@orion-agents/orion-code 0.3.11 → 0.3.14

package/dist/web/git-read-model-service.js

@@ -262,6 +262,56 @@ class GitReadModelServiceV1 {
         this.pathById.set(id, path);
         return id;
     }
+    /** v0.3.12 S3 — guarded stage: paths are host-resolved file ids only. */
+    async stagePaths(paths) {
+        assertSafeGitPaths(paths);
+        if (paths.length === 0)
+            throw new Error('stage requires at least one path.');
+        await this.mutate(['add', '--', ...paths]);
+        return { repositoryRevision: await this.revisionAfterMutation() };
+    }
+    async unstagePaths(paths) {
+        assertSafeGitPaths(paths);
+        if (paths.length === 0)
+            throw new Error('unstage requires at least one path.');
+        await this.mutate(['reset', '-q', '--', ...paths]);
+        return { repositoryRevision: await this.revisionAfterMutation() };
+    }
+    async commit(message) {
+        const trimmed = message.trim();
+        if (!trimmed || trimmed.length > 2000 || /[\x00-\x1f]/.test(trimmed)) {
+            throw new Error('A valid commit message is required.');
+        }
+        const root = await this.requireRepositoryRoot();
+        const porcelain = (await this.runGit(['status', '--porcelain=v1'], root)).trim();
+        const stagedLines = porcelain
+            .split('\n')
+            .filter(line => line.length > 1 && line[0] !== ' ' && line[0] !== '?' && line[0] !== '!');
+        if (stagedLines.length === 0) {
+            throw new Error('Nothing is staged to commit.');
+        }
+        await this.mutate(['commit', '-m', trimmed]);
+        const sha = (await this.runGit(['rev-parse', 'HEAD'], root)).trim();
+        return { repositoryRevision: await this.revisionAfterMutation(), commitSha: sha };
+    }
+    async mutate(args) {
+        const root = await this.requireRepositoryRoot();
+        const output = await this.runGit(args, root);
+        if (output) {
+            // Warnings on stderr are not captured by runGit; treat non-empty as unexpected.
+        }
+    }
+    async requireRepositoryRoot() {
+        const snapshot = await this.capture();
+        if (!snapshot.isRepository || !snapshot.root) {
+            throw new Error('Git repository is unavailable.');
+        }
+        return snapshot.root;
+    }
+    async revisionAfterMutation() {
+        const root = await this.requireRepositoryRoot();
+        return this.runGit(['rev-parse', 'HEAD'], root).then(value => value.trim());
+    }
     runGit(args, cwd) {
         return new Promise((resolvePromise, reject) => {
             this.performance.processCount += 1;
@@ -590,6 +640,20 @@ function streamGitLines(input) {
         });
     });
 }
+function assertSafeGitPaths(paths) {
+    for (const path of paths) {
+        if (typeof path !== 'string' ||
+            path.length === 0 ||
+            path.length > 4096 ||
+            path.includes('\0') ||
+            path.startsWith('-') ||
+            path.includes('/../') ||
+            path === '..' ||
+            path.startsWith('../')) {
+            throw new Error(`Unsafe Git path rejected: ${JSON.stringify(path)}`);
+        }
+    }
+}
 function gitEnvironment() {
     return {
         PATH: process.env.PATH,

package/dist/web/host-daemon.d.ts

@@ -48,6 +48,15 @@ export declare function hostDaemonStatus(port: number): HostDaemonStatus;
  * stdio to `~/.orion-code/logs/web-<port>.log`, and wait for the pidfile so the
  * foreground command can print the URL and exit cleanly.
  */
+/**
+ * True when something already listens on 127.0.0.1:port — typically another
+ * Orion host process (e.g. one managed by launchd, which does not write a
+ * pidfile). Detecting this up front turns a raw EADDRINUSE crash into a
+ * friendly message.
+ */
+export declare function isHostPortTaken(port: number): Promise<boolean>;
+/** Best-effort tail of the host log used when a background child exits early. */
+export declare function readHostLogTail(port: number, lines?: number): string;
 export declare function spawnBackgroundHost(options: {
     readonly cwd: string;
     readonly port: number;

package/dist/web/host-daemon.js

@@ -9,6 +9,8 @@ exports.writeHostPidfile = writeHostPidfile;
 exports.clearHostPidfile = clearHostPidfile;
 exports.isProcessAlive = isProcessAlive;
 exports.hostDaemonStatus = hostDaemonStatus;
+exports.isHostPortTaken = isHostPortTaken;
+exports.readHostLogTail = readHostLogTail;
 exports.spawnBackgroundHost = spawnBackgroundHost;
 exports.stopBackgroundHost = stopBackgroundHost;
 /**
@@ -26,6 +28,7 @@ exports.stopBackgroundHost = stopBackgroundHost;
  *     "startedAt": 1725000000000, "workspace": "/abs/path" }
  */
 const child_process_1 = require("child_process");
+const net_1 = require("net");
 const fs_1 = require("fs");
 const path_1 = require("path");
 const paths_1 = require("../product/paths");
@@ -119,7 +122,48 @@ function childArgs(webArgs) {
  * stdio to `~/.orion-code/logs/web-<port>.log`, and wait for the pidfile so the
  * foreground command can print the URL and exit cleanly.
  */
-function spawnBackgroundHost(options) {
+/**
+ * True when something already listens on 127.0.0.1:port — typically another
+ * Orion host process (e.g. one managed by launchd, which does not write a
+ * pidfile). Detecting this up front turns a raw EADDRINUSE crash into a
+ * friendly message.
+ */
+function isHostPortTaken(port) {
+    return new Promise(resolve => {
+        const socket = (0, net_1.connect)({ host: '127.0.0.1', port });
+        let settled = false;
+        const done = (taken) => {
+            if (settled)
+                return;
+            settled = true;
+            socket.destroy();
+            resolve(taken);
+        };
+        socket.once('connect', () => done(true));
+        socket.once('error', () => done(false));
+        socket.setTimeout(800, () => done(false));
+    });
+}
+/** Best-effort tail of the host log used when a background child exits early. */
+function readHostLogTail(port, lines = 6) {
+    try {
+        const raw = (0, fs_1.readFileSync)((0, path_1.join)(hostLogsDirectory(), `web-${port}.log`), 'utf8');
+        return raw.split('\n').filter(Boolean).slice(-lines).join('\n');
+    }
+    catch {
+        return '';
+    }
+}
+async function assertHostPortAvailable(port) {
+    if (await isHostPortTaken(port)) {
+        throw new Error(`Port ${port} is already served by another Orion host process. This is ` +
+            `often a launchd LaunchAgent (ai.orion-code.web). Check with ` +
+            '`launchctl list | grep orion`; if the running host belongs to this ' +
+            `CLI, use \`orion web status --port ${port}\` to confirm before stopping it.`);
+    }
+}
+async function spawnBackgroundHost(options) {
+    await assertHostPortAvailable(options.port);
     const logsDirectory = hostLogsDirectory();
     (0, fs_1.mkdirSync)(logsDirectory, { recursive: true });
     const logPath = (0, path_1.join)(logsDirectory, `web-${options.port}.log`);

package/dist/web/protocol.d.ts

@@ -9,7 +9,7 @@ import type { SessionMeta } from '../services/session-storage';
 import type { ToolConfirmationPolicy } from '../services/global-config';
 import type { WebFileContentPageV1, WebFileNodeV1, WebFileTreePageV1 } from './file-read-service';
 import type { WebGitCommitV1, WebGitDiffPageV1, WebGitFileV1, WebGitLogPageV1, WebGitStatusV1 } from './git-read-model-service';
-import type { WebReviewSnapshotV1, WebReviewVerificationV1 } from './review-service';
+import type { WebReviewSnapshotV1 } from './review-service';
 import type { WebSessionRuntimeSummaryV1 } from './session-runtime-registry';
 import type { WebTerminalCreateResultV1, WebTerminalExitV1, WebTerminalGapV1, WebTerminalMetadataV1, WebTerminalOutputFrameV1, WebTerminalStateV1 } from './terminal-manager';
 export declare const WEB_API_VERSION: 1;
@@ -171,6 +171,13 @@ export type WebContextReferenceV1 = {
     readonly id: string;
     readonly label: string;
     readonly revision: string;
+} | {
+    readonly kind: 'file_range';
+    readonly id: string;
+    readonly label: string;
+    readonly revision: string;
+    readonly startLine: number;
+    readonly endLine: number;
 } | {
     readonly kind: 'folder';
     readonly id: string;
@@ -369,7 +376,7 @@ export type WebWorkspaceResourceV1 = 'files' | 'git' | 'review';
 export type WebWorkspaceInvalidationReasonV1 = 'context-change' | 'filesystem-change' | 'terminal-command' | 'tool-finished';
 export type WebToolDetailSummaryV1 = ToolDetailSummary;
 export type WebToolDetailPageV1 = ToolDetailPage;
-export type { WebFileContentPageV1, WebFileNodeV1, WebFileTreePageV1, WebGitCommitV1, WebGitDiffPageV1, WebGitFileV1, WebGitLogPageV1, WebGitStatusV1, WebReviewSnapshotV1, WebReviewVerificationV1, WebTerminalCreateResultV1, WebTerminalExitV1, WebTerminalGapV1, WebTerminalMetadataV1, WebTerminalOutputFrameV1, WebTerminalStateV1, };
+export type { WebFileContentPageV1, WebFileNodeV1, WebFileTreePageV1, WebGitCommitV1, WebGitDiffPageV1, WebGitFileV1, WebGitLogPageV1, WebGitStatusV1, WebReviewSnapshotV1, WebTerminalCreateResultV1, WebTerminalExitV1, WebTerminalGapV1, WebTerminalMetadataV1, WebTerminalOutputFrameV1, WebTerminalStateV1, };
 export interface WebBootstrapV1 {
     readonly apiVersion: 1;
     readonly productVersion: string;

package/dist/web/protocol.js

@@ -523,6 +523,7 @@ function parseContextReferences(value) {
         const row = requireRecord(entry, `contextReferences[${index}]`);
         const kind = requireEnum(row.kind, `contextReferences[${index}].kind`, [
             'file',
+            'file_range',
             'folder',
             'review',
             'session',
@@ -534,6 +535,22 @@ function parseContextReferences(value) {
         }
         seen.add(`${kind}:${id}`);
         const label = requireBoundedString(row.label, `contextReferences[${index}].label`, 200);
+        if (kind === 'file_range') {
+            assertOnlyKeys(row, ['kind', 'id', 'label', 'revision', 'startLine', 'endLine'], 'Context reference');
+            const startLine = requireLineNumber(row.startLine, `contextReferences[${index}].startLine`);
+            const endLine = requireLineNumber(row.endLine, `contextReferences[${index}].endLine`);
+            if (endLine < startLine) {
+                throw new WebProtocolError('file_range endLine must not precede startLine');
+            }
+            return Object.freeze({
+                kind,
+                id,
+                label,
+                revision: requireBoundedString(row.revision, `contextReferences[${index}].revision`, 256),
+                startLine,
+                endLine,
+            });
+        }
         if (kind === 'file' || kind === 'folder') {
             assertOnlyKeys(row, ['kind', 'id', 'label', 'revision'], 'Context reference');
             return Object.freeze({
@@ -573,6 +590,15 @@ function assertOnlyKeys(row, keys, subject = 'command') {
     if (unknown)
         throw new WebProtocolError(`Unknown ${subject} field: ${unknown}`);
 }
+function requireLineNumber(value, name) {
+    if (typeof value !== 'number' ||
+        !Number.isSafeInteger(value) ||
+        value < 1 ||
+        value > 100000000) {
+        throw new WebProtocolError(`${name} must be an integer line number from 1 through 100000000`);
+    }
+    return value;
+}
 function requireBoundedString(value, name, maxLength) {
     if (typeof value !== 'string' || !value.trim()) {
         throw new WebProtocolError(`${name} must be a non-empty string`);

package/dist/web/review-service.d.ts

@@ -1,19 +1,4 @@
-import type { VerifiedDurableToolReceiptRefV1 } from '../runtime/durable-tool-receipt-reader';
 import type { GitReadModelServiceV1, WebGitDiffPageV1, WebGitFileV1 } from './git-read-model-service';
-export interface WebReviewVerificationV1 {
-    readonly callId: string;
-    readonly sessionId: string;
-    readonly threadId: string;
-    readonly sequence: number;
-    readonly toolName: string;
-    readonly state: 'success' | 'error' | 'skipped';
-    readonly terminal: VerifiedDurableToolReceiptRefV1['terminal'];
-    readonly success: boolean;
-    readonly outputBytes: number;
-    readonly hasArtifact: boolean;
-    readonly executionPolicyDigest: string;
-    readonly receiptDigest: string;
-}
 export interface WebReviewSnapshotV1 {
     readonly revision: string;
     readonly repositoryRevision: string;
@@ -26,13 +11,11 @@ export interface WebReviewSnapshotV1 {
     readonly untrackedCount: number;
     readonly conflictCount: number;
     readonly truncated: boolean;
-    readonly verification: readonly WebReviewVerificationV1[];
 }
-/** Review overview composed only from Git facts and doubly verified durable tool receipts. */
+/** Review overview composed only from Git facts. */
 export declare class ReviewServiceV1 {
     private readonly git;
-    private readonly listReceiptRefs;
-    constructor(git: GitReadModelServiceV1, listReceiptRefs: () => Promise<readonly VerifiedDurableToolReceiptRefV1[]> | readonly VerifiedDurableToolReceiptRefV1[]);
+    constructor(git: GitReadModelServiceV1);
     snapshot(): Promise<WebReviewSnapshotV1>;
     diff(input: Parameters<GitReadModelServiceV1['diff']>[0]): Promise<WebGitDiffPageV1>;
 }

package/dist/web/review-service.js

@@ -2,21 +2,17 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ReviewServiceV1 = void 0;
 const crypto_1 = require("crypto");
-/** Review overview composed only from Git facts and doubly verified durable tool receipts. */
+/** Review overview composed only from Git facts. */
 class ReviewServiceV1 {
-    constructor(git, listReceiptRefs) {
+    constructor(git) {
         this.git = git;
-        this.listReceiptRefs = listReceiptRefs;
     }
     async snapshot() {
         // v0.3.9 #237/#228 — collect every Git status page. A repository with more
         // than the single pageSize of changed files was silently truncated before;
         // the review overview must aggregate all pages (bounded by a guard that
         // keeps runaway repositories from looping forever).
-        const [receiptRefs, statusPages] = await Promise.all([
-            this.listReceiptRefs(),
-            collectStatusPages((cursor) => this.git.status({ pageSize: 2000, ...(cursor ? { cursor } : {}) })),
-        ]);
+        const statusPages = await collectStatusPages((cursor) => this.git.status({ pageSize: 2000, ...(cursor ? { cursor } : {}) }));
         const status = statusPages.at(-1) ?? (await this.git.status({ pageSize: 2000 }));
         const conflicted = [];
         const staged = [];
@@ -29,25 +25,8 @@ class ReviewServiceV1 {
             untracked.push(...page.untracked);
         }
         const changedFiles = uniqueFiles([...conflicted, ...staged, ...unstaged, ...untracked]);
-        const verification = receiptRefs.slice(0, 100).map(receipt => Object.freeze({
-            callId: receipt.callId,
-            sessionId: receipt.sessionId,
-            threadId: receipt.threadId,
-            sequence: receipt.sequence,
-            toolName: receipt.toolName,
-            state: reviewState(receipt),
-            terminal: receipt.terminal,
-            success: receipt.success,
-            outputBytes: receipt.outputBytes,
-            hasArtifact: receipt.hasArtifact,
-            executionPolicyDigest: receipt.executionPolicyDigest,
-            receiptDigest: receipt.receiptDigest,
-        }));
         const revision = (0, crypto_1.createHash)('sha256')
-            .update(JSON.stringify({
-            repositoryRevision: status.repositoryRevision,
-            verification,
-        }))
+            .update(JSON.stringify({ repositoryRevision: status.repositoryRevision }))
             .digest('hex');
         return Object.freeze({
             revision,
@@ -61,7 +40,6 @@ class ReviewServiceV1 {
             untrackedCount: untracked.length,
             conflictCount: conflicted.length,
             truncated: statusPages.at(-1)?.truncated ?? false,
-            verification: Object.freeze(verification),
         });
     }
     diff(input) {
@@ -69,25 +47,12 @@ class ReviewServiceV1 {
     }
 }
 exports.ReviewServiceV1 = ReviewServiceV1;
-function reviewState(receipt) {
-    if (receipt.success)
-        return 'success';
-    return receipt.terminal === 'interrupted' || receipt.terminal === 'indeterminate'
-        ? 'skipped'
-        : 'error';
-}
 function uniqueFiles(files) {
     const byId = new Map();
     for (const file of files)
         byId.set(file.fileId, file);
     return [...byId.values()].sort((left, right) => left.path.localeCompare(right.path));
 }
-/**
- * v0.3.9 #237/#228 — page through Git status until the snapshot is fully
- * collected. The bounded guard (64 pages x 2_000 = 128k files) exists to stop
- * runaway repositories from looping; a repository exceeding it stays marked
- * truncated so the UI can still communicate the limit.
- */
 async function collectStatusPages(fetchPage) {
     const pages = [];
     let page = await fetchPage(undefined);

package/dist/web/server.js

@@ -387,6 +387,15 @@ async function handleRequest(context) {
         sendJson(response, 200, collectionPage(url, 'mcp', context.workbench.mcp(contextGuard), server => server.id));
         return;
     }
+    if (method === 'GET' && path === '/files/search') {
+        const contextGuard = requireContextGuardQuery(url);
+        const query = url.searchParams.get('q') ?? '';
+        const scopeValue = url.searchParams.get('scope');
+        const scope = scopeValue === 'content' ? 'content' : 'name';
+        const limit = boundedInteger(url.searchParams.get('limit'), 50, 1, 200);
+        sendJson(response, 200, context.workbench.searchFiles(contextGuard, { query, scope, limit }));
+        return;
+    }
     if (method === 'GET' && path === '/files') {
         const contextGuard = requireContextGuardQuery(url);
         sendJson(response, 200, context.workbench.listFiles(contextGuard, {
@@ -422,6 +431,73 @@ async function handleRequest(context) {
         }));
         return;
     }
+    const fileWriteMatch = path === '/files/write';
+    if (method === 'POST' && fileWriteMatch) {
+        assertMutation(request, context.nonce, context.origin, 'file_mutation_forbidden');
+        assertFileUserGesture(request);
+        const body = requireRecord(await readJson(request), 'File write request');
+        assertOnlyKeys(body, [
+            'requestId',
+            'fileId',
+            'content',
+            'expectedRevision',
+            'workspaceId',
+            'expectedContextRevision',
+        ]);
+        const requestId = requireUuid(body.requestId, 'requestId');
+        const contextGuard = requireContextGuardRecord(body);
+        const fileId = requireText(body.fileId, 'fileId', 256);
+        const content = requireText(body.content, 'content', 512 * 1024 + 8);
+        const expectedRevision = requireFileRevision(body.expectedRevision);
+        const result = await context.workbench.executeMutation(requestId, 'file.write', { fileId, expectedRevision, ...contextGuard }, () => context.workbench.writeFileContent(contextGuard, {
+            fileId,
+            content,
+            expectedRevision,
+        }));
+        sendJson(response, 200, result);
+        return;
+    }
+    if (method === 'POST' && (path === '/git/stage' || path === '/git/unstage')) {
+        assertMutation(request, context.nonce, context.origin, 'git_mutation_forbidden');
+        assertGitUserGesture(request);
+        const body = requireRecord(await readJson(request), 'Git stage request');
+        assertOnlyKeys(body, [
+            'requestId',
+            'expectedContextRevision',
+            'workspaceId',
+            'fileIds',
+            'expectedRepositoryRevision',
+        ]);
+        const requestId = requireUuid(body.requestId, 'requestId');
+        const contextGuard = requireContextGuardRecord(body);
+        const fileIds = requireStringArray(body.fileIds, 'fileIds', 200, 256);
+        const expectedRepositoryRevision = requireGitRevision(body.expectedRepositoryRevision);
+        const action = path === '/git/stage' ? 'stage' : 'unstage';
+        const result = await context.workbench.executeMutation(requestId, 'git.mutation', { action, fileIds, expectedRepositoryRevision, ...contextGuard }, async () => action === 'stage'
+            ? context.workbench.gitStage(contextGuard, { fileIds, expectedRepositoryRevision })
+            : context.workbench.gitUnstage(contextGuard, { fileIds, expectedRepositoryRevision }));
+        sendJson(response, 200, result);
+        return;
+    }
+    if (method === 'POST' && path === '/git/commit') {
+        assertMutation(request, context.nonce, context.origin, 'git_mutation_forbidden');
+        assertGitUserGesture(request);
+        const body = requireRecord(await readJson(request), 'Git commit request');
+        assertOnlyKeys(body, [
+            'requestId',
+            'expectedContextRevision',
+            'workspaceId',
+            'message',
+            'expectedRepositoryRevision',
+        ]);
+        const requestId = requireUuid(body.requestId, 'requestId');
+        const contextGuard = requireContextGuardRecord(body);
+        const message = requireText(body.message, 'message', 2000);
+        const expectedRepositoryRevision = requireGitRevision(body.expectedRepositoryRevision);
+        const result = await context.workbench.executeMutation(requestId, 'git.commit', { message, expectedRepositoryRevision, ...contextGuard }, async () => context.workbench.gitCommit(contextGuard, { message, expectedRepositoryRevision }));
+        sendJson(response, 200, result);
+        return;
+    }
     if (method === 'GET' && path === '/git/log') {
         const contextGuard = requireContextGuardQuery(url);
         sendJson(response, 200, await context.workbench.gitLog(contextGuard, {
@@ -569,6 +645,41 @@ function assertMutation(request, nonce, origin, forbiddenCode = 'request_forbidd
         throw new HttpProblem(415, 'Mutations require application/json.');
     }
 }
+function requireStringArray(value, name, maxLength, maxItemBytes) {
+    if (!Array.isArray(value) || value.length === 0 || value.length > maxLength) {
+        throw new HttpProblem(400, `${name} must list 1 through ${maxLength} items.`);
+    }
+    return value.map(item => {
+        if (typeof item !== 'string' || item.length === 0 || item.length > maxItemBytes) {
+            throw new HttpProblem(400, `${name} contains an invalid item.`);
+        }
+        return item;
+    });
+}
+function requireGitRevision(value) {
+    const text = requireText(value, 'expectedRepositoryRevision', 64);
+    if (!/^[0-9a-f]{40,64}$/u.test(text)) {
+        throw new HttpProblem(400, 'expectedRepositoryRevision must be a git revision.');
+    }
+    return text;
+}
+function assertFileUserGesture(request) {
+    if (request.headers[protocol_1.WEB_USER_GESTURE_HEADER] !== 'file-mutation-v1') {
+        throw new HttpProblem(403, 'File mutations require an explicit browser user gesture.', 'file_user_gesture_required');
+    }
+}
+function requireFileRevision(value) {
+    const text = requireText(value, 'expectedRevision', 64);
+    if (!/^[0-9a-f]{64}$/u.test(text)) {
+        throw new HttpProblem(400, 'expectedRevision must be a file content revision.');
+    }
+    return text;
+}
+function assertGitUserGesture(request) {
+    if (request.headers[protocol_1.WEB_USER_GESTURE_HEADER] !== 'git-mutation-v1') {
+        throw new HttpProblem(403, 'Git mutations require an explicit browser user gesture.', 'git_user_gesture_required');
+    }
+}
 function assertTerminalUserGesture(request) {
     if (request.headers[protocol_1.WEB_USER_GESTURE_HEADER] !== 'terminal-create-v1') {
         throw new HttpProblem(403, 'Terminal creation requires an explicit browser user gesture.', 'terminal_user_gesture_required');

package/dist/web/workbench-controller.d.ts

@@ -43,6 +43,7 @@ export declare class WebWorkbenchController {
     private readonly workspaceMutationOwners;
     private readonly pendingWorkspaceMutationStates;
     private fileService;
+    private fileWriteService;
     private gitService;
     private reviewService;
     private contextRevisionValue;
@@ -100,7 +101,53 @@ export declare class WebWorkbenchController {
     readToolDetail(callId: string, offsetBytes: number, limitBytes: number, context?: WebContextGuardV1): Promise<WebToolDetailPageV1>;
     listFiles(context: WebContextGuardV1, input: Parameters<FileReadServiceV1['list']>[0]): import("./file-read-service").WebFileTreePageV1;
     readFileContent(context: WebContextGuardV1, input: Parameters<FileReadServiceV1['readContent']>[0]): import("./file-read-service").WebFileContentPageV1;
+    /** v0.3.14 — guarded CAS write for an existing in-root text file. */
+    writeFileContent(context: WebContextGuardV1, input: {
+        readonly fileId: string;
+        readonly content: string;
+        readonly expectedRevision: string;
+    }): {
+        readonly fileId: string;
+        readonly revision: string;
+        readonly sizeBytes: number;
+    };
     gitStatus(context: WebContextGuardV1, input: Parameters<GitReadModelServiceV1['status']>[0]): Promise<import("./git-read-model-service").WebGitStatusV1>;
+    searchFiles(context: WebContextGuardV1, input: {
+        readonly query: string;
+        readonly scope: 'name' | 'content';
+        readonly limit?: number;
+    }): Readonly<{
+        revision: string;
+        items: readonly Readonly<{
+            id: string;
+            name: string;
+            path: string;
+        }>[];
+        truncated: boolean;
+    }>;
+    /** v0.3.12 S3 — guarded stage/unstage/commit with repository revision CAS. */
+    gitStage(context: WebContextGuardV1, input: {
+        readonly fileIds: readonly string[];
+        readonly expectedRepositoryRevision: string;
+    }): Promise<{
+        readonly repositoryRevision: string;
+    }>;
+    gitUnstage(context: WebContextGuardV1, input: {
+        readonly fileIds: readonly string[];
+        readonly expectedRepositoryRevision: string;
+    }): Promise<{
+        readonly repositoryRevision: string;
+    }>;
+    gitCommit(context: WebContextGuardV1, input: {
+        readonly message: string;
+        readonly expectedRepositoryRevision: string;
+    }): Promise<{
+        readonly repositoryRevision: string;
+        readonly commitSha: string;
+    }>;
+    private resolveSafeGitPaths;
+    private assertGitRepositoryRevision;
+    private fileContextRevision;
     gitLog(context: WebContextGuardV1, input: Parameters<GitReadModelServiceV1['log']>[0]): Promise<import("./git-read-model-service").WebGitLogPageV1>;
     gitDiff(context: WebContextGuardV1, input: Parameters<GitReadModelServiceV1['diff']>[0]): Promise<import("./git-read-model-service").WebGitDiffPageV1>;
     review(context: WebContextGuardV1): Promise<import("./review-service").WebReviewSnapshotV1>;