@spotpatch/dev-server 0.2.0 → 0.3.0

package/dist/index.js

@@ -280,7 +280,7 @@ function createAgentJobManager(options) {
         transition(job, "completed", "No source changes were proposed.");
         return;
       }
-      const shouldApplyDirectly = options.ai.execution.applyMode === "auto" && preparedChange.autoApplyEligible || options.ai.execution.applyMode === "trusted-auto" && job.trustedFastModeConsent;
+      const shouldApplyDirectly = job.applyMode === "auto" && preparedChange.autoApplyEligible || job.applyMode === "trusted-auto" && job.trustedFastModeConsent;
       if (shouldApplyDirectly) {
         try {
           await applyChange(job, preparedChange);
@@ -356,8 +356,11 @@ function createAgentJobManager(options) {
       if (closed) {
         throw new SpotPatchError(ERROR_CODES.AI_DISABLED);
       }
-      const trustedFastModeConfigured = options.ai.execution.applyMode === "trusted-auto";
-      if (trustedFastModeConfigured !== (request.trustedFastModeConsent === true)) {
+      const configuredApplyMode = options.ai.execution.applyMode;
+      const requestedApplyMode = request.applyMode ?? (request.trustedFastModeConsent === true ? "trusted-auto" : configuredApplyMode);
+      const applyModeAllowed = configuredApplyMode === "trusted-auto" ? requestedApplyMode === "review" || requestedApplyMode === "trusted-auto" : requestedApplyMode === configuredApplyMode;
+      const trustedConsentMatches = requestedApplyMode === "trusted-auto" === (request.trustedFastModeConsent === true);
+      if (!applyModeAllowed || !trustedConsentMatches) {
         throw new SpotPatchError(ERROR_CODES.INVALID_REQUEST);
       }
       if (hasActiveJob()) {
@@ -378,6 +381,7 @@ function createAgentJobManager(options) {
       const timestamp = dependencies.now();
       const job = {
         annotation: request.annotation,
+        applyMode: requestedApplyMode,
         controller: new AbortController(),
         createdAt: timestamp,
         credential: selection.credential,
@@ -549,6 +553,181 @@ function resolveEnvironmentAiConfiguration(environment) {
   });
 }
 
+// src/integration/file-plan.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import {
+  access,
+  lstat,
+  mkdir,
+  readFile,
+  realpath,
+  rename,
+  stat,
+  unlink,
+  writeFile
+} from "fs/promises";
+import path from "path";
+function isMissingPathError(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+function isPathWithin(root, target) {
+  const relative = path.relative(root, target);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+function relativePathWithin(root, target) {
+  const relative = path.relative(root, target);
+  if (relative.length === 0 || !isPathWithin(root, target)) {
+    throw new Error("SpotPatch init refuses to modify a path outside the app root.");
+  }
+  return relative.split(path.sep).join("/");
+}
+async function integrationPathExists(absolutePath) {
+  try {
+    await access(absolutePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readIntegrationFile(absolutePath) {
+  const metadata = await lstat(absolutePath);
+  if (!metadata.isFile() || metadata.isSymbolicLink()) {
+    throw new Error(
+      `SpotPatch refuses to modify the non-regular file ${path.basename(absolutePath)}.`
+    );
+  }
+  return readFile(absolutePath, "utf8");
+}
+function createIntegrationFileChange(appRoot, absolutePath, nextContent, previousContent) {
+  if (previousContent === nextContent) {
+    return void 0;
+  }
+  const root = path.resolve(appRoot);
+  const target = path.resolve(absolutePath);
+  return Object.freeze({
+    absolutePath: target,
+    nextContent,
+    ...previousContent === void 0 ? {} : { previousContent },
+    relativePath: relativePathWithin(root, target)
+  });
+}
+function temporaryPath(absolutePath, label) {
+  return path.join(
+    path.dirname(absolutePath),
+    `.${path.basename(absolutePath)}.spotpatch-${label}-${String(process.pid)}-${randomBytes2(8).toString("hex")}`
+  );
+}
+async function writeAtomic(absolutePath, content, mode) {
+  await mkdir(path.dirname(absolutePath), { recursive: true });
+  const stagedPath = temporaryPath(absolutePath, "stage");
+  try {
+    await writeFile(stagedPath, content, { encoding: "utf8", flag: "wx", mode });
+    await rename(stagedPath, absolutePath);
+  } catch (error) {
+    await unlink(stagedPath).catch(() => void 0);
+    throw error;
+  }
+}
+async function rollbackChange(change) {
+  const currentContent = await readIntegrationFile(change.absolutePath);
+  if (currentContent !== change.nextContent) {
+    throw new Error(
+      `SpotPatch init cannot restore ${change.relativePath} because it changed during initialization.`
+    );
+  }
+  if (change.previousContent === void 0) {
+    await unlink(change.absolutePath);
+    return;
+  }
+  const mode = (await stat(change.absolutePath)).mode & 511;
+  await writeAtomic(change.absolutePath, change.previousContent, mode);
+}
+async function assertSafeTarget(appRoot, realAppRoot, change) {
+  const target = path.resolve(change.absolutePath);
+  const relativePath = relativePathWithin(appRoot, target);
+  if (target !== change.absolutePath || relativePath !== change.relativePath || path.dirname(target) === target) {
+    throw new Error("SpotPatch init received an invalid integration file plan.");
+  }
+  let targetMetadata;
+  try {
+    targetMetadata = await lstat(target);
+  } catch (error) {
+    if (!isMissingPathError(error)) {
+      throw error;
+    }
+  }
+  if (targetMetadata?.isSymbolicLink()) {
+    throw new Error(
+      `SpotPatch refuses to modify the symbolic link ${change.relativePath}.`
+    );
+  }
+  const containmentAnchor = await realpath(
+    targetMetadata === void 0 ? path.dirname(target) : target
+  );
+  if (!isPathWithin(realAppRoot, containmentAnchor)) {
+    throw new Error("SpotPatch init refuses to modify a path outside the app root.");
+  }
+}
+async function assertCurrentBaseline(change) {
+  if (change.previousContent === void 0) {
+    try {
+      await lstat(change.absolutePath);
+    } catch (error) {
+      if (isMissingPathError(error)) {
+        return;
+      }
+      throw error;
+    }
+    throw new Error(
+      `SpotPatch init cannot create ${change.relativePath} because it now exists.`
+    );
+  }
+  const currentContent = await readIntegrationFile(change.absolutePath);
+  if (currentContent !== change.previousContent) {
+    throw new Error(
+      `SpotPatch init cannot update ${change.relativePath} because it changed after the preview.`
+    );
+  }
+}
+async function applyIntegrationPlan(plan) {
+  if (plan.changes.length === 0) {
+    return;
+  }
+  const appRoot = path.resolve(plan.appRoot);
+  const realAppRoot = await realpath(appRoot);
+  const targets = /* @__PURE__ */ new Set();
+  for (const change of plan.changes) {
+    if (targets.has(change.absolutePath)) {
+      throw new Error("SpotPatch init received duplicate integration file changes.");
+    }
+    targets.add(change.absolutePath);
+    await assertSafeTarget(appRoot, realAppRoot, change);
+    await assertCurrentBaseline(change);
+  }
+  const applied = [];
+  try {
+    for (const change of plan.changes) {
+      await assertCurrentBaseline(change);
+      const mode = change.previousContent === void 0 ? 384 : (await stat(change.absolutePath)).mode & 511;
+      await writeAtomic(change.absolutePath, change.nextContent, mode);
+      applied.push(change);
+    }
+  } catch (error) {
+    const rollbackResults = await Promise.allSettled(
+      applied.reverse().map(rollbackChange)
+    );
+    if (rollbackResults.some((result) => result.status === "rejected")) {
+      throw new Error(
+        "SpotPatch init failed and could not completely restore the previous files.",
+        { cause: error }
+      );
+    }
+    throw new Error("SpotPatch init failed; all written files were restored.", {
+      cause: error
+    });
+  }
+}
+
 // src/options.ts
 import {
   AGENT_APPLY_MODES,
@@ -880,6 +1059,9 @@ function assertPositiveBudget(budget) {
   }
 }
 function resolveOptions(options = {}, environmentAi) {
+  if (options.trustedFastMode !== void 0 && typeof options.trustedFastMode !== "boolean") {
+    throw new RangeError("SpotPatch trustedFastMode must be a boolean.");
+  }
   const budget = Object.freeze({
     ...DEFAULT_OPTIONS.budget,
     ...options.budget
@@ -919,17 +1101,179 @@ function resolveOptions(options = {}, environmentAi) {
   return Object.freeze(resolved);
 }
 
+// src/project-validation.ts
+import { execFile } from "child_process";
+import { access as access2, lstat as lstat2, readFile as readFile2, realpath as realpath2 } from "fs/promises";
+import { createRequire } from "module";
+import path2 from "path";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var TYPESCRIPT_CHECK_ID = "spotpatch-typecheck";
+var TYPESCRIPT_CHECK_LABEL = "TypeScript";
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function isRegularFile(absolutePath) {
+  try {
+    const metadata = await lstat2(absolutePath);
+    return metadata.isFile() && !metadata.isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+async function readManifest(appRoot) {
+  const manifestPath = path2.join(appRoot, "package.json");
+  if (!await isRegularFile(manifestPath)) {
+    return void 0;
+  }
+  try {
+    const value = JSON.parse(await readFile2(manifestPath, "utf8"));
+    return isRecord(value) ? value : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function declaresTypeScript(manifest) {
+  return [
+    manifest.dependencies,
+    manifest.devDependencies,
+    manifest.peerDependencies
+  ].some(
+    (dependencies) => isRecord(dependencies) && typeof dependencies.typescript === "string"
+  );
+}
+async function findGitRoot(appRoot) {
+  try {
+    const result = await execFileAsync("git", ["rev-parse", "--show-toplevel"], {
+      cwd: appRoot,
+      encoding: "utf8",
+      timeout: 5e3,
+      windowsHide: true
+    });
+    const root = await realpath2(result.stdout.trim());
+    const relative = path2.relative(root, appRoot);
+    if (relative === "" || !relative.startsWith(`..${path2.sep}`) && relative !== ".." && !path2.isAbsolute(relative)) {
+      return root;
+    }
+  } catch {
+    return void 0;
+  }
+  return void 0;
+}
+async function resolveTypeScriptCli(appRoot) {
+  const resolveFromApplication = createRequire(path2.join(appRoot, "package.json"));
+  try {
+    const packagePath = resolveFromApplication.resolve("typescript/package.json");
+    const cliPath = path2.join(path2.dirname(packagePath), "bin", "tsc");
+    await access2(cliPath);
+    return await realpath2(cliPath);
+  } catch {
+    return void 0;
+  }
+}
+function portableRelativePath(from, to) {
+  return path2.relative(from, to).split(path2.sep).join("/");
+}
+async function discoverProjectValidationCheck(options) {
+  const appRoot = await realpath2(options.appRoot);
+  const tsconfigPath = path2.join(appRoot, "tsconfig.json");
+  const [manifest, projectRoot, hasTsconfig] = await Promise.all([
+    readManifest(appRoot),
+    findGitRoot(appRoot),
+    isRegularFile(tsconfigPath)
+  ]);
+  if (manifest === void 0 || projectRoot === void 0 || !hasTsconfig || !declaresTypeScript(manifest)) {
+    return void 0;
+  }
+  const cliPath = await resolveTypeScriptCli(appRoot);
+  if (cliPath === void 0) {
+    return void 0;
+  }
+  const projectPath = portableRelativePath(projectRoot, tsconfigPath);
+  if (projectPath.length === 0 || projectPath.startsWith("../")) {
+    return void 0;
+  }
+  return Object.freeze({
+    id: TYPESCRIPT_CHECK_ID,
+    label: TYPESCRIPT_CHECK_LABEL,
+    command: process.execPath,
+    args: Object.freeze([
+      cliPath,
+      "--noEmit",
+      "--pretty",
+      "false",
+      "--project",
+      projectPath
+    ]),
+    required: true,
+    timeoutMs: options.timeoutMs
+  });
+}
+
+// src/project-options.ts
+function hasRequiredCheck(ai) {
+  return Object.values(ai.execution.checks).some((check) => check.required);
+}
+function availableCheckId(checks, preferred) {
+  if (checks[preferred] === void 0) {
+    return preferred;
+  }
+  let suffix = 2;
+  while (checks[`${preferred}-${String(suffix)}`] !== void 0) {
+    suffix += 1;
+  }
+  return `${preferred}-${String(suffix)}`;
+}
+async function resolveProjectOptions(input) {
+  const userOptions = input.options ?? {};
+  const resolved = resolveOptions(userOptions, input.environmentAi);
+  if (!userOptions.trustedFastMode || resolved.ai === false) {
+    return resolved;
+  }
+  if (resolved.ai.execution.applyMode === "auto") {
+    throw new RangeError(
+      "SpotPatch trustedFastMode cannot be combined with applyMode auto."
+    );
+  }
+  let checks = resolved.ai.execution.checks;
+  if (!hasRequiredCheck(resolved.ai)) {
+    const discovered = await discoverProjectValidationCheck({
+      appRoot: input.appRoot,
+      timeoutMs: resolved.ai.execution.limits.checkTimeoutMs
+    });
+    if (discovered === void 0) {
+      throw new RangeError(
+        "SpotPatch trustedFastMode requires a configured required check or a local TypeScript project with tsconfig.json."
+      );
+    }
+    const id = availableCheckId(checks, discovered.id);
+    checks = Object.freeze({
+      ...checks,
+      [id]: Object.freeze({ ...discovered, id })
+    });
+  }
+  const ai = Object.freeze({
+    ...resolved.ai,
+    execution: Object.freeze({
+      ...resolved.ai.execution,
+      applyMode: "trusted-auto",
+      checks
+    })
+  });
+  return Object.freeze({ ...resolved, ai });
+}
+
 // src/registry/source-registry.ts
-import path from "path";
+import path3 from "path";
 
 // src/registry/source-id.ts
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes as randomBytes3 } from "crypto";
 var SOURCE_ID_BYTES = 8;
-var createRandomSourceId = () => randomBytes2(SOURCE_ID_BYTES).toString("base64url");
+var createRandomSourceId = () => randomBytes3(SOURCE_ID_BYTES).toString("base64url");
 
 // src/registry/source-registry.ts
 function normalizeAbsolutePath(absolutePath) {
-  return path.normalize(path.resolve(absolutePath));
+  return path3.normalize(path3.resolve(absolutePath));
 }
 function createSourceRegistry(options = {}) {
   const createId = options.createId ?? createRandomSourceId;
@@ -982,16 +1326,16 @@ import {
 } from "@spotpatch/shared";
 
 // src/server/agent-request.ts
-import { realpath as realpath3 } from "fs/promises";
-import path4 from "path";
+import { realpath as realpath5 } from "fs/promises";
+import path6 from "path";
 import {
   ERROR_CODES as ERROR_CODES4,
   SpotPatchError as SpotPatchError4
 } from "@spotpatch/shared";
 
 // src/server/source-context.ts
-import { readFile, realpath as realpath2 } from "fs/promises";
-import path3 from "path";
+import { readFile as readFile3, realpath as realpath4 } from "fs/promises";
+import path5 from "path";
 import {
   ERROR_CODES as ERROR_CODES3,
   SpotPatchError as SpotPatchError3
@@ -1227,8 +1571,8 @@ function extractCodeContext(options) {
 }
 
 // src/server/source-file.ts
-import { realpath, stat } from "fs/promises";
-import path2 from "path";
+import { realpath as realpath3, stat as stat2 } from "fs/promises";
+import path4 from "path";
 import { ERROR_CODES as ERROR_CODES2, SpotPatchError as SpotPatchError2 } from "@spotpatch/shared";
 
 // src/server/constants.ts
@@ -1246,8 +1590,8 @@ async function assertInsideRoot(root, candidate) {
   let realCandidate;
   try {
     [realRoot, realCandidate] = await Promise.all([
-      realpath(root),
-      realpath(candidate)
+      realpath3(root),
+      realpath3(candidate)
     ]);
   } catch (error) {
     if (isMissingFileError(error)) {
@@ -1257,8 +1601,8 @@ async function assertInsideRoot(root, candidate) {
     }
     throw error;
   }
-  const relative = path2.relative(realRoot, realCandidate);
-  const outside = relative.startsWith(`..${path2.sep}`) || relative === ".." || path2.isAbsolute(relative);
+  const relative = path4.relative(realRoot, realCandidate);
+  const outside = relative.startsWith(`..${path4.sep}`) || relative === ".." || path4.isAbsolute(relative);
   if (outside) {
     throw new SpotPatchError2(ERROR_CODES2.SOURCE_OUTSIDE_ROOT);
   }
@@ -1270,12 +1614,12 @@ async function resolveSourceFile(options) {
     throw new SpotPatchError2(ERROR_CODES2.SOURCE_NOT_FOUND);
   }
   const sourcePath = await assertInsideRoot(options.root, registeredPath);
-  if (!ALLOWED_EXTENSIONS.has(path2.extname(sourcePath).toLowerCase())) {
+  if (!ALLOWED_EXTENSIONS.has(path4.extname(sourcePath).toLowerCase())) {
     throw new SpotPatchError2(ERROR_CODES2.SOURCE_NOT_FOUND);
   }
   let sourceStat;
   try {
-    sourceStat = await stat(sourcePath);
+    sourceStat = await stat2(sourcePath);
   } catch (error) {
     if (isMissingFileError(error)) {
       throw new SpotPatchError2(ERROR_CODES2.SOURCE_NOT_FOUND, void 0, {
@@ -1295,7 +1639,7 @@ async function resolveSourceFile(options) {
 
 // src/server/source-context.ts
 function toDisplayPath(root, sourcePath) {
-  return path3.relative(root, sourcePath).split(path3.sep).join("/");
+  return path5.relative(root, sourcePath).split(path5.sep).join("/");
 }
 async function readSourceContext(options) {
   const sourcePath = await resolveSourceFile({
@@ -1305,7 +1649,7 @@ async function readSourceContext(options) {
   });
   let source;
   try {
-    source = await readFile(sourcePath, "utf8");
+    source = await readFile3(sourcePath, "utf8");
   } catch (error) {
     if (error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR")) {
       throw new SpotPatchError3(ERROR_CODES3.SOURCE_NOT_FOUND, void 0, {
@@ -1318,11 +1662,11 @@ async function readSourceContext(options) {
   if (options.request.line > lines.length) {
     throw new SpotPatchError3(ERROR_CODES3.INVALID_REQUEST);
   }
-  const extension = path3.extname(sourcePath).toLowerCase();
+  const extension = path5.extname(sourcePath).toLowerCase();
   return extractCodeContext({
     source,
     sourcePath,
-    relativePath: toDisplayPath(await realpath2(options.root), sourcePath),
+    relativePath: toDisplayPath(await realpath4(options.root), sourcePath),
     language: extension === ".tsx" ? "tsx" : "jsx",
     line: options.request.line,
     column: options.request.column,
@@ -1358,7 +1702,7 @@ async function authorizeSourceRef(source, registry, root) {
     registry,
     root
   });
-  const relativePath = path4.relative(await realpath3(root), sourcePath).split(path4.sep).join("/");
+  const relativePath = path6.relative(await realpath5(root), sourcePath).split(path6.sep).join("/");
   if (source.relativePath !== void 0 && source.relativePath !== relativePath) {
     throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
   }
@@ -1463,6 +1807,7 @@ async function authorizeAgentJobRequest(input) {
   });
   return Object.freeze({
     annotation,
+    ...input.request.applyMode === void 0 ? {} : { applyMode: input.request.applyMode },
     providerProfileId: input.request.providerProfileId,
     modelProfileId: input.request.modelProfileId,
     providerDataConsent: true,
@@ -1529,21 +1874,21 @@ var EVENT_STREAM_END_STATUSES = /* @__PURE__ */ new Set([
   "reverted",
   "failed"
 ]);
-function matchAgentRequestPath(path6) {
-  if (path6 === SPOTPATCH_ENDPOINTS.agentCapability) {
+function matchAgentRequestPath(path8) {
+  if (path8 === SPOTPATCH_ENDPOINTS.agentCapability) {
     return Object.freeze({ kind: "capability" });
   }
-  if (path6 === SPOTPATCH_ENDPOINTS.agentWorkspaceHealth) {
+  if (path8 === SPOTPATCH_ENDPOINTS.agentWorkspaceHealth) {
     return Object.freeze({ kind: "workspace-health" });
   }
-  if (path6 === SPOTPATCH_ENDPOINTS.agentJobs) {
+  if (path8 === SPOTPATCH_ENDPOINTS.agentJobs) {
     return Object.freeze({ kind: "create-job" });
   }
   const prefix = `${SPOTPATCH_ENDPOINTS.agentJobs}/`;
-  if (!path6.startsWith(prefix)) {
+  if (!path8.startsWith(prefix)) {
     return void 0;
   }
-  const segments = path6.slice(prefix.length).split("/");
+  const segments = path8.slice(prefix.length).split("/");
   const jobId = segments[0];
   const action = segments[1];
   if (segments.length !== 2 || jobId === void 0 || !AGENT_JOB_ID_PATTERN.test(jobId) || action === void 0 || !AGENT_JOB_ACTIONS.has(action)) {
@@ -2071,14 +2416,14 @@ async function handleOpenEditor(request, options) {
 function createSpotPatchMiddleware(options) {
   const bootstrap = options.bootstrap === void 0 ? void 0 : resolveRuntimeBootstrapOptions(options.bootstrap);
   return (request, response, next) => {
-    const path6 = requestPath(request);
-    const agentRoute = matchAgentRequestPath(path6);
-    if (path6 !== SPOTPATCH_ENDPOINTS2.sourceContext && path6 !== SPOTPATCH_ENDPOINTS2.openEditor && agentRoute === void 0 && !path6.startsWith(`${SPOTPATCH_API_BASE}/`)) {
+    const path8 = requestPath(request);
+    const agentRoute = matchAgentRequestPath(path8);
+    if (path8 !== SPOTPATCH_ENDPOINTS2.sourceContext && path8 !== SPOTPATCH_ENDPOINTS2.openEditor && agentRoute === void 0 && !path8.startsWith(`${SPOTPATCH_API_BASE}/`)) {
       next();
       return;
     }
     const handle = async () => {
-      if (path6 === SPOTPATCH_ENDPOINTS2.bootstrap && bootstrap !== void 0) {
+      if (path8 === SPOTPATCH_ENDPOINTS2.bootstrap && bootstrap !== void 0) {
         const data = await readRuntimeBootstrap(
           request,
           bootstrap
@@ -2090,7 +2435,7 @@ function createSpotPatchMiddleware(options) {
         allowLan: options.options.allowLan,
         sessionToken: options.session.token
       });
-      if (path6 === SPOTPATCH_ENDPOINTS2.sourceContext) {
+      if (path8 === SPOTPATCH_ENDPOINTS2.sourceContext) {
         if (request.method !== "POST") {
           throw new SpotPatchError9(ERROR_CODES9.INVALID_REQUEST);
         }
@@ -2098,7 +2443,7 @@ function createSpotPatchMiddleware(options) {
         writeJson(response, 200, { ok: true, data });
         return;
       }
-      if (path6 === SPOTPATCH_ENDPOINTS2.openEditor) {
+      if (path8 === SPOTPATCH_ENDPOINTS2.openEditor) {
         if (request.method !== "POST") {
           throw new SpotPatchError9(ERROR_CODES9.INVALID_REQUEST);
         }
@@ -2127,8 +2472,8 @@ function createSpotPatchMiddleware(options) {
 
 // src/server/source-registration.ts
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
-import { lstat, realpath as realpath4 } from "fs/promises";
-import path5 from "path";
+import { lstat as lstat3, realpath as realpath6 } from "fs/promises";
+import path7 from "path";
 import { createSourceFilter } from "@spotpatch/compiler";
 import { z as z2 } from "zod";
 var REGISTRATION_BODY_LIMIT_BYTES = 4096;
@@ -2152,11 +2497,11 @@ function identitiesMatch(actual, expected) {
   return actualBytes.byteLength === expectedBytes.byteLength && timingSafeEqual2(actualBytes, expectedBytes);
 }
 function isWithinRoot(root, candidate) {
-  const relative = path5.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${path5.sep}`) && relative !== ".." && !path5.isAbsolute(relative);
+  const relative = path7.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path7.sep}`) && relative !== ".." && !path7.isAbsolute(relative);
 }
 function hasForbiddenSegment(root, candidate) {
-  return path5.relative(root, candidate).split(path5.sep).some((segment) => FORBIDDEN_SOURCE_SEGMENTS.has(segment));
+  return path7.relative(root, candidate).split(path7.sep).some((segment) => FORBIDDEN_SOURCE_SEGMENTS.has(segment));
 }
 function writeJson2(response, statusCode, payload) {
   const body = JSON.stringify(payload);
@@ -2178,15 +2523,15 @@ function requestComesFromLoopbackWorker(request) {
   }
 }
 async function resolveAuthorizedSource(root, requestedPath, shouldTransform) {
-  if (!path5.isAbsolute(requestedPath) || requestedPath.includes("\0")) {
+  if (!path7.isAbsolute(requestedPath) || requestedPath.includes("\0")) {
     return void 0;
   }
   try {
-    const sourceStat = await lstat(requestedPath);
+    const sourceStat = await lstat3(requestedPath);
     if (!sourceStat.isFile() || sourceStat.isSymbolicLink()) {
       return void 0;
     }
-    const resolvedPath = await realpath4(requestedPath);
+    const resolvedPath = await realpath6(requestedPath);
     if (!isWithinRoot(root, resolvedPath) || hasForbiddenSegment(root, resolvedPath) || !shouldTransform(resolvedPath)) {
       return void 0;
     }
@@ -2199,7 +2544,7 @@ async function createSourceRegistrationService(input) {
   if (!REGISTRATION_IDENTITY_PATTERN.test(input.internalSecret) || !REGISTRATION_IDENTITY_PATTERN.test(input.registryEpoch)) {
     throw new TypeError("The source registration identity is invalid.");
   }
-  const root = await realpath4(input.root);
+  const root = await realpath6(input.root);
   const sourceFilter = createSourceFilter(root, input.options);
   const handler = (request, response) => {
     const handle = async () => {
@@ -2244,11 +2589,11 @@ async function createSourceRegistrationService(input) {
 }
 
 // src/session/session.ts
-import { randomBytes as randomBytes3 } from "crypto";
+import { randomBytes as randomBytes4 } from "crypto";
 function createSession() {
   return Object.freeze({
-    id: randomBytes3(16).toString("base64url"),
-    token: randomBytes3(16).toString("base64url")
+    id: randomBytes4(16).toString("base64url"),
+    token: randomBytes4(16).toString("base64url")
   });
 }
 
@@ -2276,7 +2621,7 @@ var BUDGET_KEYS = Object.freeze([
   "maxComponentDepth"
 ]);
 var REGEXP_FLAGS_PATTERN = /^(?!.*(.).*\1)[dgimsuvy]*$/u;
-function isRecord(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasExactKeys(value, keys) {
@@ -2361,7 +2706,7 @@ function parseFilterList(value) {
   }
   return Object.freeze(
     value.map((entry) => {
-      if (!isRecord(entry)) {
+      if (!isRecord2(entry)) {
         throw new TypeError("The SpotPatch filter transport is invalid.");
       }
       if (entry.kind === "string" && hasExactKeys(entry, ["kind", "value"]) && typeof entry.value === "string" && entry.value.length > 0 && entry.value.length <= 1024 && !entry.value.includes("\0")) {
@@ -2379,7 +2724,7 @@ function parseFilterList(value) {
   );
 }
 function parseBudget(value) {
-  if (!isRecord(value) || !hasExactKeys(value, BUDGET_KEYS)) {
+  if (!isRecord2(value) || !hasExactKeys(value, BUDGET_KEYS)) {
     throw new TypeError("The SpotPatch budget transport is invalid.");
   }
   const budget = Object.fromEntries(
@@ -2388,10 +2733,10 @@ function parseBudget(value) {
   return Object.freeze(budget);
 }
 function parseSerializedSpotPatchOptions(value) {
-  if (!isRecord(value) || !hasExactKeys(value, OPTION_KEYS)) {
+  if (!isRecord2(value) || !hasExactKeys(value, OPTION_KEYS)) {
     throw new TypeError("The SpotPatch options transport is invalid.");
   }
-  if (typeof value.enabled !== "boolean" || typeof value.redact !== "boolean" || typeof value.allowLan !== "boolean" || typeof value.debug !== "boolean" || typeof value.shortcut !== "string" || typeof value.maxTargets !== "number" || typeof value.editor !== "string" || typeof value.locale !== "string" || value.ai !== false && !isRecord(value.ai)) {
+  if (typeof value.enabled !== "boolean" || typeof value.redact !== "boolean" || typeof value.allowLan !== "boolean" || typeof value.debug !== "boolean" || typeof value.shortcut !== "string" || typeof value.maxTargets !== "number" || typeof value.editor !== "string" || typeof value.locale !== "string" || value.ai !== false && !isRecord2(value.ai)) {
     throw new TypeError("The SpotPatch options transport is invalid.");
   }
   try {
@@ -2418,19 +2763,25 @@ function parseSerializedSpotPatchOptions(value) {
 export {
   DEFAULT_EXCLUDE,
   DEFAULT_OPTIONS,
+  applyIntegrationPlan,
   createAgentJobManager,
+  createIntegrationFileChange,
   createRuntimeAiConfig,
   createSession,
   createSourceRegistrationService,
   createSourceRegistry,
   createSpotPatchMiddleware,
+  discoverProjectValidationCheck,
+  integrationPathExists,
   isLoopbackHostname,
   parseSerializedSpotPatchOptions,
+  readIntegrationFile,
   readJsonRequestBody,
   readRuntimeBootstrap,
   resolveCredentialEnvironment,
   resolveEnvironmentAiConfiguration,
   resolveOptions,
+  resolveProjectOptions,
   resolveRuntimeBootstrapOptions,
   serializeResolvedSpotPatchOptions
 };