@tangle-network/agent-runtime 0.318.0 → 0.319.5

package/dist/{workspace-streams-DkijayqX.js → workspace-streams-DFAhW7hF.js}

@@ -6,7 +6,7 @@ import { spawn } from "node:child_process";
 import { constants } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve, sep, win32 } from "node:path";
 import { lstat, mkdir, mkdtemp, open, readFile, readdir, readlink, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { extract, pack } from "tar-stream";
@@ -879,6 +879,16 @@ async function verifyMaterializedProfileWorkspace(root, expected, fileRoot = "wo
 async function walkWorkspace(root, options, keepBytes) {
 	const ignoredProtectedRootEntries = new Set(options.ignoredProtectedRootEntries ?? []);
 	const limits = options.limits;
+	const selected = options.selectedPaths ? new Set(options.selectedPaths) : void 0;
+	const selectedDirectories = /* @__PURE__ */ new Set();
+	for (const path of selected ?? []) {
+		if (!path || path.includes("\\") || path.includes("\0") || isAbsolute(path) || path.split("/").some((part) => !part || part === "." || part === "..")) throw new Error("workspace selected path must be a safe relative file path");
+		let parent = dirname(path);
+		while (parent !== ".") {
+			selectedDirectories.add(parent);
+			parent = dirname(parent);
+		}
+	}
 	const requestedRoot = resolve(root);
 	const rootStats = await lstat(requestedRoot);
 	if (!rootStats.isDirectory() || rootStats.isSymbolicLink()) throw new Error("workspace root must be a real directory");
@@ -898,9 +908,11 @@ async function walkWorkspace(root, options, keepBytes) {
 			const absolute = resolve(directory, entry.name);
 			const relPath = relative(absoluteRoot, absolute).split(sep).join("/");
 			if (!relPath || relPath.startsWith("../") || relPath.includes("/../")) throw new Error(`workspace entry escapes root: ${relPath}`);
+			if (selected && !selected.has(relPath) && !selectedDirectories.has(relPath)) continue;
 			const stats = await lstat(absolute);
 			if (stats.isSymbolicLink()) throw new Error(await symlinkRefusal(absolute, relPath, absoluteRoot));
 			if (stats.isDirectory()) {
+				if (selected?.has(relPath)) throw new Error(`workspace selected file is a directory: ${relPath}`);
 				await visit(absolute);
 				continue;
 			}
@@ -930,6 +942,7 @@ async function walkWorkspace(root, options, keepBytes) {
 		}
 	}
 	await visit(absoluteRoot);
+	if (selected && scanned.length !== selected.size) throw new Error("workspace selected files changed during capture");
 	return scanned;
 }
 /**
@@ -1269,7 +1282,9 @@ function parseGitHubRemote(value) {
 		repo: match[2]
 	};
 }
-async function runCandidateGit(repositoryRoot, args, input, extraEnv = {}) {
+async function runCandidateGit(repositoryRoot, args, input, extraEnv = {}, options = {}) {
+	if (options.readUserExclusions && (args.length !== 7 || args.slice(0, 4).join(",") !== "config,--includes,--path,--default" || args.slice(5).join(",") !== "--get,core.excludesFile")) throw new Error("user Git configuration may only supply the effective exclusion path");
+	if (options.maxOutputBytes !== void 0 && (!Number.isSafeInteger(options.maxOutputBytes) || options.maxOutputBytes < 0)) throw new Error("candidate Git maxOutputBytes must be a nonnegative safe integer");
 	const env = Object.fromEntries(Object.entries(process.env).filter(([name]) => !name.startsWith("GIT_")));
 	Object.assign(env, {
 		GIT_CONFIG_NOSYSTEM: "1",
@@ -1280,6 +1295,14 @@ async function runCandidateGit(repositoryRoot, args, input, extraEnv = {}) {
 		LC_ALL: "C",
 		...extraEnv
 	});
+	if (options.readUserExclusions) for (const name of [
+		"GIT_CONFIG_GLOBAL",
+		"GIT_CONFIG_SYSTEM",
+		"GIT_CONFIG_NOSYSTEM"
+	]) {
+		delete env[name];
+		if (process.env[name] !== void 0) env[name] = process.env[name];
+	}
 	const fullArgs = [
 		"-c",
 		"core.hooksPath=/dev/null",
@@ -1304,10 +1327,27 @@ async function runCandidateGit(repositoryRoot, args, input, extraEnv = {}) {
 		});
 		const stdout = [];
 		const stderr = [];
-		child.stdout.on("data", (chunk) => stdout.push(chunk));
-		child.stderr.on("data", (chunk) => stderr.push(chunk));
+		let outputBytes = 0;
+		let exceeded = false;
+		function retain(chunks, chunk) {
+			if (exceeded) return;
+			outputBytes += chunk.byteLength;
+			if (options.maxOutputBytes !== void 0 && outputBytes > options.maxOutputBytes) {
+				exceeded = true;
+				child.kill("SIGKILL");
+				return;
+			}
+			chunks.push(chunk);
+		}
+		child.stdout.on("data", (chunk) => retain(stdout, chunk));
+		child.stderr.on("data", (chunk) => retain(stderr, chunk));
 		child.on("error", reject);
+		child.stdin.on("error", reject);
 		child.on("close", (code, signal) => {
+			if (exceeded) {
+				reject(/* @__PURE__ */ new Error("candidate Git command exceeds maxOutputBytes"));
+				return;
+			}
 			const out = Buffer.concat(stdout);
 			const err = Buffer.concat(stderr);
 			if (code !== 0) {
@@ -1352,6 +1392,8 @@ const archiveKind = "agent-candidate-workspace-archive";
 const workspaceEntryPrefix = "workspace/";
 const repositoryMetadataEntry = "metadata/repository.json";
 const repositoryBundleEntry = "metadata/repository.bundle";
+const repositoryIndexEntry = "metadata/repository.index.json";
+const repositoryIndexPrefix = "index/";
 const fixedTarTime = /* @__PURE__ */ new Date(0);
 const defaultLimits = Object.freeze({
 	maxArchiveBytes: 512 * 1024 * 1024,
@@ -1366,7 +1408,9 @@ const defaultLimits = Object.freeze({
 async function captureAgentCandidateWorkspace(rootInput, options = {}) {
 	const root = resolve(rootInput);
 	const limits = workspaceLimits(options.limits);
-	const captured = options.includeRepository ? await captureRepository(root, limits) : await captureMaterializedWorkspace(root, { limits: {
+	if (options.repositoryContents !== void 0 && options.repositoryContents !== "head" && options.repositoryContents !== "working-tree") throw new Error("candidate repositoryContents is invalid");
+	if (options.repositoryContents !== void 0 && !options.includeRepository) throw new Error("candidate repositoryContents requires includeRepository");
+	const captured = options.includeRepository ? await captureRepository(root, limits, options.repositoryContents === "working-tree") : await captureMaterializedWorkspace(root, { limits: {
 		maxFiles: limits.maxFiles,
 		maxFileBytes: limits.maxFileBytes,
 		maxTotalFileBytes: limits.maxTotalFileBytes
@@ -1412,35 +1456,38 @@ async function captureWorkspaceArtifact(kind, bytes, persistence) {
 /** Create the standard bounded materializer for candidate execution ports. */
 function createAgentCandidateWorkspacePort(options = {}) {
 	const limits = workspaceLimits(options.limits);
-	return Object.freeze({ materialize: async ({ role, snapshot, archive, destination }) => {
+	return Object.freeze({ materialize: async ({ role, snapshot, archive, destination, signal }) => {
 		await materializeAgentCandidateWorkspace({
 			role,
 			snapshot,
 			archive,
 			destination,
-			limits
+			limits,
+			signal
 		});
 	} });
 }
 async function materializeAgentCandidateWorkspace(input) {
+	input.signal?.throwIfAborted();
 	const decoded = await decodeVerifiedWorkspaceArchive(input);
+	input.signal?.throwIfAborted();
 	const destination = resolve(input.destination);
-	await prepareEmptyDestination(destination);
+	await prepareEmptyDestination(destination, { createDestination: false });
+	input.signal?.throwIfAborted();
 	const staging = await mkdtemp(`${destination}.materializing-`);
 	try {
-		await writeWorkspaceFiles(staging, decoded.files);
-		if (decoded.repository) await materializeRepository(decoded.repository, staging);
+		input.signal?.throwIfAborted();
+		await writeWorkspaceFiles(staging, decoded.files, input.signal);
+		if (decoded.repository) await materializeRepository(decoded.repository, staging, input.limits, input.signal);
+		input.signal?.throwIfAborted();
 		await verifyMaterializedWorkspace(staging, input.snapshot.material, { ignoredProtectedRootEntries: decoded.repository ? [".git"] : [] });
+		input.signal?.throwIfAborted();
 		await rename(staging, destination);
 	} catch (error) {
 		await rm(staging, {
 			recursive: true,
 			force: true
 		});
-		await rm(destination, {
-			recursive: true,
-			force: true
-		});
 		throw error;
 	}
 }
@@ -1458,7 +1505,7 @@ async function decodeVerifiedWorkspaceArchive(input) {
 	assertArchiveMatchesSnapshot(decoded.files, input.snapshot);
 	return decoded;
 }
-async function captureRepository(requestedRoot, limits) {
+async function captureRepository(requestedRoot, limits, workingTree) {
 	const requestedStats = await lstat(requestedRoot);
 	if (!requestedStats.isDirectory() || requestedStats.isSymbolicLink()) throw new Error("candidate repository root must be a real directory");
 	const root = await realpath(requestedRoot);
@@ -1473,7 +1520,8 @@ async function captureRepository(requestedRoot, limits) {
 	assertGitObjectId(headCommit, "HEAD");
 	assertGitObjectId(headTree, "HEAD tree");
 	if (headCommit.length !== headTree.length) throw new Error("candidate repository HEAD and tree use different object formats");
-	const files = await readCandidateGitTreeFiles(root, headTree, {}, limits);
+	const working = workingTree ? await captureRepositoryWorkingTree(root, limits) : void 0;
+	const files = working?.files ?? await readCandidateGitTreeFiles(root, headTree, {}, limits);
 	assertWorkspaceFilesWithinLimits(files, limits);
 	const reachableBytesText = (await runCandidateGit(root, [
 		"rev-list",
@@ -1495,6 +1543,15 @@ async function captureRepository(requestedRoot, limits) {
 		]);
 		const bundle = Uint8Array.from(await readFile(bundlePath));
 		if (bundle.byteLength > limits.maxRepositoryBundleBytes) throw new Error("candidate repository bundle exceeds maxRepositoryBundleBytes");
+		if (working) {
+			const after = await readRepositoryWorkingState(root, limits);
+			if (after.paths !== working.state.paths || after.index !== working.state.index || (await runCandidateGit(root, ["rev-parse", "HEAD"])).stdout.toString("utf8").trim() !== headCommit) throw new Error("candidate repository changed during working-tree capture");
+			if ((await existingRepositoryPaths(root, after.paths, limits)).join("\0") !== files.map((file) => file.path).join("\0")) throw new Error("candidate repository files changed during working-tree capture");
+			await verifyMaterializedWorkspace(root, candidateWorkspaceManifest(files), {
+				ignoredProtectedRootEntries: [".git"],
+				selectedPaths: files.map((file) => file.path)
+			});
+		}
 		return {
 			files,
 			repository: {
@@ -1504,7 +1561,8 @@ async function captureRepository(requestedRoot, limits) {
 					sha256: sha256Bytes$1(bundle),
 					byteLength: bundle.byteLength,
 					bytes: bundle
-				}
+				},
+				...working ? { workingTree: { files: working.state.files } } : {}
 			}
 		};
 	} finally {
@@ -1514,6 +1572,114 @@ async function captureRepository(requestedRoot, limits) {
 		});
 	}
 }
+async function readRepositoryWorkingState(root, limits) {
+	const env = { GIT_OPTIONAL_LOCKS: "0" };
+	const listingLimit = Math.min(limits.maxArchiveBytes, limits.maxFiles * (limits.maxPathBytes + 256));
+	const index = new TextDecoder("utf-8", { fatal: true }).decode((await runCandidateGit(root, [
+		"ls-files",
+		"--stage",
+		"-z"
+	], void 0, env, { maxOutputBytes: listingLimit })).stdout);
+	const entries = index.split("\0").filter(Boolean).map((entry) => {
+		const match = /^(100644|100755) ([a-f0-9]{40}|[a-f0-9]{64}) 0\t(.+)$/u.exec(entry);
+		if (!match) throw new Error("candidate working-tree capture requires a resolved regular-file Git index");
+		const [, mode, object, path] = match;
+		if (!object || !path) throw new Error("candidate Git index is invalid");
+		return {
+			path: safeArchivePath(path, limits.maxPathBytes),
+			mode: mode === "100755" ? 493 : 420,
+			object
+		};
+	});
+	if (entries.length > limits.maxFiles) throw new Error("candidate Git index exceeds maxFiles");
+	if ([...(await runCandidateGit(root, [
+		"ls-files",
+		"--debug",
+		"-z"
+	], void 0, env, { maxOutputBytes: listingLimit })).stdout.toString("utf8").matchAll(/\tflags: ([a-f0-9]+)\n/gu)].some((match) => match[1] !== "0")) throw new Error("candidate working-tree capture does not support special Git index flags");
+	const sizes = entries.length ? (await runCandidateGit(root, ["cat-file", "--batch-check"], Buffer.from(entries.map((entry) => entry.object).join("\n") + "\n"), env, { maxOutputBytes: listingLimit })).stdout.toString("utf8").trimEnd().split("\n") : [];
+	if (sizes.length !== entries.length) throw new Error("candidate Git index blob metadata is incomplete");
+	let totalBytes = 0;
+	const byteLengths = entries.map((entry, index) => {
+		const match = /^([a-f0-9]{40}|[a-f0-9]{64}) blob (\d+)$/u.exec(sizes[index] ?? "");
+		const size = Number(match?.[2]);
+		if (!match || match[1] !== entry.object || !Number.isSafeInteger(size) || size < 0) throw new Error("candidate Git index blob metadata is invalid");
+		if (size > limits.maxFileBytes) throw new Error(`candidate Git index file exceeds maxFileBytes: ${entry.path}`);
+		if (size > limits.maxTotalFileBytes - totalBytes) throw new Error("candidate Git index exceeds maxTotalFileBytes");
+		totalBytes += size;
+		return size;
+	});
+	const files = [];
+	for (const [index, entry] of entries.entries()) {
+		const bytes = (await runCandidateGit(root, [
+			"cat-file",
+			"blob",
+			entry.object
+		], void 0, env, { maxOutputBytes: limits.maxFileBytes })).stdout;
+		if (bytes.byteLength !== byteLengths[index]) throw new Error("candidate Git index blob size changed");
+		files.push({
+			path: entry.path,
+			mode: entry.mode,
+			bytes: Uint8Array.from(bytes)
+		});
+	}
+	files.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+	assertWorkspaceFilesWithinLimits(files, limits);
+	const defaultExcludes = join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "git", "ignore");
+	const excludes = new TextDecoder("utf-8", { fatal: true }).decode((await runCandidateGit(root, [
+		"config",
+		"--includes",
+		"--path",
+		"--default",
+		defaultExcludes,
+		"--get",
+		"core.excludesFile"
+	], void 0, {}, {
+		maxOutputBytes: limits.maxPathBytes,
+		readUserExclusions: true
+	})).stdout).replace(/\n$/u, "");
+	const paths = new TextDecoder("utf-8", { fatal: true }).decode((await runCandidateGit(root, [
+		"-c",
+		`core.excludesFile=${excludes}`,
+		"ls-files",
+		"--cached",
+		"--others",
+		"--exclude-standard",
+		"-z"
+	], void 0, env, { maxOutputBytes: listingLimit })).stdout);
+	for (const path of paths.split("\0").filter(Boolean)) safeArchivePath(path, limits.maxPathBytes);
+	return {
+		paths,
+		index,
+		files
+	};
+}
+async function captureRepositoryWorkingTree(root, limits) {
+	const state = await readRepositoryWorkingState(root, limits);
+	return {
+		state,
+		files: [...(await captureMaterializedWorkspace(root, {
+			ignoredProtectedRootEntries: [".git"],
+			selectedPaths: await existingRepositoryPaths(root, state.paths, limits),
+			limits
+		})).files].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0)
+	};
+}
+async function existingRepositoryPaths(root, listing, limits) {
+	const paths = [...new Set(listing.split("\0").filter(Boolean))].sort();
+	if (paths.length > limits.maxFiles) throw new Error("candidate workspace exceeds maxFiles");
+	const selectedPaths = [];
+	for (const path of paths) {
+		const safe = safeArchivePath(path, limits.maxPathBytes);
+		try {
+			await lstat(workspacePath(root, safe));
+			selectedPaths.push(safe);
+		} catch (error) {
+			if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
+		}
+	}
+	return selectedPaths;
+}
 async function encodeWorkspaceArchive(files, repository, maxArchiveBytes) {
 	const archive = pack();
 	const output = collectStream(archive, maxArchiveBytes, "candidate workspace archive");
@@ -1543,6 +1709,7 @@ async function verifyCanonicalWorkspaceArchive(files, repository, expected, maxA
 async function writeWorkspaceArchiveEntries(archive, files, repository) {
 	for (const file of files) await writeTarEntry(archive, `${workspaceEntryPrefix}${file.path}`, file.mode, file.bytes);
 	if (!repository) return;
+	const indexManifest = repository.workingTree ? canonicalCandidateBytes$1(candidateWorkspaceManifest(repository.workingTree.files)) : void 0;
 	const metadata = canonicalCandidateBytes$1({
 		kind: archiveKind,
 		headCommit: repository.headCommit,
@@ -1550,10 +1717,18 @@ async function writeWorkspaceArchiveEntries(archive, files, repository) {
 		bundle: {
 			sha256: repository.bundle.sha256,
 			byteLength: repository.bundle.byteLength
-		}
+		},
+		...indexManifest ? { workingTree: { indexManifest: {
+			sha256: sha256Bytes$1(indexManifest),
+			byteLength: indexManifest.byteLength
+		} } } : {}
 	});
 	await writeTarEntry(archive, repositoryMetadataEntry, 384, metadata);
 	await writeTarEntry(archive, repositoryBundleEntry, 384, repository.bundle.bytes);
+	if (repository.workingTree && indexManifest) {
+		await writeTarEntry(archive, repositoryIndexEntry, 384, indexManifest);
+		for (const file of repository.workingTree.files) await writeTarEntry(archive, `${repositoryIndexPrefix}${file.path}`, file.mode, file.bytes);
+	}
 }
 async function parseWorkspaceArchive(bytes, limits) {
 	if (bytes.byteLength > limits.maxArchiveBytes) throw new Error("candidate workspace archive exceeds maxArchiveBytes");
@@ -1566,6 +1741,11 @@ async function parseWorkspaceArchive(bytes, limits) {
 	let previousPath;
 	let repositoryMetadata;
 	let repositoryBundle;
+	let repositoryIndex;
+	const indexFiles = [];
+	const indexPaths = /* @__PURE__ */ new Set();
+	let previousIndexPath;
+	let indexBytes = 0;
 	const decoded = (async () => {
 		for await (const entry of parser) {
 			const name = entry.header.name;
@@ -1592,16 +1772,39 @@ async function parseWorkspaceArchive(bytes, limits) {
 				assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits);
 				const metadataBytes = await readTarEntry(entry, limits.maxPathBytes, "candidate repository metadata");
 				retainedEntryBytes += metadataBytes.byteLength;
-				repositoryMetadata = parseRepositoryMetadata(metadataBytes, limits.maxRepositoryBundleBytes);
+				repositoryMetadata = parseRepositoryMetadata(metadataBytes, limits);
 			} else if (name === repositoryBundleEntry) {
 				if (entry.header.mode !== 384 || repositoryBundle) throw new Error("candidate workspace archive repository bundle is invalid");
 				assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits);
 				repositoryBundle = await readTarEntry(entry, limits.maxRepositoryBundleBytes, "candidate Git bundle");
 				retainedEntryBytes += repositoryBundle.byteLength;
+			} else if (name === repositoryIndexEntry) {
+				if (entry.header.mode !== 384 || repositoryIndex) throw new Error("candidate workspace archive repository index is invalid");
+				assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits);
+				repositoryIndex = await readTarEntry(entry, limits.maxArchiveBytes, "candidate Git index manifest");
+				retainedEntryBytes += repositoryIndex.byteLength;
+			} else if (name.startsWith(repositoryIndexPrefix)) {
+				if (!repositoryMetadata?.workingTree || !repositoryIndex || indexFiles.length >= limits.maxFiles) throw new Error("candidate Git index evidence is incomplete or exceeds maxFiles");
+				const path = safeArchivePath(name.slice(6), limits.maxPathBytes);
+				if (entry.header.mode !== 420 && entry.header.mode !== 493) throw new Error("candidate Git index contains an unsupported mode");
+				assertWorkspacePathOrder(path, previousIndexPath, indexPaths, "candidate Git index paths must be unique and sorted");
+				previousIndexPath = path;
+				assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits);
+				if (entry.header.size === void 0 || entry.header.size > limits.maxTotalFileBytes - indexBytes) throw new Error("candidate Git index exceeds maxTotalFileBytes");
+				if (entry.header.size > limits.maxFileBytes) throw new Error("candidate Git index exceeds maxFileBytes");
+				const fileBytes = await readTarEntry(entry, limits.maxFileBytes, `Git index file ${path}`);
+				retainedEntryBytes += fileBytes.byteLength;
+				indexBytes += fileBytes.byteLength;
+				indexFiles.push({
+					path,
+					mode: entry.header.mode,
+					bytes: fileBytes
+				});
 			} else throw new Error(`candidate workspace tar contains an unsupported entry: ${name}`);
 		}
 		if (Boolean(repositoryMetadata) !== Boolean(repositoryBundle)) throw new Error("candidate workspace archive repository evidence is incomplete");
-		const repository = repositoryMetadata && repositoryBundle ? repositoryFromTar(repositoryMetadata, repositoryBundle) : void 0;
+		if (Boolean(repositoryMetadata?.workingTree) !== Boolean(repositoryIndex)) throw new Error("candidate workspace archive repository index evidence is incomplete");
+		const repository = repositoryMetadata && repositoryBundle ? repositoryFromTar(repositoryMetadata, repositoryBundle, repositoryIndex, indexFiles) : void 0;
 		return {
 			files,
 			...repository ? { repository } : {}
@@ -1615,18 +1818,27 @@ async function parseWorkspaceArchive(bytes, limits) {
 function assertRetainedArchiveSize(archiveBytes, retainedEntryBytes, entryBytes, limits) {
 	if (!Number.isSafeInteger(entryBytes) || entryBytes === void 0 || entryBytes < 0 || entryBytes > limits.maxArchiveBytes - archiveBytes - retainedEntryBytes) throw new Error("candidate workspace archive exceeds maxArchiveBytes while decoding");
 }
-function parseRepositoryMetadata(bytes, maxBundleBytes) {
+function parseRepositoryMetadata(bytes, limits) {
 	let value;
 	try {
 		value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
 	} catch (error) {
 		throw new Error("candidate workspace archive repository metadata is invalid", { cause: error });
 	}
-	if (!isRecord(value) || Object.keys(value).sort().join(",") !== "bundle,headCommit,headTree,kind" || value.kind !== archiveKind || typeof value.headCommit !== "string" || typeof value.headTree !== "string" || !isRecord(value.bundle) || Object.keys(value.bundle).sort().join(",") !== "byteLength,sha256" || typeof value.bundle.sha256 !== "string" || !/^sha256:[a-f0-9]{64}$/.test(value.bundle.sha256) || !Number.isSafeInteger(value.bundle.byteLength) || value.bundle.byteLength <= 0 || value.bundle.byteLength > maxBundleBytes) throw new Error("candidate workspace archive repository is invalid");
+	if (!isRecord(value) || !["bundle,headCommit,headTree,kind", "bundle,headCommit,headTree,kind,workingTree"].includes(Object.keys(value).sort().join(",")) || value.kind !== archiveKind || typeof value.headCommit !== "string" || typeof value.headTree !== "string" || !isRecord(value.bundle) || Object.keys(value.bundle).sort().join(",") !== "byteLength,sha256" || typeof value.bundle.sha256 !== "string" || !/^sha256:[a-f0-9]{64}$/.test(value.bundle.sha256) || !Number.isSafeInteger(value.bundle.byteLength) || value.bundle.byteLength <= 0 || value.bundle.byteLength > limits.maxRepositoryBundleBytes) throw new Error("candidate workspace archive repository is invalid");
 	if (!Buffer.from(canonicalCandidateBytes$1(value)).equals(Buffer.from(bytes))) throw new Error("candidate workspace archive repository metadata is not canonical");
 	assertGitObjectId(value.headCommit, "repository HEAD");
 	assertGitObjectId(value.headTree, "repository HEAD tree");
 	if (value.headCommit.length !== value.headTree.length) throw new Error("candidate repository HEAD and tree use different object formats");
+	let workingTree;
+	if ("workingTree" in value) {
+		const working = value.workingTree;
+		if (!isRecord(working) || Object.keys(working).join(",") !== "indexManifest" || !isRecord(working.indexManifest) || Object.keys(working.indexManifest).sort().join(",") !== "byteLength,sha256" || typeof working.indexManifest.sha256 !== "string" || !/^sha256:[a-f0-9]{64}$/.test(working.indexManifest.sha256) || !Number.isSafeInteger(working.indexManifest.byteLength) || working.indexManifest.byteLength < 0 || working.indexManifest.byteLength > limits.maxArchiveBytes) throw new Error("candidate workspace archive repository index is invalid");
+		workingTree = { indexManifest: {
+			sha256: working.indexManifest.sha256,
+			byteLength: working.indexManifest.byteLength
+		} };
+	}
 	return {
 		kind: archiveKind,
 		headCommit: value.headCommit,
@@ -1634,18 +1846,24 @@ function parseRepositoryMetadata(bytes, maxBundleBytes) {
 		bundle: {
 			sha256: value.bundle.sha256,
 			byteLength: value.bundle.byteLength
-		}
+		},
+		...workingTree ? { workingTree } : {}
 	};
 }
-function repositoryFromTar(metadata, bundle) {
+function repositoryFromTar(metadata, bundle, indexManifest, indexFiles) {
 	verifyBytes(bundle, metadata.bundle.sha256, metadata.bundle.byteLength, "candidate Git bundle");
+	if (metadata.workingTree && indexManifest) {
+		verifyBytes(indexManifest, metadata.workingTree.indexManifest.sha256, metadata.workingTree.indexManifest.byteLength, "candidate Git index manifest");
+		if (!Buffer.from(indexManifest).equals(Buffer.from(canonicalCandidateBytes$1(candidateWorkspaceManifest(indexFiles))))) throw new Error("candidate Git index files do not match the captured manifest");
+	}
 	return {
 		headCommit: metadata.headCommit,
 		headTree: metadata.headTree,
 		bundle: {
 			...metadata.bundle,
 			bytes: bundle
-		}
+		},
+		...metadata.workingTree && indexManifest ? { workingTree: { files: indexFiles } } : {}
 	};
 }
 async function writeTarEntry(archive, name, mode, bytes) {
@@ -1693,19 +1911,26 @@ async function streamEqualsBytes(stream, expected, maxBytes, label) {
 	}
 	return equal && offset === expectedBuffer.byteLength;
 }
-async function prepareEmptyDestination(destination) {
-	await mkdir(destination, {
+async function prepareEmptyDestination(destination, options = {}) {
+	await mkdir(options.createDestination === false ? dirname(destination) : destination, {
 		recursive: true,
 		mode: 448
 	});
-	const stats = await lstat(destination);
+	let stats;
+	try {
+		stats = await lstat(destination);
+	} catch (error) {
+		if (options.createDestination === false && error.code === "ENOENT") return;
+		throw error;
+	}
 	if (!stats.isDirectory() || stats.isSymbolicLink()) throw new Error("candidate workspace destination must be a real directory");
 	const resolvedStats = await lstat(await realpath(destination));
 	if (!resolvedStats.isDirectory() || resolvedStats.isSymbolicLink()) throw new Error("candidate workspace destination must resolve to a real directory");
 	if ((await readdir(destination)).length > 0) throw new Error("candidate workspace destination must be empty");
 }
-async function writeWorkspaceFiles(destination, files) {
+async function writeWorkspaceFiles(destination, files, signal) {
 	for (const file of files) {
+		signal?.throwIfAborted();
 		const path = workspacePath(destination, file.path);
 		await mkdir(dirname(path), {
 			recursive: true,
@@ -1713,53 +1938,86 @@ async function writeWorkspaceFiles(destination, files) {
 		});
 		const descriptor = await open(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0), 384);
 		try {
-			await descriptor.writeFile(file.bytes);
+			signal?.throwIfAborted();
+			await descriptor.writeFile(file.bytes, { signal });
 			const stats = await descriptor.stat();
 			if (!stats.isFile() || stats.nlink !== 1) throw new Error(`candidate workspace file identity changed while writing: ${file.path}`);
 			await descriptor.chmod(file.mode);
+			signal?.throwIfAborted();
 		} finally {
 			await descriptor.close();
 		}
 	}
 }
-async function materializeRepository(repository, destination) {
+async function materializeRepository(repository, destination, limits, signal) {
+	signal?.throwIfAborted();
+	const git = async (args, bytes, options = {}) => {
+		signal?.throwIfAborted();
+		const result = await runCandidateGit(destination, args, bytes, {}, options);
+		signal?.throwIfAborted();
+		return result;
+	};
 	const temporary = await mkdtemp(join(tmpdir(), "agent-candidate-workspace-bundle-"));
 	const bundlePath = join(temporary, `${randomUUID()}.bundle`);
 	try {
+		signal?.throwIfAborted();
 		await writeFile(bundlePath, repository.bundle.bytes, {
 			flag: "wx",
-			mode: 384
+			mode: 384,
+			signal
 		});
-		await runCandidateGit(destination, [
+		await git([
 			"init",
 			"--quiet",
 			"--initial-branch=candidate",
 			`--object-format=${repository.headCommit.length === 64 ? "sha256" : "sha1"}`
 		]);
-		await runCandidateGit(destination, [
+		await git([
 			"bundle",
 			"verify",
 			bundlePath
 		]);
-		await runCandidateGit(destination, [
+		await git([
 			"bundle",
 			"unbundle",
 			bundlePath
 		]);
-		if ((await runCandidateGit(destination, [
+		if ((await git([
 			"cat-file",
 			"-t",
 			repository.headCommit
 		])).stdout.toString("utf8").trim() !== "commit") throw new Error("candidate repository HEAD is not a commit");
-		if ((await runCandidateGit(destination, ["rev-parse", `${repository.headCommit}^{tree}`])).stdout.toString("utf8").trim() !== repository.headTree) throw new Error("candidate repository bundle HEAD tree changed");
-		await runCandidateGit(destination, [
+		if ((await git(["rev-parse", `${repository.headCommit}^{tree}`])).stdout.toString("utf8").trim() !== repository.headTree) throw new Error("candidate repository bundle HEAD tree changed");
+		await git([
 			"update-ref",
 			"--no-deref",
 			"HEAD",
 			repository.headCommit
 		]);
-		await runCandidateGit(destination, ["read-tree", repository.headTree]);
-		if ((await runCandidateGit(destination, [
+		await git(["read-tree", repository.headTree]);
+		if (repository.workingTree) {
+			await git(["read-tree", "--empty"]);
+			const entries = [];
+			for (const file of repository.workingTree.files) {
+				const object = (await git([
+					"hash-object",
+					"-w",
+					"--stdin"
+				], file.bytes, { maxOutputBytes: 256 })).stdout.toString("utf8").trim();
+				assertGitObjectId(object, "staged blob");
+				entries.push(`${file.mode === 493 ? "100755" : "100644"} ${object}\t${file.path}\0`);
+			}
+			if (entries.length) await git([
+				"update-index",
+				"-z",
+				"--index-info"
+			], Buffer.from(entries.join("")));
+			const observed = await readCandidateGitTreeFiles(destination, (await git(["write-tree"])).stdout.toString("utf8").trim(), {}, limits);
+			signal?.throwIfAborted();
+			if (!Buffer.from(canonicalCandidateBytes$1(candidateWorkspaceManifest(observed))).equals(Buffer.from(canonicalCandidateBytes$1(candidateWorkspaceManifest(repository.workingTree.files))))) throw new Error("candidate repository staged files do not match the captured index");
+			return;
+		}
+		if ((await git([
 			"status",
 			"--porcelain=v1",
 			"--untracked-files=all"
@@ -2231,6 +2489,6 @@ function asError(error) {
 	return error instanceof Error ? error : new Error(String(error));
 }
 //#endregion
-export { randomSuffix as $, verifiedArtifactChunks as A, addSpend as B, readVerifiedArtifact as C, isDeadlineAbortReason as Ct, verifyMaterializedWorkspace as D, verifyMaterializedProfileWorkspace as E, teardownSurfaces as Et, embeddedCandidateArtifact as F, deleteBoxSafe as G, chargedTokens as H, immutableCandidateValue as I, hasCompleteCacheBreakdown as J, errorMessage as K, omitTopLevelDigest as L, canonicalCandidateDigest$1 as M, canonicalCandidateDocument as N, verifyWorkspaceSnapshotArtifacts as O, deepFreezeCandidate as P, promptCacheTokenClasses as Q, sha256Bytes$1 as R, readMaterializedWorkspaceFiles as S, checkInIdleMs as St, verifyBytes as T, teardownExecutor as Tt, cloneSpend as U, addTokenUsage as V, cloneTokenUsage as W, isAsyncIterable as X, isAbortError as Y, mapWithConcurrency as Z, isWellFormedUnicode as _, DEFAULT_CHECK_IN_IDLE_MS as _t, verifyAgentCandidateWorkspaceArtifacts as a, throwIfAborted as at, candidateWorkspaceManifest as b, armDeadlineTimer as bt, captureAgentCandidateWorkspaceFiles as c, zeroSpend as ct, persistCandidateOutputArtifact as d, assertResources as dt, randomUuid as et, readCandidateGitHubResource as f, resourceTelemetry as ft, assertExactObjectKeys as g, DEADLINE_CHECK_IN_MESSAGE as gt, verifyTaskOutcomePatch as h, CHILD_DEADLINE_REASON as ht, readAgentCandidateWorkspaceArtifactFiles as i, throwAbort as it, canonicalCandidateBytes$1 as j, markPutStreamVerified as k, createAgentCandidateWorkspacePort as l, zeroTokenUsage as lt, verifyTaskCheckout as m, ACCEPTED_RESULT_GRACE_MS as mt, captureAgentCandidateWorkspaceTreeToArtifacts as n, sleep as nt, verifyAgentCandidateWorkspaceTree as o, unmeteredSpend as ot, verifyCandidateCode as p, withBudgetResources as pt, fnv1a32Hex as q, materializeAgentCandidateWorkspaceFromArtifacts as r, stringifySafe as rt, captureAgentCandidateWorkspace as s, withTimeout as st, captureAgentCandidateWorkspaceToArtifacts as t, roundBoxMinutes as tt, verifyAgentCandidateWorkspaceArchive as u, addResourceSpend as ut, WorkspaceScanLimitError as v, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as vt, scanMaterializedWorkspaceManifest as w, singleFlightTeardown as wt, captureMaterializedWorkspace as x, boundedChildDeadlineAt as xt, artifactCacheKey as y, ROOT_DEADLINE_REASON as yt, verifyCanonicalCandidateDocument as z };
+export { promptCacheTokenClasses as $, markPutStreamVerified as A, verifyCanonicalCandidateDocument as B, readMaterializedWorkspaceFiles as C, checkInIdleMs as Ct, verifyMaterializedProfileWorkspace as D, teardownSurfaces as Dt, verifyBytes as E, teardownExecutor as Et, deepFreezeCandidate as F, cloneTokenUsage as G, addTokenUsage as H, embeddedCandidateArtifact as I, fnv1a32Hex as J, deleteBoxSafe as K, immutableCandidateValue as L, canonicalCandidateBytes$1 as M, canonicalCandidateDigest$1 as N, verifyMaterializedWorkspace as O, canonicalCandidateDocument as P, mapWithConcurrency as Q, omitTopLevelDigest as R, captureMaterializedWorkspace as S, boundedChildDeadlineAt as St, scanMaterializedWorkspaceManifest as T, singleFlightTeardown as Tt, chargedTokens as U, addSpend as V, cloneSpend as W, isAbortError as X, hasCompleteCacheBreakdown as Y, isAsyncIterable as Z, assertExactObjectKeys as _, DEADLINE_CHECK_IN_MESSAGE as _t, verifyAgentCandidateWorkspaceArtifacts as a, throwAbort as at, artifactCacheKey as b, ROOT_DEADLINE_REASON as bt, captureAgentCandidateWorkspaceFiles as c, withTimeout as ct, workspaceLimits as d, addResourceSpend as dt, randomSuffix as et, persistCandidateOutputArtifact as f, assertResources as ft, verifyTaskOutcomePatch as g, CHILD_DEADLINE_REASON as gt, verifyTaskCheckout as h, ACCEPTED_RESULT_GRACE_MS as ht, readAgentCandidateWorkspaceArtifactFiles as i, stringifySafe as it, verifiedArtifactChunks as j, verifyWorkspaceSnapshotArtifacts as k, createAgentCandidateWorkspacePort as l, zeroSpend as lt, verifyCandidateCode as m, withBudgetResources as mt, captureAgentCandidateWorkspaceTreeToArtifacts as n, roundBoxMinutes as nt, verifyAgentCandidateWorkspaceTree as o, throwIfAborted as ot, readCandidateGitHubResource as p, resourceTelemetry as pt, errorMessage as q, materializeAgentCandidateWorkspaceFromArtifacts as r, sleep as rt, captureAgentCandidateWorkspace as s, unmeteredSpend as st, captureAgentCandidateWorkspaceToArtifacts as t, randomUuid as tt, verifyAgentCandidateWorkspaceArchive as u, zeroTokenUsage as ut, isWellFormedUnicode as v, DEFAULT_CHECK_IN_IDLE_MS as vt, readVerifiedArtifact as w, isDeadlineAbortReason as wt, candidateWorkspaceManifest as x, armDeadlineTimer as xt, WorkspaceScanLimitError as y, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as yt, sha256Bytes$1 as z };
 
-//# sourceMappingURL=workspace-streams-DkijayqX.js.map
+//# sourceMappingURL=workspace-streams-DFAhW7hF.js.map