@sema-ai/core 1.275.1

package/dist/core/hooks.js

@@ -0,0 +1,269 @@
+import { decisionText } from "./tool-policy.js";
+/**
+ * 1.256 复审 MED-1 — observe-only payload isolation for {@link Hooks.permissionDenied}: clone the tool
+ * args before they ride the observer payload, so a hook mutating `payload.input` can never pollute the
+ * LIVE args object (later events / audit records share it). Same posture as the postToolUseFailure
+ * details clone (prepare-task): `structuredClone` first; a non-structured-cloneable graph
+ * (functions/handles) falls back to a SHALLOW plain object/array copy (top-level mutation isolated);
+ * a non-object primitive passes through as-is (immutable anyway).
+ */
+export function cloneObserverInput(input) {
+    try {
+        return structuredClone(input);
+    }
+    catch {
+        if (Array.isArray(input))
+            return [...input];
+        if (input !== null && typeof input === "object")
+            return { ...input };
+        return input;
+    }
+}
+/** Wrap model-facing hook/gate feedback in a `<system-reminder>` so it reads as guidance, not data.
+ *  NOTE (council design/74 #6): this does NOT escape a literal `</system-reminder>` in `text` — callers MUST
+ *  pass trusted, first-party strings (every current caller does: fixed gate/limit messages). If a future
+ *  caller needs to relay UNTRUSTED content (tool output, user data), it must sanitize the close tag first
+ *  (or use the `delimitUntrusted` fence), or a crafted payload could break out of the reminder framing. */
+export function formatHookFeedback(text) {
+    return `<system-reminder>\n${text}\n</system-reminder>`;
+}
+/**
+ * design/77 §4: resolve `p`, but REJECT (so the caller catches and fails closed) if it hasn't settled within
+ * `ms` OR the `signal` aborts first (the task timed out / was cancelled — its real deadline). A rejection of
+ * `p` propagates with its true cause. Both `ms` and `signal` undefined ⇒ no deadline (await `p`). Mirrors
+ * `tool-policy.ts withTimeout`, but REJECTS on timeout (the probe has no safe fallback VALUE — the gate's
+ * only safe action on an unresolved probe is to tighten to ask).
+ */
+function withProbeTimeout(p, ms, signal) {
+    if (ms === undefined && signal === undefined)
+        return p;
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const done = (fn, v) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timer !== undefined)
+                clearTimeout(timer);
+            signal?.removeEventListener("abort", onAbort);
+            fn(v);
+        };
+        const onAbort = () => done(reject, new Error("reversibilityProbe aborted (task ended)"));
+        const timer = ms !== undefined
+            ? setTimeout(() => done(reject, new Error(`reversibilityProbe timed out after ${ms}ms`)), ms)
+            : undefined;
+        if (signal?.aborted) {
+            onAbort();
+            return;
+        }
+        signal?.addEventListener("abort", onAbort);
+        p.then((v) => done(resolve, v), (err) => done(reject, err));
+    });
+}
+/**
+ * The design/37 **two-phase tool gate** — the single chokepoint that makes the load-bearing invariant
+ * structural ("a hook's `allow` cannot bypass the policy's `deny`/`ask`"):
+ *
+ *  1. **collect** — run the PreToolUse hook, threading any `updatedInput` rewrite into `currentInput`
+ *     and collecting `additionalContext`. A hook `deny` short-circuits to a block immediately; a hook
+ *     `ask` is remembered (it does not short-circuit — a later policy `deny` outranks it).
+ *  2. **adjudicate** — run the tool policy on the FINAL `currentInput` (never the model's stale args),
+ *     fold it with any remembered hook-ask via `deny > ask > allow`, and resolve a surviving `ask`
+ *     through `onAsk`. The policy ALWAYS runs regardless of the hook's verdict. A policy `allow` may
+ *     itself carry an `updatedInput` rewrite (redact/clamp), applied last over any hook rewrite.
+ *
+ * Because both phases run in this one linear function, the ordering — and the "policy is final"
+ * invariant — is enforced by the call stack, not by registration convention. Returns the gate result
+ * for the harness `tool_call` hook plus the PreToolUse context to attach to the tool result.
+ */
+export async function runToolGate(input) {
+    const { event, preToolUse, adjudicate, resolveAsk, suspendAsk } = input;
+    const { toolCallId, toolName } = event;
+    let currentInput = event.input;
+    const preToolContext = [];
+    let hookAsk;
+    // Phase 1: collect — PreToolUse hook may rewrite args, restrict, and/or inject context.
+    if (preToolUse) {
+        const r = await preToolUse(toolName, currentInput, { toolCallId, toolName });
+        if (r) {
+            if (r.additionalContext) {
+                preToolContext.push(r.additionalContext);
+            }
+            if (r.action === "deny") {
+                // design/134 R5: a PreToolUse hook deny does NOT fire `permissionDenied` (CC-exact: "PreToolUse
+                // hook denies bypass canUseTool and are not covered here") — this return stays observer-free.
+                return {
+                    block: true,
+                    reason: formatHookFeedback(decisionText(r) ?? `tool "${toolName}" blocked by a PreToolUse hook`),
+                    preToolContext,
+                };
+            }
+            if (r.action === "ask") {
+                hookAsk = r; // fold into adjudication; a policy deny still outranks it
+            }
+            else if (r.updatedInput !== undefined) {
+                currentInput = r.updatedInput; // rewrite; the policy below sees this, never the stale args
+            }
+        }
+    }
+    // Phase 2: adjudicate — the policy runs on the FINAL args and is the final say.
+    const req = { toolName, args: currentInput, toolCallId };
+    let decision = adjudicate ? await adjudicate(req) : { action: "allow" };
+    // design/134 R5: attribute WHO raised the gate that (may) end in a deny — the PermissionDenied `source`.
+    // Starts as "policy" (a direct policy deny, or a policy-raised ask later resolved to deny) and is
+    // re-attributed by each promotion below (hook-ask fold → "hook"; egress/irreversibility tighten →
+    // "safety"/"shellGate"). Only consumed at the single deny exit at the bottom of this function.
+    let denySource = "policy";
+    // Fold the remembered hook-ask: deny > ask > allow. A policy deny/ask already outranks (or ties) an
+    // ask, so only promote allow→ask.
+    // B-1 (round-2 audit): a policy `allow{updatedInput}` (redact a secret, clamp a path) was silently lost
+    // when a hook-ask promoted the decision to `ask` — after the human approves, the resolved `allow` carries
+    // no rewrite, so the tool ran on un-redacted args. Remember the policy rewrite BEFORE the promotion and
+    // re-apply it on the approved path (the redaction is not cancelled just because a human confirmed).
+    // Capture a rewrite from EITHER an allow OR an ask: combinePolicies now carries an accumulated rewrite
+    // out on the ask when an ask outranks a later redaction (round-2 council confirmed dropping it was a real
+    // bug). Either way the redaction must survive a hook-ask promotion + human approval.
+    // R-4 (round-3 council): the rewrite can come from the policy (allow/ask) OR — when the policy returns a
+    // bare allow — from a hook's own `ask{updatedInput}` (`hookAsk`, which the type widening now permits and
+    // was previously a dead field). Policy takes priority (it runs last / is the final say); the hook rewrite
+    // is the fallback. This single `policyRewrite` then survives the promotion + approval below.
+    let policyRewrite;
+    if ((decision.action === "allow" || decision.action === "ask") && decision.updatedInput !== undefined) {
+        policyRewrite = decision.updatedInput;
+    }
+    else if (hookAsk?.action === "ask" && hookAsk.updatedInput !== undefined) {
+        policyRewrite = hookAsk.updatedInput;
+    }
+    if (decision.action === "allow" && hookAsk) {
+        decision = hookAsk;
+        denySource = "hook"; // R5: the gate now standing is the PreToolUse hook's ask, not a policy verdict
+    }
+    // design/70 post-fold tighten: an egress-marked tool (external write) is NEVER auto-allowed — a
+    // surviving `allow` (the no-policy default OR an explicit/blanket policy allow) is tightened to `ask`,
+    // so execution always passes an explicit ask-resolution: synchronous onAsk, a durable suspend
+    // (design/45 — approve the PR from anywhere), or a deployment-authored approver. With no approver
+    // wired, `resolveAsk` auto-denies (headless: an external write never happens without confirmation).
+    // Ordering is load-bearing: AFTER the policyRewrite capture (a redaction survives the tighten +
+    // approval exactly like a hook-ask promotion) and AFTER the hook-ask fold (already `ask` → no-op).
+    // A policy `deny`/`ask` is untouched — the tighten only ever tightens.
+    if (input.egress && decision.action === "allow") {
+        decision = {
+            action: "ask",
+            message: `tool "${toolName}" performs an external write (egress) — explicit approval required`,
+            decisionReason: "safety",
+        };
+        denySource = "safety"; // R5: the standing gate is the deterministic egress tighten
+    }
+    // design/77 §4 (Gate 4) post-fold tighten — runs immediately AFTER the egress tighten, on the SAME axis
+    // (only ever tightens a surviving `allow` to `ask`; a `deny`/`ask` is untouched, and an egress tool already
+    // tightened to `ask` is a no-op here, idempotent under deny>ask). An IRREVERSIBLE tool (send money/email,
+    // file a return) is NEVER auto-allowed: execution must pass an explicit ask-resolution (onAsk / durable
+    // `irreversible_ask` suspend / approver). `"always"` always tightens; `"maybe"` calls the deployment's
+    // `reversibilityProbe` on the post-hook args and tightens UNLESS it reports reversible — fail-closed: a
+    // timeout, a throw, or any non-`reversible` verdict tightens to ask (the probe can never auto-allow).
+    if (decision.action === "allow" && (input.irreversibility === "always" || input.irreversibility === "maybe")) {
+        let tighten = true;
+        if (input.irreversibility === "maybe" && input.reversibilityProbe) {
+            let reversible = false;
+            try {
+                const verdict = await withProbeTimeout(Promise.resolve(input.reversibilityProbe(currentInput)), input.approvalTimeoutMs, input.abortSignal);
+                reversible = verdict?.reversible === true;
+            }
+            catch {
+                reversible = false; // fail-closed: a throwing probe must not auto-allow an irreversible action
+            }
+            tighten = !reversible;
+        }
+        if (tighten) {
+            decision = {
+                action: "ask",
+                message: `tool "${toolName}" performs an irreversible action — explicit approval required`,
+                decisionReason: "safety",
+            };
+            // R5: a coarse-shellGate-installed tier attributes to "shellGate"; an explicit per-tool mark to "safety".
+            denySource = input.shellGated === true ? "shellGate" : "safety";
+        }
+    }
+    if (decision.action === "ask") {
+        // R-1 (round-3 council): apply `policyRewrite` to the args BEFORE checkpointing on the durable path.
+        // Resume BYPASSES the gate (`prepare-task.ts` — the human already adjudicated the checkpointed call) and
+        // executes the stored postHookArgs verbatim; if we checkpoint un-redacted args here, resume runs them
+        // un-redacted (a redacting policy's sanitization is lost). Merging into `currentInput`/`req.args` now
+        // means the checkpoint stores the REDACTED args. No double-apply — resume never re-runs the gate.
+        if (policyRewrite !== undefined) {
+            currentInput = policyRewrite;
+            req.args = policyRewrite;
+        }
+        // design/45: in durable mode, persist a checkpoint + abort instead of asking synchronously. The
+        // suspend decision lives ONLY in this `ask` branch (the policy already ran and stays pure). On
+        // `undefined` (no durable mode, or capture failed) fall through to the synchronous onAsk path.
+        if (suspendAsk) {
+            // design/80 D-2 (council BLOCKER fix): thread the SAFETY grade to the mint-site from the AUTHORITATIVE
+            // TOOL MARKS (`input.egress` / `input.irreversibility`), NOT from how the ask arose. The gate's egress/
+            // irreversibility tightens only fire from a surviving `allow`; if a POLICY or PreToolUse HOOK already
+            // returned `ask` on a safety-marked tool, those tightens are skipped and `decisionReason` is not
+            // "safety" — yet the tool is STILL egress/irreversible and MUST mint the non-budgetable `irreversible_ask`
+            // (else a budget auto-approves the git-push/send-money — the exact r2 bypass D-2 closes). Keying on the
+            // static tool marks instead of the per-call `decisionReason` also closes the inverse: a policy/hook can no
+            // longer FORGE `decisionReason:"safety"` on an unmarked tool to force `irreversible_ask`. A tool with
+            // NEITHER mark → a plain ask → budgetable `human`. `"maybe"` counts as irreversible here: an ask for it
+            // means either the probe did not prove it reversible (it tightened) or a policy asked before the probe ran
+            // (unknown ⇒ fail-closed). The deployment's lever to make a tool budgetable is `irreversibility:"never"`.
+            const egressTool = input.egress === true;
+            const irreversibleTool = input.irreversibility === "always" || input.irreversibility === "maybe";
+            const safety = egressTool || irreversibleTool ? { egress: egressTool, irreversible: irreversibleTool } : undefined;
+            const suspended = await suspendAsk(req, currentInput, safety);
+            if (suspended) {
+                return { suspend: suspended, preToolContext };
+            }
+        }
+        decision = await resolveAsk(decision, req);
+    }
+    if (decision.action === "deny") {
+        // design/134 R5 — the SINGLE deny exit of the adjudicate chain (every path funnels here: a direct
+        // policy deny, and every tighten/fold whose surviving `ask` resolved to deny — headless auto-deny,
+        // approver-no, approval-abort). The durable-suspend path returned `{ suspend }` above (ask domain —
+        // never fires this), and a PreToolUse hook deny returned in phase 1 (CC-exact exclusion).
+        const denyReason = decisionText(decision) ?? `tool "${toolName}" denied by policy`;
+        // 1.256 复审 MED-2: a combined-policy deny can carry the ACCUMULATED pre-deny rewrite (policy A
+        // redacted → policy B denied; combinePolicies now returns it as `deny.updatedInput`). Fold it into
+        // `currentInput` so the observer payload honors its "FINAL post-rewrite args" contract — without
+        // this, the deny observer saw the stale un-redacted args.
+        if (decision.updatedInput !== undefined) {
+            currentInput = decision.updatedInput;
+        }
+        if (input.permissionDenied) {
+            try {
+                // MED-1: clone the args (observe-only isolation) — a hook mutating `payload.input` must not
+                // pollute the live args object shared with later events/audit.
+                await input.permissionDenied({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason: denyReason, source: denySource });
+            }
+            catch {
+                /* observe-only: a throwing observer (or wrapper) must never alter the deny outcome */
+            }
+        }
+        return {
+            block: true,
+            reason: formatHookFeedback(denyReason),
+            preToolContext,
+        };
+    }
+    // A policy `allow` may itself REWRITE args (redact a secret, clamp a path/value) — apply it as the
+    // final say, layered over any hook rewrite (the policy runs last). The loop re-validates it against the
+    // tool schema like a hook rewrite. An `ask` that was promoted/approved here carries no rewrite of its
+    // own, so we fall back to `policyRewrite` (captured above from the original allow OR ask) — the redaction
+    // survives approval.
+    if (decision.action === "allow") {
+        // B-1: prefer the resolved decision's own rewrite; fall back to the policy rewrite remembered before a
+        // hook-ask promotion / on the ask path (the promoted-then-approved path carries no updatedInput itself).
+        const rw = decision.updatedInput !== undefined ? decision.updatedInput : policyRewrite;
+        if (rw !== undefined)
+            currentInput = rw;
+    }
+    // Allowed. Carry a rewrite only when phase 1 or 2 actually changed the args (else the loop skips re-validation).
+    return {
+        updatedInput: currentInput === event.input ? undefined : currentInput,
+        preToolContext,
+    };
+}
+//# sourceMappingURL=hooks.js.map

package/dist/core/hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/core/hooks.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA+IhD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,EAAE,GAAI,KAAiC,EAAE,CAAC;QAClG,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AA2ID;;;;2GAI2G;AAC3G,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,sBAAsB,IAAI,sBAAsB,CAAC;AAC1D,CAAC;AA4FD;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAI,CAAa,EAAE,EAAsB,EAAE,MAAoB;IACtF,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACvD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,EAAsB,EAAE,CAAQ,EAAE,EAAE;YAChD,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,EAAE,CAAC,CAAC,CAAC,CAAC;QACR,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,MAAe,EAAE,IAAI,KAAK,CAAC,yCAAyC,CAAU,CAAC,CAAC;QAC3G,MAAM,KAAK,GACT,EAAE,KAAK,SAAS;YACd,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAe,EAAE,IAAI,KAAK,CAAC,sCAAsC,EAAE,IAAI,CAAU,CAAC,EAAE,EAAE,CAAC;YAC/G,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC,CAAC,IAAI,CACJ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAgB,EAAE,CAAU,CAAC,EACzC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAe,EAAE,GAAY,CAAC,CAC7C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAoB;IACpD,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACxE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACvC,IAAI,YAAY,GAAY,KAAK,CAAC,KAAK,CAAC;IACxC,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,IAAI,OAAqC,CAAC;IAE1C,wFAAwF;IACxF,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,EAAE,CAAC;YACN,IAAI,CAAC,CAAC,iBAAiB,EAAE,CAAC;gBACxB,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAC3C,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACxB,gGAAgG;gBAChG,8FAA8F;gBAC9F,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,SAAS,QAAQ,gCAAgC,CAAC;oBAChG,cAAc;iBACf,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACvB,OAAO,GAAG,CAAC,CAAC,CAAC,0DAA0D;YACzE,CAAC;iBAAM,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACxC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,4DAA4D;YAC7F,CAAC;QACH,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,MAAM,GAAG,GAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;IAC1E,IAAI,QAAQ,GAAqB,UAAU,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC1F,yGAAyG;IACzG,kGAAkG;IAClG,kGAAkG;IAClG,+FAA+F;IAC/F,IAAI,UAAU,GAA2B,QAAQ,CAAC;IAElD,oGAAoG;IACpG,kCAAkC;IAClC,wGAAwG;IACxG,0GAA0G;IAC1G,wGAAwG;IACxG,oGAAoG;IACpG,uGAAuG;IACvG,0GAA0G;IAC1G,qFAAqF;IACrF,yGAAyG;IACzG,yGAAyG;IACzG,0GAA0G;IAC1G,6FAA6F;IAC7F,IAAI,aAAsB,CAAC;IAC3B,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACtG,aAAa,GAAG,QAAQ,CAAC,YAAY,CAAC;IACxC,CAAC;SAAM,IAAI,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC3E,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IACvC,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,IAAI,OAAO,EAAE,CAAC;QAC3C,QAAQ,GAAG,OAAO,CAAC;QACnB,UAAU,GAAG,MAAM,CAAC,CAAC,+EAA+E;IACtG,CAAC;IACD,gGAAgG;IAChG,uGAAuG;IACvG,8FAA8F;IAC9F,kGAAkG;IAClG,oGAAoG;IACpG,gGAAgG;IAChG,mGAAmG;IACnG,uEAAuE;IACvE,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAChD,QAAQ,GAAG;YACT,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,SAAS,QAAQ,oEAAoE;YAC9F,cAAc,EAAE,QAAQ;SACzB,CAAC;QACF,UAAU,GAAG,QAAQ,CAAC,CAAC,4DAA4D;IACrF,CAAC;IACD,wGAAwG;IACxG,4GAA4G;IAC5G,0GAA0G;IAC1G,wGAAwG;IACxG,uGAAuG;IACvG,wGAAwG;IACxG,sGAAsG;IACtG,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,KAAK,QAAQ,IAAI,KAAK,CAAC,eAAe,KAAK,OAAO,CAAC,EAAE,CAAC;QAC7G,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,KAAK,CAAC,eAAe,KAAK,OAAO,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;YAClE,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,gBAAgB,CACpC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,EACvD,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,WAAW,CAClB,CAAC;gBACF,UAAU,GAAG,OAAO,EAAE,UAAU,KAAK,IAAI,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,GAAG,KAAK,CAAC,CAAC,2EAA2E;YACjG,CAAC;YACD,OAAO,GAAG,CAAC,UAAU,CAAC;QACxB,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,GAAG;gBACT,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,SAAS,QAAQ,gEAAgE;gBAC1F,cAAc,EAAE,QAAQ;aACzB,CAAC;YACF,0GAA0G;YAC1G,UAAU,GAAG,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;QAClE,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC9B,qGAAqG;QACrG,yGAAyG;QACzG,sGAAsG;QACtG,sGAAsG;QACtG,kGAAkG;QAClG,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,YAAY,GAAG,aAAa,CAAC;YAC7B,GAAG,CAAC,IAAI,GAAG,aAAa,CAAC;QAC3B,CAAC;QACD,gGAAgG;QAChG,+FAA+F;QAC/F,+FAA+F;QAC/F,IAAI,UAAU,EAAE,CAAC;YACf,uGAAuG;YACvG,wGAAwG;YACxG,sGAAsG;YACtG,iGAAiG;YACjG,2GAA2G;YAC3G,wGAAwG;YACxG,2GAA2G;YAC3G,sGAAsG;YACtG,wGAAwG;YACxG,2GAA2G;YAC3G,0GAA0G;YAC1G,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC;YACzC,MAAM,gBAAgB,GAAG,KAAK,CAAC,eAAe,KAAK,QAAQ,IAAI,KAAK,CAAC,eAAe,KAAK,OAAO,CAAC;YACjG,MAAM,MAAM,GAAG,UAAU,IAAI,gBAAgB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACnH,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;YAC9D,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;YAChD,CAAC;QACH,CAAC;QACD,QAAQ,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/B,kGAAkG;QAClG,mGAAmG;QACnG,oGAAoG;QACpG,0FAA0F;QAC1F,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,SAAS,QAAQ,oBAAoB,CAAC;QACnF,8FAA8F;QAC9F,mGAAmG;QACnG,iGAAiG;QACjG,0DAA0D;QAC1D,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACxC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;QACvC,CAAC;QACD,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,4FAA4F;gBAC5F,+DAA+D;gBAC/D,MAAM,KAAK,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1I,CAAC;YAAC,MAAM,CAAC;gBACP,sFAAsF;YACxF,CAAC;QACH,CAAC;QACD,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,kBAAkB,CAAC,UAAU,CAAC;YACtC,cAAc;SACf,CAAC;IACJ,CAAC;IACD,mGAAmG;IACnG,wGAAwG;IACxG,sGAAsG;IACtG,0GAA0G;IAC1G,qBAAqB;IACrB,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAChC,uGAAuG;QACvG,yGAAyG;QACzG,MAAM,EAAE,GAAG,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC;QACvF,IAAI,EAAE,KAAK,SAAS;YAAE,YAAY,GAAG,EAAE,CAAC;IAC1C,CAAC;IACD,iHAAiH;IACjH,OAAO;QACL,YAAY,EAAE,YAAY,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY;QACrE,cAAc;KACf,CAAC;AACJ,CAAC"}

package/dist/core/lsp-diagnostics.d.ts

@@ -0,0 +1,74 @@
+/**
+ * design/121 — LSP diagnostics registry + model-facing formatting (CC 2.1.198 parity).
+ *
+ * CC's two diagnostics sources (IDE MCP baseline/diff + passive LSP publishDiagnostics) collapse to
+ * ONE in sema: the passive registry. The "only NEW diagnostics" semantics CC gets from per-file
+ * baselines falls out of the delivered-set here — a diagnostic is injected at most once, and editing
+ * a file clears its delivered set so a persisting problem can resurface (CC `Fjn` same behavior).
+ *
+ * Volumes and wire format are CC-exact (198:320661 `Njn=10, nqa=30`; 198:320480-320505 summary +
+ * 4000-char cap; severity symbols ✖/⚠/ℹ/★).
+ *
+ * NOT durable: diagnostics regenerate from the language server on the next edit; a suspend/resume
+ * simply starts empty (recorded in design/121 §2).
+ */
+/** One LSP diagnostic, the subset the model/shell needs (LSP `Diagnostic` narrowed). */
+export interface LspDiagnostic {
+    message: string;
+    /** LSP severity: 1=Error 2=Warning 3=Information 4=Hint. Absent = unknown (sorted last). */
+    severity?: number;
+    range?: {
+        start: {
+            line: number;
+            character: number;
+        };
+        end?: {
+            line: number;
+            character: number;
+        };
+    };
+    code?: string | number;
+    source?: string;
+}
+/** One file's new diagnostics, as drained for injection + the wire frame. */
+export interface LspFileDiagnostics {
+    uri: string;
+    diagnostics: LspDiagnostic[];
+}
+/**
+ * Per-run pending/delivered registry. `publish` is called by an LSP session's publishDiagnostics
+ * subscription (whole-file replacement semantics, per the LSP spec); `drain` is called at the turn
+ * boundary and returns only diagnostics not yet delivered, sorted and volume-capped.
+ */
+export declare class LspDiagnosticsRegistry {
+    /** uri → the LAST published full diagnostic set for that file (LSP replace semantics). */
+    private readonly pending;
+    /** Keys already injected once — cleared per file when the agent edits it (may resurface). */
+    private readonly delivered;
+    /** Record a `textDocument/publishDiagnostics` payload (already version-checked by the session). */
+    publish(uri: string, diagnostics: LspDiagnostic[]): void;
+    /** The agent edited `uri` — its delivered set resets so a still-present problem can resurface
+     *  against the NEW text (CC clears per-file delivered on edit, 198 `Fjn`). */
+    fileEdited(uri: string): void;
+    /** True when a drain would produce nothing (cheap pre-check for the turn-boundary hook). */
+    isEmpty(): boolean;
+    /**
+     * Take the NEW (never-delivered) diagnostics: sorted Error>Warning>Info>Hint within each file,
+     * capped at {@link MAX_PER_FILE}/{@link MAX_TOTAL}, marked delivered. Pending is consumed (a file
+     * with only already-delivered diagnostics simply drops out until its server publishes again or the
+     * file is edited).
+     */
+    drain(): LspFileDiagnostics[];
+}
+/**
+ * CC 198 `formatDiagnosticsSummary` (198:320480-320499), verbatim shape:
+ * ```
+ * {basename}:
+ *   {symbol} [Line {line+1}:{col+1}] {message}[ [{code}]][ ({source})]
+ * ```
+ * capped at 4000 chars with an honest `…[truncated]` tail.
+ */
+export declare function formatDiagnosticsSummary(files: LspFileDiagnostics[]): string;
+/** CC 198 model-facing injection block (198:320500-320503), verbatim framing. */
+export declare function formatDiagnosticsBlock(files: LspFileDiagnostics[]): string;
+//# sourceMappingURL=lsp-diagnostics.d.ts.map

package/dist/core/lsp-diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lsp-diagnostics.d.ts","sourceRoot":"","sources":["../../src/core/lsp-diagnostics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,wFAAwF;AACxF,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE;QAAE,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,GAAG,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAClG,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,aAAa,EAAE,CAAC;CAC9B;AAyBD;;;;GAIG;AACH,qBAAa,sBAAsB;IACjC,0FAA0F;IAC1F,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAC9D,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAE/C,mGAAmG;IACnG,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,IAAI;IAMxD;kFAC8E;IAC9E,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAO7B,4FAA4F;IAC5F,OAAO,IAAI,OAAO;IAIlB;;;;;OAKG;IACH,KAAK,IAAI,kBAAkB,EAAE;CAiB9B;AASD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAa5E;AAED,iFAAiF;AACjF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAE1E"}

package/dist/core/lsp-diagnostics.js

@@ -0,0 +1,125 @@
+/**
+ * design/121 — LSP diagnostics registry + model-facing formatting (CC 2.1.198 parity).
+ *
+ * CC's two diagnostics sources (IDE MCP baseline/diff + passive LSP publishDiagnostics) collapse to
+ * ONE in sema: the passive registry. The "only NEW diagnostics" semantics CC gets from per-file
+ * baselines falls out of the delivered-set here — a diagnostic is injected at most once, and editing
+ * a file clears its delivered set so a persisting problem can resurface (CC `Fjn` same behavior).
+ *
+ * Volumes and wire format are CC-exact (198:320661 `Njn=10, nqa=30`; 198:320480-320505 summary +
+ * 4000-char cap; severity symbols ✖/⚠/ℹ/★).
+ *
+ * NOT durable: diagnostics regenerate from the language server on the next edit; a suspend/resume
+ * simply starts empty (recorded in design/121 §2).
+ */
+/** CC 198 volume caps (198:320661). */
+const MAX_PER_FILE = 10;
+const MAX_TOTAL = 30;
+/** CC 198 summary cap (198:320500 `Z4a`). */
+const MAX_SUMMARY_CHARS = 4000;
+/** CC 198 severity symbols (198:320505): Error=✖ Warning=⚠ Info=ℹ Hint=★, fallback ●. */
+function severitySymbol(severity) {
+    switch (severity) {
+        case 1: return "✖";
+        case 2: return "⚠";
+        case 3: return "ℹ";
+        case 4: return "★";
+        default: return "●";
+    }
+}
+/** Identity key for the delivered set — CC compares message+severity+source+code+range (198:320457). */
+function diagnosticKey(uri, d) {
+    const r = d.range ? `${d.range.start.line}:${d.range.start.character}-${d.range.end?.line ?? ""}:${d.range.end?.character ?? ""}` : "";
+    return `${uri}|${d.message}|${d.severity ?? ""}|${d.source ?? ""}|${d.code ?? ""}|${r}`;
+}
+/**
+ * Per-run pending/delivered registry. `publish` is called by an LSP session's publishDiagnostics
+ * subscription (whole-file replacement semantics, per the LSP spec); `drain` is called at the turn
+ * boundary and returns only diagnostics not yet delivered, sorted and volume-capped.
+ */
+export class LspDiagnosticsRegistry {
+    /** uri → the LAST published full diagnostic set for that file (LSP replace semantics). */
+    pending = new Map();
+    /** Keys already injected once — cleared per file when the agent edits it (may resurface). */
+    delivered = new Set();
+    /** Record a `textDocument/publishDiagnostics` payload (already version-checked by the session). */
+    publish(uri, diagnostics) {
+        // An empty set REPLACES too (the server saying "all clear") — it clears pending for the file.
+        if (diagnostics.length === 0)
+            this.pending.delete(uri);
+        else
+            this.pending.set(uri, diagnostics);
+    }
+    /** The agent edited `uri` — its delivered set resets so a still-present problem can resurface
+     *  against the NEW text (CC clears per-file delivered on edit, 198 `Fjn`). */
+    fileEdited(uri) {
+        const prefix = `${uri}|`;
+        for (const key of this.delivered) {
+            if (key.startsWith(prefix))
+                this.delivered.delete(key);
+        }
+    }
+    /** True when a drain would produce nothing (cheap pre-check for the turn-boundary hook). */
+    isEmpty() {
+        return this.pending.size === 0;
+    }
+    /**
+     * Take the NEW (never-delivered) diagnostics: sorted Error>Warning>Info>Hint within each file,
+     * capped at {@link MAX_PER_FILE}/{@link MAX_TOTAL}, marked delivered. Pending is consumed (a file
+     * with only already-delivered diagnostics simply drops out until its server publishes again or the
+     * file is edited).
+     */
+    drain() {
+        const out = [];
+        let total = 0;
+        for (const [uri, all] of this.pending) {
+            if (total >= MAX_TOTAL)
+                break;
+            const fresh = all
+                .filter((d) => !this.delivered.has(diagnosticKey(uri, d)))
+                .sort((a, b) => (a.severity ?? 99) - (b.severity ?? 99))
+                .slice(0, Math.min(MAX_PER_FILE, MAX_TOTAL - total));
+            if (fresh.length === 0)
+                continue;
+            for (const d of fresh)
+                this.delivered.add(diagnosticKey(uri, d));
+            total += fresh.length;
+            out.push({ uri, diagnostics: fresh });
+        }
+        this.pending.clear();
+        return out;
+    }
+}
+/** `file:///a/b/c.ts` → `c.ts` (CC's summary shows basenames, 198:320485). */
+function basenameOfUri(uri) {
+    const path = uri.replace(/^file:\/\//, "");
+    const idx = path.lastIndexOf("/");
+    return idx >= 0 ? path.slice(idx + 1) : path;
+}
+/**
+ * CC 198 `formatDiagnosticsSummary` (198:320480-320499), verbatim shape:
+ * ```
+ * {basename}:
+ *   {symbol} [Line {line+1}:{col+1}] {message}[ [{code}]][ ({source})]
+ * ```
+ * capped at 4000 chars with an honest `…[truncated]` tail.
+ */
+export function formatDiagnosticsSummary(files) {
+    const lines = [];
+    for (const f of files) {
+        lines.push(`${basenameOfUri(f.uri)}:`);
+        for (const d of f.diagnostics) {
+            const pos = d.range ? `[Line ${d.range.start.line + 1}:${d.range.start.character + 1}] ` : "";
+            const code = d.code !== undefined ? ` [${d.code}]` : "";
+            const source = d.source ? ` (${d.source})` : "";
+            lines.push(`  ${severitySymbol(d.severity)} ${pos}${d.message}${code}${source}`);
+        }
+    }
+    const summary = lines.join("\n");
+    return summary.length > MAX_SUMMARY_CHARS ? `${summary.slice(0, MAX_SUMMARY_CHARS)}…[truncated]` : summary;
+}
+/** CC 198 model-facing injection block (198:320500-320503), verbatim framing. */
+export function formatDiagnosticsBlock(files) {
+    return `<new-diagnostics>The following new diagnostic issues were detected:\n\n${formatDiagnosticsSummary(files)}</new-diagnostics>`;
+}
+//# sourceMappingURL=lsp-diagnostics.js.map

package/dist/core/lsp-diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lsp-diagnostics.js","sourceRoot":"","sources":["../../src/core/lsp-diagnostics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAkBH,uCAAuC;AACvC,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,6CAA6C;AAC7C,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,yFAAyF;AACzF,SAAS,cAAc,CAAC,QAAiB;IACvC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC;QACnB,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC;QACnB,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC;QACnB,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC;QACnB,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC;IACtB,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,SAAS,aAAa,CAAC,GAAW,EAAE,CAAgB;IAClD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvI,OAAO,GAAG,GAAG,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,sBAAsB;IACjC,0FAA0F;IACzE,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC9D,6FAA6F;IAC5E,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/C,mGAAmG;IACnG,OAAO,CAAC,GAAW,EAAE,WAA4B;QAC/C,8FAA8F;QAC9F,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;;YAClD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC1C,CAAC;IAED;kFAC8E;IAC9E,UAAU,CAAC,GAAW;QACpB,MAAM,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,4FAA4F;IAC5F,OAAO;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACH,KAAK;QACH,MAAM,GAAG,GAAyB,EAAE,CAAC;QACrC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACtC,IAAI,KAAK,IAAI,SAAS;gBAAE,MAAM;YAC9B,MAAM,KAAK,GAAG,GAAG;iBACd,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;iBACzD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;iBACvD,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC;YACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACjC,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACjE,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,8EAA8E;AAC9E,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAA2B;IAClE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,KAAK,CAAC,IAAI,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,OAAO,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,OAAO,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7G,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,sBAAsB,CAAC,KAA2B;IAChE,OAAO,0EAA0E,wBAAwB,CAAC,KAAK,CAAC,oBAAoB,CAAC;AACvI,CAAC"}

package/dist/core/lsp-protocol.d.ts

@@ -0,0 +1,28 @@
+import type { LspOperation, LspRequestParams, LspResult } from "./lsp.js";
+/**
+ * file:// URI for an absolute path. channel [388](service win32 真机逮):this serves TWO lanes —
+ * TOC host files (NodeLspManager, host semantics correct) AND remote WS-lane container paths
+ * (E2B/kata sidecar, Linux form). `pathToFileURL` is HOST-platform-semantic: on a win32 host it
+ * parses a remote `/home/user/x.ts` as drive-relative → `file:///C:/home/user/x.ts` → the remote
+ * LSP server gets a nonexistent URI(win32 host + 远程 lane 全瘫). Structural form detection
+ * instead(与 [385] fs-safety 双家族修同哲学——路径来自 ExecutionEnv,可能是另一家族,绝不按
+ * process.platform 判):POSIX-form absolutes are hand-assembled(percent-encoded per segment,
+ * no host path module);drive-letter form keeps `pathToFileURL`(CC parity for Windows files).
+ * On a POSIX host the hand-assembled branch matches `pathToFileURL(p).href` for typical paths(space 等常见字符同形;极端字符按 encodeURIComponent 更严格,LSP server 两者都收).
+ */
+export declare function pathToUri(p: string): string;
+/**
+ * [K-PLATFORM-SWEEP] MINOR#5: structural inverse of {@link pathToUri} — the naive `file://` prefix strip
+ * left win-form URIs as `/C:/x` (never matching the didOpen keys) and never percent-decoded (a space in a
+ * filename broke the staleness map). Form-detected, never host `fileURLToPath` (cross-family lanes).
+ */
+export declare function uriToPath(uri: string): string;
+/** The follow-up method for the 2-step call ops (issued by the session after prepareCallHierarchy). */
+export declare function callHierarchyMethod(op: "incomingCalls" | "outgoingCalls"): string;
+/** The LSP method + params for an op (incoming/outgoing FIRST issue prepareCallHierarchy — the session 2-steps). */
+export declare function buildRequest(op: LspOperation, params: LspRequestParams): {
+    method: string;
+    params: unknown;
+} | undefined;
+export declare function parseResult(op: LspOperation, raw: unknown): LspResult;
+//# sourceMappingURL=lsp-protocol.d.ts.map

package/dist/core/lsp-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lsp-protocol.d.ts","sourceRoot":"","sources":["../../src/core/lsp-protocol.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,SAAS,EAA8B,MAAM,UAAU,CAAC;AAEtG;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAK3C;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAe7C;AAED,uGAAuG;AACvG,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,eAAe,GAAG,eAAe,GAAG,MAAM,CAEjF;AAOD,oHAAoH;AACpH,wBAAgB,YAAY,CAAC,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,CAuBxH;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,GAAG,SAAS,CAwBrE"}