@mulmoclaude/core 4.4.2 → 4.5.0

package/dist/{server-CF1qllGV.cjs → server-Wz4_ALLl.cjs}

@@ -1,10 +1,10 @@
 const require_rolldown_runtime = require("./rolldown-runtime-VH7oDXx4.cjs");
 const require_dist = require("./dist-CsgSfWwR.cjs");
-const require_root = require("./root-rPH6FGDT.cjs");
+const require_root = require("./root-BvwBUcol.cjs");
 const require_relPath = require("./relPath-CTAjGdCL.cjs");
-const require_itemId = require("./itemId-CEQdK01z.cjs");
-const require_promptSafety = require("./promptSafety-C0BWDsfT.cjs");
-const require_discovery = require("./discovery-Dl9nRa-m.cjs");
+const require_itemId = require("./itemId-CGT2J7YK.cjs");
+const require_promptSafety = require("./promptSafety-Cv-SoTd4.cjs");
+const require_discovery = require("./discovery-2TvulIz8.cjs");
 const require_feeds_paths = require("./feeds/paths.cjs");
 const require_skill_bridge_index = require("./skill-bridge/index.cjs");
 let node_fs = require("node:fs");
@@ -1878,24 +1878,53 @@ function openItemsFileRefusal(err, shown) {
 *  descriptor's inode is the one reachable at a contained path. A hardlink
 *  would satisfy it, but the agent cannot create one across the mount boundary
 *  — only the workspace is mounted, and a hardlink cannot cross filesystems. */
-async function verifyOpenedItemsFile(handle, hostPath, root, shown) {
-	const opened = await handle.stat();
+/** What the filesystem says about the path the descriptor was opened from:
+*  the link itself (is it a symlink?), the resolved target, the root resolved
+*  BY THE SAME API, and the target's stat.
+*
+*  Resolving the two sides with different apis is not a style question: on
+*  Windows `realpath` expands an 8.3 short name and `realpathSync` does not, so
+*  a root from `os.tmpdir()` compared against an async-resolved file inside it
+*  read as "outside the workspace" and refused every itemsFile (#2972). */
+async function resolveOpenedPaths(hostPath, root) {
+	const link = await (0, node_fs_promises.lstat)(hostPath);
+	const real = await (0, node_fs_promises.realpath)(hostPath);
+	return {
+		link,
+		real,
+		rootReal: await (0, node_fs_promises.realpath)(root),
+		atPath: await (0, node_fs_promises.stat)(real)
+	};
+}
+/** Judge the opened descriptor against the paths it claims to be. Returns the
+*  refusal text, or null when the descriptor is the contained file it should
+*  be. `opened` is the descriptor's own stat, so the identity check compares
+*  what was OPENED with what is reachable at the path. */
+function openedFileProblem(paths, opened, shown) {
+	if (paths.link.isSymbolicLink()) return symlinkRefusal(shown);
+	if (!require_discovery.isUnderRealRoot(paths.real, paths.rootReal)) return outsideWorkspaceRefusal(shown);
+	if (paths.atPath.ino !== opened.ino || paths.atPath.dev !== opened.dev) return `manageCollection: \`itemsFile\` '${shown}' changed while it was being opened. Nothing was read; write the file, then call putItems.`;
+	return null;
+}
+/** The descriptor's own shape: a regular file, within the byte cap. Returns the
+*  refusal text, or null. Checked before any path work — a fifo or an 8 MiB
+*  blob is refused without paying for a realpath. */
+function openedShapeProblem(opened, shown) {
 	if (!opened.isFile()) return `manageCollection: \`itemsFile\` '${shown}' is not a regular file. It must be a JSON file holding an array of record objects.`;
 	if (opened.size > 8388608) return `manageCollection: \`itemsFile\` '${shown}' is ${opened.size} bytes, over the limit of ${MAX_ITEMS_FILE_BYTES}. Nothing was read; split the rows across several files and call once per file.`;
-	let real;
-	let atPath;
-	let link;
+	return null;
+}
+async function verifyOpenedItemsFile(handle, hostPath, root, shown) {
+	const opened = await handle.stat();
+	const shapeProblem = openedShapeProblem(opened, shown);
+	if (shapeProblem !== null) return shapeProblem;
+	let paths;
 	try {
-		link = await (0, node_fs_promises.lstat)(hostPath);
-		real = await (0, node_fs_promises.realpath)(hostPath);
-		atPath = await (0, node_fs_promises.stat)(real);
+		paths = await resolveOpenedPaths(hostPath, root);
 	} catch (err) {
 		return openItemsFileRefusal(err, shown);
 	}
-	if (link.isSymbolicLink()) return symlinkRefusal(shown);
-	if (!require_discovery.isContainedInRoot(real, root)) return outsideWorkspaceRefusal(shown);
-	if (atPath.ino !== opened.ino || atPath.dev !== opened.dev) return `manageCollection: \`itemsFile\` '${shown}' changed while it was being opened. Nothing was read; write the file, then call putItems.`;
-	return { size: opened.size };
+	return openedFileProblem(paths, opened, shown) ?? { size: opened.size };
 }
 /** Open the file ONCE, then prove that descriptor is the contained file.
 *  `O_NOFOLLOW` refuses a symlink outright rather than resolving it, and
@@ -2335,7 +2364,7 @@ var MANAGE_COLLECTION_DEFINITION = {
 			},
 			schema: {
 				type: "object",
-				description: "putSchema: the full collection schema object (same shape as schema.json — title, icon, dataPath, primaryKey, fields, …). Call getSchema first for the current one, and schemaDocs for the field DSL."
+				description: "putSchema: the full collection schema object (same shape as schema.json — title, icon, dataPath, primaryKey, fields, …). `icon` is either a Material Symbols name (lowercase letters, digits and underscores only — `podcasts`, `rss_feed`, `3d_rotation`; capitals/spaces/hyphens never match) or a SINGLE emoji. Prefer an emoji when the collection would otherwise share a look-alike glyph with another one — it is in colour and tells them apart in the launcher. `color` is an OPTIONAL accent (violet | indigo | sky | teal | emerald | lime | fuchsia) drawn as a pale chip behind the launcher glyph — another way to separate collections that share a generic icon. Omit it rather than guessing; an unknown name simply draws no accent. Call getSchema first for the current one, and schemaDocs for the field DSL."
 			},
 			topic: {
 				type: "string",
@@ -2593,4 +2622,4 @@ Object.defineProperty(exports, "validateRecordObject", {
 	}
 });
 
-//# sourceMappingURL=server-CF1qllGV.cjs.map
+//# sourceMappingURL=server-Wz4_ALLl.cjs.map