@paraharness/fs 0.0.0-stage → 0.1.0

package/dist/executors/internal/evaluate-fs-allow-and-protect-guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-fs-allow-and-protect-guards.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/evaluate-fs-allow-and-protect-guards.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,2BAA2B,EAC5B,MAAM,mBAAmB,CAAC;AAI3B;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,0BAA0B,GAChC,2BAA2B,CAO7B;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,0BAA0B,GAChC,2BAA2B,CAM7B;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,0BAA0B,GAChC,2BAA2B,CAO7B"}

package/dist/executors/internal/evaluate-fs-allow-and-protect-guards.js

@@ -0,0 +1,37 @@
+import { compileGlobOrExactMatcher } from './compile-glob-or-exact-matcher.js';
+import { projectViolatedWriteEffects } from './project-violated-write-effects.js';
+/**
+ * Evaluates `FsProtectGuardNode` path globs against proposed write effects.
+ *
+ * @param {FsProtectGuardNode}         node  - Protect guard AST node.
+ * @param {PolicyGuardEvaluationInput} input - Proposed effects and active capability leases.
+ *
+ * @returns {PolicyGuardEvaluationResult} Frozen policy guard evaluation result.
+ */
+export function evaluateFsProtectPaths(node, input) {
+    const isProtectedMatch = compileGlobOrExactMatcher(node.globs);
+    return projectViolatedWriteEffects(input, (relPath) => isProtectedMatch(relPath), (paths) => `Protected file write denied on [${paths.join(', ')}]`);
+}
+/**
+ * Evaluates `FsReadOnlyGuardNode` against proposed write effects.
+ *
+ * @param {PolicyGuardEvaluationInput} input - Proposed effects and active capability leases.
+ *
+ * @returns {PolicyGuardEvaluationResult} Frozen policy guard evaluation result.
+ */
+export function evaluateFsReadOnlyPaths(input) {
+    return projectViolatedWriteEffects(input, () => true, (paths) => `Read-only policy violation: write denied on [${paths.join(', ')}]`);
+}
+/**
+ * Evaluates `FsAllowOnlyGuardNode` path globs against proposed write effects.
+ *
+ * @param {FsAllowOnlyGuardNode}       node  - Allow-only guard AST node.
+ * @param {PolicyGuardEvaluationInput} input - Proposed effects and active capability leases.
+ *
+ * @returns {PolicyGuardEvaluationResult} Frozen policy guard evaluation result.
+ */
+export function evaluateFsAllowOnlyPaths(node, input) {
+    const isAllowedMatch = compileGlobOrExactMatcher(node.globs);
+    return projectViolatedWriteEffects(input, (relPath) => !isAllowedMatch(relPath), (paths) => `Write outside allowOnly globs denied on [${paths.join(', ')}]`);
+}
+//# sourceMappingURL=evaluate-fs-allow-and-protect-guards.js.map

package/dist/executors/internal/evaluate-fs-allow-and-protect-guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-fs-allow-and-protect-guards.js","sourceRoot":"","sources":["../../../src/executors/internal/evaluate-fs-allow-and-protect-guards.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAElF;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAwB,EACxB,KAAiC;IAEjC,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,2BAA2B,CAChC,KAAK,EACL,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,EACtC,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAClE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAiC;IAEjC,OAAO,2BAA2B,CAChC,KAAK,EACL,GAAG,EAAE,CAAC,IAAI,EACV,CAAC,KAAK,EAAE,EAAE,CAAC,gDAAgD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC/E,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAA0B,EAC1B,KAAiC;IAEjC,MAAM,cAAc,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,OAAO,2BAA2B,CAChC,KAAK,EACL,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,EACrC,CAAC,KAAK,EAAE,EAAE,CAAC,4CAA4C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3E,CAAC;AACJ,CAAC"}

package/dist/executors/internal/evaluate-fs-content-and-read-guards.d.ts

@@ -0,0 +1,20 @@
+import type { FsSecretLiteralsGuardNode, PolicyGuardEvaluationInput, PolicyGuardEvaluationResult, StepExecutionContext } from '@paraharness/core';
+/**
+ * Evaluates `FsRequireReadBeforeWriteGuardNode` against `ctx.observedEffects` and `existingPathsAtBaseRef`.
+ *
+ * @param {PolicyGuardEvaluationInput}    input - Proposed effects and active capability leases.
+ * @param {StepExecutionContext<unknown>} ctx   - Step execution context providing `observedEffects`.
+ *
+ * @returns {PolicyGuardEvaluationResult} Frozen policy guard evaluation result.
+ */
+export declare function evaluateFsReadBeforeWritePaths(input: PolicyGuardEvaluationInput, ctx: StepExecutionContext<unknown>): PolicyGuardEvaluationResult;
+/**
+ * Evaluates `FsSecretLiteralsGuardNode` against `proposedContent` in proposed write effects.
+ *
+ * @param {FsSecretLiteralsGuardNode}  node  - Secret literals guard AST node.
+ * @param {PolicyGuardEvaluationInput} input - Proposed effects and active capability leases.
+ *
+ * @returns {PolicyGuardEvaluationResult} Frozen policy guard evaluation result.
+ */
+export declare function evaluateFsSecretLiteralPaths(node: FsSecretLiteralsGuardNode, input: PolicyGuardEvaluationInput): PolicyGuardEvaluationResult;
+//# sourceMappingURL=evaluate-fs-content-and-read-guards.d.ts.map

package/dist/executors/internal/evaluate-fs-content-and-read-guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-fs-content-and-read-guards.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/evaluate-fs-content-and-read-guards.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,oBAAoB,EACrB,MAAM,mBAAmB,CAAC;AAM3B;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,0BAA0B,EACjC,GAAG,EAAE,oBAAoB,CAAC,OAAO,CAAC,GACjC,2BAA2B,CAW7B;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,yBAAyB,EAC/B,KAAK,EAAE,0BAA0B,GAChC,2BAA2B,CAkB7B"}

package/dist/executors/internal/evaluate-fs-content-and-read-guards.js

@@ -0,0 +1,46 @@
+import { collectReadPathsFromEffects } from './collect-read-paths-from-effects.js';
+import { compileSecretPatterns } from './compile-secret-patterns.js';
+import { createEffectBaseRefPathLookup } from './create-effect-base-ref-path-lookup.js';
+import { projectViolatedWriteEffects } from './project-violated-write-effects.js';
+/**
+ * Evaluates `FsRequireReadBeforeWriteGuardNode` against `ctx.observedEffects` and `existingPathsAtBaseRef`.
+ *
+ * @param {PolicyGuardEvaluationInput}    input - Proposed effects and active capability leases.
+ * @param {StepExecutionContext<unknown>} ctx   - Step execution context providing `observedEffects`.
+ *
+ * @returns {PolicyGuardEvaluationResult} Frozen policy guard evaluation result.
+ */
+export function evaluateFsReadBeforeWritePaths(input, ctx) {
+    const readPaths = collectReadPathsFromEffects(ctx.observedEffects);
+    const existsAtBaseRef = createEffectBaseRefPathLookup(ctx.scopeHandle);
+    return projectViolatedWriteEffects(input, (relPath, eff) => {
+        if (readPaths.has(relPath))
+            return false;
+        return existsAtBaseRef(eff, relPath);
+    }, (paths) => `Read-before-write required prior to mutating existing file(s) [${paths.join(', ')}]`);
+}
+/**
+ * Evaluates `FsSecretLiteralsGuardNode` against `proposedContent` in proposed write effects.
+ *
+ * @param {FsSecretLiteralsGuardNode}  node  - Secret literals guard AST node.
+ * @param {PolicyGuardEvaluationInput} input - Proposed effects and active capability leases.
+ *
+ * @returns {PolicyGuardEvaluationResult} Frozen policy guard evaluation result.
+ */
+export function evaluateFsSecretLiteralPaths(node, input) {
+    const secretRegexes = compileSecretPatterns(node.patterns);
+    return projectViolatedWriteEffects(input, (relPath, eff) => {
+        const proposedMap = eff.attributes?.['proposedContent'];
+        if (proposedMap === undefined)
+            return false;
+        const content = proposedMap[relPath];
+        if (typeof content !== 'string' || content.length === 0)
+            return false;
+        for (const regex of secretRegexes) {
+            if (regex.test(content))
+                return true;
+        }
+        return false;
+    }, (paths) => `Secret literal detected in proposed write to [${paths.join(', ')}]`);
+}
+//# sourceMappingURL=evaluate-fs-content-and-read-guards.js.map

package/dist/executors/internal/evaluate-fs-content-and-read-guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-fs-content-and-read-guards.js","sourceRoot":"","sources":["../../../src/executors/internal/evaluate-fs-content-and-read-guards.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAElF;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAAiC,EACjC,GAAkC;IAElC,MAAM,SAAS,GAAG,2BAA2B,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACnE,MAAM,eAAe,GAAG,6BAA6B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACvE,OAAO,2BAA2B,CAChC,KAAK,EACL,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;QACf,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,OAAO,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,kEAAkE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjG,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAA+B,EAC/B,KAAiC;IAEjC,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3D,OAAO,2BAA2B,CAChC,KAAK,EACL,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,iBAAiB,CAEzC,CAAC;QACd,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtE,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;QACvC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,iDAAiD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChF,CAAC;AACJ,CAAC"}

package/dist/executors/internal/evaluate-fs-write-and-boundary-guards.d.ts

@@ -0,0 +1,31 @@
+import type { FsBoundaryGuardNode, FsScopedWriteGuardNode, FsWriteGuardNode, PolicyGuardEvaluationInput, PolicyGuardEvaluationResult, StepExecutionContext } from '@paraharness/core';
+/**
+ * Evaluates `FsBoundaryGuardNode` partition `boundaryGlobs` against proposed write effects.
+ *
+ * @param {FsBoundaryGuardNode}        node  - Boundary guard AST node.
+ * @param {PolicyGuardEvaluationInput} input - Proposed effects and active capability leases.
+ *
+ * @returns {PolicyGuardEvaluationResult} Frozen policy guard evaluation result.
+ */
+export declare function evaluateFsBoundaryPaths(node: FsBoundaryGuardNode, input: PolicyGuardEvaluationInput): PolicyGuardEvaluationResult;
+/**
+ * Evaluates `FsWriteGuardNode` (`denyGlobs`, `allowGlobs`, `onlyExistingAtBaseRef`) against proposed write effects.
+ *
+ * @param {FsWriteGuardNode}              node  - Write guard AST node.
+ * @param {PolicyGuardEvaluationInput}    input - Proposed effects and active capability leases.
+ * @param {StepExecutionContext<unknown>} ctx   - Step execution context.
+ *
+ * @returns {PolicyGuardEvaluationResult} Frozen policy guard evaluation result.
+ */
+export declare function evaluateFsWriteGuardPaths(node: FsWriteGuardNode, input: PolicyGuardEvaluationInput, ctx: StepExecutionContext<unknown>): PolicyGuardEvaluationResult;
+/**
+ * Evaluates `FsScopedWriteGuardNode` active partition member `globs` against proposed write effects.
+ *
+ * @param {FsScopedWriteGuardNode}        node  - Scoped write guard AST node.
+ * @param {PolicyGuardEvaluationInput}    input - Proposed effects and active capability leases.
+ * @param {StepExecutionContext<unknown>} ctx   - Step execution context providing `activePartitions`.
+ *
+ * @returns {PolicyGuardEvaluationResult} Frozen policy guard evaluation result.
+ */
+export declare function evaluateFsScopedWritePaths(node: FsScopedWriteGuardNode, input: PolicyGuardEvaluationInput, ctx: StepExecutionContext<unknown>): PolicyGuardEvaluationResult;
+//# sourceMappingURL=evaluate-fs-write-and-boundary-guards.d.ts.map

package/dist/executors/internal/evaluate-fs-write-and-boundary-guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-fs-write-and-boundary-guards.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/evaluate-fs-write-and-boundary-guards.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,EAChB,0BAA0B,EAC1B,2BAA2B,EAC3B,oBAAoB,EACrB,MAAM,mBAAmB,CAAC;AAwC3B;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,0BAA0B,GAChC,2BAA2B,CAO7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,0BAA0B,EACjC,GAAG,EAAE,oBAAoB,CAAC,OAAO,CAAC,GACjC,2BAA2B,CAc7B;AAyBD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,sBAAsB,EAC5B,KAAK,EAAE,0BAA0B,EACjC,GAAG,EAAE,oBAAoB,CAAC,OAAO,CAAC,GACjC,2BAA2B,CAO7B"}

package/dist/executors/internal/evaluate-fs-write-and-boundary-guards.js

@@ -0,0 +1,100 @@
+import { compileGlobOrExactMatcher } from './compile-glob-or-exact-matcher.js';
+import { createEffectBaseRefPathLookup } from './create-effect-base-ref-path-lookup.js';
+import { CACHED_BOUNDARY_GUARD_MATCHERS } from './glob-matcher-cache.constants.js';
+import { projectViolatedWriteEffects } from './project-violated-write-effects.js';
+/**
+ * Pre-compiles and memoizes a boundary path matcher across all partitions in `node.partitionMap` (`Rules 4.2 & 4.4`).
+ *
+ * Iterates `Object.keys(node.partitionMap.mapping)` once on a cold `WeakMap` miss, compiling each
+ * partition's frozen `boundaryGlobs` slice via `compileGlobOrExactMatcher` and caching the composed predicate on `node`.
+ *
+ * @param {FsBoundaryGuardNode} node - Boundary guard AST node.
+ *
+ * @returns {(candidatePath: string) => boolean} Memoized synchronous predicate returning `true` when `candidatePath` is a boundary file.
+ */
+function compileBoundaryGuardMatcher(node) {
+    const cached = CACHED_BOUNDARY_GUARD_MATCHERS.get(node);
+    if (cached !== undefined) {
+        return cached;
+    }
+    const partitionMatchers = [];
+    for (const partitionKey of Object.keys(node.partitionMap.mapping)) {
+        const entry = node.partitionMap.mapping[partitionKey];
+        if (entry !== undefined) {
+            partitionMatchers.push(compileGlobOrExactMatcher(entry.boundaryGlobs));
+        }
+    }
+    const compiled = (candidatePath) => {
+        for (const isMatch of partitionMatchers) {
+            if (isMatch(candidatePath))
+                return true;
+        }
+        return false;
+    };
+    CACHED_BOUNDARY_GUARD_MATCHERS.set(node, compiled);
+    return compiled;
+}
+/**
+ * Evaluates `FsBoundaryGuardNode` partition `boundaryGlobs` against proposed write effects.
+ *
+ * @param {FsBoundaryGuardNode}        node  - Boundary guard AST node.
+ * @param {PolicyGuardEvaluationInput} input - Proposed effects and active capability leases.
+ *
+ * @returns {PolicyGuardEvaluationResult} Frozen policy guard evaluation result.
+ */
+export function evaluateFsBoundaryPaths(node, input) {
+    const isBoundaryMatch = compileBoundaryGuardMatcher(node);
+    return projectViolatedWriteEffects(input, (relPath) => isBoundaryMatch(relPath), (paths) => `Protected partition boundary write denied on [${paths.join(', ')}]`);
+}
+/**
+ * Evaluates `FsWriteGuardNode` (`denyGlobs`, `allowGlobs`, `onlyExistingAtBaseRef`) against proposed write effects.
+ *
+ * @param {FsWriteGuardNode}              node  - Write guard AST node.
+ * @param {PolicyGuardEvaluationInput}    input - Proposed effects and active capability leases.
+ * @param {StepExecutionContext<unknown>} ctx   - Step execution context.
+ *
+ * @returns {PolicyGuardEvaluationResult} Frozen policy guard evaluation result.
+ */
+export function evaluateFsWriteGuardPaths(node, input, ctx) {
+    const isDenied = compileGlobOrExactMatcher(node.denyGlobs);
+    const isAllowed = node.allowGlobs !== undefined ? compileGlobOrExactMatcher(node.allowGlobs) : () => false;
+    const existsAtBaseRef = createEffectBaseRefPathLookup(ctx.scopeHandle);
+    return projectViolatedWriteEffects(input, (relPath, eff) => {
+        if (isAllowed(relPath) || !isDenied(relPath))
+            return false;
+        if (node.onlyExistingAtBaseRef !== true)
+            return true;
+        return existsAtBaseRef(eff, relPath);
+    }, (paths) => `Write guard '${node.id}' denied mutation on [${paths.join(', ')}]`);
+}
+/**
+ * Tests whether `relPath` matches at least one active partition's `globs` in `node.partitionMap` (`Rules 4.2 & 4.4`).
+ *
+ * @param {FsScopedWriteGuardNode} node             - Scoped write guard AST node.
+ * @param {readonly string[]}      activePartitions - Active partition identifiers for the step.
+ * @param {string}                 relPath          - Normalized worktree-relative file path.
+ *
+ * @returns {boolean} True when `relPath` belongs to at least one active partition.
+ */
+function isPathInActivePartitions(node, activePartitions, relPath) {
+    for (const partitionId of activePartitions) {
+        const entry = node.partitionMap.mapping[partitionId];
+        if (entry !== undefined && compileGlobOrExactMatcher(entry.globs)(relPath)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Evaluates `FsScopedWriteGuardNode` active partition member `globs` against proposed write effects.
+ *
+ * @param {FsScopedWriteGuardNode}        node  - Scoped write guard AST node.
+ * @param {PolicyGuardEvaluationInput}    input - Proposed effects and active capability leases.
+ * @param {StepExecutionContext<unknown>} ctx   - Step execution context providing `activePartitions`.
+ *
+ * @returns {PolicyGuardEvaluationResult} Frozen policy guard evaluation result.
+ */
+export function evaluateFsScopedWritePaths(node, input, ctx) {
+    return projectViolatedWriteEffects(input, (relPath) => !isPathInActivePartitions(node, ctx.activePartitions, relPath), (paths) => `Scoped write denied outside active partitions [${ctx.activePartitions.join(', ')}] on [${paths.join(', ')}]`);
+}
+//# sourceMappingURL=evaluate-fs-write-and-boundary-guards.js.map

package/dist/executors/internal/evaluate-fs-write-and-boundary-guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-fs-write-and-boundary-guards.js","sourceRoot":"","sources":["../../../src/executors/internal/evaluate-fs-write-and-boundary-guards.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAElF;;;;;;;;;GASG;AACH,SAAS,2BAA2B,CAClC,IAAyB;IAEzB,MAAM,MAAM,GAAG,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,iBAAiB,GAA8C,EAAE,CAAC;IACxE,KAAK,MAAM,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,iBAAiB,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,aAAqB,EAAW,EAAE;QAClD,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACxC,IAAI,OAAO,CAAC,aAAa,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC1C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,8BAA8B,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAyB,EACzB,KAAiC;IAEjC,MAAM,eAAe,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,2BAA2B,CAChC,KAAK,EACL,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,EACrC,CAAC,KAAK,EAAE,EAAE,CAAC,iDAAiD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAsB,EACtB,KAAiC,EACjC,GAAkC;IAElC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3D,MAAM,SAAS,GACb,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAY,EAAE,CAAC,KAAK,CAAC;IACpG,MAAM,eAAe,GAAG,6BAA6B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACvE,OAAO,2BAA2B,CAChC,KAAK,EACL,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;QACf,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3D,IAAI,IAAI,CAAC,qBAAqB,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACrD,OAAO,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,IAAI,CAAC,EAAE,yBAAyB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC/E,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAC/B,IAA4B,EAC5B,gBAAmC,EACnC,OAAe;IAEf,KAAK,MAAM,WAAW,IAAI,gBAAgB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,KAAK,KAAK,SAAS,IAAI,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,IAA4B,EAC5B,KAAiC,EACjC,GAAkC;IAElC,OAAO,2BAA2B,CAChC,KAAK,EACL,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,IAAI,EAAE,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,EAC3E,CAAC,KAAK,EAAE,EAAE,CACR,kDAAkD,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChH,CAAC;AACJ,CAAC"}

package/dist/executors/internal/execute-fs-edit-operation.d.ts

@@ -0,0 +1,26 @@
+import type { ToolExecutionResult } from '@paraharness/core';
+/**
+ * Validated edit arguments for {@link executeFsEditOperation}.
+ */
+export interface ExecuteFsEditOperationParams {
+    /** Workspace-relative path of the file to edit. */
+    readonly path: string;
+    /** Exact substring to replace. */
+    readonly oldString: string;
+    /** Replacement string. */
+    readonly newString: string;
+}
+/**
+ * Executes a jailed `edit_file` string replacement inside `scopeHandle`.
+ *
+ * Verifies that `params.oldString` exists in the target file before writing the updated UTF-8 text.
+ *
+ * @param {unknown}                      scopeHandle - Active isolation scope handle.
+ * @param {ExecuteFsEditOperationParams} params      - Validated edit arguments (`path`, `oldString`, `newString`).
+ *
+ * @returns {Promise<ToolExecutionResult>} Frozen tool execution result.
+ *
+ * @throws {Error} If `params.oldString` is not found in the target file.
+ */
+export declare function executeFsEditOperation(scopeHandle: unknown, params: ExecuteFsEditOperationParams): Promise<ToolExecutionResult>;
+//# sourceMappingURL=execute-fs-edit-operation.d.ts.map

package/dist/executors/internal/execute-fs-edit-operation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execute-fs-edit-operation.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/execute-fs-edit-operation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAG7D;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,kCAAkC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,0BAA0B;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,OAAO,EACpB,MAAM,EAAE,4BAA4B,GACnC,OAAO,CAAC,mBAAmB,CAAC,CAe9B"}

package/dist/executors/internal/execute-fs-edit-operation.js

@@ -0,0 +1,25 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import { resolveJailedWorktreePath } from './resolve-jailed-worktree-path.js';
+/**
+ * Executes a jailed `edit_file` string replacement inside `scopeHandle`.
+ *
+ * Verifies that `params.oldString` exists in the target file before writing the updated UTF-8 text.
+ *
+ * @param {unknown}                      scopeHandle - Active isolation scope handle.
+ * @param {ExecuteFsEditOperationParams} params      - Validated edit arguments (`path`, `oldString`, `newString`).
+ *
+ * @returns {Promise<ToolExecutionResult>} Frozen tool execution result.
+ *
+ * @throws {Error} If `params.oldString` is not found in the target file.
+ */
+export async function executeFsEditOperation(scopeHandle, params) {
+    const { normalizedRelPath, absolutePath } = resolveJailedWorktreePath(scopeHandle, params.path, 'write');
+    const currentContent = await readFile(absolutePath, 'utf8');
+    if (!currentContent.includes(params.oldString)) {
+        throw new Error(`fs:edit failed on '${normalizedRelPath}': target oldString was not found in file.`);
+    }
+    const updatedContent = currentContent.replace(params.oldString, () => params.newString);
+    await writeFile(absolutePath, updatedContent, 'utf8');
+    return Object.freeze({ content: `Edited ${normalizedRelPath}` });
+}
+//# sourceMappingURL=execute-fs-edit-operation.js.map

package/dist/executors/internal/execute-fs-edit-operation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execute-fs-edit-operation.js","sourceRoot":"","sources":["../../../src/executors/internal/execute-fs-edit-operation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAgB9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,WAAoB,EACpB,MAAoC;IAEpC,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,GAAG,yBAAyB,CACnE,WAAW,EACX,MAAM,CAAC,IAAI,EACX,OAAO,CACR,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,sBAAsB,iBAAiB,4CAA4C,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxF,MAAM,SAAS,CAAC,YAAY,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC,MAAM,CAAsB,EAAE,OAAO,EAAE,UAAU,iBAAiB,EAAE,EAAE,CAAC,CAAC;AACxF,CAAC"}

package/dist/executors/internal/execute-fs-write-operation.d.ts

@@ -0,0 +1,22 @@
+import type { ToolExecutionResult } from '@paraharness/core';
+/**
+ * Validated write arguments for {@link executeFsWriteOperation}.
+ */
+export interface ExecuteFsWriteOperationParams {
+    /** Workspace-relative path of the file to write. */
+    readonly path: string;
+    /** UTF-8 file content to write. */
+    readonly content: string;
+}
+/**
+ * Executes a jailed `write_file` operation inside `scopeHandle`.
+ *
+ * Creates parent directories if needed, re-verifies symlink jailing, and writes UTF-8 text.
+ *
+ * @param {unknown}                       scopeHandle - Active isolation scope handle.
+ * @param {ExecuteFsWriteOperationParams} params      - Validated write arguments (`path`, `content`).
+ *
+ * @returns {Promise<ToolExecutionResult>} Frozen tool execution result.
+ */
+export declare function executeFsWriteOperation(scopeHandle: unknown, params: ExecuteFsWriteOperationParams): Promise<ToolExecutionResult>;
+//# sourceMappingURL=execute-fs-write-operation.d.ts.map

package/dist/executors/internal/execute-fs-write-operation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execute-fs-write-operation.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/execute-fs-write-operation.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAG7D;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,mCAAmC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,OAAO,EACpB,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,mBAAmB,CAAC,CAU9B"}

package/dist/executors/internal/execute-fs-write-operation.js

@@ -0,0 +1,21 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { resolveJailedWorktreePath } from './resolve-jailed-worktree-path.js';
+/**
+ * Executes a jailed `write_file` operation inside `scopeHandle`.
+ *
+ * Creates parent directories if needed, re-verifies symlink jailing, and writes UTF-8 text.
+ *
+ * @param {unknown}                       scopeHandle - Active isolation scope handle.
+ * @param {ExecuteFsWriteOperationParams} params      - Validated write arguments (`path`, `content`).
+ *
+ * @returns {Promise<ToolExecutionResult>} Frozen tool execution result.
+ */
+export async function executeFsWriteOperation(scopeHandle, params) {
+    const { normalizedRelPath, absolutePath } = resolveJailedWorktreePath(scopeHandle, params.path, 'write');
+    await mkdir(path.dirname(absolutePath), { recursive: true });
+    resolveJailedWorktreePath(scopeHandle, normalizedRelPath, 'write');
+    await writeFile(absolutePath, params.content, 'utf8');
+    return Object.freeze({ content: `Wrote ${normalizedRelPath}` });
+}
+//# sourceMappingURL=execute-fs-write-operation.js.map

package/dist/executors/internal/execute-fs-write-operation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execute-fs-write-operation.js","sourceRoot":"","sources":["../../../src/executors/internal/execute-fs-write-operation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAa9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAoB,EACpB,MAAqC;IAErC,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,GAAG,yBAAyB,CACnE,WAAW,EACX,MAAM,CAAC,IAAI,EACX,OAAO,CACR,CAAC;IACF,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,yBAAyB,CAAC,WAAW,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC,MAAM,CAAsB,EAAE,OAAO,EAAE,SAAS,iBAAiB,EAAE,EAAE,CAAC,CAAC;AACvF,CAAC"}

package/dist/executors/internal/extract-worktree-root-and-base-ref.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Extracts `rootPath` and optional `baseRef` from an opaque isolation `scopeHandle`.
+ *
+ * Defaults `rootPath` to `process.cwd()` when `scopeHandle` does not carry a `worktreePath`
+ * string (`SPEC.md` Invariant 5 & §4.3).
+ *
+ * @param {unknown} scopeHandle - Active isolation scope handle or `undefined`.
+ *
+ * @returns {{ readonly rootPath: string; readonly baseRef: string | undefined }} Resolved root directory and optional git `baseRef`.
+ */
+export declare function extractWorktreeRootAndBaseRef(scopeHandle: unknown): {
+    readonly rootPath: string;
+    readonly baseRef: string | undefined;
+};
+//# sourceMappingURL=extract-worktree-root-and-base-ref.d.ts.map

package/dist/executors/internal/extract-worktree-root-and-base-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-worktree-root-and-base-ref.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/extract-worktree-root-and-base-ref.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,OAAO,GAAG;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC,CAcA"}

package/dist/executors/internal/extract-worktree-root-and-base-ref.js

@@ -0,0 +1,24 @@
+/**
+ * Extracts `rootPath` and optional `baseRef` from an opaque isolation `scopeHandle`.
+ *
+ * Defaults `rootPath` to `process.cwd()` when `scopeHandle` does not carry a `worktreePath`
+ * string (`SPEC.md` Invariant 5 & §4.3).
+ *
+ * @param {unknown} scopeHandle - Active isolation scope handle or `undefined`.
+ *
+ * @returns {{ readonly rootPath: string; readonly baseRef: string | undefined }} Resolved root directory and optional git `baseRef`.
+ */
+export function extractWorktreeRootAndBaseRef(scopeHandle) {
+    if (typeof scopeHandle !== 'object' || scopeHandle === null) {
+        return Object.freeze({ rootPath: process.cwd(), baseRef: undefined });
+    }
+    const record = scopeHandle;
+    const rawWorktreePath = record['worktreePath'];
+    const rootPath = typeof rawWorktreePath === 'string' && rawWorktreePath.trim().length > 0
+        ? rawWorktreePath
+        : process.cwd();
+    const rawBaseRef = record['baseRef'];
+    const baseRef = typeof rawBaseRef === 'string' && rawBaseRef.trim().length > 0 ? rawBaseRef : undefined;
+    return Object.freeze({ rootPath, baseRef });
+}
+//# sourceMappingURL=extract-worktree-root-and-base-ref.js.map

package/dist/executors/internal/extract-worktree-root-and-base-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-worktree-root-and-base-ref.js","sourceRoot":"","sources":["../../../src/executors/internal/extract-worktree-root-and-base-ref.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAAC,WAAoB;IAIhE,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,WAAgD,CAAC;IAChE,MAAM,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,QAAQ,GACZ,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACtE,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACpB,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,OAAO,GACX,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;AAC9C,CAAC"}

package/dist/executors/internal/filter-jailed-dirents.d.ts

@@ -0,0 +1,25 @@
+import { type Dirent } from 'node:fs';
+/**
+ * Parameters for {@link filterJailedDirents}.
+ */
+export interface FilterJailedDirentsParams {
+    /** Canonicalized `realpathSync` root directory of the workspace. */
+    readonly realRoot: string;
+    /** Set of canonical directory paths already visited in this walk. */
+    readonly visitedDirs: Set<string>;
+    /** Current directory path being read by `tinyglobby`. */
+    readonly dirPath: string;
+    /** Raw directory entries returned by `fs.readdir`. */
+    readonly entries: readonly Dirent[];
+}
+/**
+ * Filters directory entries for `tinyglobby` so symlinks escaping `realRoot`, broken symlinks, and cycles are skipped.
+ *
+ * Enforces `realpathSync` containment inside `realRoot` and prevents cyclic directory symlink recursion.
+ *
+ * @param {FilterJailedDirentsParams} params - Canonical root, visited directory set, current directory, and raw dirents.
+ *
+ * @returns {Dirent[]} Filtered array of jailed directory entries.
+ */
+export declare function filterJailedDirents(params: FilterJailedDirentsParams): Dirent[];
+//# sourceMappingURL=filter-jailed-dirents.d.ts.map

package/dist/executors/internal/filter-jailed-dirents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filter-jailed-dirents.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/filter-jailed-dirents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAA0B,MAAM,SAAS,CAAC;AAG9D;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAElC,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,GAAG,MAAM,EAAE,CA0C/E"}

package/dist/executors/internal/filter-jailed-dirents.js

@@ -0,0 +1,54 @@
+import { realpathSync, statSync } from 'node:fs';
+import path from 'node:path';
+/**
+ * Filters directory entries for `tinyglobby` so symlinks escaping `realRoot`, broken symlinks, and cycles are skipped.
+ *
+ * Enforces `realpathSync` containment inside `realRoot` and prevents cyclic directory symlink recursion.
+ *
+ * @param {FilterJailedDirentsParams} params - Canonical root, visited directory set, current directory, and raw dirents.
+ *
+ * @returns {Dirent[]} Filtered array of jailed directory entries.
+ */
+export function filterJailedDirents(params) {
+    let realDir;
+    try {
+        realDir = realpathSync(params.dirPath);
+    }
+    catch {
+        return [];
+    }
+    const dirRel = path.relative(params.realRoot, realDir);
+    if (dirRel === '..' ||
+        dirRel.startsWith('../') ||
+        dirRel.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(dirRel)) {
+        return [];
+    }
+    const allowed = [];
+    for (const entry of params.entries) {
+        if (entry.name === '.git' || entry.name === 'node_modules')
+            continue;
+        let realTarget;
+        try {
+            realTarget = realpathSync(path.join(params.dirPath, entry.name));
+        }
+        catch {
+            continue;
+        }
+        const rel = path.relative(params.realRoot, realTarget);
+        if (rel === '..' || rel.startsWith('../') || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) {
+            continue;
+        }
+        if (entry.isSymbolicLink() && statSync(realTarget).isDirectory()) {
+            if (params.visitedDirs.has(realTarget) ||
+                realDir === realTarget ||
+                realDir.startsWith(`${realTarget}${path.sep}`)) {
+                continue;
+            }
+            params.visitedDirs.add(realTarget);
+        }
+        allowed.push(entry);
+    }
+    return allowed;
+}
+//# sourceMappingURL=filter-jailed-dirents.js.map

package/dist/executors/internal/filter-jailed-dirents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filter-jailed-dirents.js","sourceRoot":"","sources":["../../../src/executors/internal/filter-jailed-dirents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,IAAI,MAAM,WAAW,CAAC;AAmB7B;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAiC;IACnE,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,IACE,MAAM,KAAK,IAAI;QACf,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;QACxB,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EACvB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;YAAE,SAAS;QACrE,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACvD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrG,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACjE,IACE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC;gBAClC,OAAO,KAAK,UAAU;gBACtB,OAAO,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAC9C,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/executors/internal/fs-coding-tool-drivers.d.ts

@@ -0,0 +1,38 @@
+import type { FsEditToolNode, FsReadToolNode, FsWriteToolNode, StepExecutionContext, ToolExecutionResult } from '@paraharness/core';
+/**
+ * Validates `args` against `node.inputSchema` and reads the jailed UTF-8 file for `fs:read`.
+ *
+ * @template THandle Runtime handle type of the active isolation scope.
+ *
+ * @param {FsReadToolNode<THandle>}       node - Passive `fs:read` tool AST node.
+ * @param {unknown}                       args - Raw tool call arguments.
+ * @param {StepExecutionContext<THandle>} ctx  - Active step execution context.
+ *
+ * @returns {Promise<ToolExecutionResult>} Frozen tool execution result containing the UTF-8 file text.
+ */
+export declare function readFsToolFile<THandle = unknown>(node: FsReadToolNode<THandle>, args: unknown, ctx: StepExecutionContext<THandle>): Promise<ToolExecutionResult>;
+/**
+ * Validates `args` against `node.inputSchema` and executes a jailed `fs:edit` replacement.
+ *
+ * @template THandle Runtime handle type of the active isolation scope.
+ *
+ * @param {FsEditToolNode<THandle>}       node - Passive `fs:edit` tool AST node.
+ * @param {unknown}                       args - Raw tool call arguments.
+ * @param {StepExecutionContext<THandle>} ctx  - Active step execution context.
+ *
+ * @returns {Promise<ToolExecutionResult>} Frozen tool execution result.
+ */
+export declare function editFsToolFile<THandle = unknown>(node: FsEditToolNode<THandle>, args: unknown, ctx: StepExecutionContext<THandle>): Promise<ToolExecutionResult>;
+/**
+ * Validates `args` against `node.inputSchema` and executes a jailed `fs:write` operation.
+ *
+ * @template THandle Runtime handle type of the active isolation scope.
+ *
+ * @param {FsWriteToolNode<THandle>}      node - Passive `fs:write` tool AST node.
+ * @param {unknown}                       args - Raw tool call arguments.
+ * @param {StepExecutionContext<THandle>} ctx  - Active step execution context.
+ *
+ * @returns {Promise<ToolExecutionResult>} Frozen tool execution result.
+ */
+export declare function writeFsToolFile<THandle = unknown>(node: FsWriteToolNode<THandle>, args: unknown, ctx: StepExecutionContext<THandle>): Promise<ToolExecutionResult>;
+//# sourceMappingURL=fs-coding-tool-drivers.d.ts.map

package/dist/executors/internal/fs-coding-tool-drivers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-coding-tool-drivers.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/fs-coding-tool-drivers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,mBAAmB,CAAC;AAW3B;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,OAAO,GAAG,OAAO,EACpD,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,EAC7B,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,oBAAoB,CAAC,OAAO,CAAC,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAK9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAG,OAAO,EAC9C,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,EAC7B,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,oBAAoB,CAAC,OAAO,CAAC,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAG9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAG,OAAO,EAC/C,IAAI,EAAE,eAAe,CAAC,OAAO,CAAC,EAC9B,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,oBAAoB,CAAC,OAAO,CAAC,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAG9B"}

package/dist/executors/internal/fs-coding-tool-drivers.js

@@ -0,0 +1,52 @@
+import { readFile } from 'node:fs/promises';
+import { executeFsEditOperation, } from './execute-fs-edit-operation.js';
+import { executeFsWriteOperation, } from './execute-fs-write-operation.js';
+import { resolveJailedWorktreePath } from './resolve-jailed-worktree-path.js';
+/**
+ * Validates `args` against `node.inputSchema` and reads the jailed UTF-8 file for `fs:read`.
+ *
+ * @template THandle Runtime handle type of the active isolation scope.
+ *
+ * @param {FsReadToolNode<THandle>}       node - Passive `fs:read` tool AST node.
+ * @param {unknown}                       args - Raw tool call arguments.
+ * @param {StepExecutionContext<THandle>} ctx  - Active step execution context.
+ *
+ * @returns {Promise<ToolExecutionResult>} Frozen tool execution result containing the UTF-8 file text.
+ */
+export async function readFsToolFile(node, args, ctx) {
+    const parsed = node.inputSchema.parse(args);
+    const { absolutePath } = resolveJailedWorktreePath(ctx.scopeHandle, parsed.path, 'read');
+    const content = await readFile(absolutePath, 'utf8');
+    return Object.freeze({ content });
+}
+/**
+ * Validates `args` against `node.inputSchema` and executes a jailed `fs:edit` replacement.
+ *
+ * @template THandle Runtime handle type of the active isolation scope.
+ *
+ * @param {FsEditToolNode<THandle>}       node - Passive `fs:edit` tool AST node.
+ * @param {unknown}                       args - Raw tool call arguments.
+ * @param {StepExecutionContext<THandle>} ctx  - Active step execution context.
+ *
+ * @returns {Promise<ToolExecutionResult>} Frozen tool execution result.
+ */
+export function editFsToolFile(node, args, ctx) {
+    const parsed = node.inputSchema.parse(args);
+    return executeFsEditOperation(ctx.scopeHandle, parsed);
+}
+/**
+ * Validates `args` against `node.inputSchema` and executes a jailed `fs:write` operation.
+ *
+ * @template THandle Runtime handle type of the active isolation scope.
+ *
+ * @param {FsWriteToolNode<THandle>}      node - Passive `fs:write` tool AST node.
+ * @param {unknown}                       args - Raw tool call arguments.
+ * @param {StepExecutionContext<THandle>} ctx  - Active step execution context.
+ *
+ * @returns {Promise<ToolExecutionResult>} Frozen tool execution result.
+ */
+export function writeFsToolFile(node, args, ctx) {
+    const parsed = node.inputSchema.parse(args);
+    return executeFsWriteOperation(ctx.scopeHandle, parsed);
+}
+//# sourceMappingURL=fs-coding-tool-drivers.js.map