@stigmer/runner 3.0.1

package/dist/shared/workspace/platform-mount.js

@@ -0,0 +1,157 @@
+/**
+ * Virtual platform mount — path classification and display humanization
+ * for the `.stigmer/` namespace.
+ *
+ * The platform owns the `.stigmer/` namespace inside the agent's virtual
+ * view of the workspace. Platform files (skills, inputs) physically live
+ * in an external `platformDir` that is separate from the workspace
+ * `rootDir`. Backend path-resolution methods call `classifyPlatformPath`
+ * to decide whether a given path targets the platform mount or the
+ * workspace, keeping the routing decision in a single place.
+ *
+ * All functions in this module are **pure** — no I/O, no side effects.
+ * They operate exclusively on strings.
+ *
+ * See Python reference: graphton/core/backends/platform_mount.py (AD-01 v3).
+ */
+import { dirname } from "node:path";
+/** Prefix that identifies paths targeting the virtual platform mount. */
+export const PLATFORM_PREFIX = ".stigmer/";
+/** Directory name used in listings and equality checks. */
+export const PLATFORM_DIR_NAME = ".stigmer";
+/**
+ * Environment variable injected into `execute()` calls so shell commands
+ * can access platform files via `$STIGMER_PLATFORM_DIR/skills/…`.
+ */
+export const STIGMER_PLATFORM_DIR_ENV = "STIGMER_PLATFORM_DIR";
+/**
+ * Matches `$STIGMER_PLATFORM_DIR` and `${STIGMER_PLATFORM_DIR}` in
+ * display strings. Brace form is tried first so the replacement does not
+ * leave stray braces. The negative lookahead on the bare-dollar form
+ * prevents matching `$STIGMER_PLATFORM_DIR_OTHER` as a false positive.
+ */
+const PLATFORM_ENV_RE = new RegExp(`\\$\\{${STIGMER_PLATFORM_DIR_ENV}\\}`
+    + `|\\$${STIGMER_PLATFORM_DIR_ENV}(?![A-Za-z0-9_])`, "g");
+/**
+ * Matches `.stigmer` in shell commands when it appears as a standalone
+ * path component (e.g. `.stigmer/skills/…`), not as part of a longer
+ * name (`my.stigmer`) or a subdirectory (`foo/.stigmer`).
+ */
+const STIGMER_DIR_CMD_RE = /(?<!\w)(?<!\/)\.stigmer(?![a-zA-Z0-9_])/g;
+/**
+ * Classify whether `relPath` targets the virtual platform mount.
+ *
+ * Strips leading slashes before checking so that absolute-looking paths
+ * (`/.stigmer/skills/…`) are handled identically to relative ones.
+ *
+ * @returns An object with `isPlatform` (true when path falls under
+ *   `.stigmer/`) and `remainder` (the path relative to whichever root
+ *   applies — `platformDir` when platform, `rootDir` when workspace).
+ */
+export function classifyPlatformPath(relPath) {
+    const clean = relPath.replace(/^\/+/, "");
+    if (clean.startsWith(PLATFORM_PREFIX)) {
+        return { isPlatform: true, remainder: clean.slice(PLATFORM_PREFIX.length) };
+    }
+    if (clean === PLATFORM_DIR_NAME || clean === PLATFORM_DIR_NAME + "/") {
+        return { isPlatform: true, remainder: "" };
+    }
+    return { isPlatform: false, remainder: clean };
+}
+/**
+ * Replace platform environment-variable references with the user-facing
+ * `.stigmer` virtual-mount prefix.
+ *
+ * Intended for **display strings only** (approval previews, messages) —
+ * not for the actual command executed in the sandbox, where the shell
+ * must expand the real environment variable.
+ *
+ * Handles both `$STIGMER_PLATFORM_DIR` and `${STIGMER_PLATFORM_DIR}`.
+ */
+export function humanizePlatformRefs(text) {
+    if (!text)
+        return text;
+    return text.replace(PLATFORM_ENV_RE, PLATFORM_DIR_NAME);
+}
+/**
+ * Replace `.stigmer` virtual-mount references in a shell command with
+ * the `$STIGMER_PLATFORM_DIR` environment variable.
+ *
+ * The execute environment already has `STIGMER_PLATFORM_DIR` set, so
+ * the shell expands the variable at runtime.
+ *
+ * This is the inverse of `humanizePlatformRefs`: that function rewrites
+ * `$STIGMER_PLATFORM_DIR` → `.stigmer` for display, while this function
+ * rewrites `.stigmer` → `$STIGMER_PLATFORM_DIR` for execution.
+ *
+ * Callers **must** guard this behind a `platformDir != null` check to
+ * avoid replacing `.stigmer` when it is a real directory.
+ */
+export function resolvePlatformCommand(command) {
+    if (!command)
+        return command;
+    return command.replace(STIGMER_DIR_CMD_RE, `$${STIGMER_PLATFORM_DIR_ENV}`);
+}
+/**
+ * Replace absolute sandbox workspace paths with workspace-relative
+ * display paths.
+ *
+ * Intended for **display strings only** (approval previews, streamed
+ * messages) — not for the actual command executed in the sandbox.
+ *
+ * Performs three ordered replacements:
+ * 1. `workspaceRoot + "/"` → empty string (workspace-relative paths)
+ * 2. `workspaceRoot` (exact) → `"."` (the workspace root itself)
+ * 3. Sandbox home dir (parent of workspaceRoot) → `"~"` (paths outside
+ *    the workspace, e.g. `/home/daytona/.bashrc` → `~/.bashrc`)
+ *
+ * Returns `text` unchanged when `workspaceRoot` is empty.
+ */
+export function humanizeSandboxPaths(text, workspaceRoot) {
+    if (!text || !workspaceRoot)
+        return text;
+    const wsRoot = workspaceRoot.replace(/\/+$/, "");
+    // 1) workspace_root + "/" → "" (relative paths)
+    text = text.replaceAll(wsRoot + "/", "");
+    // 2) bare workspace_root → "." (must run after slash-suffixed above)
+    text = text.replaceAll(wsRoot, ".");
+    // 3) sandbox home → "~" (parent of workspace root)
+    const sandboxHome = dirname(wsRoot);
+    if (sandboxHome && sandboxHome !== "/") {
+        text = text.replaceAll(sandboxHome + "/", "~/");
+        text = text.replaceAll(sandboxHome, "~");
+    }
+    return text;
+}
+/**
+ * Resolve agent environment-variable references to their values in a
+ * display string.
+ *
+ * Replaces `$KEY` and `${KEY}` with the corresponding value from
+ * `envVars` for every key that is **not** marked as secret.
+ *
+ * `$STIGMER_PLATFORM_DIR` is handled separately by
+ * `humanizePlatformRefs` and is always skipped here.
+ *
+ * Call this **after** `humanizePlatformRefs` so platform paths are
+ * humanized before general env-var resolution runs.
+ */
+export function resolveDisplayEnvVars(text, envVars, secretKeys) {
+    if (!text || !envVars || Object.keys(envVars).length === 0)
+        return text;
+    const secrets = secretKeys ?? new Set();
+    for (const [key, value] of Object.entries(envVars)) {
+        if (key === STIGMER_PLATFORM_DIR_ENV)
+            continue;
+        if (secrets.has(key))
+            continue;
+        const pattern = new RegExp(`\\$\\{${escapeRegExp(key)}\\}`
+            + `|\\$${escapeRegExp(key)}(?![A-Za-z0-9_])`, "g");
+        text = text.replace(pattern, value);
+    }
+    return text;
+}
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+//# sourceMappingURL=platform-mount.js.map

package/dist/shared/workspace/platform-mount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-mount.js","sourceRoot":"","sources":["../../../src/shared/workspace/platform-mount.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAE3C,2DAA2D;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAE5C;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,SAAS,wBAAwB,KAAK;MACpC,OAAO,wBAAwB,kBAAkB,EACnD,GAAG,CACJ,CAAC;AAEF;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,0CAA0C,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAIlD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE1C,IAAI,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;IAC9E,CAAC;IAED,IAAI,KAAK,KAAK,iBAAiB,IAAI,KAAK,KAAK,iBAAiB,GAAG,GAAG,EAAE,CAAC;QACrE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC7C,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7B,OAAO,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE,IAAI,wBAAwB,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,aAAqB;IAErB,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEjD,gDAAgD;IAChD,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC;IAEzC,qEAAqE;IACrE,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEpC,mDAAmD;IACnD,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,WAAW,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAY,EACZ,OAA+B,EAC/B,UAAgC;IAEhC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAExE,MAAM,OAAO,GAAG,UAAU,IAAI,IAAI,GAAG,EAAU,CAAC;IAEhD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,KAAK,wBAAwB;YAAE,SAAS;QAC/C,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAE/B,MAAM,OAAO,GAAG,IAAI,MAAM,CACxB,SAAS,YAAY,CAAC,GAAG,CAAC,KAAK;cAC7B,OAAO,YAAY,CAAC,GAAG,CAAC,kBAAkB,EAC5C,GAAG,CACJ,CAAC;QACF,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC"}

package/dist/shared/workspace/provisioner.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Workspace provisioner — dispatches on WorkspaceSource proto type to
+ * populate a workspace directory.
+ *
+ * Supports three source variants:
+ * - git_repo: clone a repository
+ * - local_path: use an existing host directory
+ * - empty: create an empty workspace
+ *
+ * Multi-entry sessions provision each WorkspaceEntry into its own
+ * subdirectory of the workspace root.
+ *
+ * Phase 2 scope: local backend only. The remote (Daytona sandbox)
+ * backend will be added in Phase 3.
+ */
+import type { ProvisionResult, WorkspaceBackend } from "./types.js";
+export interface WorkspaceEntry {
+    name: string;
+    source?: WorkspaceSource;
+}
+export interface WorkspaceSource {
+    source: {
+        case: "gitRepo";
+        value: GitRepoSource;
+    } | {
+        case: "localPath";
+        value: LocalPathSource;
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+}
+export interface GitRepoSource {
+    url: string;
+    branch?: string;
+}
+export interface LocalPathSource {
+    path: string;
+}
+export declare class WorkspaceProvisioner {
+    provision(workspaceSource: WorkspaceSource | undefined, backend: WorkspaceBackend, mergedEnv: Record<string, string>, isLocalMode: boolean, options?: {
+        targetSubdir?: string;
+        configureCredentials?: boolean;
+    }): Promise<ProvisionResult>;
+    provisionAll(entries: WorkspaceEntry[], backend: WorkspaceBackend, mergedEnv: Record<string, string>, isLocalMode: boolean, configureCredentials?: boolean): Promise<ProvisionResult[]>;
+    private dispatch;
+}

package/dist/shared/workspace/provisioner.js

@@ -0,0 +1,84 @@
+/**
+ * Workspace provisioner — dispatches on WorkspaceSource proto type to
+ * populate a workspace directory.
+ *
+ * Supports three source variants:
+ * - git_repo: clone a repository
+ * - local_path: use an existing host directory
+ * - empty: create an empty workspace
+ *
+ * Multi-entry sessions provision each WorkspaceEntry into its own
+ * subdirectory of the workspace root.
+ *
+ * Phase 2 scope: local backend only. The remote (Daytona sandbox)
+ * backend will be added in Phase 3.
+ */
+import { provisionEmpty } from "./sources/empty.js";
+import { provisionLocalPath } from "./sources/local-path.js";
+import { provisionGit } from "./sources/git.js";
+const PROVISION_KEY_PREFIX = "WORKSPACE_PROVISION_";
+export class WorkspaceProvisioner {
+    async provision(workspaceSource, backend, mergedEnv, isLocalMode, options) {
+        const result = await this.dispatch(workspaceSource, backend, mergedEnv, isLocalMode, options);
+        const prefixKeys = Object.keys(mergedEnv)
+            .filter(k => k.startsWith(PROVISION_KEY_PREFIX));
+        const allConsumed = mergeConsumedKeys(result.consumedKeys, prefixKeys);
+        if (allConsumed.length !== result.consumedKeys.length) {
+            return { ...result, consumedKeys: allConsumed };
+        }
+        return result;
+    }
+    async provisionAll(entries, backend, mergedEnv, isLocalMode, configureCredentials = false) {
+        if (entries.length === 0)
+            return [];
+        const useSubdirs = entries.length > 1;
+        const results = [];
+        for (const entry of entries) {
+            const targetSubdir = useSubdirs ? entry.name : undefined;
+            const result = await this.provision(entry.source, backend, mergedEnv, isLocalMode, { targetSubdir, configureCredentials });
+            results.push({ ...result, entryName: entry.name });
+        }
+        return results;
+    }
+    async dispatch(workspaceSource, backend, mergedEnv, isLocalMode, options) {
+        if (!workspaceSource || !workspaceSource.source?.case) {
+            return provisionEmpty(backend);
+        }
+        switch (workspaceSource.source.case) {
+            case "gitRepo": {
+                const gitSource = workspaceSource.source.value;
+                return provisionGit({
+                    url: gitSource.url,
+                    branch: gitSource.branch,
+                    backend,
+                    envVars: mergedEnv,
+                    isLocalMode,
+                    targetSubdir: options?.targetSubdir,
+                    configureCredentials: options?.configureCredentials,
+                });
+            }
+            case "localPath": {
+                const localSource = workspaceSource.source.value;
+                return provisionLocalPath({
+                    path: localSource.path,
+                    isLocalMode,
+                    targetSubdir: options?.targetSubdir,
+                    backendRootDir: options?.targetSubdir ? backend.rootDir : undefined,
+                });
+            }
+            default:
+                return provisionEmpty(backend);
+        }
+    }
+}
+function mergeConsumedKeys(sourceKeys, prefixKeys) {
+    if (prefixKeys.length === 0)
+        return [...sourceKeys];
+    const merged = new Map();
+    for (const k of sourceKeys)
+        merged.set(k, true);
+    for (const k of prefixKeys)
+        merged.set(k, true);
+    return [...merged.keys()];
+}
+//# sourceMappingURL=provisioner.js.map

package/dist/shared/workspace/provisioner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioner.js","sourceRoot":"","sources":["../../../src/shared/workspace/provisioner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAsBpD,MAAM,OAAO,oBAAoB;IAC/B,KAAK,CAAC,SAAS,CACb,eAA4C,EAC5C,OAAyB,EACzB,SAAiC,EACjC,WAAoB,EACpB,OAGC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAChC,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAC1D,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;aACtC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAEnD,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACvE,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;YACtD,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,OAAyB,EACzB,OAAyB,EACzB,SAAiC,EACjC,WAAoB,EACpB,oBAAoB,GAAG,KAAK;QAE5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEpC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAsB,EAAE,CAAC;QAEtC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CACjC,KAAK,CAAC,MAAM,EACZ,OAAO,EACP,SAAS,EACT,WAAW,EACX,EAAE,YAAY,EAAE,oBAAoB,EAAE,CACvC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,eAA4C,EAC5C,OAAyB,EACzB,SAAiC,EACjC,WAAoB,EACpB,OAGC;QAED,IAAI,CAAC,eAAe,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;YACtD,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAED,QAAQ,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACpC,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC/C,OAAO,YAAY,CAAC;oBAClB,GAAG,EAAE,SAAS,CAAC,GAAG;oBAClB,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,OAAO;oBACP,OAAO,EAAE,SAAS;oBAClB,WAAW;oBACX,YAAY,EAAE,OAAO,EAAE,YAAY;oBACnC,oBAAoB,EAAE,OAAO,EAAE,oBAAoB;iBACpD,CAAC,CAAC;YACL,CAAC;YAED,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC;gBACjD,OAAO,kBAAkB,CAAC;oBACxB,IAAI,EAAE,WAAW,CAAC,IAAI;oBACtB,WAAW;oBACX,YAAY,EAAE,OAAO,EAAE,YAAY;oBACnC,cAAc,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;iBACpE,CAAC,CAAC;YACL,CAAC;YAED;gBACE,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;CACF;AAED,SAAS,iBAAiB,CACxB,UAA6B,EAC7B,UAAoB;IAEpB,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgB,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5B,CAAC"}

package/dist/shared/workspace/sources/empty.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Empty workspace source — the default when no WorkspaceSource is configured.
+ *
+ * The workspace directory already exists (created by initializeLocalWorkspace).
+ * This handler simply records the fact and returns the existing root.
+ */
+import { type ProvisionResult, type WorkspaceBackend } from "../types.js";
+export declare function provisionEmpty(backend: WorkspaceBackend): ProvisionResult;

package/dist/shared/workspace/sources/empty.js

@@ -0,0 +1,18 @@
+/**
+ * Empty workspace source — the default when no WorkspaceSource is configured.
+ *
+ * The workspace directory already exists (created by initializeLocalWorkspace).
+ * This handler simply records the fact and returns the existing root.
+ */
+import { SourceType } from "../types.js";
+export function provisionEmpty(backend) {
+    return {
+        rootDir: backend.rootDir,
+        sourceType: SourceType.EMPTY,
+        consumedKeys: [],
+        workspaceDescription: "Your workspace is empty. " +
+            "Create files and directories as needed for your task.",
+        entryName: "",
+    };
+}
+//# sourceMappingURL=empty.js.map

package/dist/shared/workspace/sources/empty.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"empty.js","sourceRoot":"","sources":["../../../../src/shared/workspace/sources/empty.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAA+C,MAAM,aAAa,CAAC;AAEtF,MAAM,UAAU,cAAc,CAAC,OAAyB;IACtD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,UAAU,CAAC,KAAK;QAC5B,YAAY,EAAE,EAAE;QAChB,oBAAoB,EAClB,2BAA2B;YAC3B,uDAAuD;QACzD,SAAS,EAAE,EAAE;KACd,CAAC;AACJ,CAAC"}

package/dist/shared/workspace/sources/git.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Git workspace source — clones a repository into the workspace.
+ *
+ * Key behaviors ported from Python:
+ * - Idempotent: detects existing .git and skips re-clone
+ * - GitHub token injection via HTTPS URL (x-access-token)
+ * - Token is never logged; sanitized in error messages
+ * - GITHUB_TOKEN reported in consumedKeys for env stripping
+ * - Multi-entry mode: clones into target_subdir
+ * - Credential store configuration for git push/writeback
+ */
+import { type ProvisionResult, type WorkspaceBackend } from "../types.js";
+export interface GitProvisionOptions {
+    url: string;
+    branch?: string;
+    backend: WorkspaceBackend;
+    envVars: Record<string, string>;
+    isLocalMode: boolean;
+    targetSubdir?: string;
+    configureCredentials?: boolean;
+}
+export declare function provisionGit(options: GitProvisionOptions): Promise<ProvisionResult>;

package/dist/shared/workspace/sources/git.js

@@ -0,0 +1,207 @@
+/**
+ * Git workspace source — clones a repository into the workspace.
+ *
+ * Key behaviors ported from Python:
+ * - Idempotent: detects existing .git and skips re-clone
+ * - GitHub token injection via HTTPS URL (x-access-token)
+ * - Token is never logged; sanitized in error messages
+ * - GITHUB_TOKEN reported in consumedKeys for env stripping
+ * - Multi-entry mode: clones into target_subdir
+ * - Credential store configuration for git push/writeback
+ */
+import { join } from "node:path";
+import { SourceType, WorkspaceProvisionError, } from "../types.js";
+const GITHUB_HOST = "github.com";
+export async function provisionGit(options) {
+    const { url, branch, backend, envVars, isLocalMode, targetSubdir, configureCredentials } = options;
+    const cloneDir = targetSubdir
+        ? join(backend.rootDir, targetSubdir)
+        : backend.rootDir;
+    const gitExists = await backend.exists(targetSubdir ? join(targetSubdir, ".git") : ".git");
+    if (gitExists) {
+        return reuseExistingRepo(cloneDir, url, backend, envVars, configureCredentials, targetSubdir);
+    }
+    const githubToken = envVars.GITHUB_TOKEN;
+    const consumedKeys = [];
+    let cloneUrl = url;
+    if (githubToken && url.includes(GITHUB_HOST)) {
+        cloneUrl = injectToken(url, githubToken);
+        consumedKeys.push("GITHUB_TOKEN");
+    }
+    try {
+        await cloneInPlace(backend, cloneDir, cloneUrl, branch);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const sanitized = githubToken
+            ? message.replaceAll(githubToken, "***")
+            : message;
+        throw new WorkspaceProvisionError(SourceType.GIT_REPO, `Git clone failed: ${sanitized}`, { cause: err instanceof Error ? err : undefined, transient: true });
+    }
+    let metadata = await extractGitMetadata(cloneDir, url, backend, targetSubdir);
+    if (configureCredentials && githubToken && url.includes(GITHUB_HOST)) {
+        const configured = await configureGitCredentialStore(backend, cloneDir, url, githubToken);
+        if (configured) {
+            metadata = { ...metadata, gitCredentialsConfigured: true };
+        }
+    }
+    await addGitExcludes(backend, targetSubdir);
+    return {
+        rootDir: cloneDir,
+        sourceType: SourceType.GIT_REPO,
+        consumedKeys,
+        workspaceDescription: `Your workspace is a git clone of ${url}` +
+            (metadata.branch ? ` (branch: ${metadata.branch})` : "") +
+            `.\nBase commit: ${metadata.baseCommit}`,
+        gitMetadata: metadata,
+        entryName: "",
+    };
+}
+async function reuseExistingRepo(cloneDir, url, backend, envVars, configureCredentials, targetSubdir) {
+    let metadata = await extractGitMetadata(cloneDir, url, backend, targetSubdir);
+    const githubToken = envVars.GITHUB_TOKEN;
+    if (configureCredentials && githubToken && url.includes(GITHUB_HOST)) {
+        const configured = await configureGitCredentialStore(backend, cloneDir, url, githubToken);
+        if (configured) {
+            metadata = { ...metadata, gitCredentialsConfigured: true };
+        }
+    }
+    return {
+        rootDir: cloneDir,
+        sourceType: SourceType.GIT_REPO,
+        consumedKeys: [],
+        workspaceDescription: `Your workspace is a git clone of ${url}` +
+            (metadata.branch ? ` (branch: ${metadata.branch})` : "") +
+            ` (existing repo detected).\nBase commit: ${metadata.baseCommit}`,
+        gitMetadata: metadata,
+        entryName: "",
+    };
+}
+/**
+ * Clone a repository into a directory that may already be non-empty.
+ *
+ * `git clone` refuses to write into a non-empty target, but cloud workspace
+ * mounts are not guaranteed empty — a freshly provisioned ext4 PersistentVolume
+ * ships a `lost+found` directory at its root. We therefore reproduce clone
+ * semantics in place: init the repo, add the (token-injected) origin remote,
+ * fetch all branches, and check out the requested branch (or the remote's
+ * default branch when none is requested). The result is identical to a clone —
+ * a working tree on a tracking branch — but tolerant of pre-existing content.
+ */
+async function cloneInPlace(backend, cloneDir, cloneUrl, branch) {
+    await backend.execute(`git init -q '${cloneDir}'`);
+    const exec = (cmd) => backend.execute(cmd, { cwd: cloneDir });
+    await exec(`git remote add origin '${cloneUrl}'`);
+    await exec("git fetch --quiet origin");
+    const targetBranch = branch && branch.length > 0
+        ? branch
+        : await resolveDefaultBranch(backend, cloneDir);
+    // No target branch means the remote has no branches (empty repository).
+    // Leave the initialized repo as-is, matching `git clone` of an empty repo.
+    if (!targetBranch)
+        return;
+    await exec(`git checkout '${targetBranch}'`);
+}
+/**
+ * Resolve the remote's default branch after a fetch. Returns an empty string
+ * when the remote exposes no default (e.g. an empty repository), so the caller
+ * can skip checkout gracefully.
+ */
+async function resolveDefaultBranch(backend, cloneDir) {
+    const exec = (cmd) => backend.execute(cmd, { cwd: cloneDir });
+    try {
+        await exec("git remote set-head origin --auto");
+        const ref = (await exec("git symbolic-ref --short refs/remotes/origin/HEAD")).trim();
+        return ref.replace(/^origin\//, "");
+    }
+    catch {
+        return "";
+    }
+}
+async function extractGitMetadata(cloneDir, url, backend, targetSubdir) {
+    const cwd = targetSubdir ?? undefined;
+    let branchName = "";
+    let headSha = "";
+    try {
+        branchName = (await backend.execute("git rev-parse --abbrev-ref HEAD", { cwd: cloneDir })).trim();
+    }
+    catch { /* non-fatal */ }
+    try {
+        headSha = (await backend.execute("git rev-parse HEAD", { cwd: cloneDir })).trim();
+    }
+    catch { /* non-fatal */ }
+    return {
+        repoUrl: stripToken(url),
+        branch: branchName,
+        baseCommit: headSha,
+        gitCredentialsConfigured: false,
+    };
+}
+/**
+ * Working-tree entries the agent should never see as untracked changes:
+ * - `.stigmer` — platform-managed namespace (skills, inputs, attachments)
+ * - `lost+found` — present at the root of a freshly provisioned ext4
+ *   PersistentVolume, which is where single-entry sessions clone in place
+ */
+const GIT_EXCLUDE_ENTRIES = [".stigmer", "lost+found"];
+async function addGitExcludes(backend, targetSubdir) {
+    const excludePath = targetSubdir
+        ? join(targetSubdir, ".git/info/exclude")
+        : ".git/info/exclude";
+    try {
+        const current = await backend.readFile(excludePath);
+        const missing = GIT_EXCLUDE_ENTRIES.filter((entry) => !current.includes(entry));
+        if (missing.length > 0) {
+            await backend.writeFile(excludePath, current.trimEnd() + "\n" + missing.join("\n") + "\n");
+        }
+    }
+    catch {
+        // .git/info/exclude might not exist — non-fatal
+    }
+}
+/**
+ * Configure git credential store for push operations.
+ *
+ * Three-step process (each step is non-fatal):
+ * 1. Clean the remote URL — remove any embedded token from the origin remote
+ * 2. Set credential.helper to `store` with a repo-local credential file
+ * 3. Write the credential entry to the file
+ *
+ * Using repo-local config (not --global) keeps credentials scoped to
+ * the workspace and avoids polluting the host git config.
+ */
+async function configureGitCredentialStore(backend, cloneDir, url, token) {
+    const exec = (cmd) => backend.execute(cmd, { cwd: cloneDir });
+    const credFile = join(cloneDir, ".git", ".git-credentials");
+    const cleanUrl = stripToken(url);
+    try {
+        await exec(`git remote set-url origin '${cleanUrl}'`);
+    }
+    catch (err) {
+        console.warn(`[git] Failed to clean remote URL (non-fatal): ${err}`);
+        return false;
+    }
+    try {
+        await exec(`git config credential.helper 'store --file=${credFile}'`);
+    }
+    catch (err) {
+        console.warn(`[git] Failed to configure credential helper (non-fatal): ${err}`);
+        return false;
+    }
+    const credEntry = `https://x-access-token:${token}@github.com\n`;
+    try {
+        await backend.writeFile(credFile, credEntry);
+    }
+    catch (err) {
+        console.warn(`[git] Failed to write credential file (non-fatal): ${err}`);
+        return false;
+    }
+    return true;
+}
+function injectToken(url, token) {
+    return url.replace("https://", `https://x-access-token:${token}@`);
+}
+function stripToken(url) {
+    return url.replace(/https:\/\/[^@]+@/, "https://");
+}
+//# sourceMappingURL=git.js.map

package/dist/shared/workspace/sources/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../../../../src/shared/workspace/sources/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,UAAU,EACV,uBAAuB,GAIxB,MAAM,aAAa,CAAC;AAYrB,MAAM,WAAW,GAAG,YAAY,CAAC;AAEjC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA4B;IAC7D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAC;IAEnG,MAAM,QAAQ,GAAG,YAAY;QAC3B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC;QACrC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAEpB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,MAAM,CACpC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CACnD,CAAC;IAEF,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IACzC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,QAAQ,GAAG,GAAG,CAAC;IAEnB,IAAI,WAAW,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACzC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,WAAW;YAC3B,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC;YACxC,CAAC,CAAC,OAAO,CAAC;QACZ,MAAM,IAAI,uBAAuB,CAC/B,UAAU,CAAC,QAAQ,EACnB,qBAAqB,SAAS,EAAE,EAChC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CACnE,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IAE9E,IAAI,oBAAoB,IAAI,WAAW,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACrE,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QAC1F,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,MAAM,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAE5C,OAAO;QACL,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,UAAU,CAAC,QAAQ;QAC/B,YAAY;QACZ,oBAAoB,EAClB,oCAAoC,GAAG,EAAE;YACzC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,mBAAmB,QAAQ,CAAC,UAAU,EAAE;QAC1C,WAAW,EAAE,QAAQ;QACrB,SAAS,EAAE,EAAE;KACd,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,QAAgB,EAChB,GAAW,EACX,OAAyB,EACzB,OAA+B,EAC/B,oBAA8B,EAC9B,YAAqB;IAErB,IAAI,QAAQ,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IAE9E,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IACzC,IAAI,oBAAoB,IAAI,WAAW,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACrE,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QAC1F,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,UAAU,CAAC,QAAQ;QAC/B,YAAY,EAAE,EAAE;QAChB,oBAAoB,EAClB,oCAAoC,GAAG,EAAE;YACzC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,4CAA4C,QAAQ,CAAC,UAAU,EAAE;QACnE,WAAW,EAAE,QAAQ;QACrB,SAAS,EAAE,EAAE;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,YAAY,CACzB,OAAyB,EACzB,QAAgB,EAChB,QAAgB,EAChB,MAA0B;IAE1B,MAAM,OAAO,CAAC,OAAO,CAAC,gBAAgB,QAAQ,GAAG,CAAC,CAAC;IAEnD,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtE,MAAM,IAAI,CAAC,0BAA0B,QAAQ,GAAG,CAAC,CAAC;IAClD,MAAM,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAEvC,MAAM,YAAY,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAC9C,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,MAAM,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAElD,wEAAwE;IACxE,2EAA2E;IAC3E,IAAI,CAAC,YAAY;QAAE,OAAO;IAE1B,MAAM,IAAI,CAAC,iBAAiB,YAAY,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CACjC,OAAyB,EACzB,QAAgB;IAEhB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,mDAAmD,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrF,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,QAAgB,EAChB,GAAW,EACX,OAAyB,EACzB,YAAqB;IAErB,MAAM,GAAG,GAAG,YAAY,IAAI,SAAS,CAAC;IACtC,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,OAAO,GAAG,EAAE,CAAC;IAEjB,IAAI,CAAC;QACH,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,iCAAiC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAE3B,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAE3B,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC;QACxB,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,OAAO;QACnB,wBAAwB,EAAE,KAAK;KAChC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AAEvD,KAAK,UAAU,cAAc,CAAC,OAAyB,EAAE,YAAqB;IAC5E,MAAM,WAAW,GAAG,YAAY;QAC9B,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC;QACzC,CAAC,CAAC,mBAAmB,CAAC;IAExB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAChF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,OAAO,CAAC,SAAS,CACrB,WAAW,EACX,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CACrD,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,2BAA2B,CACxC,OAAyB,EACzB,QAAgB,EAChB,GAAW,EACX,KAAa;IAEb,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAEjC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,8BAA8B,QAAQ,GAAG,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,iDAAiD,GAAG,EAAE,CAAC,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,8CAA8C,QAAQ,GAAG,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,4DAA4D,GAAG,EAAE,CAAC,CAAC;QAChF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,0BAA0B,KAAK,eAAe,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,sDAAsD,GAAG,EAAE,CAAC,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,KAAa;IAC7C,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,0BAA0B,KAAK,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;AACrD,CAAC"}

package/dist/shared/workspace/sources/local-path.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Local-path workspace source — uses an existing host directory as-is.
+ *
+ * The user's project directory becomes the workspace root directly. No
+ * copy or clone is made; the agent operates on the original files.
+ *
+ * LocalPathSource is only valid in local mode. Cloud runners reject it
+ * with a clear error — use git_repo for cloud deployments.
+ */
+import { type ProvisionResult } from "../types.js";
+export interface LocalPathProvisionOptions {
+    path: string;
+    isLocalMode: boolean;
+    targetSubdir?: string;
+    backendRootDir?: string;
+}
+export declare function provisionLocalPath(options: LocalPathProvisionOptions): ProvisionResult;

package/dist/shared/workspace/sources/local-path.js

@@ -0,0 +1,57 @@
+/**
+ * Local-path workspace source — uses an existing host directory as-is.
+ *
+ * The user's project directory becomes the workspace root directly. No
+ * copy or clone is made; the agent operates on the original files.
+ *
+ * LocalPathSource is only valid in local mode. Cloud runners reject it
+ * with a clear error — use git_repo for cloud deployments.
+ */
+import { existsSync, statSync, symlinkSync, readlinkSync, unlinkSync, mkdirSync } from "node:fs";
+import { join, isAbsolute } from "node:path";
+import { realpathSync } from "node:fs";
+import { SourceType, WorkspaceProvisionError, } from "../types.js";
+export function provisionLocalPath(options) {
+    const { path, isLocalMode, targetSubdir, backendRootDir } = options;
+    if (!isLocalMode) {
+        throw new WorkspaceProvisionError(SourceType.LOCAL_PATH, "LocalPathSource is only supported in local mode. " +
+            "Use git_repo for cloud deployments.");
+    }
+    if (!isAbsolute(path)) {
+        throw new WorkspaceProvisionError(SourceType.LOCAL_PATH, `Path must be absolute, got relative path: '${path}'`);
+    }
+    if (!existsSync(path)) {
+        throw new WorkspaceProvisionError(SourceType.LOCAL_PATH, `Path does not exist: '${path}'`);
+    }
+    if (!statSync(path).isDirectory()) {
+        throw new WorkspaceProvisionError(SourceType.LOCAL_PATH, `Path is not a directory: '${path}'`);
+    }
+    if (targetSubdir && backendRootDir) {
+        createEntrySymlink(backendRootDir, targetSubdir, path);
+    }
+    return {
+        rootDir: path,
+        sourceType: SourceType.LOCAL_PATH,
+        consumedKeys: [],
+        workspaceDescription: `Your workspace is the user's project directory: ${path}\n` +
+            "IMPORTANT: You are operating directly on the user's files. " +
+            "Changes are immediate and persistent.\n" +
+            "Use git to track and verify your changes before finalizing.",
+        entryName: "",
+    };
+}
+function createEntrySymlink(backendRootDir, targetSubdir, path) {
+    const linkPath = join(backendRootDir, targetSubdir);
+    try {
+        const existing = readlinkSync(linkPath);
+        if (realpathSync(existing) === realpathSync(path))
+            return;
+        unlinkSync(linkPath);
+    }
+    catch {
+        // link doesn't exist — will create below
+    }
+    mkdirSync(backendRootDir, { recursive: true });
+    symlinkSync(path, linkPath);
+}
+//# sourceMappingURL=local-path.js.map

package/dist/shared/workspace/sources/local-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-path.js","sourceRoot":"","sources":["../../../../src/shared/workspace/sources/local-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EACL,UAAU,EACV,uBAAuB,GAExB,MAAM,aAAa,CAAC;AASrB,MAAM,UAAU,kBAAkB,CAAC,OAAkC;IACnE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAEpE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,uBAAuB,CAC/B,UAAU,CAAC,UAAU,EACrB,mDAAmD;YACnD,qCAAqC,CACtC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAC/B,UAAU,CAAC,UAAU,EACrB,8CAA8C,IAAI,GAAG,CACtD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAC/B,UAAU,CAAC,UAAU,EACrB,yBAAyB,IAAI,GAAG,CACjC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,CAC/B,UAAU,CAAC,UAAU,EACrB,6BAA6B,IAAI,GAAG,CACrC,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,IAAI,cAAc,EAAE,CAAC;QACnC,kBAAkB,CAAC,cAAc,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,YAAY,EAAE,EAAE;QAChB,oBAAoB,EAClB,mDAAmD,IAAI,IAAI;YAC3D,6DAA6D;YAC7D,yCAAyC;YACzC,6DAA6D;QAC/D,SAAS,EAAE,EAAE;KACd,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,cAAsB,EAAE,YAAoB,EAAE,IAAY;IACpF,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,IAAI,CAAC;YAAE,OAAO;QAC1D,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IAED,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC9B,CAAC"}