", providers: [], workflows: [] };
+      this.statuses.push(status);
+      try {
+        const negotiated = negotiateExtension(manifest);
+        const info = await lstat(manifest.module);
+        if (!info.isFile() || info.isSymbolicLink() || info.size > 512 * 1024) throw new Error("Plugin must be a bundled regular .mjs file under 512 KiB");
+        const contents = await readBundle(manifest.module, 512 * 1024);
+        if (contents.length > 512 * 1024 || createHash("sha256").update(contents).digest("hex") !== manifest.sha256) throw new Error("Plugin bundle changed; review it and update its SHA-256 pin explicitly");
+        const directory = join(this.options.home ?? CODEFLOW_HOME, "extension-cache");
+        await mkdir(directory, { recursive: true, mode: 448 });
+        const cacheInfo = await lstat(directory);
+        if (!cacheInfo.isDirectory() || cacheInfo.isSymbolicLink()) throw new Error("Extension cache must be a regular private directory");
+        const cached = join(directory, `${manifest.id}-${manifest.sha256}.mjs`), temp = cached + `.${process.pid}.tmp`;
+        try {
+          const file = await open(temp, "wx", 384);
+          try {
+            await file.writeFile(contents);
+            await file.sync();
+          } finally {
+            await file.close();
+          }
+          await rename(temp, cached);
+        } finally {
+          await unlink(temp).catch(() => void 0);
+        }
+        const extension = (await import(pathToFileURL(cached).href)).default;
+        if (!object(extension) || !object(extension.api) || extension.api.major !== negotiated.major || !Number.isInteger(extension.api.minor) || extension.api.minor < manifest.api.minimumMinor || extension.api.minor > negotiated.minor || Object.keys(extension).some((key) => !["api", "providers", "workflows"].includes(key))) throw new Error("Plugin export does not match its negotiated API");
+        const providers = extension.providers ?? [], workflows = extension.workflows ?? [];
+        if (!Array.isArray(providers) || !Array.isArray(workflows) || providers.length > 8 || workflows.length > 8 || !providers.length && !workflows.length) throw new Error("Plugin must export 1\u20138 providers or workflows");
+        for (const provider of providers) if (!object(provider) || !new RegExp(`^plugin:${manifest.id}/[a-z][a-z0-9-]{0,40}$`).test(provider.id) || !bounded(provider.displayName, 120) || !bounded(provider.binary, 200) || ["available", "catalog", "run"].some((key) => typeof provider[key] !== "function")) throw new Error("Provider needs a namespaced ID and the AgentAdapter contract");
+        for (const workflow of workflows) {
+          if (!object(workflow) || !new RegExp(`^plugin:${manifest.id}/[a-z][a-z0-9-]{0,40}$`).test(workflow.id) || !bounded(workflow.name, 120) || !bounded(workflow.summary, 500) || !bounded(workflow.description, 8e3) || typeof workflow.run !== "function" || !Array.isArray(workflow.roles) || !workflow.roles.length || workflow.roles.length > 16 || !Array.isArray(workflow.options) || workflow.options.length > 16) throw new Error("Workflow needs a namespaced ID and the Pattern contract");
+          const roles = /* @__PURE__ */ new Set();
+          for (const role of workflow.roles) {
+            if (!object(role) || !identifier.test(role.id) || roles.has(role.id) || !bounded(role.label, 120) || !bounded(role.description, 1e3) || !Array.isArray(role.default) || role.default.length > 6 || role.default.some((id) => typeof id !== "string")) throw new Error("Invalid workflow role");
+            roles.add(role.id);
+          }
+          const options = /* @__PURE__ */ new Set();
+          for (const option of workflow.options) {
+            if (!object(option) || !identifier.test(option.id) || options.has(option.id) || !bounded(option.label, 120) || !["number", "boolean"].includes(option.type) || typeof option.default !== option.type || option.type === "number" && (!Number.isFinite(option.default) || option.min !== void 0 && !Number.isFinite(option.min) || option.max !== void 0 && !Number.isFinite(option.max) || option.min !== void 0 && option.max !== void 0 && option.min > option.max)) throw new Error("Invalid workflow option");
+            options.add(option.id);
+          }
+        }
+        this.options.register(providers, workflows);
+        const binding = { id: manifest.id, version: manifest.version, sha256: manifest.sha256 };
+        for (const value of [...providers, ...workflows]) bindings.set(value.id, binding);
+        status.state = "loaded";
+        status.api = negotiated;
+        status.providers = providers.map((provider) => provider.id);
+        status.workflows = workflows.map((workflow) => workflow.id);
+      } catch (error) {
+        status.error = error.message.slice(0, 1e3);
+      }
+    }
+  }
+}
+export {
+  EXTENSION_API,
+  Extensions,
+  assertExtensionBindings,
+  extensionBindings,
+  negotiateExtension
+};

package/src/filesystem-access.js

@@ -0,0 +1,107 @@
+import { FilePolicyError, policyIsRestrictive } from "./filesystem-policy.js";
+import { readJson } from "./http.js";
+import { repoRoot } from "./git.js";
+class FilesystemAccess {
+  constructor(store, projects, manager) {
+    this.store = store;
+    this.projects = projects;
+    this.manager = manager;
+    store.onChange((next) => this.cache.set(next.projectId, next));
+  }
+  cache = /* @__PURE__ */ new Map();
+  operations = /* @__PURE__ */ new Set();
+  activating = false;
+  failure;
+  async all() {
+    try {
+      const policies = await Promise.all(this.projects.list().map(async (project) => {
+        const policy = await this.store.get(project.id);
+        this.cache.set(project.id, policy);
+        return policy;
+      }));
+      this.failure = void 0;
+      return policies;
+    } catch (error) {
+      this.failure = error;
+      throw error;
+    }
+  }
+  hasRestrictions() {
+    return !!this.failure || [...this.cache.values()].some(policyIsRestrictive);
+  }
+  projectIds(repo, run) {
+    const related = /* @__PURE__ */ new Set([repo]);
+    const owned = this.manager.relatedRuns(repo);
+    for (const item of owned) related.add(item.repo);
+    return [.../* @__PURE__ */ new Set([...this.projects.list().filter((project) => project.repos.some((repo2) => related.has(repo2))).map((project) => project.id), ...owned.flatMap((item) => item.project ? [item.project] : []), ...run?.project ? [run.project] : []])];
+  }
+  async forRepo(repo, run) {
+    const policies = await Promise.all(this.projectIds(repo, run).map(async (id) => {
+      const policy = await this.store.get(id);
+      this.cache.set(id, policy);
+      return policy;
+    }));
+    return [...policies, ...run?.filePolicies ?? []];
+  }
+  async execution(repo, run) {
+    if (this.activating) throw new FilePolicyError("Filesystem policy is being applied; execution preparation is paused", 409);
+    return [...await this.all(), ...await this.forRepo(repo, run)];
+  }
+  restrictedRun(run) {
+    const pinned = !!run.filePolicies?.some(policyIsRestrictive);
+    if (!this.hasRestrictions()) return pinned;
+    return pinned || this.projectIds(run.repo, run).some((id) => {
+      const policy = this.cache.get(id);
+      return !!policy && policyIsRestrictive(policy);
+    });
+  }
+  list() {
+    return this.manager.list().filter((run) => !this.restrictedRun(run));
+  }
+  page(input = {}) {
+    return this.manager.page({ ...input, ...this.hasRestrictions() ? { predicate: (run) => !this.restrictedRun(run) && (input.predicate?.(run) ?? true) } : {} });
+  }
+  end(req) {
+    this.operations.delete(req);
+  }
+  async sharedGate(req) {
+    if (this.activating) throw new FilePolicyError("Filesystem policy is being applied; retry after it finishes", 409);
+    this.operations.add(req);
+    await this.all();
+  }
+  async update(projectId, input, activate) {
+    if (this.activating || this.operations.size) throw new FilePolicyError("Wait for active application operations to finish before changing filesystem policy", 409);
+    this.activating = true;
+    try {
+      return await this.store.set(projectId, input, async (commit, next) => activate(commit, next));
+    } finally {
+      this.activating = false;
+    }
+  }
+  /** Register before awaiting body/policy reads. Policy activation cannot race an in-flight command request. */
+  async ownerGate(req, url, parts) {
+    if (parts[1] === "projects" && parts[3] === "filesystem-policy") return;
+    if (this.activating) throw new FilePolicyError("Filesystem policy is being applied; retry after it finishes", 409);
+    this.operations.add(req);
+    const all = await this.all();
+    const globallyRestricted = all.some(policyIsRestrictive);
+    const body = ["POST", "PUT", "PATCH"].includes(req.method ?? "") && req.headers["content-type"]?.startsWith("application/json") ? await readJson(req) : {};
+    const requested = typeof body.repo === "string" ? body.repo : url.searchParams.get("repo");
+    const selected = requested?.startsWith("/") ? await repoRoot(requested).catch(() => requested) : requested;
+    const run = parts[1] === "runs" && parts[2] ? await this.manager.getAsync(parts[2]) : void 0;
+    const policyProject = parts[1] === "projects" && parts[2] ? this.cache.get(parts[2]) : typeof body.project === "string" ? this.cache.get(body.project) : void 0;
+    const targetRestricted = !!run && this.restrictedRun(run) || !!policyProject && policyIsRestrictive(policyProject) || !!selected && (await this.forRepo(selected)).some(policyIsRestrictive);
+    const fileApi = parts[1] === "file" && req.method === "GET" || parts[1] === "workspace" && parts[2] === "file" && ["GET", "POST"].includes(req.method ?? "");
+    const safeSearch = req.method === "GET" && (["tree", "search"].includes(parts[1] ?? "") || parts[1] === "workspace" && parts[2] === "search" && url.searchParams.get("mode") !== "semantic");
+    const filteredDiff = req.method === "GET" && parts[1] === "runs" && parts[3] === "diff";
+    if (targetRestricted && !fileApi && !safeSearch && !filteredDiff) throw new FilePolicyError("This project's filesystem policy blocks raw history, configuration and operations that cannot enforce its paths", req.method === "GET" ? 403 : 409);
+    if (globallyRestricted) {
+      const globalPrivate = ["docs-help", "experience", "journeys", "fs", "notes", "memory", "stats", "automations", "deferred-runs", "coordination", "coordinated-changes", "project-teams", "notifications", "maintenance", "diagnostics", "shells", "serve", "preview", "snapshot", "disk", "cleanup", "models", "doctor", "approvals", "team-capabilities", "team-evaluations", "team-rollout"].includes(parts[1] ?? "");
+      const execution = req.method !== "GET" && (["acp-connections", "runs", "readiness", "verification", "compare", "sweeps", "automations", "deferred-runs", "coordination", "coordinated-changes", "project-teams", "remote-workers", "code-hosts", "improve-prompt", "team-link"].includes(parts[1] ?? "") || parts[1] === "workspace" && !fileApi);
+      if (globalPrivate || execution || parts[1] === "workspace" && ["references", "dependencies"].includes(parts[2] ?? "") || parts[1] === "workspace" && parts[2] === "search" && url.searchParams.get("mode") === "semantic") throw new FilePolicyError("Custom filesystem restrictions pause app-managed execution and unscoped private data access globally because current backends share host authority", req.method === "GET" ? 403 : 409);
+    }
+  }
+}
+export {
+  FilesystemAccess
+};

package/src/filesystem-policy.js

@@ -0,0 +1,238 @@
+import { constants } from "node:fs";
+import { lstat, mkdir, open, realpath, rename, rm } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+import { CODEFLOW_HOME } from "./config.js";
+import { sensitiveContextPath } from "./context-inspection.js";
+class FilePolicyError extends Error {
+  constructor(message, status = 403, current) {
+    super(message);
+    this.status = status;
+    this.current = current;
+  }
+}
+const queues = /* @__PURE__ */ new Map();
+const object = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+const sha = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+function normalizePolicyPath(raw) {
+  if (typeof raw !== "string" || raw.length > 500 || /[\\\x00-\x1f\x7f*?\[\]{}]/.test(raw) || raw.startsWith("/") || /^[a-z]:/i.test(raw)) throw new FilePolicyError("Policy paths must be literal relative repository paths", 400);
+  if (raw === ".") return ".";
+  const path = raw.replace(/\/$/, "");
+  if (!path || path.split("/").some((part) => !part || part === "." || part === ".." || part.toLowerCase() === ".git")) throw new FilePolicyError("Paths must stay inside the repository; traversal, empty components and Git internals are not allowed", 400);
+  return path;
+}
+function rules(raw) {
+  if (!object(raw) || Object.keys(raw).some((key) => !["allow", "deny"].includes(key))) throw new FilePolicyError("Choose explicit allow and deny path lists", 400);
+  const list = (value) => {
+    if (!Array.isArray(value) || value.length > 100) throw new FilePolicyError("Use at most 100 literal paths per list", 400);
+    return [...new Set(value.map(normalizePolicyPath))].sort();
+  };
+  return { allow: list(raw.allow), deny: list(raw.deny) };
+}
+function snapshot(projectId, revision, read, write, updatedAt) {
+  const base = { version: 1, projectId, revision, read, write, updatedAt };
+  return { ...base, hash: sha(base) };
+}
+function defaults(projectId) {
+  return snapshot(projectId, 0, { allow: ["."], deny: [] }, { allow: ["."], deny: [] }, 0);
+}
+function validateFilePolicySnapshot(raw) {
+  if (!object(raw) || Object.keys(raw).some((key) => !["version", "projectId", "revision", "read", "write", "hash", "updatedAt"].includes(key)) || raw.version !== 1 || typeof raw.projectId !== "string" || !/^[a-zA-Z0-9_-]{1,100}$/.test(raw.projectId) || !Number.isSafeInteger(raw.revision) || raw.revision < 0 || !Number.isSafeInteger(raw.updatedAt) || raw.updatedAt < 0) throw new FilePolicyError("Invalid filesystem policy snapshot", 503);
+  const value = snapshot(raw.projectId, raw.revision, rules(raw.read), rules(raw.write), raw.updatedAt);
+  if (value.hash !== raw.hash) throw new FilePolicyError("Filesystem policy snapshot hash changed", 503);
+  return value;
+}
+const contains = (root, path) => root === "." || path === root || path.startsWith(`${root}/`);
+const folded = (path) => path.normalize("NFKC").toUpperCase().toLowerCase();
+function policyIsRestrictive(policy) {
+  return [policy.read, policy.write].some((rules2) => rules2.allow.length !== 1 || rules2.allow[0] !== "." || rules2.deny.length > 0);
+}
+function allowsFilePolicy(policy, operation, rawPath) {
+  let path;
+  try {
+    path = normalizePolicyPath(rawPath);
+  } catch {
+    return false;
+  }
+  if (path !== "." && sensitiveContextPath(path)) return false;
+  const rules2 = policy[operation];
+  return rules2.allow.some((root) => contains(root, path)) && !rules2.deny.some((root) => contains(folded(root), folded(path)));
+}
+function assertPolicyExecution(policies, surface) {
+  const restricted = policies.filter(policyIsRestrictive);
+  if (restricted.length) throw new FilePolicyError(`${surface} cannot enforce this project's filesystem restrictions. Host, native CLI, Docker and SSH execution remain disabled until an enforcing filtered backend is available. Review the policy deliberately before choosing unrestricted execution.`, 409);
+}
+function filterPolicyDiff(policies, files) {
+  return files.filter((file) => policies.every((policy) => allowsFilePolicy(policy, "read", file.path) && (!file.oldPath || allowsFilePolicy(policy, "read", file.oldPath))));
+}
+let resolver;
+let suppressRepositoryCommands;
+function configureFilePolicyResolver(next, options = {}) {
+  resolver = next;
+  suppressRepositoryCommands = options.suppressRepositoryCommands;
+  return () => {
+    if (resolver === next) {
+      resolver = void 0;
+      suppressRepositoryCommands = void 0;
+    }
+  };
+}
+function filePolicyRegistryActive() {
+  return !!resolver;
+}
+function filePolicyMetadataOnly() {
+  return suppressRepositoryCommands?.() ?? false;
+}
+async function filterAllowedProjectEntries(repo, entries) {
+  if (!resolver) return entries;
+  const policies = await resolver(repo);
+  return entries.filter((entry) => !sensitiveContextPath(entry.path) && policies.every((policy) => allowsFilePolicy(policy, "read", entry.path) || entry.type === "dir" && policy.read.allow.some((root) => root.startsWith(`${entry.path}/`)) && !policy.read.deny.some((root) => contains(folded(root), folded(entry.path)))));
+}
+async function assertNoSymbolicAncestor(repo, path) {
+  const root = await realpath(repo);
+  let target = root;
+  for (const part of path === "." ? [] : path.split("/")) {
+    target = join(target, part);
+    let info;
+    try {
+      info = await lstat(target);
+    } catch (error) {
+      if (error.code === "ENOENT") return;
+      throw error;
+    }
+    if (info.isSymbolicLink()) throw new FilePolicyError("Symbolic paths cannot bypass filesystem policy");
+  }
+}
+async function assertProjectFileAccess(repo, rawPath, operation) {
+  if (!resolver) return;
+  const path = normalizePolicyPath(rawPath), policies = await resolver(repo);
+  if (path !== "." && sensitiveContextPath(path) || policies.some((policy) => !allowsFilePolicy(policy, operation, path))) throw new FilePolicyError(`This project's filesystem policy denies ${operation} access to this path`);
+  await assertNoSymbolicAncestor(repo, path);
+}
+async function assertProjectDirectoryAccess(repo, rawPath) {
+  if (!resolver) return;
+  const path = normalizePolicyPath(rawPath), policies = await resolver(repo);
+  const traversable = (policy) => !policy.read.deny.some((root) => contains(folded(root), folded(path))) && (allowsFilePolicy(policy, "read", path) || policy.read.allow.some((root) => path === "." || root.startsWith(`${path}/`)));
+  if (path !== "." && sensitiveContextPath(path) || policies.some((policy) => !traversable(policy))) throw new FilePolicyError("This project's filesystem policy denies directory access to this path");
+  await assertNoSymbolicAncestor(repo, path);
+}
+class ProjectFilePolicies {
+  constructor(home = CODEFLOW_HOME) {
+    this.home = home;
+  }
+  listeners = /* @__PURE__ */ new Set();
+  path(projectId) {
+    if (!/^[a-zA-Z0-9_-]{1,100}$/.test(projectId)) throw new FilePolicyError("Invalid project identity", 400);
+    return resolve(this.home, "filesystem-policies", `${projectId}.json`);
+  }
+  onChange(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  async get(projectId) {
+    return this.read(projectId, this.path(projectId));
+  }
+  async set(projectId, input, activate = async (commit) => commit()) {
+    const file = this.path(projectId);
+    const work = (queues.get(file) ?? Promise.resolve()).catch(() => void 0).then(async () => {
+      const previous = await this.read(projectId, file);
+      if (!Number.isSafeInteger(input.revision) || input.revision !== previous.revision) throw new FilePolicyError("Filesystem policy changed; reload before saving", 409, previous);
+      const next = snapshot(projectId, previous.revision + 1, rules(input.read), rules(input.write), Date.now());
+      let committed = false;
+      await activate(async () => {
+        if (committed) throw new FilePolicyError("Policy activation may commit only once", 409);
+        const latest = await this.read(projectId, file);
+        if (latest.hash !== previous.hash) throw new FilePolicyError("Filesystem policy changed during activation", 409, latest);
+        await this.write(file, next);
+        committed = true;
+        for (const listener of this.listeners) {
+          try {
+            listener(structuredClone(next), structuredClone(previous));
+          } catch {
+          }
+        }
+      }, structuredClone(next), structuredClone(previous));
+      if (!committed) throw new FilePolicyError("Filesystem policy was not activated", 409);
+      return structuredClone(next);
+    });
+    queues.set(file, work);
+    try {
+      return await work;
+    } finally {
+      if (queues.get(file) === work) queues.delete(file);
+    }
+  }
+  async read(projectId, file) {
+    try {
+      await this.safeParent(file);
+      const handle = await open(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+      try {
+        const info = await handle.stat();
+        if (!info.isFile() || info.size > 256 * 1024) throw new Error("Policy must be a bounded regular file");
+        const raw = JSON.parse(await handle.readFile("utf8"));
+        if (!object(raw) || Object.keys(raw).some((key) => !["version", "projectId", "revision", "read", "write", "hash", "updatedAt"].includes(key)) || raw.version !== 1 || raw.projectId !== projectId || !Number.isSafeInteger(raw.revision) || raw.revision < 1 || !Number.isSafeInteger(raw.updatedAt) || raw.updatedAt < 0) throw new Error("Invalid policy version or metadata");
+        const value = snapshot(projectId, raw.revision, rules(raw.read), rules(raw.write), raw.updatedAt);
+        if (raw.hash !== value.hash) throw new Error("Policy content hash changed");
+        return value;
+      } finally {
+        await handle.close();
+      }
+    } catch (error) {
+      if (error.code === "ENOENT") return defaults(projectId);
+      throw new FilePolicyError(`Filesystem policy cannot be read; restricted operations are unavailable: ${error.message}`, 503);
+    }
+  }
+  async safeParent(file) {
+    const parent = dirname(file);
+    let info;
+    try {
+      info = await lstat(parent);
+    } catch (error) {
+      if (error.code === "ENOENT") return;
+      throw error;
+    }
+    if (!info.isDirectory() || info.isSymbolicLink()) throw new Error("Policy storage cannot be a symbolic directory");
+  }
+  async write(file, value) {
+    await mkdir(dirname(file), { recursive: true, mode: 448 });
+    await this.safeParent(file);
+    const temp = `${file}.${randomUUID()}.tmp`;
+    try {
+      const handle = await open(temp, "wx", 384);
+      try {
+        await handle.writeFile(JSON.stringify(value));
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      await rename(temp, file);
+      if (process.platform !== "win32") {
+        const parent = await open(dirname(file), "r");
+        try {
+          await parent.sync();
+        } finally {
+          await parent.close();
+        }
+      }
+    } finally {
+      await rm(temp, { force: true }).catch(() => {
+      });
+    }
+  }
+}
+export {
+  FilePolicyError,
+  ProjectFilePolicies,
+  allowsFilePolicy,
+  assertPolicyExecution,
+  assertProjectDirectoryAccess,
+  assertProjectFileAccess,
+  configureFilePolicyResolver,
+  filePolicyMetadataOnly,
+  filePolicyRegistryActive,
+  filterAllowedProjectEntries,
+  filterPolicyDiff,
+  normalizePolicyPath,
+  policyIsRestrictive,
+  validateFilePolicySnapshot
+};