@piagent/platform 1.6.1 → 1.7.1

package/packages/piagent-core/runtime/workflows/task-repair-intent.ts

@@ -0,0 +1,67 @@
+import { LONG_INPUT_CHARS } from "../runtime-limits.ts";
+import { foldChangeIntent, isExplicitChangeRequest } from "./change-clarification.ts";
+
+const INSPECTION = /\b(?:audit|check|inspect|review|tests?|verify|verification|validate|rerun|re-run|recheck|re-check|kiem tra|ra soat|xac minh|danh gia|chay lai)\b/i;
+const REPAIR = "(?:address|change|correct(?:ing)?|edit|fix|patch|repair|resolve|update|cap nhat|chinh sua|khac phuc|sua)";
+const ACTION = "(?:add|apply|build|create|implement|modify|mutate|refactor|remove|rename|replace|write|them|tao|xoa|doi|" + REPAIR + ")";
+const PREFIX_CONDITION = /^(?:(?:please|only|chi|em|anh)\s+)*(?:if|when|neu|khi)\b/i;
+const REPAIR_LEAD = new RegExp(`^(?:(?:please|only|chi|em|anh)\\s+)*${REPAIR}\\b`, "i");
+const CONDITIONAL_REPAIR = [
+  new RegExp(`^(?:(?:please|only|chi|em|anh)\\s+)*(?:if|when|neu|khi)\\b.*\\b${REPAIR}\\b`, "i"),
+  new RegExp(`\\b${REPAIR}\\b.*\\b(?:if|when|neu|khi)\\b.*\\b(?:fail(?:s|ed|ures?|ing)?|issues?|errors?|problems?|defects?|findings?|tests?|verification|verifier|needed|necessary|required|found|detected|discovered|can|co|loi|van de)\\b`, "i"),
+  new RegExp(`\\b${REPAIR}\\b.*\\b(?:as\\s+(?:needed|necessary|required)|(?:any|all|every)\\s+(?:(?:additional|remaining|new)\\s+)?(?:failures?|issues?|errors?|problems?|defects?|findings?)|whatever\\s+fails|(?:failures?|issues?|errors?|problems?|defects?|findings?)\\s+(?:(?:(?:if|when)\\s+)?(?:found|detected|discovered)|if\\s+any|(?:you|we)\\s+find)|loi|van de)\\b`, "i"),
+  new RegExp(`\\b${REPAIR}\\b\\s+(?:(?:any|all|every)\\s+)?(?:failures?|issues?|errors?|problems?|defects?|findings?|failing\\s+tests?)\\b`, "i")
+];
+const DIRECTIVE_PREFIX = "(?:(?:you|we|the task|your task)\\s+(?:must|need to|have to)|(?:can|could|would|will)\\s+you|i\\s+(?:need|want)\\s+you\\s+to|(?:em|anh)\\s+(?:phai|can)|must|please|only|chi|em|anh|also|always|still|regardless|in any case|bat buoc)";
+const DIRECTIVE_LEAD = new RegExp(`^(?:${DIRECTIVE_PREFIX}\\b[,;:]?\\s+)*`, "i");
+const ACTION_SEPARATOR = new RegExp(`(?:,\\s*|\\b(?:and|then|but|va|roi|nhung|sau do)\\s+)(?=(?:${DIRECTIVE_PREFIX}\\b[,;:]?\\s+)*${ACTION}\\b)`, "i");
+const NEGATED_REPAIR = /\b(?:do not|don't|must not|never|khong|dung)\s+(?:ever\s+)?(?:fix|repair|edit|change|update|sua|chinh sua|cap nhat)\b/i;
+
+// Examples, quoted data and fenced snippets cannot make an otherwise required
+// implementation optional. Keep line boundaries while masking literal text.
+function instructionText(text: string): string {
+  let quote = "", escaped = false, result = "";
+  for (let index = 0; index < text.length; index++) {
+    const character = text[index];
+    if (quote) {
+      result += character === "\n" ? "\n" : " ";
+      if (character === quote && !escaped) quote = "";
+      escaped = character === "\\" && !escaped;
+      continue;
+    }
+    const apostrophe = character === "'" && /[\p{L}\p{N}]/u.test(text[index - 1] ?? "") && /[\p{L}\p{N}]/u.test(text[index + 1] ?? "");
+    if ((character === "`" || character === '"' || character === "'") && !apostrophe) { quote = character; escaped = false; result += " "; }
+    else result += character;
+  }
+  return result.replace(/^\s*>[^\n]*$/gm, "");
+}
+
+export type ConditionalRepairIntent = "none" | "conditional-only" | "mixed";
+
+/** Linguistic evidence only: task scope, approval and observed failures still gate writes. */
+export function classifyConditionalRepairIntent(text: string): ConditionalRepairIntent {
+  if (text.length > LONG_INPUT_CHARS) return "none";
+  const visible = foldChangeIntent(instructionText(text));
+  if (!INSPECTION.test(visible)) return "none";
+  let conditional = false, unconditional = false;
+  const statements = visible.split(/(?<=[.!?;:])\s+|\n+|\b(?:but|however|nevertheless|nhung|tuy nhien)\b[,:]?\s*|(?:,|\b(?:and|then|va|roi)\b)\s*(?=(?:if|when|neu|khi)\b)/)
+    .map((part) => part.replace(/^\s*(?:[-*+]\s+|\d+[.)]\s+)/, "").trim()).filter(Boolean);
+  for (const statement of statements) {
+    if (PREFIX_CONDITION.test(statement) && CONDITIONAL_REPAIR.some((pattern) => pattern.test(statement)) && !NEGATED_REPAIR.test(statement)) {
+      conditional = true;
+      continue;
+    }
+    for (const clause of statement.split(ACTION_SEPARATOR)) {
+      const directive = clause.trim().replace(DIRECTIVE_LEAD, "");
+      const repairCommand = REPAIR_LEAD.test(directive);
+      const imperative = repairCommand || isExplicitChangeRequest(directive);
+      if (!imperative && NEGATED_REPAIR.test(clause)) continue;
+      // Qualify the repair command itself, not a repair word inside the
+      // description of a different mandatory implementation command.
+      const qualified = repairCommand && CONDITIONAL_REPAIR.some((pattern) => pattern.test(clause));
+      if (qualified) conditional = true;
+      else if (imperative) unconditional = true;
+    }
+  }
+  return !conditional ? "none" : unconditional ? "mixed" : "conditional-only";
+}

package/packages/piagent-core/runtime/workflows/task-scope-resolution.ts

@@ -0,0 +1,83 @@
+import { matchesAnyPath, normalizePathCandidate } from "../../extensions/policy-core.js";
+
+function uniqueStrings(values: string[]): string[] {
+  return [...new Set(values)];
+}
+
+export type TaskScopeResolution = {
+  scope: string[];
+  mappings: Array<{ from: string; to: string }>;
+  ambiguous: Array<{ input: string; candidates: string[] }>;
+  unmatched: string[];
+};
+
+const STANDARD_SCOPE_ROOT = /^(?:\.github|app|apps|bin|config|docs|examples|lib|logs|packages|pages|plans|public|scripts|services|spec|src|test|tests|vendor|__tests__)(?:\/|$)/i;
+
+function wildcardPrefix(value: string): string {
+  const index = value.search(/[*?{}\[\]]/);
+  return (index < 0 ? value : value.slice(0, index)).replace(/\/+$/, "");
+}
+
+function nestedDirectoryMatches(prefix: string, projectFiles: string[]): string[] {
+  if (!prefix) return [];
+  const segments = prefix.split("/").filter(Boolean);
+  const matches = new Set<string>();
+  for (const file of projectFiles) {
+    const parts = normalizePathCandidate(file).split("/");
+    for (let index = 0; index <= parts.length - 1 - segments.length; index += 1) {
+      if (segments.every((segment, offset) => parts[index + offset] === segment)) {
+        matches.add(parts.slice(0, index + segments.length).join("/"));
+      }
+    }
+  }
+  return [...matches].sort();
+}
+
+export function resolveTaskScopePatterns(scope: string[], projectFiles: string[]): TaskScopeResolution {
+  const files = uniqueStrings(projectFiles.map(normalizePathCandidate).filter(Boolean));
+  const resolved: string[] = [];
+  const mappings: Array<{ from: string; to: string }> = [];
+  const ambiguous: Array<{ input: string; candidates: string[] }> = [];
+  const unmatched: string[] = [];
+  for (const raw of scope) {
+    const candidate = normalizePathCandidate(raw);
+    if (!candidate) continue;
+    if (files.includes(candidate) || files.some((file) => matchesAnyPath(file, [candidate]))) {
+      resolved.push(candidate);
+      continue;
+    }
+    const hasWildcard = /[*?{}\[\]]/.test(candidate);
+    if (hasWildcard) {
+      const prefix = wildcardPrefix(candidate);
+      const directories = nestedDirectoryMatches(prefix, files);
+      if (directories.length === 1) {
+        const suffix = candidate.slice(prefix.length).replace(/^\/+/, "");
+        const canonical = suffix ? `${directories[0]}/${suffix}` : directories[0];
+        resolved.push(canonical);
+        mappings.push({ from: candidate, to: canonical });
+      } else if (directories.length > 1 && prefix && !STANDARD_SCOPE_ROOT.test(prefix)) {
+        ambiguous.push({ input: candidate, candidates: directories.slice(0, 12).map((directory) => {
+          const suffix = candidate.slice(prefix.length).replace(/^\/+/, "");
+          return suffix ? `${directory}/${suffix}` : directory;
+        }) });
+      } else if (directories.length === 0 && prefix && !prefix.includes("/") && !STANDARD_SCOPE_ROOT.test(prefix) && !raw.startsWith("./")) {
+        unmatched.push(candidate);
+      } else {
+        resolved.push(candidate);
+      }
+      continue;
+    }
+    const suffixMatches = files.filter((file) => file === candidate || file.endsWith(`/${candidate}`));
+    if (suffixMatches.length === 1) {
+      resolved.push(suffixMatches[0]);
+      mappings.push({ from: candidate, to: suffixMatches[0] });
+    } else if (suffixMatches.length > 1) {
+      ambiguous.push({ input: candidate, candidates: suffixMatches.slice(0, 12) });
+    } else if (!candidate.includes("/") && !raw.startsWith("./")) {
+      unmatched.push(candidate);
+    } else {
+      resolved.push(candidate);
+    }
+  }
+  return { scope: uniqueStrings(resolved), mappings, ambiguous, unmatched: uniqueStrings(unmatched) };
+}

package/packages/piagent-core/runtime/workflows/webui-runtime-command.ts

@@ -1,5 +1,5 @@
 export const WEBUI_RUNTIME_ACTION_IDS = [
-  "runtime.status", "runtime.inspector", "runtime.commands", "orchestration.status",
+  "runtime.status", "runtime.inspector", "runtime.commands", "runtime.fast-status", "runtime.fast-on", "runtime.fast-off", "orchestration.status",
   "usage.live", "usage.history", "usage.logs", "usage.efficiency", "usage.preflight",
   "onboarding.status", "onboarding.profile", "onboarding.tech",
   "profile.status", "profile.options", "profile.tech-options", "profile.apply", "profile.auto",
@@ -9,7 +9,7 @@ export const WEBUI_RUNTIME_ACTION_IDS = [
 ] as const;
 
 export type WebUiRuntimeActionId = typeof WEBUI_RUNTIME_ACTION_IDS[number];
-export type WebUiRuntimeEffect = "read-only" | "workspace-write" | "model-assisted";
+export type WebUiRuntimeEffect = "read-only" | "workspace-write" | "model-assisted" | "session-setting";
 export type WebUiRuntimeArgument = "none" | "optional-text" | "required-text" | "profile" | "connection";
 
 export type WebUiRuntimeAction = {
@@ -27,6 +27,8 @@ const action = (id: WebUiRuntimeActionId, category: WebUiRuntimeAction["category
 
 export const WEBUI_RUNTIME_ACTIONS: readonly WebUiRuntimeAction[] = [
   action("runtime.status", "runtime"), action("runtime.inspector", "runtime"), action("runtime.commands", "runtime"),
+  action("runtime.fast-status", "runtime"), action("runtime.fast-on", "runtime", "session-setting"),
+  action("runtime.fast-off", "runtime", "session-setting"),
   action("orchestration.status", "runtime"),
   action("usage.live", "usage"), action("usage.history", "usage"), action("usage.logs", "usage"),
   action("usage.efficiency", "usage"), action("usage.preflight", "usage", "read-only", "optional-text"),
@@ -71,6 +73,7 @@ export function buildWebUiRuntimeCommand(input: {
   const suffix = argument ? ` ${argument}` : "";
   const commands: Record<WebUiRuntimeActionId, string> = {
     "runtime.status": "/piagent-status", "runtime.inspector": "/piagent-inspector", "runtime.commands": "/commands",
+    "runtime.fast-status": "/fast status", "runtime.fast-on": "/fast on", "runtime.fast-off": "/fast off",
     "orchestration.status": "/piagent-orchestration",
     "usage.live": "/usage live", "usage.history": "/usage history", "usage.logs": "/usage logs",
     "usage.efficiency": "/usage efficiency", "usage.preflight": `/usage preflight${suffix}`,

package/packages/piagent-core/runtime/workflows/webui-workflow.ts

@@ -1,40 +1,47 @@
-export const WEBUI_WORKFLOW_IDS = [
-  "task",
-  "scout",
-  "be-to-fe",
-  "discuss",
-  "plan",
-  "review",
-  "commit",
-  "pr",
-  "onboard",
-  "platform-improve"
-] as const;
+import {
+  WORKFLOW_IDS,
+  WORKFLOW_OPTIONS,
+  type WorkflowId,
+  type WorkflowOption
+} from "../../extensions/workflow-catalog.ts";
 
-export type WebUiWorkflowId = typeof WEBUI_WORKFLOW_IDS[number];
+/**
+ * Runtime/WebUI adapter over the surface-neutral workflow catalog.
+ *
+ * Keep aliases here rather than in an individual surface. A workflow selection
+ * is a property of one message/operation; it never pins the rest of a session.
+ */
+export {
+  WORKFLOW_ALIASES,
+  WORKFLOW_IDS,
+  WORKFLOW_OPTIONS,
+  resolveWorkflowId,
+  stripWorkflowCommand,
+  workflowCommandNames,
+  workflowCommandPattern,
+  workflowHelpLines,
+  workflowIdFromCommand,
+  workflowOption
+} from "../../extensions/workflow-catalog.ts";
+export type { ContextWorkflow, WorkflowId, WorkflowOption } from "../../extensions/workflow-catalog.ts";
 
-export type WebUiWorkflowOption = {
-  id: WebUiWorkflowId;
-  changeMode: "source-change" | "read-only" | "plan-only" | "clarification" | "git" | "onboarding" | "platform";
-  modelUse: "required";
-  recommendedFreshSession: boolean;
-};
+// Compatibility exports keep the public WebUI contract stable while its data
+// now comes from the surface-neutral catalog above.
+export const WEBUI_WORKFLOW_IDS = WORKFLOW_IDS;
+export type WebUiWorkflowId = WorkflowId;
 
-export const WEBUI_WORKFLOW_OPTIONS: readonly WebUiWorkflowOption[] = [
-  { id: "task", changeMode: "source-change", modelUse: "required", recommendedFreshSession: true },
-  { id: "scout", changeMode: "read-only", modelUse: "required", recommendedFreshSession: true },
-  { id: "be-to-fe", changeMode: "source-change", modelUse: "required", recommendedFreshSession: true },
-  { id: "discuss", changeMode: "clarification", modelUse: "required", recommendedFreshSession: false },
-  { id: "plan", changeMode: "plan-only", modelUse: "required", recommendedFreshSession: false },
-  { id: "review", changeMode: "read-only", modelUse: "required", recommendedFreshSession: false },
-  { id: "commit", changeMode: "git", modelUse: "required", recommendedFreshSession: false },
-  { id: "pr", changeMode: "git", modelUse: "required", recommendedFreshSession: false },
-  { id: "onboard", changeMode: "onboarding", modelUse: "required", recommendedFreshSession: true },
-  { id: "platform-improve", changeMode: "platform", modelUse: "required", recommendedFreshSession: true }
-] as const;
+export type WebUiWorkflowOption = Pick<WorkflowOption,
+  "id" | "label" | "changeMode" | "modelUse" | "recommendedFreshSession">;
+export const WEBUI_WORKFLOW_OPTIONS: readonly WebUiWorkflowOption[] = WORKFLOW_OPTIONS.map((option) => ({
+  id: option.id,
+  label: option.label,
+  changeMode: option.changeMode,
+  modelUse: option.modelUse,
+  recommendedFreshSession: option.recommendedFreshSession
+}));
 
 export function isWebUiWorkflowId(value: unknown): value is WebUiWorkflowId {
-  return typeof value === "string" && (WEBUI_WORKFLOW_IDS as readonly string[]).includes(value);
+  return typeof value === "string" && (WORKFLOW_IDS as readonly string[]).includes(value);
 }
 
 /**

package/packages/piagent-core/runtime/workflows/workflow-follow-up.ts

@@ -0,0 +1,33 @@
+import type { WorkflowId } from "../../extensions/workflow-catalog.ts";
+
+export function buildOnboardingWorkflowPrompt(focus: string): string {
+  return [
+    "Run the Pi Agent Platform first-read onboarding workflow for this repository.",
+    "",
+    `Optional focus: ${focus.trim() || "whole repository"}`,
+    "",
+    "Preconditions:",
+    "- The operator has logged in and selected the intended model/thinking level.",
+    "- Stay read-only except writing Piagent onboarding state through piagent tools.",
+    "",
+    "Mandatory flow:",
+    "1. Call piagent_context with detail=full.",
+    "2. If the project is unprofiled, call piagent_profile_options, do a lightweight root scout, recommend a profile, and use piagent_profile_apply only after the operator choice is clear.",
+    "3. Prefer /profile setup or piagent_profile_tech_options + piagent_profile_tech_apply for tech stack selection.",
+    "4. Re-call piagent_context after profile/tech changes.",
+    "5. Call piagent_memory_status and treat memory as advisory.",
+    "6. Read AGENTS.md, README/package/build config, required context, docs/architecture files, source map, and verify command definitions. Do not ingest the whole repo.",
+    "7. Identify project purpose, stack/runtime, ownership boundaries, high-risk areas, protected paths, verify commands, MCP/tool capabilities, selected tech stack, memory policy, and conventions.",
+    "8. Write a concise .pi/project-context.md snapshot and record it with piagent_project_onboarding_record so .pi/context-index.json is generated.",
+    "9. Call piagent_context_index_status and report pending/stale warnings.",
+    "",
+    "Final output: profile, tech stack, context files read, verification matrix, high-risk areas, context-index status, memory status, and any missing operator decisions."
+  ].join("\n");
+}
+
+/** Exact /workflow namespace follow-up; keep request whitespace and workflow intent. */
+export function buildWorkflowFollowUp(workflow: WorkflowId, request: string): string {
+  return workflow === "onboard"
+    ? buildOnboardingWorkflowPrompt(request)
+    : [`/${workflow}`, request].filter(Boolean).join(" ");
+}

package/packages/piagent-core/security/workspace-file-reader.ts

@@ -0,0 +1,132 @@
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+export class WorkspaceReadError extends Error {
+  readonly code: "outside-root" | "symlink-ancestor" | "not-file" | "oversized" | "changed-during-read";
+
+  constructor(code: WorkspaceReadError["code"], message: string) {
+    super(message);
+    this.name = "WorkspaceReadError";
+    this.code = code;
+  }
+}
+
+type SafeCandidate = { root: string; absolute: string; parent: string };
+
+function inside(root: string, candidate: string): boolean {
+  const relative = path.relative(root, candidate);
+  return relative === "" || (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+}
+
+function safeCandidate(repoRoot: string, repoPath: string): SafeCandidate {
+  const root = fs.realpathSync.native(repoRoot);
+  const segments = repoPath.split("/");
+  if (!repoPath || path.posix.isAbsolute(repoPath) || segments.includes("..") || segments.includes("")) {
+    throw new WorkspaceReadError("outside-root", "Workspace path is not a safe repository-relative path");
+  }
+  let parent = root;
+  for (const segment of segments.slice(0, -1)) {
+    parent = path.join(parent, segment);
+    const stat = fs.lstatSync(parent);
+    if (stat.isSymbolicLink()) throw new WorkspaceReadError("symlink-ancestor", "Workspace path traverses a symbolic link");
+    if (!stat.isDirectory()) throw new WorkspaceReadError("not-file", "Workspace path has a non-directory ancestor");
+  }
+  const canonicalParent = fs.realpathSync.native(parent);
+  if (!inside(root, canonicalParent)) throw new WorkspaceReadError("outside-root", "Workspace path resolves outside its repository root");
+  const absolute = path.join(canonicalParent, segments.at(-1) as string);
+  if (!inside(root, absolute)) throw new WorkspaceReadError("outside-root", "Workspace path escapes its repository root");
+  return { root, absolute, parent: canonicalParent };
+}
+
+function sameFile(left: fs.Stats, right: fs.Stats): boolean {
+  return left.dev === right.dev && left.ino === right.ino && left.mode === right.mode;
+}
+
+function openRegularFile(repoRoot: string, repoPath: string): { descriptor: number; stat: fs.Stats; candidate: SafeCandidate } {
+  const candidate = safeCandidate(repoRoot, repoPath);
+  const descriptor = fs.openSync(candidate.absolute, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+  try {
+    const stat = fs.fstatSync(descriptor);
+    if (!stat.isFile()) throw new WorkspaceReadError("not-file", "Workspace entry is not a regular file");
+    const canonical = fs.realpathSync.native(candidate.absolute);
+    const current = fs.lstatSync(candidate.absolute);
+    if (!inside(candidate.root, canonical) || !sameFile(stat, current)) {
+      throw new WorkspaceReadError("changed-during-read", "Workspace path changed while it was opened");
+    }
+    return { descriptor, stat, candidate };
+  } catch (error) {
+    fs.closeSync(descriptor);
+    throw error;
+  }
+}
+
+function verifyAfterRead(descriptor: number, before: fs.Stats, candidate: SafeCandidate): void {
+  const after = fs.fstatSync(descriptor);
+  const current = fs.lstatSync(candidate.absolute);
+  const canonical = fs.realpathSync.native(candidate.absolute);
+  if (
+    !sameFile(before, after)
+    || !sameFile(after, current)
+    || before.size !== after.size
+    || before.mtimeMs !== after.mtimeMs
+    || before.ctimeMs !== after.ctimeMs
+    || !inside(candidate.root, canonical)
+  ) {
+    throw new WorkspaceReadError("changed-during-read", "Workspace file changed during inspection");
+  }
+}
+
+export function inspectWorkspaceEntry(repoRoot: string, repoPath: string): fs.Stats {
+  const candidate = safeCandidate(repoRoot, repoPath);
+  return fs.lstatSync(candidate.absolute);
+}
+
+export function readWorkspaceLink(repoRoot: string, repoPath: string): string {
+  const candidate = safeCandidate(repoRoot, repoPath);
+  const before = fs.lstatSync(candidate.absolute);
+  if (!before.isSymbolicLink()) throw new WorkspaceReadError("not-file", "Workspace entry is not a symbolic link");
+  const target = fs.readlinkSync(candidate.absolute);
+  const after = fs.lstatSync(candidate.absolute);
+  if (!sameFile(before, after) || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs) {
+    throw new WorkspaceReadError("changed-during-read", "Workspace link changed during inspection");
+  }
+  return target;
+}
+
+export function readWorkspaceFile(repoRoot: string, repoPath: string, maxBytes: number): Buffer {
+  const opened = openRegularFile(repoRoot, repoPath);
+  try {
+    if (opened.stat.size > maxBytes) throw new WorkspaceReadError("oversized", "Workspace file exceeds its read cap");
+    const content = Buffer.allocUnsafe(opened.stat.size);
+    let position = 0;
+    while (position < content.length) {
+      const count = fs.readSync(opened.descriptor, content, position, content.length - position, position);
+      if (count <= 0) throw new WorkspaceReadError("changed-during-read", "Workspace file ended during inspection");
+      position += count;
+    }
+    verifyAfterRead(opened.descriptor, opened.stat, opened.candidate);
+    return content;
+  } finally {
+    fs.closeSync(opened.descriptor);
+  }
+}
+
+export function hashWorkspaceFile(repoRoot: string, repoPath: string): string {
+  const opened = openRegularFile(repoRoot, repoPath);
+  try {
+    const state = createHash("sha256");
+    const buffer = Buffer.allocUnsafe(256 * 1024);
+    let position = 0;
+    while (position < opened.stat.size) {
+      const count = fs.readSync(opened.descriptor, buffer, 0, Math.min(buffer.length, opened.stat.size - position), position);
+      if (count <= 0) throw new WorkspaceReadError("changed-during-read", "Workspace file ended during hashing");
+      state.update(buffer.subarray(0, count));
+      position += count;
+    }
+    verifyAfterRead(opened.descriptor, opened.stat, opened.candidate);
+    return state.digest("hex");
+  } finally {
+    fs.closeSync(opened.descriptor);
+  }
+}