@oscharko-dev/keiko 0.1.6 → 0.1.7

package/node_modules/@oscharko-dev/keiko-workspace/dist/discovery.js

@@ -0,0 +1,167 @@
+// Recursive, bounded, deterministic file discovery and a single boundary-checked read path.
+// Security invariants (ADR-0005 D2/D3):
+//   - every directory descent and every read goes through resolveWithinWorkspace first;
+//   - always-on DENY patterns are applied before the optional .gitignore subset;
+//   - a symlink whose realpath escapes the root is skipped (never followed);
+//   - recursion is capped by maxDepth and total results by maxFiles.
+import { relative } from "node:path";
+import { nodeWorkspaceFs, } from "./fs.js";
+import { compileIgnore, isDenied, isIgnored } from "./ignore.js";
+import { resolveWithinWorkspace } from "./paths.js";
+import { assertContainedRealPath } from "./realpath.js";
+import { FileTooLargeError, PathDeniedError, WorkspaceReadError } from "./errors.js";
+import { redact } from "@oscharko-dev/keiko-security";
+import { DEFAULT_READ_OPTIONS, } from "./types.js";
+function toRelative(root, absolutePath) {
+    return relative(root, absolutePath).split("\\").join("/");
+}
+function toRealRelative(fs, root, absolutePath) {
+    try {
+        return toRelative(fs.realPath(root), absolutePath);
+    }
+    catch {
+        return toRelative(root, absolutePath);
+    }
+}
+// Returns false when the entry must be skipped for any security or noise reason, recording
+// which tier rejected it for the discovery stats.
+function isAllowed(walk, relPath, isDir) {
+    if (isDenied(relPath)) {
+        walk.denied += 1;
+        return false;
+    }
+    if (walk.applyGitignore && isIgnored(walk.matcher, relPath, isDir)) {
+        walk.ignored += 1;
+        return false;
+    }
+    return true;
+}
+function childRelative(root, absoluteDir, name) {
+    const dirRel = toRelative(root, absoluteDir);
+    return dirRel === "" ? name : `${dirRel}/${name}`;
+}
+function readDirSafe(walk, absoluteDir) {
+    try {
+        return walk.fs.readDir(absoluteDir);
+    }
+    catch {
+        return [];
+    }
+}
+function statSize(walk, absolutePath) {
+    try {
+        return walk.fs.stat(absolutePath).size;
+    }
+    catch {
+        return 0;
+    }
+}
+function handleEntry(walk, absoluteDir, entry, depth) {
+    const childAbs = resolveWithinWorkspace(walk.root, childRelative(walk.root, absoluteDir, entry.name));
+    const relPath = toRelative(walk.root, childAbs);
+    if (!isAllowed(walk, relPath, entry.isDirectory)) {
+        return;
+    }
+    // Symlinks are skipped unconditionally (for safety/simplicity). A non-symlink entry that
+    // reports neither isFile nor isDirectory is likewise treated as non-traversable noise.
+    // Only genuine files and directories are walked.
+    if (entry.isSymbolicLink) {
+        return;
+    }
+    if (entry.isDirectory) {
+        descend(walk, childAbs, depth + 1);
+        return;
+    }
+    if (entry.isFile) {
+        walk.out.push({ relativePath: relPath, sizeBytes: statSize(walk, childAbs) });
+    }
+}
+function descend(walk, absoluteDir, depth) {
+    if (depth > walk.opts.maxDepth || walk.out.length >= walk.opts.maxFiles) {
+        return;
+    }
+    const entries = [...readDirSafe(walk, absoluteDir)].sort((a, b) => (a.name < b.name ? -1 : 1));
+    for (const entry of entries) {
+        if (walk.out.length >= walk.opts.maxFiles) {
+            return;
+        }
+        handleEntry(walk, absoluteDir, entry, depth);
+    }
+}
+function runWalk(workspace, opts, fs) {
+    const walk = {
+        fs,
+        root: workspace.root,
+        matcher: compileIgnore(workspace.ignoreLines),
+        opts,
+        applyGitignore: opts.applyGitignore,
+        out: [],
+        denied: 0,
+        ignored: 0,
+    };
+    descend(walk, resolveWithinWorkspace(workspace.root, "."), 0);
+    return walk;
+}
+export function discoverFiles(workspace, opts, fs = nodeWorkspaceFs) {
+    return runWalk(workspace, opts, fs).out;
+}
+export function discoverWithStats(workspace, opts, fs = nodeWorkspaceFs) {
+    const walk = runWalk(workspace, opts, fs);
+    return {
+        files: walk.out,
+        stats: { discovered: walk.out.length, denied: walk.denied, ignored: walk.ignored },
+    };
+}
+function describe(error) {
+    return error instanceof Error ? error.message : "unknown error";
+}
+function statFile(fs, absolutePath, relPath) {
+    try {
+        return fs.stat(absolutePath);
+    }
+    catch (error) {
+        throw new WorkspaceReadError(`cannot stat file: ${relPath} (${describe(error)})`, relPath);
+    }
+}
+function assertNoHardLinkAlias(stats, relPath) {
+    if (stats.hardLinkCount !== undefined && stats.hardLinkCount > 1) {
+        throw new PathDeniedError(`refusing to read a hard-linked workspace alias: ${relPath}`, relPath);
+    }
+}
+function readContent(fs, absolutePath, relPath, opts) {
+    let raw;
+    try {
+        raw = fs.readFileUtf8(absolutePath);
+    }
+    catch (error) {
+        throw new WorkspaceReadError(`cannot read file: ${relPath} (${describe(error)})`, relPath);
+    }
+    const rawBytes = Buffer.byteLength(raw, "utf8");
+    const truncated = rawBytes > opts.maxBytes;
+    const text = truncated
+        ? Buffer.from(raw, "utf8").subarray(0, opts.maxBytes).toString("utf8")
+        : raw;
+    return { relativePath: relPath, sizeBytes: rawBytes, text: redact(text), truncated };
+}
+// The single read path. Order: boundary -> deny -> realpath containment -> size cap -> read -> redact.
+// Realpath containment is shared with the write/cwd paths via assertContainedRealPath: when the
+// path does not exist, it validates the nearest existing parent and returns absolutePath, so a
+// missing in-root file still surfaces as a WorkspaceReadError (not a false PathEscapeError).
+export function readWorkspaceFile(workspace, relPath, opts = DEFAULT_READ_OPTIONS, fs = nodeWorkspaceFs) {
+    const absolutePath = resolveWithinWorkspace(workspace.root, relPath);
+    const normalizedRel = toRelative(workspace.root, absolutePath);
+    if (isDenied(normalizedRel)) {
+        throw new PathDeniedError(`refusing to read a denied path: ${normalizedRel}`, normalizedRel);
+    }
+    const resolvedPath = assertContainedRealPath(fs, workspace.root, absolutePath, normalizedRel);
+    const resolvedRel = toRealRelative(fs, workspace.root, resolvedPath);
+    if (isDenied(resolvedRel)) {
+        throw new PathDeniedError(`refusing to read a denied path: ${normalizedRel}`, normalizedRel);
+    }
+    const stats = statFile(fs, resolvedPath, normalizedRel);
+    assertNoHardLinkAlias(stats, normalizedRel);
+    if (stats.size > opts.maxBytes) {
+        throw new FileTooLargeError(`file exceeds the read cap: ${normalizedRel}`, normalizedRel, stats.size, opts.maxBytes);
+    }
+    return readContent(fs, resolvedPath, normalizedRel, opts);
+}

package/node_modules/@oscharko-dev/keiko-workspace/dist/errors.d.ts

@@ -0,0 +1,3 @@
+export { WORKSPACE_CODES, WorkspaceError, PathEscapeError, PathDeniedError, WorkspaceNotFoundError, FileTooLargeError, WorkspaceReadError, } from "@oscharko-dev/keiko-security/errors/workspace";
+export type { WorkspaceCode } from "@oscharko-dev/keiko-security/errors/workspace";
+//# sourceMappingURL=errors.d.ts.map

package/node_modules/@oscharko-dev/keiko-workspace/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,+CAA+C,CAAC;AACvD,YAAY,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAC"}

package/node_modules/@oscharko-dev/keiko-workspace/dist/errors.js

@@ -0,0 +1,4 @@
+// Re-export shim: the workspace error taxonomy now lives in @oscharko-dev/keiko-security
+// (issue #159, ADR-0019). All existing import sites (`from "./errors.js"`) keep resolving
+// unchanged via this barrel.
+export { WORKSPACE_CODES, WorkspaceError, PathEscapeError, PathDeniedError, WorkspaceNotFoundError, FileTooLargeError, WorkspaceReadError, } from "@oscharko-dev/keiko-security/errors/workspace";

package/node_modules/@oscharko-dev/keiko-workspace/dist/fs.d.ts

@@ -0,0 +1,22 @@
+export interface WorkspaceStat {
+    readonly size: number;
+    readonly isFile: boolean;
+    readonly isDirectory: boolean;
+    readonly isSymbolicLink: boolean;
+    readonly hardLinkCount?: number | undefined;
+}
+export interface WorkspaceDirEntry {
+    readonly name: string;
+    readonly isDirectory: boolean;
+    readonly isFile: boolean;
+    readonly isSymbolicLink: boolean;
+}
+export interface WorkspaceFs {
+    readonly readFileUtf8: (absolutePath: string) => string;
+    readonly stat: (absolutePath: string) => WorkspaceStat;
+    readonly readDir: (absolutePath: string) => readonly WorkspaceDirEntry[];
+    readonly realPath: (absolutePath: string) => string;
+    readonly exists: (absolutePath: string) => boolean;
+}
+export declare const nodeWorkspaceFs: WorkspaceFs;
+//# sourceMappingURL=fs.d.ts.map

package/node_modules/@oscharko-dev/keiko-workspace/dist/fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../src/fs.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;IACxD,QAAQ,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,aAAa,CAAC;IACvD,QAAQ,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,iBAAiB,EAAE,CAAC;IACzE,QAAQ,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;IACpD,QAAQ,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;CACpD;AAMD,eAAO,MAAM,eAAe,EAAE,WA2B7B,CAAC"}

package/node_modules/@oscharko-dev/keiko-workspace/dist/fs.js

@@ -0,0 +1,36 @@
+// The single filesystem boundary for the workspace layer (ADR-0005 D1). Every other module
+// depends on the `WorkspaceFs` port, never on `node:fs` directly, so discovery/detection are
+// testable with an in-memory fake and all real IO is auditable in one place. Synchronous, to
+// mirror the existing `loadConfigFromFile`/`readFileSync` usage in the gateway.
+import { lstatSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
+function isSymlink(absolutePath) {
+    return lstatSync(absolutePath, { throwIfNoEntry: false })?.isSymbolicLink() ?? false;
+}
+export const nodeWorkspaceFs = {
+    readFileUtf8: (absolutePath) => readFileSync(absolutePath, "utf8"),
+    stat: (absolutePath) => {
+        const stats = statSync(absolutePath, { throwIfNoEntry: true });
+        return {
+            size: stats.size,
+            isFile: stats.isFile(),
+            isDirectory: stats.isDirectory(),
+            isSymbolicLink: isSymlink(absolutePath),
+            hardLinkCount: stats.nlink,
+        };
+    },
+    readDir: (absolutePath) => readdirSync(absolutePath, { withFileTypes: true }).map((entry) => ({
+        name: entry.name,
+        isDirectory: entry.isDirectory(),
+        isFile: entry.isFile(),
+        isSymbolicLink: entry.isSymbolicLink(),
+    })),
+    realPath: (absolutePath) => realpathSync(absolutePath),
+    exists: (absolutePath) => {
+        try {
+            return statSync(absolutePath, { throwIfNoEntry: false }) !== undefined;
+        }
+        catch {
+            return false;
+        }
+    },
+};

package/node_modules/@oscharko-dev/keiko-workspace/dist/ignore.d.ts

@@ -0,0 +1,15 @@
+export declare const DEFAULT_DENY_PATTERNS: readonly string[];
+export declare function isDenied(relPath: string): boolean;
+interface IgnoreRule {
+    readonly regex: RegExp;
+    readonly dirEntryRegex: RegExp | null;
+    readonly negated: boolean;
+    readonly dirOnly: boolean;
+}
+export interface IgnoreMatcher {
+    readonly rules: readonly IgnoreRule[];
+}
+export declare function compileIgnore(lines: readonly string[]): IgnoreMatcher;
+export declare function isIgnored(matcher: IgnoreMatcher, relPath: string, isDir: boolean): boolean;
+export {};
+//# sourceMappingURL=ignore.d.ts.map

package/node_modules/@oscharko-dev/keiko-workspace/dist/ignore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ignore.d.ts","sourceRoot":"","sources":["../src/ignore.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EA8BjD,CAAC;AA4BH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAajD;AAMD,UAAU,UAAU;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAGvB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;CACvC;AAkFD,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,aAAa,CASrE;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAS1F"}

package/node_modules/@oscharko-dev/keiko-workspace/dist/ignore.js

@@ -0,0 +1,176 @@
+// PURE filtering. Two tiers (ADR-0005 D3):
+//   1. isDenied()  — ALWAYS-ON security deny list. Enforced before every read regardless
+//      of .gitignore. Secret/dep/build/cache/vcs/log/os files are never discovered or read.
+//   2. compileIgnore()/isIgnored() — best-effort noise reduction over a DOCUMENTED, bounded
+//      .gitignore subset. Never relaxes the deny list.
+// Glob translation produces only linear regex pieces (`[^/]*`, `.*`) so there is no
+// catastrophic backtracking (no ReDoS).
+export const DEFAULT_DENY_PATTERNS = Object.freeze([
+    // secrets
+    ".env",
+    ".env.*",
+    "*.pem",
+    "*.key",
+    "id_rsa",
+    "id_ed25519",
+    "id_ecdsa",
+    "id_dsa",
+    "*.p12",
+    "*.pfx",
+    ".npmrc",
+    // deps
+    "node_modules",
+    // build
+    "dist",
+    "build",
+    "out",
+    "coverage",
+    // caches
+    ".cache",
+    ".next",
+    ".turbo",
+    // vcs
+    ".git",
+    // logs
+    "*.log",
+    // os
+    ".DS_Store",
+]);
+// Iterates from the end rather than using /\/+$/ to avoid quadratic ReDoS on
+// inputs with many consecutive trailing slashes (CodeQL js/polynomial-redos).
+function stripTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value.charCodeAt(end - 1) === 47 /* "/" */) {
+        end -= 1;
+    }
+    return value.slice(0, end);
+}
+function normalize(relPath) {
+    return stripTrailingSlashes(relPath.replace(/\\/g, "/").replace(/^\.\//, ""));
+}
+function segments(relPath) {
+    return normalize(relPath)
+        .split("/")
+        .filter((part) => part.length > 0);
+}
+const EXAMPLE_ENV = ".env.example";
+// Always-on security check. Denied if ANY path segment matches a deny pattern (a denied
+// directory denies everything under it). `.env.example` is the single documented exception.
+// Matching is CASE-INSENSITIVE: on case-insensitive filesystems (macOS, Windows) `.ENV` and
+// `.env` name the same file, so a case-only variant must not bypass the deny list.
+export function isDenied(relPath) {
+    for (const part of segments(relPath)) {
+        const lower = part.toLowerCase();
+        if (lower === EXAMPLE_ENV) {
+            continue;
+        }
+        for (const matcher of PRECOMPILED_DENY_MATCHERS) {
+            if (matcher.regex.test(lower)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+function globBody(glob) {
+    let body = "";
+    let i = 0;
+    while (i < glob.length) {
+        // charAt returns "" past the end; the loop bound guarantees a real char here, so there is
+        // no dead nullish fallback. charAt(i + 1)/(i + 2) safely return "" at the boundary.
+        const char = glob.charAt(i);
+        if (char === "*" && glob.charAt(i + 1) === "*") {
+            body += ".*";
+            i += glob.charAt(i + 2) === "/" ? 3 : 2;
+            continue;
+        }
+        if (char === "*") {
+            body += "[^/]*";
+        }
+        else if (char === "?") {
+            body += "[^/]";
+        }
+        else {
+            body += escapeLiteral(char);
+        }
+        i += 1;
+    }
+    return body;
+}
+function globToRegExp(glob, anchored) {
+    const prefix = anchored ? "^" : "^(?:.*/)?";
+    return new RegExp(`${prefix}${globBody(glob)}(?:/.*)?$`);
+}
+const PRECOMPILED_DENY_MATCHERS = DEFAULT_DENY_PATTERNS.map((pattern) => ({
+    regex: globToRegExp(pattern.toLowerCase(), false),
+}));
+// Matches the path that names the directory itself (no nested suffix), used so a `dir/` rule
+// can distinguish a real subdirectory from a same-named file at another depth.
+function globToDirEntryRegExp(glob, anchored) {
+    const prefix = anchored ? "^" : "^(?:.*/)?";
+    return new RegExp(`${prefix}${globBody(glob)}$`);
+}
+function escapeLiteral(char) {
+    return /[.*+?^${}()|[\]\\]/.test(char) ? `\\${char}` : char;
+}
+function stripAnchors(value, anchored, dirOnly) {
+    let core = value;
+    if (anchored) {
+        core = core.slice(1);
+    }
+    if (dirOnly) {
+        core = core.slice(0, -1);
+    }
+    return core;
+}
+function buildRule(rawLine) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#")) {
+        return null;
+    }
+    const negated = line.startsWith("!");
+    const afterBang = negated ? line.slice(1) : line;
+    const anchored = afterBang.startsWith("/");
+    const dirOnly = afterBang.endsWith("/");
+    const core = stripAnchors(afterBang, anchored, dirOnly);
+    if (core.length === 0) {
+        return null;
+    }
+    return {
+        regex: globToRegExp(core, anchored),
+        dirEntryRegex: dirOnly ? globToDirEntryRegExp(core, anchored) : null,
+        negated,
+        dirOnly,
+    };
+}
+export function compileIgnore(lines) {
+    const rules = [];
+    for (const line of lines) {
+        const rule = buildRule(line);
+        if (rule !== null) {
+            rules.push(rule);
+        }
+    }
+    return { rules };
+}
+export function isIgnored(matcher, relPath, isDir) {
+    const target = normalize(relPath);
+    let ignored = false;
+    for (const rule of matcher.rules) {
+        if (ruleMatches(rule, target, isDir)) {
+            ignored = !rule.negated;
+        }
+    }
+    return ignored;
+}
+// A `dir/` rule ignores either the matching directory entry itself (only when it IS a
+// directory), or any path genuinely nested under it. A same-named FILE is not ignored.
+function ruleMatches(rule, target, isDir) {
+    if (!rule.dirOnly) {
+        return rule.regex.test(target);
+    }
+    if (rule.dirEntryRegex?.test(target) === true) {
+        return isDir;
+    }
+    return rule.regex.test(target);
+}

package/node_modules/@oscharko-dev/keiko-workspace/dist/index.d.ts

@@ -0,0 +1,14 @@
+export type { AuditEntry, AuditSummary, ContextEntry, ContextEntrySummary, ContextPack, ContextPackSummary, ContextRequest, DiscoveredFile, DiscoveryOptions, DiscoveryStats, FileContent, ReadOptions, SelectionReason, TestFramework, WorkspaceInfo, WorkspaceLanguage, WorkspaceSummary, } from "./types.js";
+export { DEFAULT_CONTEXT_REQUEST, DEFAULT_DISCOVERY_OPTIONS, DEFAULT_READ_OPTIONS, SELECTION_REASON_PRIORITY, } from "./types.js";
+export { FileTooLargeError, PathDeniedError, PathEscapeError, WORKSPACE_CODES, WorkspaceError, WorkspaceNotFoundError, WorkspaceReadError, type WorkspaceCode, } from "./errors.js";
+export { type WorkspaceDirEntry, type WorkspaceFs, type WorkspaceStat } from "./fs.js";
+export { isWithinWorkspace, resolveWithinWorkspace } from "./paths.js";
+export { assertContainedRealPath, containedRealPathInfo } from "./realpath.js";
+export { compileIgnore, DEFAULT_DENY_PATTERNS, isDenied, isIgnored, type IgnoreMatcher, } from "./ignore.js";
+export { detectWorkspace } from "./detect.js";
+export { discoverFiles, discoverWithStats, readWorkspaceFile, type DiscoveryResult, } from "./discovery.js";
+export { lexicalRetrievalStrategy, type RankedFile, type RetrievalStrategy } from "./retrieval.js";
+export { buildContextPack, buildContextPackFromFiles, type ContextPackDeps, } from "./contextPack.js";
+export { buildWorkspaceSummary, summarizeForAudit } from "./summary.js";
+export { KEIKO_WORKSPACE_VERSION } from "./version.js";
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@oscharko-dev/keiko-workspace/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,YAAY,EACV,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,WAAW,EACX,eAAe,EACf,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AAEvF,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEvE,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE/E,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,QAAQ,EACR,SAAS,EACT,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,wBAAwB,EAAE,KAAK,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnG,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAExE,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC"}

package/node_modules/@oscharko-dev/keiko-workspace/dist/index.js

@@ -0,0 +1,17 @@
+// Public barrel for the repository-context & workspace-access layer (ADR-0005). The only
+// boundary-checked file-read seam is `readWorkspaceFile` (lexical containment + symlink
+// realpath gate + size cap + redaction). The Node-backed `nodeWorkspaceFs` adapter is kept on
+// the package's internal subpath so the public barrel exposes safe operations and injectable port
+// types, not a parallel raw read path.
+export { DEFAULT_CONTEXT_REQUEST, DEFAULT_DISCOVERY_OPTIONS, DEFAULT_READ_OPTIONS, SELECTION_REASON_PRIORITY, } from "./types.js";
+export { FileTooLargeError, PathDeniedError, PathEscapeError, WORKSPACE_CODES, WorkspaceError, WorkspaceNotFoundError, WorkspaceReadError, } from "./errors.js";
+export {} from "./fs.js";
+export { isWithinWorkspace, resolveWithinWorkspace } from "./paths.js";
+export { assertContainedRealPath, containedRealPathInfo } from "./realpath.js";
+export { compileIgnore, DEFAULT_DENY_PATTERNS, isDenied, isIgnored, } from "./ignore.js";
+export { detectWorkspace } from "./detect.js";
+export { discoverFiles, discoverWithStats, readWorkspaceFile, } from "./discovery.js";
+export { lexicalRetrievalStrategy } from "./retrieval.js";
+export { buildContextPack, buildContextPackFromFiles, } from "./contextPack.js";
+export { buildWorkspaceSummary, summarizeForAudit } from "./summary.js";
+export { KEIKO_WORKSPACE_VERSION } from "./version.js";

package/node_modules/@oscharko-dev/keiko-workspace/dist/paths.d.ts

@@ -0,0 +1,3 @@
+export declare function resolveWithinWorkspace(root: string, candidate: string): string;
+export declare function isWithinWorkspace(root: string, candidate: string): boolean;
+//# sourceMappingURL=paths.d.ts.map

package/node_modules/@oscharko-dev/keiko-workspace/dist/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAeA,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAgB9E;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAO1E"}

package/node_modules/@oscharko-dev/keiko-workspace/dist/paths.js

@@ -0,0 +1,38 @@
+// PURE, security-critical lexical path containment. This module performs NO filesystem
+// access: it decides whether a candidate path lexically resolves inside a workspace root.
+// Symlink/realpath containment (which DOES touch the filesystem) is enforced separately at
+// the IO edge in discovery.ts — see ADR-0005 D2 for the split.
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { PathEscapeError } from "./errors.js";
+function hasNul(value) {
+    return value.includes("\u0000");
+}
+// Returns the normalized absolute path of `candidate` inside `root`, or throws
+// PathEscapeError. The returned value is the ONLY path that downstream IO should read, so
+// a static analyser's path sanitizer sits on this boundary.
+export function resolveWithinWorkspace(root, candidate) {
+    if (hasNul(root) || hasNul(candidate)) {
+        throw new PathEscapeError("path contains a NUL byte", candidate);
+    }
+    const absoluteRoot = resolve(root);
+    const absoluteCandidate = isAbsolute(candidate)
+        ? resolve(candidate)
+        : resolve(absoluteRoot, candidate);
+    const rel = relative(absoluteRoot, absoluteCandidate);
+    if (rel === "") {
+        return absoluteRoot;
+    }
+    if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+        throw new PathEscapeError(`path escapes the workspace boundary: ${candidate}`, candidate);
+    }
+    return absoluteCandidate;
+}
+export function isWithinWorkspace(root, candidate) {
+    try {
+        resolveWithinWorkspace(root, candidate);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/node_modules/@oscharko-dev/keiko-workspace/dist/realpath.d.ts

@@ -0,0 +1,8 @@
+import type { WorkspaceFs } from "./fs.js";
+export interface ContainedRealPathInfo {
+    readonly path: string;
+    readonly realRelative: string;
+}
+export declare function containedRealPathInfo(fs: WorkspaceFs, root: string, absolutePath: string): ContainedRealPathInfo;
+export declare function assertContainedRealPath(fs: WorkspaceFs, root: string, absolutePath: string, _label: string): string;
+//# sourceMappingURL=realpath.d.ts.map

package/node_modules/@oscharko-dev/keiko-workspace/dist/realpath.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"realpath.d.ts","sourceRoot":"","sources":["../src/realpath.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAqC3C,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,WAAW,EACf,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,qBAAqB,CAwBvB;AAQD,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,WAAW,EACf,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,MAAM,CAGR"}

package/node_modules/@oscharko-dev/keiko-workspace/dist/realpath.js

@@ -0,0 +1,72 @@
+// PURE-at-the-port symlink containment. After lexical resolveWithinWorkspace has proven a path is
+// lexically inside the root, this gate defends against the symlink class of escape: a path whose
+// real (symlink-followed) location is outside the root, or a not-yet-existing create target whose
+// nearest existing parent escapes via a symlink. Every filesystem touch goes through the injected
+// WorkspaceFs port (realPath only) so the logic stays testable with an in-memory fake and all real
+// IO is auditable in one place (ADR-0005 D2, ADR-0006 D2). The read path (discovery.ts) and the
+// write/cwd paths (tools/patch.ts, tools/exec.ts) share this single primitive — no duplicated logic.
+import { dirname } from "node:path";
+import { isWithinWorkspace } from "./paths.js";
+import { PathEscapeError } from "./errors.js";
+// Resolves `root` through any platform symlinks (e.g. macOS /var -> /private/var) so the
+// containment comparison is symlink-consistent on both sides. Falls back to the lexical root.
+function realRoot(fs, root) {
+    try {
+        return fs.realPath(root);
+    }
+    catch {
+        return root;
+    }
+}
+// Walks up from `absolutePath` to the nearest ancestor that exists on disk and returns its real
+// path. A create target does not exist yet, so we must realpath the deepest existing parent to
+// catch a symlinked parent directory (e.g. `link/evil` where `link` -> /outside). Bounded by the
+// path depth; terminates at the filesystem root where dirname is a fixpoint.
+function realNearestExisting(fs, absolutePath) {
+    let current = absolutePath;
+    for (;;) {
+        try {
+            return fs.realPath(current);
+        }
+        catch {
+            const parent = dirname(current);
+            if (parent === current) {
+                return absolutePath; // reached the root with nothing resolvable; lexical check stands
+            }
+            current = parent;
+        }
+    }
+}
+function toRelative(root, absolutePath) {
+    return absolutePath.slice(root.length).replace(/^[/\\]/, "");
+}
+export function containedRealPathInfo(fs, root, absolutePath) {
+    const realBase = realRoot(fs, root);
+    try {
+        const target = fs.realPath(absolutePath);
+        if (!isWithinWorkspace(realBase, target)) {
+            throw new PathEscapeError(`path escapes the workspace boundary via symlink: ${absolutePath}`, absolutePath);
+        }
+        return { path: target, realRelative: toRelative(realBase, target) };
+    }
+    catch (error) {
+        if (error instanceof PathEscapeError) {
+            throw error;
+        }
+        const parentReal = realNearestExisting(fs, absolutePath);
+        if (!isWithinWorkspace(realBase, parentReal)) {
+            throw new PathEscapeError(`path escapes the workspace boundary via symlink: ${absolutePath}`, absolutePath);
+        }
+        return { path: absolutePath, realRelative: toRelative(realBase, parentReal) };
+    }
+}
+// Asserts that `absolutePath` (already lexically contained) does not escape `root` via a symlink.
+// For an existing target, the target's own realpath must stay within the real root. For a
+// not-yet-existing target (create), the nearest existing ancestor's realpath must stay within it,
+// which blocks `create through a symlinked directory` (the S-H1 .git/hooks escalation).
+// Returns the canonical real path to hand to IO (existing case) or the lexically-resolved path
+// (pure-create case where the target itself has no realpath yet).
+export function assertContainedRealPath(fs, root, absolutePath, _label) {
+    const info = containedRealPathInfo(fs, root, absolutePath);
+    return info.path;
+}

package/node_modules/@oscharko-dev/keiko-workspace/dist/retrieval.d.ts

@@ -0,0 +1,10 @@
+import { type DiscoveredFile, type SelectionReason } from "./types.js";
+export interface RankedFile {
+    readonly file: DiscoveredFile;
+    readonly selectionReason: SelectionReason;
+}
+export interface RetrievalStrategy {
+    readonly rank: (files: readonly DiscoveredFile[], task: string | undefined) => readonly RankedFile[];
+}
+export declare const lexicalRetrievalStrategy: RetrievalStrategy;
+//# sourceMappingURL=retrieval.d.ts.map

package/node_modules/@oscharko-dev/keiko-workspace/dist/retrieval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retrieval.d.ts","sourceRoot":"","sources":["../src/retrieval.ts"],"names":[],"mappings":"AAKA,OAAO,EAA6B,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAElG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;CAC3C;AAED,MAAM,WAAW,iBAAiB;IAGhC,QAAQ,CAAC,IAAI,EAAE,CACb,KAAK,EAAE,SAAS,cAAc,EAAE,EAChC,IAAI,EAAE,MAAM,GAAG,SAAS,KACrB,SAAS,UAAU,EAAE,CAAC;CAC5B;AAoED,eAAO,MAAM,wBAAwB,EAAE,iBAatC,CAAC"}