@playcraft/cli 0.1.52 → 0.1.53-beta

package/dist/workspace-runtime/batch/freeze.js

@@ -0,0 +1,101 @@
+import { rm, writeFile } from 'node:fs/promises';
+import { statfs } from 'node:fs/promises';
+import { batchSourceFreezeResultSchema, batchSourceRemoteRef, sandboxBatchSourceFreezeRequestSchema, workspaceDiskAdmission, } from '@playcraft/common/cloud-workspace/runtime';
+import { stopBackgroundWriter } from '../processes/managed-writes.js';
+import { workspaceRoot } from '../workspaces/registry.js';
+import { gitRead } from './git.js';
+import { captureIndependentSource } from './source-capture.js';
+import { filesystemObjectStore, readSnapshot, serializeFreeze, sourceCacheDir, writeSnapshot, } from './records.js';
+import { assertSourceIdentity, readSourceCandidate, writeSourceCandidate } from './source-candidate.js';
+import { BatchSourceFreezeError, sourceFreezeError } from './source-failure.js';
+import { publishSourceCandidate } from './source-publish.js';
+async function usagePercent(path) {
+    const disk = await statfs(path);
+    if (disk.blocks <= 0)
+        throw new Error('disk_usage_unavailable');
+    return ((disk.blocks - disk.bfree) / disk.blocks) * 100;
+}
+/** Dependency installs are keyed `workspaceId:directoryName`. A bare workspace id is not this directory. */
+async function stopManagedWriters(state, workspaceId, directoryName) {
+    const scope = `${workspaceId}:${directoryName}`;
+    for (const write of state.journal.listManagedWrites()) {
+        if (write.stoppedAt || write.workspaceId !== scope)
+            continue;
+        if (write.pid !== undefined) {
+            const stopped = await stopBackgroundWriter(write.pid);
+            if (!stopped)
+                continue;
+        }
+        await state.journal.putManagedWrite({ ...write, stoppedAt: new Date().toISOString() });
+    }
+}
+export async function freezeBatchSource(state, body, options) {
+    const parsed = sandboxBatchSourceFreezeRequestSchema.safeParse(body);
+    if (!parsed.success)
+        throw new Error('invalid_batch_request');
+    const request = parsed.data;
+    return serializeFreeze(async () => {
+        let candidate;
+        let source;
+        try {
+            const pending = await readSourceCandidate(state, request.batchId);
+            const existing = await readSnapshot(state, request.batchId);
+            if (existing) {
+                assertSourceIdentity(state, request, existing, pending);
+                return batchSourceFreezeResultSchema.parse({ status: 'frozen', snapshot: existing });
+            }
+            if (!pending && 'resumeOnly' in request && request.resumeOnly === true) {
+                throw await sourceFreezeError(state, request.batchId, { code: 'batch_source_candidate_lost', stage: 'capture', retryable: false, outcome: 'unknown' });
+            }
+            if (pending)
+                assertSourceIdentity(state, request, pending.snapshot, pending);
+            source = await workspaceRoot(state, request.workspaceId, request.sourceDirectoryName);
+            if (pending)
+                candidate = pending;
+            else {
+                const percent = Math.min(100, Math.max(0, options?.usagePercent ?? await usagePercent(source)));
+                if (workspaceDiskAdmission(percent) === 'paused')
+                    throw new Error('disk_admission_paused');
+                await stopManagedWriters(state, request.workspaceId, request.sourceDirectoryName);
+                const cache = sourceCacheDir(state, request.batchId);
+                await rm(cache, { recursive: true, force: true });
+                const captured = await captureIndependentSource(source, cache);
+                await writeFile(`${cache}.digest`, captured.digest, { mode: 0o600 });
+                const binding = state.journal.getWorkspace(request.workspaceId);
+                const snapshot = {
+                    batchId: request.batchId, commitHash: captured.commitHash, digest: captured.digest,
+                    sourceWorkspaceId: request.workspaceId, sourceDirectoryName: request.sourceDirectoryName,
+                    frozenAt: new Date((await gitRead(cache, ['show', '-s', '--format=%cI', 'HEAD'])).trim()).toISOString(),
+                    ...(request.persist === 'remote_ref' ? { remoteRef: batchSourceRemoteRef(request.batchId) }
+                        : { artifactKey: `workspaces/${request.workspaceId}/batches/${request.batchId}/source/${captured.digest}.json.gz` }),
+                };
+                candidate = {
+                    version: 1, persist: request.persist, repositoryUrl: binding?.repositoryUrl ?? undefined, projectId: binding?.projectId,
+                    branchName: request.sourceDirectoryName === 'basic' ? binding?.branchName ?? undefined
+                        : binding?.directories?.find(directory => directory.directoryName === request.sourceDirectoryName)?.branchName ?? undefined,
+                    snapshot,
+                };
+                await writeSourceCandidate(state, candidate);
+            }
+        }
+        catch (error) {
+            if (error instanceof BatchSourceFreezeError)
+                throw error;
+            const known = new Set(['disk_admission_paused', 'disk_usage_unavailable', 'batch_source_changed', 'batch_source_path_invalid',
+                'workspace_not_registered', 'batch_source_identity_mismatch', 'batch_source_snapshot_mismatch']);
+            const code = error instanceof Error && known.has(error.message) ? error.message : 'batch_source_capture_failed';
+            throw await sourceFreezeError(state, request.batchId, {
+                code, stage: 'capture', retryable: !['batch_source_path_invalid', 'batch_source_identity_mismatch', 'batch_source_snapshot_mismatch'].includes(code),
+                outcome: code === 'batch_source_identity_mismatch' || code === 'batch_source_snapshot_mismatch' ? 'unknown' : 'not_published',
+            }, error);
+        }
+        await publishSourceCandidate(state, candidate, source, options?.objectStore ?? filesystemObjectStore(state));
+        try {
+            await writeSnapshot(state, candidate.snapshot);
+        }
+        catch (error) {
+            throw await sourceFreezeError(state, request.batchId, { code: 'batch_source_verification_failed', stage: 'verify', retryable: true, outcome: 'unknown' }, error);
+        }
+        return batchSourceFreezeResultSchema.parse({ status: 'frozen', snapshot: candidate.snapshot });
+    });
+}

package/dist/workspace-runtime/batch/generate.js

@@ -0,0 +1,249 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
+import { hashOperationPayload, operationScopeKey, sandboxBatchMemberGenerateSchema, } from '@playcraft/common/cloud-workspace/runtime';
+import { attachNativeCollector, executeOperation } from '../server/dispatch.js';
+import { workspaceRoot } from '../workspaces/registry.js';
+import { snapshotWorkspaceTree } from '../workspaces/git.js';
+import { requireBatchContentChanges } from './content-changes.js';
+import { bindMemberPolicy, memberExecutionPolicy } from './policy.js';
+import { groupExited, stopProcessGroup } from './processes.js';
+import { memberStatus, readMember, readStopMarker, serializeRun, writeMember } from './records.js';
+function hashCommand(value) {
+    return hashOperationPayload(value);
+}
+function operation(state, input) {
+    const now = new Date().toISOString();
+    const record = {
+        operationId: randomUUID(), environment: state.config.environment, userId: state.config.userId,
+        clientRequestId: input.clientRequestId, kind: input.kind, status: 'queued', payloadHash: hashOperationPayload(input.payload),
+        workspaceId: input.workspaceId, directoryName: input.directoryName, sessionId: input.sessionId,
+        generation: state.config.generation, runtimeEpoch: state.runtimeEpoch, leaseFence: state.acceptedLeaseFence,
+        createdAt: now, updatedAt: now,
+    };
+    return { scopeKey: operationScopeKey(record), record };
+}
+function turnTerminal(event) {
+    if (event.kind === 'approval_request')
+        return 'needs_user';
+    if (event.method !== 'turn/completed' && event.method !== 'turn.completed' && event.method !== 'turn.failed' && event.method !== 'turn.interrupted')
+        return undefined;
+    const turn = event.params && typeof event.params === 'object' ? event.params.turn : undefined;
+    if (event.method === 'turn.failed' || turn?.status === 'failed')
+        return 'failed';
+    if (event.method === 'turn.interrupted' || turn?.status === 'interrupted')
+        return 'interrupted';
+    return 'completed';
+}
+function threadIdOf(event) {
+    const params = event.params && typeof event.params === 'object' ? event.params : undefined;
+    return typeof params?.threadId === 'string' ? params.threadId : undefined;
+}
+async function proveStopped(record) {
+    let stopped = true;
+    for (const process of record.processes) {
+        if (process.stopped || groupExited(process.pid))
+            process.stopped = true;
+        else {
+            const did = await stopProcessGroup(process);
+            process.stopped = did;
+            if (!did)
+                stopped = false;
+        }
+    }
+    return stopped;
+}
+export async function generateBatchMember(state, body) {
+    if (!body || typeof body !== 'object' || !('occupancyId' in body) || !body.occupancyId)
+        throw new Error('occupancy_required');
+    const parsed = sandboxBatchMemberGenerateSchema.safeParse(body);
+    if (!parsed.success)
+        throw new Error('invalid_batch_request');
+    const command = parsed.data;
+    const hash = hashCommand(command);
+    return serializeRun(command.runId, async () => {
+        attachNativeCollector(state);
+        const existing = await readMember(state, command.runId);
+        if (existing && command.ownerFence < existing.ownerFence)
+            throw new Error('stale_owner');
+        if (await readStopMarker(state, command.runId))
+            return memberStatus(await stoppedRecord(state, command, existing));
+        if (existing && existing.ownerFence === command.ownerFence && existing.commandHash?.generate === hash && existing.phase === 'generate' && existing.state !== 'running') {
+            return memberStatus(await reconcileGenerate(state, existing));
+        }
+        if (existing && existing.ownerFence === command.ownerFence && existing.commandHash?.generate && existing.commandHash.generate !== hash)
+            throw new Error('batch_command_conflict');
+        const root = await workspaceRoot(state, command.workspaceId, command.directoryName);
+        const sessionId = command.sessionId ?? existing?.sessionId ?? `member-${command.runId}`;
+        const tempDir = join(state.config.stateDir, 'batch-temp', command.runId);
+        await mkdir(tempDir, { recursive: true, mode: 0o700 });
+        const policy = memberExecutionPolicy(root, tempDir);
+        await bindMemberPolicy(state, sessionId, policy);
+        const modelConfigId = command.model && /^[0-9a-f-]{36}$/i.test(command.model) ? command.model : undefined;
+        const turnPayload = { text: command.prompt, permissionMode: 'auto', ...(modelConfigId ? { modelConfigId } : {}) };
+        const turnKey = operation(state, { kind: 'session.turn', clientRequestId: `batch-turn:${command.runId}`, sessionId, workspaceId: command.workspaceId, directoryName: command.directoryName, payload: turnPayload });
+        const prior = state.journal.getOperation(turnKey.scopeKey);
+        if (prior && prior.payloadHash !== turnKey.record.payloadHash)
+            throw new Error('batch_command_conflict');
+        const sourceCommit = existing?.sourceCommit ?? state.journal.getWorkspace(command.workspaceId)?.directories?.find(directory => directory.directoryName === command.directoryName)?.sourceCommit;
+        const beforeTree = existing?.beforeTree ?? (prior ? sourceCommit : await snapshotWorkspaceTree(root));
+        let record = await writeMember(state, {
+            runId: command.runId, ownerFence: command.ownerFence, occupancyId: command.occupancyId, workspaceId: command.workspaceId,
+            directoryName: command.directoryName, phase: 'generate', state: prior ? (prior.status === 'uncertain' ? 'unknown' : prior.status === 'completed' ? 'completed' : 'running') : 'running',
+            writersStopped: false, holding: true, stopRequested: false, processes: existing?.processes ?? [], sessionId,
+            operationId: prior?.operationId, commandHash: { ...existing?.commandHash, generate: hash },
+            snapshotDigest: existing?.snapshotDigest, branchName: existing?.branchName, headCommit: existing?.headCommit,
+            sourceCommit, beforeTree,
+            updatedAt: new Date().toISOString(),
+        });
+        if (prior)
+            return memberStatus(await finishGenerate(state, record, prior, root));
+        if (!state.native?.ready()) {
+            record = await writeMember(state, { ...record, state: 'failed', writersStopped: true, holding: false, error: 'capability_unavailable' });
+            return memberStatus(record);
+        }
+        const terminals = new Map();
+        const unsubscribe = state.native.onCollected?.((event) => {
+            const threadId = threadIdOf(event);
+            const terminal = turnTerminal(event);
+            if (!threadId || !terminal)
+                return;
+            if (terminals.get(threadId) === 'needs_user')
+                return;
+            terminals.set(threadId, terminal);
+        });
+        try {
+            if (!state.journal.getSession(sessionId)) {
+                const created = operation(state, { kind: 'session.create', clientRequestId: `batch-create:${command.runId}`, sessionId, workspaceId: command.workspaceId, directoryName: command.directoryName, payload: { permissionMode: 'auto', ...(modelConfigId ? { modelConfigId } : {}) } });
+                if (!state.journal.getOperation(created.scopeKey))
+                    await executeOperation(state, created.scopeKey, created.record, { permissionMode: 'auto', ...(modelConfigId ? { modelConfigId } : {}) });
+            }
+            if (await readStopMarker(state, command.runId))
+                return memberStatus(await stoppedRecord(state, command, record));
+            const started = await executeOperation(state, turnKey.scopeKey, turnKey.record, turnPayload);
+            record = await writeMember(state, { ...record, operationId: started.operationId, sessionId });
+            return memberStatus(await finishGenerate(state, record, started, root, () => {
+                const threadId = state.journal.getSession(sessionId)?.threadId;
+                return threadId ? terminals.get(threadId) : undefined;
+            }));
+        }
+        finally {
+            unsubscribe?.();
+        }
+    });
+}
+async function finishGenerate(state, record, started, root, early) {
+    if (await readStopMarker(state, record.runId))
+        return stoppedRecord(state, { ...record, occupancyId: record.occupancyId }, record);
+    const sessionId = record.sessionId;
+    let terminal = early?.();
+    if (!terminal && (started.status === 'uncertain' || started.error === 'native_receipt_lost')) {
+        return writeMember(state, { ...record, state: 'unknown', writersStopped: false, holding: true, operationId: started.operationId, error: 'native_receipt_lost' });
+    }
+    if (!terminal && started.status === 'failed') {
+        const writersStopped = await proveStopped(record);
+        return writeMember(state, { ...record, state: writersStopped ? 'failed' : 'stopping', writersStopped, holding: !writersStopped, operationId: started.operationId, error: started.error ?? 'batch_turn_failed' });
+    }
+    const deadline = Date.now() + 5_000;
+    while (!terminal && Date.now() < deadline) {
+        terminal = early?.();
+        const session = state.journal.getSession(sessionId);
+        if (session?.turnStatus === 'waiting_for_user')
+            terminal = 'needs_user';
+        else if (session?.turnStatus === 'completed')
+            terminal = 'completed';
+        else if (session?.turnStatus === 'failed')
+            terminal = 'failed';
+        else if (session?.turnStatus === 'interrupted')
+            terminal = 'interrupted';
+        if (!terminal)
+            await delay(15);
+    }
+    if (terminal === 'needs_user') {
+        const session = state.journal.getSession(sessionId);
+        if (session?.threadId)
+            await state.native?.interrupt?.({ sessionId, threadId: session.threadId }).catch(() => undefined);
+        const writersStopped = await proveStopped(record);
+        if (await readStopMarker(state, record.runId))
+            return stoppedRecord(state, record, record);
+        return writeMember(state, {
+            ...record, state: writersStopped ? 'needs_user' : 'stopping', writersStopped, holding: writersStopped ? false : true,
+            operationId: started.operationId, error: writersStopped ? 'needs_user' : undefined,
+        });
+    }
+    if (terminal === 'completed') {
+        const writersStopped = await proveStopped(record);
+        if (!writersStopped)
+            return writeMember(state, { ...record, state: 'stopping', writersStopped: false, holding: true, operationId: started.operationId });
+        if (await readStopMarker(state, record.runId))
+            return stoppedRecord(state, record, record);
+        return completeGeneration(state, { ...record, operationId: started.operationId }, root);
+    }
+    if (!terminal) {
+        return writeMember(state, {
+            ...record, state: 'running', writersStopped: false, holding: true, operationId: started.operationId, error: undefined,
+        });
+    }
+    const writersStopped = await proveStopped(record);
+    return writeMember(state, {
+        ...record, state: writersStopped ? (terminal === 'interrupted' ? 'stopped' : 'failed') : 'unknown',
+        writersStopped, holding: !writersStopped, operationId: started.operationId,
+        error: writersStopped ? (terminal === 'interrupted' ? undefined : 'batch_turn_failed') : 'native_receipt_lost',
+    });
+}
+/** A later status read finishes a generate turn that was still running when dispatch returned. */
+export async function settleObservedGenerate(state, record) {
+    if (record.phase !== 'generate' || record.state !== 'running' || record.stopRequested)
+        return record;
+    const session = record.sessionId ? state.journal.getSession(record.sessionId) : undefined;
+    if (!session || session.turnBlock === 'uncertain' || session.turnStatus === 'starting' || session.turnStatus === 'running')
+        return record;
+    const terminal = session.turnStatus === 'completed' ? 'completed'
+        : session.turnStatus === 'failed' ? 'failed'
+            : session.turnStatus === 'interrupted' ? 'interrupted'
+                : session.turnStatus === 'waiting_for_user' ? 'needs_user'
+                    : undefined;
+    if (!terminal)
+        return record;
+    const root = await workspaceRoot(state, record.workspaceId, record.directoryName);
+    return finishGenerate(state, record, { operationId: record.operationId, status: 'accepted' }, root, () => terminal);
+}
+async function reconcileGenerate(state, record) {
+    const session = record.sessionId ? state.journal.getSession(record.sessionId) : undefined;
+    if (record.state === 'unknown' && session?.turnStatus === 'completed') {
+        const writersStopped = await proveStopped(record);
+        if (writersStopped && !await readStopMarker(state, record.runId)) {
+            const root = await workspaceRoot(state, record.workspaceId, record.directoryName);
+            return completeGeneration(state, record, root);
+        }
+    }
+    return record;
+}
+async function completeGeneration(state, record, root) {
+    try {
+        const afterTree = await snapshotWorkspaceTree(root);
+        await requireBatchContentChanges(root, record.beforeTree ?? '', afterTree);
+        await requireBatchContentChanges(root, record.sourceCommit ?? '', afterTree);
+    }
+    catch (error) {
+        const code = error instanceof Error && /^[a-z0-9_]+$/.test(error.message) ? error.message : 'batch_generation_failed';
+        return writeMember(state, { ...record, state: 'failed', writersStopped: true, holding: false, error: code });
+    }
+    if (await readStopMarker(state, record.runId))
+        return stoppedRecord(state, record, record);
+    const head = await import('./git.js').then(git => git.gitRead(root, ['rev-parse', 'HEAD'])).then(value => value.trim()).catch(() => record.headCommit);
+    return writeMember(state, { ...record, state: 'completed', writersStopped: true, holding: true, headCommit: head, error: undefined });
+}
+async function stoppedRecord(state, command, existing) {
+    if (existing)
+        await proveStopped(existing);
+    return writeMember(state, {
+        runId: command.runId, ownerFence: command.ownerFence, occupancyId: command.occupancyId, workspaceId: command.workspaceId,
+        directoryName: command.directoryName, phase: existing?.phase ?? 'generate', state: 'stopped', writersStopped: true, holding: false,
+        stopRequested: true, processes: existing?.processes ?? [], sessionId: existing?.sessionId, operationId: existing?.operationId,
+        headCommit: existing?.headCommit, evidence: existing?.evidence, commandHash: existing?.commandHash, snapshotDigest: existing?.snapshotDigest,
+        branchName: existing?.branchName, updatedAt: new Date().toISOString(),
+        sourceCommit: existing?.sourceCommit, beforeTree: existing?.beforeTree,
+    });
+}

package/dist/workspace-runtime/batch/git.js

@@ -0,0 +1,40 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { dirname } from 'node:path';
+const execute = promisify(execFile);
+/** Read-only git. An empty credential helper keeps the source checkout from authenticating or writing. */
+export async function gitRead(root, args) {
+    return runGit(root, ['-c', 'credential.helper=', ...args]);
+}
+/** Push and fetch. Local credential helpers copied onto this repo stay in effect. */
+export async function gitWrite(root, args) {
+    return runGit(root, args);
+}
+async function runGit(root, args) {
+    const { stdout } = await execute('git', [
+        '-c', 'core.hooksPath=/dev/null', '-c', 'init.templateDir=', '-c', 'core.fsmonitor=false', '-C', root, ...args,
+    ], {
+        timeout: 90_000, maxBuffer: 64 * 1024 * 1024,
+        env: {
+            PATH: process.env.PATH, HOME: dirname(root), GIT_OPTIONAL_LOCKS: '0',
+            GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1', GIT_TERMINAL_PROMPT: '0',
+        },
+    });
+    return stdout;
+}
+/** Copies URL credential helpers onto a snapshot repo without reading or writing the source config. */
+export async function copyCredentialHelpers(sourceRoot, destinationRoot) {
+    const listed = await gitRead(sourceRoot, ['config', '--local', '--get-regexp', '^(credential\\.|http\\.|url\\.)']).catch(() => '');
+    for (const line of listed.split('\n')) {
+        if (!line)
+            continue;
+        const space = line.indexOf(' ');
+        if (space < 1)
+            continue;
+        const key = line.slice(0, space);
+        const value = line.slice(space + 1);
+        if (!/^(credential\.|http\.|url\.)/.test(key) || /[\r\n]/.test(value))
+            continue;
+        await gitWrite(destinationRoot, ['config', '--local', key, value]);
+    }
+}

package/dist/workspace-runtime/batch/occupancy.js

@@ -0,0 +1,8 @@
+import { listMembers } from './records.js';
+/** True while a member Run still holds the directory. Other sandbox write entries must refuse it. */
+export async function batchDirectoryHeld(state, workspaceId, directoryName = 'basic') {
+    if (!workspaceId)
+        return false;
+    const members = await listMembers(state);
+    return members.some(record => record.holding && record.workspaceId === workspaceId && record.directoryName === directoryName);
+}

package/dist/workspace-runtime/batch/policy.js

@@ -0,0 +1,70 @@
+import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { dirname, join } from 'node:path';
+const memory = new WeakMap();
+/** Unattended member execution: workspace-write to the member directory and one controlled temp dir. */
+export function memberExecutionPolicy(cwd, tempDir) {
+    return {
+        cwd,
+        approvalPolicy: 'never',
+        sandboxPolicy: {
+            type: 'workspaceWrite',
+            writableRoots: [cwd, tempDir],
+            networkAccess: true,
+            excludeTmpdirEnvVar: true,
+            excludeSlashTmp: true,
+        },
+    };
+}
+function policyPath(state, sessionId) {
+    return join(state.config.stateDir, 'batch-sessions', `${sessionId.replace(/[^a-zA-Z0-9._-]/g, '_')}.json`);
+}
+function parsePolicy(raw) {
+    const value = JSON.parse(raw);
+    if (value?.approvalPolicy !== 'never' || value.sandboxPolicy?.type !== 'workspaceWrite')
+        return undefined;
+    if (!value.cwd || !Array.isArray(value.sandboxPolicy.writableRoots) || value.sandboxPolicy.writableRoots.length === 0)
+        return undefined;
+    if (!value.sandboxPolicy.excludeSlashTmp || !value.sandboxPolicy.excludeTmpdirEnvVar)
+        return undefined;
+    return value;
+}
+export async function bindMemberPolicy(state, sessionId, policy) {
+    const path = policyPath(state, sessionId);
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    writeFileSync(temporary, JSON.stringify(policy), { mode: 0o600 });
+    renameSync(temporary, path);
+    const map = memory.get(state) ?? new Map();
+    map.set(sessionId, policy);
+    memory.set(state, map);
+}
+/** Synchronous: the shared session adapter reapplies this on every thread start and resume. */
+export function trustedMemberPolicy(state, sessionId) {
+    const cached = memory.get(state)?.get(sessionId);
+    if (cached)
+        return cached;
+    try {
+        const parsed = parsePolicy(readFileSync(policyPath(state, sessionId), 'utf8'));
+        if (!parsed) {
+            return {
+                cwd: state.config.workspaceRoot,
+                approvalPolicy: 'never',
+                sandboxPolicy: { type: 'readOnly', networkAccess: false },
+            };
+        }
+        const map = memory.get(state) ?? new Map();
+        map.set(sessionId, parsed);
+        memory.set(state, map);
+        return parsed;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        return {
+            cwd: state.config.workspaceRoot,
+            approvalPolicy: 'never',
+            sandboxPolicy: { type: 'readOnly', networkAccess: false },
+        };
+    }
+}