@nexrall/code-core 1.4.59 → 1.4.60

package/dist/agent/worktree.js

@@ -0,0 +1,502 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports._worktreeInternal = void 0;
+exports.randomWorktreeName = randomWorktreeName;
+exports.createWorktree = createWorktree;
+exports.worktreeHasWork = worktreeHasWork;
+exports.removeWorktree = removeWorktree;
+exports.enterWorktree = enterWorktree;
+exports.pathEscapesWorktree = pathEscapesWorktree;
+exports.listWorktrees = listWorktrees;
+exports.findWorktreeByName = findWorktreeByName;
+/**
+ * Worktree isolation — lets one session confine ALL its file mutations to a
+ * separate directory, so a SECOND session working the same repo can never be
+ * physically overwritten by the first. This is the primitive Claude Code's
+ * docs describe under "Isolate sessions with worktrees": messaging (see
+ * peer messaging, once that lands) is a SIGNAL channel — it tells another
+ * session what happened. Worktree isolation is a PHYSICAL guarantee — it
+ * makes "what happened" impossible to be "you overwrote my file", because
+ * the two sessions were never touching the same bytes on disk in the first
+ * place.
+ *
+ * Two backends, chosen automatically per workDir:
+ *
+ *   1. GIT-NATIVE (`git worktree add`) — used when workDir is inside a git
+ *      repository. A real git worktree: its own checkout, its own branch,
+ *      full history/remote sharing with the main checkout. Cleanup is
+ *      `git worktree remove`. This mirrors Claude Code's own `--worktree`
+ *      flag almost exactly (`.nexrall/worktrees/<name>/` instead of
+ *      `.claude/worktrees/<name>/`, `worktree-<name>` branch naming kept the
+ *      same since there's no reason to diverge on a convention this legible).
+ *
+ *   2. COPY-BASED (non-git) — used when workDir has no git ancestor at all
+ *      (Perforce, SVN, no VCS, or a git repo the user explicitly opted out
+ *      of). Claude Code solves this with a `WorktreeCreate` hook the PROJECT
+ *      must supply; we go one step further and ALSO ship a zero-config
+ *      default (a plain recursive copy, respecting .gitignore-style ignore
+ *      patterns) so isolation works out of the box even in a project that
+ *      hasn't written a hook. A project CAN still override this default with
+ *      its own `.nexrall/hooks/worktree-create|enter|exit` command for a
+ *      VCS-aware equivalent (Perforce `p4 client`, SVN working copies, etc.)
+ *      — see `runWorktreeHook` below — exactly the escape hatch Claude Code's
+ *      docs describe for "Non-git version control".
+ *
+ * STATE
+ * -----
+ * A worktree session's active isolation state lives in-memory in the caller
+ * (loop.ts / the client), passed as `WorktreeState` through AgentLoopOptions.
+ * This module only creates/removes/enforces — it does not own "which
+ * worktree is this session in right now", because that already has an
+ * owner in every client (ChatPanel's session state, the CLI's chat loop
+ * locals, TaskHost) and a second source of truth would drift from it.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const crypto = __importStar(require("crypto"));
+const WORKTREE_ROOT_DIRNAME = '.nexrall/worktrees';
+// Directories that must never be copied into a copy-based worktree: they are
+// either huge/regenerable (node_modules, dist, build caches) or themselves a
+// VCS metadata directory that would confuse the copy semantics. This list is
+// intentionally conservative and copy-specific — NOT the same list search/glob
+// tools use, because those exist to avoid noisy search results, while this one
+// exists to keep worktree creation fast and avoid duplicating gigabytes of
+// reproducible artifacts. A project can still get everything copied verbatim
+// by using its OWN hook instead of the built-in copy fallback.
+const COPY_SKIP_DIRS = new Set([
+    '.git', 'node_modules', 'dist', 'build', '.next', '__pycache__',
+    '.venv', 'venv', '.nexrall', '.svn', '.hg',
+]);
+function isGitRepo(dir) {
+    try {
+        const r = (0, child_process_1.spawnSync)('git', ['rev-parse', '--show-toplevel'], {
+            cwd: dir, encoding: 'utf-8', timeout: 5000,
+        });
+        if (r.status === 0 && r.stdout)
+            return { ok: true, root: r.stdout.trim() };
+    }
+    catch { /* git not installed or not a repo */ }
+    return { ok: false };
+}
+/** Generate a readable random name, same shape Claude Code uses ("bright-running-fox"). */
+function randomWorktreeName() {
+    const adjectives = ['bright', 'quiet', 'brave', 'calm', 'swift', 'keen', 'bold', 'clear', 'gentle', 'sharp'];
+    const nouns = ['fox', 'river', 'falcon', 'harbor', 'meadow', 'ember', 'summit', 'cedar', 'otter', 'quartz'];
+    const a = adjectives[crypto.randomInt(adjectives.length)];
+    const n = nouns[crypto.randomInt(nouns.length)];
+    const suffix = crypto.randomBytes(2).toString('hex');
+    return `${a}-${n}-${suffix}`;
+}
+function safeName(name) {
+    // Same constraint a git branch name / directory basename both need: no
+    // path separators, no leading dot, nothing that could escape
+    // .nexrall/worktrees/ via `..`.
+    const cleaned = name.replace(/[^a-zA-Z0-9._-]/g, '-').replace(/^\.+/, '');
+    return cleaned || randomWorktreeName();
+}
+/**
+ * Look for a project-supplied override hook: `.nexrall/hooks/worktree-<phase>`
+ * (an executable script/command), same escape hatch Claude Code's docs
+ * describe for non-git version control. Returns the command string to run,
+ * or null if the project hasn't defined one for this phase.
+ */
+function findWorktreeHook(workDir, phase) {
+    try {
+        const settingsPath = path.join(workDir, '.nexrall', 'settings.json');
+        if (!fs.existsSync(settingsPath))
+            return null;
+        const raw = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
+        const hooks = (raw.worktreeHooks ?? {});
+        const cmd = hooks[phase];
+        return typeof cmd === 'string' && cmd.trim() ? cmd.trim() : null;
+    }
+    catch {
+        return null;
+    }
+}
+function runWorktreeHook(workDir, phase, env) {
+    const cmd = findWorktreeHook(workDir, phase);
+    if (!cmd)
+        return { ran: false, ok: false };
+    try {
+        const r = (0, child_process_1.spawnSync)(cmd, {
+            shell: true,
+            cwd: workDir,
+            timeout: 60000,
+            encoding: 'utf-8',
+            env: { ...process.env, ...env },
+        });
+        return { ran: true, ok: r.status === 0, output: (r.stdout ?? '') + (r.stderr ?? '') };
+    }
+    catch (err) {
+        return { ran: true, ok: false, output: err.message };
+    }
+}
+function copyRecursive(src, dest) {
+    fs.mkdirSync(dest, { recursive: true });
+    for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
+        if (entry.isDirectory() && COPY_SKIP_DIRS.has(entry.name))
+            continue;
+        const s = path.join(src, entry.name);
+        const d = path.join(dest, entry.name);
+        if (entry.isSymbolicLink()) {
+            try {
+                fs.symlinkSync(fs.readlinkSync(s), d);
+            }
+            catch { /* best-effort */ }
+        }
+        else if (entry.isDirectory()) {
+            copyRecursive(s, d);
+        }
+        else if (entry.isFile()) {
+            fs.copyFileSync(s, d);
+        }
+    }
+}
+/**
+ * Create an isolated worktree for `workDir`, choosing the best backend
+ * automatically:
+ *   1. A project-supplied `.nexrall/hooks` override for 'create', if defined
+ *      (works for ANY VCS, or a fully custom isolation scheme).
+ *   2. Git-native `git worktree add`, if workDir is inside a git repo.
+ *   3. Plain recursive copy (skips COPY_SKIP_DIRS), as a zero-config
+ *      fallback that always works.
+ */
+function createWorktree(workDir, requestedName) {
+    const name = safeName(requestedName?.trim() || randomWorktreeName());
+    const root = path.join(workDir, WORKTREE_ROOT_DIRNAME);
+    const worktreePath = path.join(root, name);
+    if (fs.existsSync(worktreePath)) {
+        return { ok: false, error: `A worktree named "${name}" already exists at ${worktreePath}.` };
+    }
+    // 1. Project hook takes priority — even in a git repo, a project may want
+    //    VCS-specific behaviour (e.g. Perforce) instead of the git-native path.
+    const hookEnv = { NEXRALL_WORKTREE_NAME: name, NEXRALL_WORKTREE_PATH: worktreePath, NEXRALL_MAIN_CHECKOUT: workDir };
+    const hook = runWorktreeHook(workDir, 'create', hookEnv);
+    if (hook.ran) {
+        if (!hook.ok)
+            return { ok: false, error: `worktree-create hook failed: ${hook.output ?? 'unknown error'}` };
+        if (!fs.existsSync(worktreePath)) {
+            return { ok: false, error: `worktree-create hook exited 0 but did not create ${worktreePath}.` };
+        }
+        const state = { worktreePath, mainCheckout: workDir, backend: 'hook', name };
+        writeMetadata(state);
+        return { ok: true, state };
+    }
+    // 2. Git-native.
+    const git = isGitRepo(workDir);
+    if (git.ok && git.root) {
+        fs.mkdirSync(root, { recursive: true });
+        const branch = `worktree-${name}`;
+        const r = (0, child_process_1.spawnSync)('git', ['worktree', 'add', '-b', branch, worktreePath], { cwd: git.root, encoding: 'utf-8', timeout: 30000 });
+        if (r.status !== 0) {
+            return { ok: false, error: `git worktree add failed: ${(r.stderr ?? r.stdout ?? '').trim() || 'unknown error'}` };
+        }
+        const state = { worktreePath, mainCheckout: workDir, backend: 'git', branch, name };
+        writeMetadata(state);
+        return { ok: true, state };
+    }
+    // 3. Zero-config copy fallback — always works, no git and no hook required.
+    try {
+        copyRecursive(workDir, worktreePath);
+        const state = { worktreePath, mainCheckout: workDir, backend: 'copy', name };
+        writeMetadata(state);
+        return { ok: true, state };
+    }
+    catch (err) {
+        return { ok: false, error: `Failed to create copy-based worktree: ${err.message}` };
+    }
+}
+/** Whether a worktree has anything in it worth not silently discarding. */
+function worktreeHasWork(state) {
+    if (state.backend === 'git') {
+        try {
+            const status = (0, child_process_1.spawnSync)('git', ['status', '--porcelain'], {
+                cwd: state.worktreePath, encoding: 'utf-8', timeout: 10000,
+            });
+            // Filter our own bookkeeping file out of the porcelain output before
+            // deciding — see writeMetadata's comment on why this is filtered here
+            // rather than via `.git/info/exclude` (which is shared repo-wide and
+            // would leak into the main checkout's status).
+            const meaningfulLines = (status.stdout ?? '')
+                .split('\n')
+                .filter((line) => line.trim().length > 0 && !line.includes(METADATA_FILENAME));
+            if (meaningfulLines.length > 0)
+                return true;
+            // Also check for unpushed commits on the worktree's own branch.
+            const unpushed = (0, child_process_1.spawnSync)('git', ['log', '@{u}..HEAD', '--oneline'], { cwd: state.worktreePath, encoding: 'utf-8', timeout: 10000 });
+            if (unpushed.status === 0 && unpushed.stdout && unpushed.stdout.trim().length > 0)
+                return true;
+            return false;
+        }
+        catch {
+            return true; // can't verify — be conservative like Claude Code's own docs describe
+        }
+    }
+    // Copy-based / hook-based: can't diff against an origin, so any content at
+    // all counts as "has work" — conservative on purpose (see Claude Code's
+    // "worktree's state can't be verified" case: it prompts rather than assumes clean).
+    // Our own bookkeeping file doesn't count — a freshly created worktree with
+    // nothing done in it yet must still read as clean.
+    try {
+        return fs.readdirSync(state.worktreePath).some((f) => f !== METADATA_FILENAME);
+    }
+    catch {
+        return false;
+    }
+}
+function removeWorktree(state, opts = {}) {
+    if (!opts.force && worktreeHasWork(state)) {
+        return { ok: false, hadWork: true };
+    }
+    const hookEnv = { NEXRALL_WORKTREE_NAME: state.name, NEXRALL_WORKTREE_PATH: state.worktreePath, NEXRALL_MAIN_CHECKOUT: state.mainCheckout };
+    if (state.backend === 'hook') {
+        const hook = runWorktreeHook(state.mainCheckout, 'exit', hookEnv);
+        if (hook.ran && !hook.ok)
+            return { ok: false, error: `worktree-exit hook failed: ${hook.output ?? 'unknown error'}` };
+        // A hook backend is responsible for its own directory removal during 'exit'.
+        // If it left the directory in place, that's the hook's choice to make (it
+        // may want to keep worktrees around for its own reasons) — don't second-guess it.
+        return { ok: true };
+    }
+    if (state.backend === 'git') {
+        // worktreeHasWork (checked above) already treats our own bookkeeping file
+        // as invisible, but `git worktree remove` itself does its OWN untracked-
+        // file check and does not know about that exception — it would refuse a
+        // "clean" (per worktreeHasWork) worktree purely because our metadata
+        // file is untracked. Remove it first: by this point it has served its
+        // only purpose (letting a fresh process reconstruct this WorktreeState),
+        // and the worktree itself is one syscall from being deleted anyway.
+        try {
+            fs.unlinkSync(metadataPath(state.worktreePath));
+        }
+        catch { /* fine if already gone */ }
+        const r = (0, child_process_1.spawnSync)('git', ['worktree', 'remove', state.worktreePath, ...(opts.force ? ['--force'] : [])], { cwd: state.mainCheckout, encoding: 'utf-8', timeout: 30000 });
+        if (r.status !== 0) {
+            return { ok: false, error: `git worktree remove failed: ${(r.stderr ?? r.stdout ?? '').trim() || 'unknown error'}` };
+        }
+        // Also drop the branch — an unnamed worktree's branch is disposable once
+        // its worktree is gone (mirrors Claude Code's automatic cleanup for
+        // unnamed sessions). Best-effort: a shared/renamed branch failing to
+        // delete is not worth surfacing as an error.
+        if (state.branch) {
+            (0, child_process_1.spawnSync)('git', ['branch', '-D', state.branch], { cwd: state.mainCheckout, encoding: 'utf-8', timeout: 10000 });
+        }
+        return { ok: true };
+    }
+    // Copy-based.
+    try {
+        fs.rmSync(state.worktreePath, { recursive: true, force: true });
+        return { ok: true };
+    }
+    catch (err) {
+        return { ok: false, error: err.message };
+    }
+}
+/**
+ * Called when a session ENTERS an already-created worktree (including
+ * re-entering across a resume). Fires the project's 'enter' hook if defined
+ * — informational only for the git/copy backends (nothing to actually do:
+ * the directory already exists and is already the session's cwd), but
+ * REQUIRED for the 'hook' backend, which may need to check out/refresh
+ * VCS-specific state each time.
+ */
+function enterWorktree(state) {
+    if (state.backend !== 'hook')
+        return { ok: true };
+    const hookEnv = { NEXRALL_WORKTREE_NAME: state.name, NEXRALL_WORKTREE_PATH: state.worktreePath, NEXRALL_MAIN_CHECKOUT: state.mainCheckout };
+    const hook = runWorktreeHook(state.mainCheckout, 'enter', hookEnv);
+    if (hook.ran && !hook.ok)
+        return { ok: false, error: `worktree-enter hook failed: ${hook.output ?? 'unknown error'}` };
+    return { ok: true };
+}
+function isWithin(real, ancestorReal) {
+    if (real === ancestorReal)
+        return true;
+    const rel = path.relative(ancestorReal, real);
+    // Within the ancestor iff the relative path does NOT start with '..' and is
+    // NOT itself absolute (path.relative returns an absolute path on Windows
+    // when the two inputs are on different drives, which correctly means "not
+    // within").
+    return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel);
+}
+/**
+ * Resolve `p` to a real, symlink-free absolute path, even when `p` itself
+ * does not exist yet (e.g. a `write_file` target about to be created).
+ *
+ * A plain `fs.realpathSync` fails outright on a non-existent path, and a
+ * plain `path.resolve` fallback for that case is not enough on its own: on
+ * macOS, `/tmp` is itself a symlink to `/private/tmp`, so a target
+ * `/tmp/x/new-file.txt` (lexical, unresolved) and its EXISTING sibling
+ * directory `/tmp/x` (which realpathSync resolves to `/private/tmp/x`) would
+ * compare as two different roots even though they are the same directory —
+ * silently defeating `isWithin` for any not-yet-created path under a
+ * symlinked ancestor. The fix: walk up to the NEAREST ancestor that DOES
+ * exist, realpath just that ancestor, then re-append the non-existent
+ * remainder lexically (a component that doesn't exist cannot itself be a
+ * symlink to resolve).
+ */
+function realOrLexical(p) {
+    try {
+        return fs.realpathSync(p);
+    }
+    catch { /* fall through — p (or a piece of it) doesn't exist yet */ }
+    let dir = path.dirname(p);
+    const tail = [path.basename(p)];
+    for (;;) {
+        try {
+            const realDir = fs.realpathSync(dir);
+            return path.join(realDir, ...tail.reverse());
+        }
+        catch {
+            const parent = path.dirname(dir);
+            if (parent === dir)
+                return path.resolve(p); // reached filesystem root without finding an existing ancestor
+            tail.push(path.basename(dir));
+            dir = parent;
+        }
+    }
+}
+/**
+ * True when `absPath` resolves to somewhere inside the MAIN CHECKOUT that
+ * isolation is meant to protect, while NOT being inside the currently active
+ * worktree — the check `blockOutsideWorktree` (in executor.ts) uses to
+ * refuse a write/bash-cwd that targets the wrong tree. This is exactly the
+ * check Claude Code's own worktree docs describe: "blocks an Edit, Write, or
+ * NotebookEdit that targets a path in the main checkout" — NOT "any path
+ * outside the worktree" (a write to some unrelated directory elsewhere on
+ * disk isn't the hazard this specific check exists to prevent; ordinary
+ * sandbox/permission rules still govern that separately).
+ *
+ * The git/copy backends nest the worktree INSIDE the main checkout
+ * (`<mainCheckout>/.nexrall/worktrees/<name>`), so "inside mainCheckout" on
+ * its own would wrongly flag every path inside a perfectly legitimate
+ * worktree — this function excludes the active worktree's own subtree first.
+ *
+ * Deliberately resolves symlinks (fs.realpathSync) so a symlink planted
+ * INSIDE the worktree that points back at the main checkout can't be used to
+ * defeat the check — the same class of bypass Claude Code's own worktree
+ * docs call out for git redirects.
+ */
+function pathEscapesWorktree(absPath, state) {
+    const real = realOrLexical(absPath);
+    const worktreeReal = realOrLexical(state.worktreePath);
+    if (isWithin(real, worktreeReal))
+        return false; // inside the active worktree — never escaping
+    const mainReal = realOrLexical(state.mainCheckout);
+    return isWithin(real, mainReal); // outside the worktree AND inside the main checkout — this IS the hazard
+}
+/**
+ * Small metadata file written next to a worktree's own contents
+ * (`.nexrall-worktree.json` at its root) so a LATER process invocation —
+ * `nex --worktree <name>` in a brand-new CLI process, VS Code re-opening the
+ * same project, a resumed session — can reconstruct the WorktreeState
+ * without re-deriving `backend`/`branch` from scratch. This is what makes
+ * "resume into an existing worktree" possible at all: the git/copy/hook
+ * distinction is a property of HOW it was created, not something a fresh
+ * process can re-detect reliably from the directory alone (a copy-based
+ * worktree contains no marker of its own; nothing stops a git worktree's
+ * branch from being renamed after the fact).
+ */
+const METADATA_FILENAME = '.nexrall-worktree.json';
+function metadataPath(worktreePath) {
+    return path.join(worktreePath, METADATA_FILENAME);
+}
+function writeMetadata(state) {
+    try {
+        fs.writeFileSync(metadataPath(state.worktreePath), JSON.stringify(state));
+        // NOTE: deliberately NOT using `.git/info/exclude` to hide this file from
+        // git status. `info/exclude` is a REPO-WIDE file shared by every linked
+        // worktree (`git rev-parse --git-path info/exclude` resolves to the SAME
+        // path from the main checkout and from any worktree) — writing to it
+        // would leak this exclusion into the main checkout's own `git status`
+        // too, which is exactly the cross-contamination worktree isolation
+        // exists to prevent. Instead, worktreeHasWork (below) filters this one
+        // filename out of `git status --porcelain`'s output directly — no shared
+        // state touched, no risk to the main checkout.
+    }
+    catch { /* best-effort */ }
+}
+function readMetadata(worktreePath) {
+    try {
+        const raw = JSON.parse(fs.readFileSync(metadataPath(worktreePath), 'utf-8'));
+        if (raw && typeof raw.worktreePath === 'string' && typeof raw.mainCheckout === 'string')
+            return raw;
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * List every worktree registered under `workDir`'s `.nexrall/worktrees/`,
+ * reconstructed from each one's metadata file. Skips (rather than throws on)
+ * a directory with no readable metadata — e.g. one a user created by hand,
+ * or debris from an older version — since one bad entry must not hide every
+ * legitimate one from a session picker.
+ */
+function listWorktrees(workDir) {
+    const root = path.join(workDir, WORKTREE_ROOT_DIRNAME);
+    let entries;
+    try {
+        entries = fs.readdirSync(root);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const name of entries) {
+        const wt = path.join(root, name);
+        try {
+            if (!fs.statSync(wt).isDirectory())
+                continue;
+        }
+        catch {
+            continue;
+        }
+        const meta = readMetadata(wt);
+        if (meta)
+            out.push(meta);
+    }
+    return out;
+}
+/** Find a previously created worktree by name, for resuming into it in a fresh process. */
+function findWorktreeByName(workDir, name) {
+    return listWorktrees(workDir).find((w) => w.name === name) ?? null;
+}
+exports._worktreeInternal = { isGitRepo, safeName, copyRecursive, findWorktreeHook, COPY_SKIP_DIRS, WORKTREE_ROOT_DIRNAME, metadataPath };
+//# sourceMappingURL=worktree.js.map

package/dist/agent/worktreeEnforcement.d.ts

@@ -0,0 +1,29 @@
+import type { WorktreeState } from './worktree';
+export interface WorktreeRefusal {
+    reason: 'edit-outside-worktree' | 'bash-cwd-outside-worktree' | 'git-redirect-outside-worktree' | 'bash-shape-unverifiable';
+    message: string;
+}
+/**
+ * Check ONE tool call against active worktree isolation. Returns null when
+ * the call is fine (either no isolation is active, or the call stays inside
+ * the worktree). Call this the same way checkPlanMode is called — BEFORE
+ * requestPermission, since no user answer at that prompt can lawfully unlock
+ * a session-wide isolation boundary.
+ */
+export declare function checkWorktreeIsolation(tool: string, input: Record<string, unknown>, state: WorktreeState | undefined, workDir?: string): WorktreeRefusal | null;
+declare function resolvesIntoMainCheckout(candidate: string, state: WorktreeState): boolean;
+declare function checkBashAgainstWorktree(command: string, state: WorktreeState): WorktreeRefusal | null;
+/**
+ * Prepended to nexrall.md when worktree isolation is active — same rationale
+ * as PLAN_MODE_INSTRUCTIONS in planMode.ts: telling the model up front is not
+ * the enforcement (checkWorktreeIsolation at the call site is), it exists so
+ * the model plans its work AROUND the boundary instead of discovering it one
+ * refused tool call at a time.
+ */
+export declare function worktreeInstructions(state: WorktreeState): string;
+export declare const _worktreeEnforcementInternal: {
+    checkBashAgainstWorktree: typeof checkBashAgainstWorktree;
+    resolvesIntoMainCheckout: typeof resolvesIntoMainCheckout;
+};
+export {};
+//# sourceMappingURL=worktreeEnforcement.d.ts.map

package/dist/agent/worktreeEnforcement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktreeEnforcement.d.ts","sourceRoot":"","sources":["../../src/agent/worktreeEnforcement.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,uBAAuB,GAAG,2BAA2B,GAAG,+BAA+B,GAAG,yBAAyB,CAAC;IAC5H,OAAO,EAAE,MAAM,CAAC;CACjB;AAwBD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,KAAK,EAAE,aAAa,GAAG,SAAS,EAChC,OAAO,CAAC,EAAE,MAAM,GACf,eAAe,GAAG,IAAI,CAuBxB;AA2BD,iBAAS,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAIlF;AAED,iBAAS,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,eAAe,GAAG,IAAI,CAyC/F;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAcjE;AAED,eAAO,MAAM,4BAA4B;;;CAAyD,CAAC"}