@oisincoveney/pipeline 3.24.2 → 4.0.0

package/dist/runtime/parallel-node/parallel-node.js

@@ -2,171 +2,160 @@ import { childReporter } from "../events/events.js";
 import "../events/index.js";
 import { configUsesOpencode, leaseOpencodeRuntime } from "../opencode-runtime.js";
 import { WorktreeService, WorktreeServiceLive } from "../services/worktree-service.js";
-import { Effect, Semaphore } from "effect";
+import { Effect, Option, Semaphore } from "effect";
 //#region src/runtime/parallel-node/parallel-node.ts
-function executeParallelNode(node, context, runtime) {
-	return Effect.runPromise(Effect.provide(parallelNodeProgram(node, context, runtime), WorktreeServiceLive));
-}
-function parallelNodeProgram(node, context, runtime) {
-	const children = node.children ?? [];
-	if (children.length === 0) return Effect.succeed({
-		evidence: [`parallel node '${node.id}' has no children`],
-		exitCode: 1,
-		output: ""
-	});
-	return Effect.gen(function* () {
-		yield* gcStaleWorktrees(context);
-		const failFast = context.plan.execution.failFast;
-		const linkedAbort = createLinkedAbortController(context.signal);
-		const childContext = createParallelChildContext(context, node.id, children, failFast ? linkedAbort.controller.signal : context.signal);
-		const gate = failFast ? makeFailFastGate(linkedAbort.controller) : void 0;
-		for (const child of children) runtime.markNodeReady(childContext, child.id);
-		const settled = yield* runAllChildren(children, childContext, runtime, yield* makeCategorySemaphores(childContext), gate).pipe(Effect.ensuring(Effect.sync(linkedAbort.cleanup)));
-		return aggregateParallelResult(node.id, children, settled);
-	});
-}
-function makeFailFastGate(controller) {
-	return {
-		abort: () => controller.abort(),
-		aborted: () => controller.signal.aborted
-	};
-}
-function aggregateParallelResult(nodeId, children, settled) {
-	const results = settled.filter((result) => result !== void 0);
-	const failed = results.filter((result) => result.status === "failed");
-	return {
-		evidence: parallelEvidence(nodeId, results, failed),
-		exitCode: failed.length > 0 ? 1 : 0,
-		output: parallelOutput(children, results)
-	};
-}
-function runAllChildren(children, context, runtime, caps, gate) {
-	return Effect.forEach(children, (child) => runChildCapped(child, context, runtime, caps, gate), { concurrency: context.maxParallelNodes ?? "unbounded" });
-}
-function runChildCapped(child, context, runtime, caps, gate) {
-	return Effect.gen(function* () {
-		if (gate?.aborted()) return;
-		const result = yield* withCategoryCap(caps, child.id, context, runChildInWorktree(child, context, runtime));
-		if (gate && result.status === "failed") gate.abort();
-		return result;
-	});
-}
-function withCategoryCap(caps, childId, context, effect) {
-	const category = childCategory(childId, context.config.token_budget?.fan_out_width);
-	const semaphore = category ? caps.get(category) : void 0;
-	return semaphore ? semaphore.withPermits(1)(effect) : effect;
-}
-function makeCategorySemaphores(context) {
-	const fanOut = context.config.token_budget?.fan_out_width;
-	if (!fanOut) return Effect.succeed(/* @__PURE__ */ new Map());
-	return Effect.gen(function* () {
+const makeFailFastGate = (controller) => ({
+	abort: () => {
+		controller.abort();
+	},
+	aborted: () => controller.signal.aborted
+});
+const makeCategorySemaphores = (context) => {
+	const fanOut = context.config.token_budget.fan_out_width;
+	return Effect.gen(function* effectBody() {
 		const caps = /* @__PURE__ */ new Map();
 		for (const [category, permits] of Object.entries(fanOut.by_category)) caps.set(category, yield* Semaphore.make(permits));
 		return caps;
 	});
-}
-function gcStaleWorktrees(context) {
-	return Effect.gen(function* () {
-		if (context.config.parallel_worktrees?.enabled) yield* (yield* WorktreeService).gc(context.worktreePath);
+};
+const gcStaleWorktrees = (context) => Effect.gen(function* effectBody() {
+	if (context.config.parallel_worktrees?.enabled === true) yield* (yield* WorktreeService).gc(context.worktreePath);
+});
+const executeChild = (child, context, runtime) => Effect.tryPromise(async () => await runtime.executeNode(child, context)).pipe(Effect.orDie);
+const opencodeSessionReporter = (context) => (nodeId, sessionId) => {
+	context.reporter?.({
+		nodeId,
+		sessionId,
+		type: "node.session"
 	});
-}
+};
+const leaseChildOpencodeRuntime = (context, worktreePath) => Effect.tryPromise(async () => await leaseOpencodeRuntime({
+	config: context.config,
+	...context.reporter === void 0 ? {} : { onSession: opencodeSessionReporter(context) },
+	...context.signal === void 0 ? {} : { signal: context.signal },
+	worktreePath
+})).pipe(Effect.orDie);
+const runChildWithWorktreeLease = (child, context, runtime, worktreePath) => {
+	const childContext = {
+		...context,
+		worktreePath
+	};
+	if (!configUsesOpencode(context.config)) return executeChild(child, childContext, runtime);
+	return Effect.acquireUseRelease(leaseChildOpencodeRuntime(context, worktreePath), (childRuntime) => executeChild(child, {
+		...childContext,
+		executor: childRuntime.executor
+	}, runtime), (childRuntime) => Effect.tryPromise(async () => {
+		await childRuntime.release();
+	}).pipe(Effect.orDie));
+};
+const childLeaseOptions = (child, context) => ({
+	childNodeId: child.id,
+	parentNodeId: context.parentParallelNodeId ?? "parallel",
+	repoRoot: context.worktreePath,
+	...context.runId === void 0 || context.runId.length === 0 ? {} : { runId: context.runId }
+});
 /**
 * PIPE-83.4: run a parallel child in its own git worktree when enabled, so
 * concurrent candidate edits can't collide. The worktree lease is acquired and
 * released as an Effect-scoped resource (released on success, failure, or
 * interruption); release retains dirty/unpushed work for downstream selection.
 */
-function runChildInWorktree(child, context, runtime) {
-	if (!context.config.parallel_worktrees?.enabled) return executeChild(child, context, runtime);
-	return Effect.gen(function* () {
+const runChildInWorktree = (child, context, runtime) => {
+	if (context.config.parallel_worktrees?.enabled !== true) return executeChild(child, context, runtime);
+	return Effect.gen(function* effectBody() {
 		const worktree = yield* WorktreeService;
 		return yield* Effect.acquireUseRelease(worktree.createChild(childLeaseOptions(child, context)), (lease) => runChildWithWorktreeLease(child, context, runtime, lease.path), (lease) => Effect.sync(() => lease.release()));
 	});
-}
-function executeChild(child, context, runtime) {
-	return Effect.tryPromise(() => runtime.executeNode(child, context)).pipe(Effect.orDie);
-}
-function runChildWithWorktreeLease(child, context, runtime, worktreePath) {
-	const childContext = {
-		...context,
-		worktreePath
-	};
-	if (!configUsesOpencode(context.config)) return executeChild(child, childContext, runtime);
-	return Effect.acquireUseRelease(leaseChildOpencodeRuntime(context, worktreePath), (childRuntime) => executeChild(child, {
-		...childContext,
-		executor: childRuntime.executor
-	}, runtime), (childRuntime) => Effect.tryPromise(() => childRuntime.release()).pipe(Effect.orDie));
-}
-function leaseChildOpencodeRuntime(context, worktreePath) {
-	return Effect.tryPromise(() => leaseOpencodeRuntime({
-		config: context.config,
-		...context.reporter ? { onSession: opencodeSessionReporter(context) } : {},
-		...context.signal ? { signal: context.signal } : {},
-		worktreePath
-	})).pipe(Effect.orDie);
-}
-function opencodeSessionReporter(context) {
-	return (nodeId, sessionId) => {
-		context.reporter?.({
-			nodeId,
-			sessionId,
-			type: "node.session"
-		});
-	};
-}
-function childLeaseOptions(child, context) {
-	return {
-		childNodeId: child.id,
-		parentNodeId: context.parentParallelNodeId ?? "parallel",
-		repoRoot: context.worktreePath,
-		...context.runId ? { runId: context.runId } : {}
-	};
-}
-function createParallelChildContext(context, parentNodeId, children, signal) {
-	return {
-		...context,
-		hookResults: new Map(context.hookResults),
-		nodeStateStore: context.nodeStateStore.forkForParallelChildren(children),
-		plan: {
-			...context.plan,
-			parallelBatches: [children],
-			topologicalOrder: children
-		},
-		parentParallelNodeId: parentNodeId,
-		reporter: childReporter(context, parentNodeId),
-		...signal ? { signal } : {}
-	};
-}
-function createLinkedAbortController(signal) {
+};
+const createParallelChildContext = (context, parentNodeId, children, signal) => ({
+	...context,
+	hookResults: new Map(context.hookResults),
+	nodeStateStore: context.nodeStateStore.forkForParallelChildren(children),
+	parentParallelNodeId: parentNodeId,
+	plan: {
+		...context.plan,
+		parallelBatches: [children],
+		topologicalOrder: children
+	},
+	reporter: childReporter(context, parentNodeId),
+	...signal === void 0 ? {} : { signal }
+});
+const createLinkedAbortController = (signal) => {
 	const controller = new AbortController();
-	if (!signal) return {
-		cleanup: () => void 0,
+	if (signal === void 0) return {
+		cleanup: () => {},
 		controller
 	};
 	if (signal.aborted) {
 		controller.abort();
 		return {
-			cleanup: () => void 0,
+			cleanup: () => {},
 			controller
 		};
 	}
-	const abort = () => controller.abort();
+	const abort = () => {
+		controller.abort();
+	};
 	signal.addEventListener("abort", abort, { once: true });
 	return {
-		cleanup: () => signal.removeEventListener("abort", abort),
+		cleanup: () => {
+			signal.removeEventListener("abort", abort);
+		},
 		controller
 	};
-}
-function childCategory(childId, fanOut) {
-	return fanOut ? Object.keys(fanOut.by_category).find((category) => childId.includes(category)) : void 0;
-}
-function parallelEvidence(nodeId, results, failed) {
+};
+const childCategory = (childId, fanOut) => fanOut === void 0 ? Option.none() : Option.fromUndefinedOr(Object.keys(fanOut.by_category).find((category) => childId.includes(category)));
+const withCategoryCap = (caps, childId, context, effect) => {
+	const category = childCategory(childId, context.config.token_budget.fan_out_width);
+	const semaphore = Option.flatMap(category, (value) => Option.fromUndefinedOr(caps.get(value)));
+	return Option.match(semaphore, {
+		onNone: () => effect,
+		onSome: (value) => value.withPermits(1)(effect)
+	});
+};
+const runChildCapped = (child, context, runtime, caps, gate) => Effect.gen(function* effectBody() {
+	if (gate !== void 0 && gate.aborted()) return Option.none();
+	const result = yield* withCategoryCap(caps, child.id, context, runChildInWorktree(child, context, runtime));
+	if (gate !== void 0 && result.status === "failed") gate.abort();
+	return Option.some(result);
+});
+const runAllChildren = (children, context, runtime, caps, gate) => Effect.forEach(children, (child) => runChildCapped(child, context, runtime, caps, gate), { concurrency: context.maxParallelNodes ?? "unbounded" });
+const parallelEvidence = (nodeId, results, failed) => {
 	if (failed.length === 0) return [`parallel node '${nodeId}' completed ${results.length} child nodes`];
 	return [`parallel node '${nodeId}' failed with ${failed.length} failed child nodes`, ...failed.flatMap((result) => result.evidence)];
-}
-function parallelOutput(children, results) {
+};
+const parallelOutput = (children, results) => {
 	const outputsByNode = new Map(results.map((result) => [result.nodeId, result.output]));
 	return JSON.stringify({ children: Object.fromEntries(children.filter((child) => outputsByNode.has(child.id)).map((child) => [child.id, outputsByNode.get(child.id)])) });
-}
+};
+const aggregateParallelResult = (nodeId, children, settled) => {
+	const results = settled.filter(Option.isSome).map((result) => result.value);
+	const failed = results.filter((result) => result.status === "failed");
+	return {
+		evidence: parallelEvidence(nodeId, results, failed),
+		exitCode: failed.length > 0 ? 1 : 0,
+		output: parallelOutput(children, results)
+	};
+};
+const parallelNodeProgram = (node, context, runtime) => {
+	const children = node.children ?? [];
+	if (children.length === 0) return Effect.succeed({
+		evidence: [`parallel node '${node.id}' has no children`],
+		exitCode: 1,
+		output: ""
+	});
+	return Effect.gen(function* effectBody() {
+		yield* gcStaleWorktrees(context);
+		const { failFast } = context.plan.execution;
+		const linkedAbort = createLinkedAbortController(context.signal);
+		const childContext = createParallelChildContext(context, node.id, children, failFast ? linkedAbort.controller.signal : context.signal);
+		const gate = failFast ? makeFailFastGate(linkedAbort.controller) : void 0;
+		for (const child of children) runtime.markNodeReady(childContext, child.id);
+		const caps = yield* makeCategorySemaphores(childContext);
+		const settled = yield* runAllChildren(children, childContext, runtime, caps, gate).pipe(Effect.ensuring(Effect.sync(linkedAbort.cleanup)));
+		return aggregateParallelResult(node.id, children, settled);
+	});
+};
+const executeParallelNode = async (node, context, runtime) => await Effect.runPromise(Effect.provide(parallelNodeProgram(node, context, runtime), WorktreeServiceLive));
 //#endregion
 export { executeParallelNode };

package/dist/runtime/parallel-worktrees/parallel-worktrees.js

@@ -1,3 +1,4 @@
+import { literalSchema, literalsSchema, optionalSchema, parseWithSchema, stringValue, struct } from "../../schema-boundary.js";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { execFileSync } from "node:child_process";
@@ -14,37 +15,100 @@ const WORKTREE_ROOT = ".pipeline/worktrees";
 const REGISTRY_DIR = join(WORKTREE_ROOT, "registry");
 const OWNER = "oisin-pipeline";
 const GENERATED_WORKTREE_RESOURCES = [join(".opencode", "agents"), join(".opencode", "command")];
-function provisionGeneratedResources(repoRoot, worktreePath) {
+const provisionGeneratedResources = (repoRoot, worktreePath) => {
 	for (const relativePath of GENERATED_WORKTREE_RESOURCES) {
 		const source = join(repoRoot, relativePath);
 		const target = join(worktreePath, relativePath);
 		if (existsSync(source) && !existsSync(target)) cpSync(source, target, { recursive: true });
 	}
-}
-function childWorktreeRelPath(runId, parentNodeId, childNodeId) {
-	return join(WORKTREE_ROOT, "trees", sanitize(runId ?? "local"), sanitize(parentNodeId), sanitize(childNodeId));
-}
-function git(cwd, args) {
-	return execFileSync("git", args, {
-		cwd,
-		encoding: "utf8"
-	}).trim();
-}
-function sanitize(id) {
-	return id.replace(/[^A-Za-z0-9._-]/g, "-");
-}
-function writeManifest(path, manifest) {
-	writeFileSync(path, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
-}
-function readManifest(path) {
-	return JSON.parse(readFileSync(path, "utf8"));
-}
-function createChildWorktree(opts) {
+};
+literalsSchema([
+	"active",
+	"removed",
+	"retained-dirty",
+	"retained-unpushed"
+]);
+const worktreeManifestSchema = struct({
+	baseSha: stringValue(),
+	branch: stringValue(),
+	childNodeId: stringValue(),
+	leaseId: stringValue(),
+	owner: stringValue(),
+	parentNodeId: stringValue(),
+	path: stringValue(),
+	runId: optionalSchema(stringValue()),
+	schemaVersion: literalSchema(1),
+	state: literalsSchema([
+		"active",
+		"creating",
+		"removed",
+		"retained-dirty",
+		"retained-unpushed"
+	])
+});
+const git = (cwd, args) => execFileSync("git", args, {
+	cwd,
+	encoding: "utf-8"
+}).trim();
+const sanitize = (id) => id.replaceAll(/[^A-Za-z0-9._-]/gu, "-");
+const childWorktreeRelPath = (parentNodeId, childNodeId, runId) => join(WORKTREE_ROOT, "trees", sanitize(runId ?? "local"), sanitize(parentNodeId), sanitize(childNodeId));
+const writeManifest = (path, manifest) => {
+	writeFileSync(path, `${JSON.stringify(manifest, null, 2)}\n`, "utf-8");
+};
+const readManifest = (path) => parseWithSchema(worktreeManifestSchema, JSON.parse(readFileSync(path, "utf-8")));
+const retentionState = (absPath, baseSha) => {
+	if (git(absPath, [
+		"status",
+		"--porcelain",
+		"--untracked-files=all"
+	]).length > 0) return "retained-dirty";
+	if (git(absPath, ["rev-parse", "HEAD"]) !== baseSha) return "retained-unpushed";
+	return "remove";
+};
+/** Idempotent, crash-safe teardown. Retains (never deletes) dirty/unpushed work. */
+const releaseWorktree = (repoRoot, manifestPath) => {
+	if (!existsSync(manifestPath)) return "removed";
+	const manifest = readManifest(manifestPath);
+	const absPath = join(repoRoot, manifest.path);
+	git(repoRoot, ["worktree", "prune"]);
+	if (!existsSync(absPath)) {
+		writeManifest(manifestPath, {
+			...manifest,
+			state: "removed"
+		});
+		return "removed";
+	}
+	const guarded = retentionState(absPath, manifest.baseSha);
+	if (guarded !== "remove") {
+		writeManifest(manifestPath, {
+			...manifest,
+			state: guarded
+		});
+		return guarded;
+	}
+	git(repoRoot, [
+		"worktree",
+		"remove",
+		"--force",
+		absPath
+	]);
+	git(repoRoot, [
+		"branch",
+		"-D",
+		manifest.branch
+	]);
+	writeManifest(manifestPath, {
+		...manifest,
+		state: "removed"
+	});
+	return "removed";
+};
+const createChildWorktree = (opts) => {
 	const runSeg = sanitize(opts.runId ?? "local");
 	const parentSeg = sanitize(opts.parentNodeId);
 	const childSeg = sanitize(opts.childNodeId);
 	const baseSha = git(opts.repoRoot, ["rev-parse", "HEAD"]);
-	const relPath = childWorktreeRelPath(opts.runId, opts.parentNodeId, opts.childNodeId);
+	const relPath = childWorktreeRelPath(opts.parentNodeId, opts.childNodeId, opts.runId);
 	const absPath = join(opts.repoRoot, relPath);
 	const branch = `pipeline/worktrees/${runSeg}/${parentSeg}/${childSeg}`;
 	const leaseId = `${runSeg}__${parentSeg}__${childSeg}`;
@@ -84,61 +148,14 @@ function createChildWorktree(opts) {
 		path: absPath,
 		release: () => releaseWorktree(opts.repoRoot, manifestPath)
 	};
-}
-/** Idempotent, crash-safe teardown. Retains (never deletes) dirty/unpushed work. */
-function releaseWorktree(repoRoot, manifestPath) {
-	if (!existsSync(manifestPath)) return "removed";
-	const manifest = readManifest(manifestPath);
-	const absPath = join(repoRoot, manifest.path);
-	git(repoRoot, ["worktree", "prune"]);
-	if (!existsSync(absPath)) {
-		writeManifest(manifestPath, {
-			...manifest,
-			state: "removed"
-		});
-		return "removed";
-	}
-	const guarded = retentionState(absPath, manifest.baseSha);
-	if (guarded) {
-		writeManifest(manifestPath, {
-			...manifest,
-			state: guarded
-		});
-		return guarded;
-	}
-	git(repoRoot, [
-		"worktree",
-		"remove",
-		"--force",
-		absPath
-	]);
-	git(repoRoot, [
-		"branch",
-		"-D",
-		manifest.branch
-	]);
-	writeManifest(manifestPath, {
-		...manifest,
-		state: "removed"
-	});
-	return "removed";
-}
-/** Returns a retention reason when the worktree must be kept, else undefined. */
-function retentionState(absPath, baseSha) {
-	if (git(absPath, [
-		"status",
-		"--porcelain",
-		"--untracked-files=all"
-	]).length > 0) return "retained-dirty";
-	if (git(absPath, ["rev-parse", "HEAD"]) !== baseSha) return "retained-unpushed";
-}
+};
 /** Startup GC: release every pipeline-owned lease using the same safety guard. */
-function gcParallelWorktrees(repoRoot) {
+const gcParallelWorktrees = (repoRoot) => {
 	const registryAbs = join(repoRoot, REGISTRY_DIR);
 	if (!existsSync(registryAbs)) return [];
-	const results = readdirSync(registryAbs).sort().filter((file) => file.endsWith(".json")).map((file) => join(registryAbs, file)).filter((manifestPath) => readManifest(manifestPath).owner === OWNER).map((manifestPath) => releaseWorktree(repoRoot, manifestPath));
+	const results = readdirSync(registryAbs).toSorted().filter((file) => file.endsWith(".json")).map((file) => join(registryAbs, file)).filter((manifestPath) => readManifest(manifestPath).owner === OWNER).map((manifestPath) => releaseWorktree(repoRoot, manifestPath));
 	git(repoRoot, ["worktree", "prune"]);
 	return results;
-}
+};
 //#endregion
 export { createChildWorktree, gcParallelWorktrees };

package/dist/runtime/protected-paths/protected-paths.js

@@ -1,97 +1,96 @@
 import { globSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { Option } from "effect";
 //#region src/runtime/protected-paths/protected-paths.ts
 /**
 * Build the per-path `deny` overlay shared by the transports' permission maps.
 * Keeping the pattern → action shaping here makes the protected set a single
 * owner rather than two ad-hoc maps.
 */
-function protectedPermissionOverlay(patterns) {
-	return Object.fromEntries(patterns.map((pattern) => [pattern, "deny"]));
-}
-/**
-* Snapshot the files matching `patterns` inside `worktreePath` and return a
-* guard that can later revert any tampering. Configuring no patterns yields a
-* no-op guard (no globbing, no filesystem reads).
-*/
-function createProtectedPathGuard(worktreePath, patterns) {
-	const safePatterns = (patterns ?? []).filter((pattern) => pattern.trim().length > 0);
-	const snapshot = snapshotProtectedFiles(worktreePath, safePatterns);
-	return {
-		patterns: safePatterns,
-		verifyAndRestore: () => verifyAndRestoreSnapshot(snapshot)
-	};
-}
-function snapshotProtectedFiles(worktreePath, patterns) {
-	if (patterns.length === 0) return [];
-	const root = resolve(worktreePath);
-	const entries = /* @__PURE__ */ new Map();
-	for (const pattern of patterns) for (const match of globSync(pattern, { cwd: root })) {
-		const entry = snapshotEntry(root, match);
-		if (entry) entries.set(entry.absPath, entry);
-	}
-	return [...entries.values()];
-}
-function snapshotEntry(root, match) {
-	const absPath = resolve(root, match);
-	if (!isWithinRoot(root, absPath)) return;
-	const bytes = regularFileBytes(absPath);
-	if (!bytes) return;
-	return {
-		absPath,
-		bytes,
-		relPath: relative(root, absPath)
-	};
-}
-function verifyAndRestoreSnapshot(snapshot) {
-	const violations = [];
-	for (const entry of snapshot) {
-		const violation = verifyEntry(entry);
-		if (violation) violations.push(violation);
-	}
-	return violations;
-}
-function verifyEntry(entry) {
-	const current = regularFileBytes(entry.absPath);
-	if (!current) {
-		restoreEntry(entry);
-		return {
-			kind: "deleted",
-			path: entry.relPath
-		};
-	}
-	if (current.equals(entry.bytes)) return;
-	restoreEntry(entry);
-	return {
-		kind: "modified",
-		path: entry.relPath
-	};
-}
-function restoreEntry(entry) {
+const protectedPermissionOverlay = (patterns) => Object.fromEntries(patterns.map((pattern) => [pattern, "deny"]));
+const restoreEntry = (entry) => {
 	rmSync(entry.absPath, {
 		force: true,
 		recursive: true
 	});
 	mkdirSync(dirname(entry.absPath), { recursive: true });
 	writeFileSync(entry.absPath, entry.bytes);
-}
-function regularFileBytes(absPath) {
+};
+const regularFileBytes = (absPath) => {
 	let stats;
 	try {
 		stats = statSync(absPath);
 	} catch {
-		return;
+		return Option.none();
 	}
-	if (!stats.isFile()) return;
+	if (!stats.isFile()) return Option.none();
 	try {
-		return readFileSync(absPath);
+		return Option.some(readFileSync(absPath));
 	} catch {
-		return;
+		return Option.none();
+	}
+};
+const verifyEntry = (entry) => {
+	const current = regularFileBytes(entry.absPath);
+	if (Option.isNone(current)) {
+		restoreEntry(entry);
+		return Option.some({
+			kind: "deleted",
+			path: entry.relPath
+		});
 	}
-}
-function isWithinRoot(root, absPath) {
+	if (current.value.equals(entry.bytes)) return Option.none();
+	restoreEntry(entry);
+	return Option.some({
+		kind: "modified",
+		path: entry.relPath
+	});
+};
+const verifyAndRestoreSnapshot = (snapshot) => {
+	const violations = [];
+	for (const entry of snapshot) {
+		const violation = verifyEntry(entry);
+		if (Option.isSome(violation)) violations.push(violation.value);
+	}
+	return violations;
+};
+const isWithinRoot = (root, absPath) => {
 	const rel = relative(root, absPath);
 	return rel.length > 0 && !rel.startsWith("..") && !isAbsolute(rel);
-}
+};
+const snapshotEntry = (root, match) => {
+	const absPath = resolve(root, match);
+	if (!isWithinRoot(root, absPath)) return Option.none();
+	const bytes = regularFileBytes(absPath);
+	if (Option.isNone(bytes)) return Option.none();
+	return Option.some({
+		absPath,
+		bytes: bytes.value,
+		relPath: relative(root, absPath)
+	});
+};
+const snapshotProtectedFiles = (worktreePath, patterns) => {
+	if (patterns.length === 0) return [];
+	const root = resolve(worktreePath);
+	const entries = /* @__PURE__ */ new Map();
+	for (const pattern of patterns) for (const match of globSync(pattern, { cwd: root })) {
+		const entry = snapshotEntry(root, match);
+		if (Option.isSome(entry)) entries.set(entry.value.absPath, entry.value);
+	}
+	return [...entries.values()];
+};
+/**
+* Snapshot the files matching `patterns` inside `worktreePath` and return a
+* guard that can later revert any tampering. Configuring no patterns yields a
+* no-op guard (no globbing, no filesystem reads).
+*/
+const createProtectedPathGuard = (worktreePath, patterns) => {
+	const safePatterns = (patterns ?? []).filter((pattern) => pattern.trim().length > 0);
+	const snapshot = snapshotProtectedFiles(worktreePath, safePatterns);
+	return {
+		patterns: safePatterns,
+		verifyAndRestore: () => verifyAndRestoreSnapshot(snapshot)
+	};
+};
 //#endregion
 export { createProtectedPathGuard, protectedPermissionOverlay };