@usecontextlayer/ctxs 0.5.4 → 0.5.6

package/dist/cli.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="203202bf-ce01-592c-a003-11e98e6ee3f4")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3dbc3cff-70da-5d01-b6fc-a83d63e0c3f3")}catch(e){}}();
 import { createRequire } from "node:module";
 import * as Sentry from "@sentry/node";
 import * as fs$2 from "node:fs/promises";
@@ -8,8 +8,6 @@ import { access, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm,
 import path, { sep } from "node:path";
 import { execFile } from "node:child_process";
 import { formatWithOptions, promisify } from "node:util";
-import { existsSync } from "node:fs";
-import { fileURLToPath } from "node:url";
 import { serve } from "@hono/node-server";
 import { createNodeWebSocket } from "@hono/node-ws";
 import { Hono } from "hono";
@@ -25,6 +23,8 @@ import tls from "tls";
 import crypto$1 from "crypto";
 import Stream from "stream";
 import { performance } from "perf_hooks";
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 import { getSessionMessages } from "@anthropic-ai/claude-agent-sdk";
 import { query } from "@anthropic-ai/claude-agent-sdk/browser";
 import g$1 from "node:process";
@@ -60,7 +60,7 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 //#endregion
 //#region package.json
-var version$2 = "0.5.4";
+var version$2 = "0.5.6";
 
 //#endregion
 //#region sentry.ts
@@ -264,13 +264,21 @@ async function cloneRepo(repo) {
 	], { auth: repo.remote });
 }
 /**
-* Snapshot the working dir to pggit: `add -A` -> commit -> `push --force`. A no-op if
+* Snapshot the working dir to pggit: `add -A` -> commit -> plain `push`. A no-op if
 * nothing changed (a per-turn snapshot may find no new bytes under eventual consistency).
 * Excludes (`.credentials.json`, `.DS_Store`) come from a `.gitignore` the caller commits,
-* not from this function. Self-initializes a fresh dir (the capture-only engine home is
-* never cloned), so it works for both the restored (slate) and fresh (engine) cases.
+* not from this function. Self-initializes a fresh dir, so it works for both the
+* restored (slate) and fresh cases.
+*
+* NON-FORCE is load-bearing (the workspace-writes no-overwrites invariant):
+* a snapshot may only ADVANCE the remote. A home is single-writer
+* (one repoId ↔ one owning process — ClaudeRepo's premise), so its history is
+* linear and a plain push always fast-forwards. The accident class this blocks:
+* a self-inited fresh dir pushing over an existing remote's real history is a
+* LOUD client-side rejection instead of silent destruction (and
+* pggit's deny-non-FF is the server backstop).
 */
-async function forcePushSnapshot(repo, opts) {
+async function pushSnapshot(repo, opts) {
 	await ensureGitRepo(repo);
 	await runGit(["add", "-A"], { cwd: repo.hostDir });
 	if ((await runGit([
@@ -289,7 +297,6 @@ async function forcePushSnapshot(repo, opts) {
 	], { cwd: repo.hostDir });
 	await runGit([
 		"push",
-		"--force",
 		"origin",
 		`HEAD:${BRANCH}`
 	], {
@@ -316,11 +323,33 @@ async function localHead(repo) {
 	return result.stdout.trim() || null;
 }
 /**
-* Fast-forward the working dir to the remote tip (`fetch` + `reset --hard`) — the
-* refresh half of the read-copy model: callers HEAD-gate it so a reader catches the
-* engine's pushes without paying a fetch when nothing changed.
+* Is there a writer's live work in the tree — uncommitted changes, untracked files,
+* or a merge in flight? `status --porcelain` covers modified/untracked/conflicted;
+* the MERGE_HEAD probe covers the one state porcelain can miss (a merge whose
+* resolution happens to match HEAD exactly). Callers treat `true` as "the tree is
+* owned; touching it would be an overwrite."
+*/
+async function hasUncommittedWork(repo) {
+	if ((await runGit(["status", "--porcelain"], { cwd: repo.hostDir })).stdout.trim() !== "") return true;
+	return (await runGit([
+		"rev-parse",
+		"-q",
+		"--verify",
+		"MERGE_HEAD"
+	], {
+		cwd: repo.hostDir,
+		throwOnNonZero: false
+	})).exitCode === 0;
+}
+/**
+* Fetch the remote tip and integrate by PURE fast-forward or not at all (`merge
+* --ff-only`) — the refresh half of the landlord model. `refused` means local
+* commits exist that origin lacks (an unfinished heal): the caller serves the
+* local tree as-is — which history wins is the healing session's business, never
+* this function's. Fetch failures (network, auth) still throw — those are
+* infrastructure, not divergence.
 */
-async function fetchToHead(repo) {
+async function fastForwardToRemote(repo) {
 	await runGit([
 		"fetch",
 		"origin",
@@ -329,11 +358,14 @@ async function fetchToHead(repo) {
 		auth: repo.remote,
 		cwd: repo.hostDir
 	});
-	await runGit([
-		"reset",
-		"--hard",
+	return (await runGit([
+		"merge",
+		"--ff-only",
 		"FETCH_HEAD"
-	], { cwd: repo.hostDir });
+	], {
+		cwd: repo.hostDir,
+		throwOnNonZero: false
+	})).exitCode === 0 ? "fast_forwarded" : "refused";
 }
 async function ensureGitRepo(repo) {
 	const inside = await runGit(["rev-parse", "--is-inside-work-tree"], {
@@ -593,9 +625,11 @@ var ClaudeRepo = class ClaudeRepo {
 	* Clone-on-first-use into the host dir (slate resume). A no-op for a capture-only
 	* home (`restore:false`) and after the first success — memoized so concurrent sessions
 	* don't double-clone. Restore failure **propagates**: the caller blocks the connection
-	* — no boot → no capture → the good repo is untouched (proceeding fresh would
-	* force-push a blank home over real history). The memo is cleared on failure so a later
-	* connection retries rather than inheriting a permanent rejection.
+	* — no boot → no capture → the good repo is untouched. (Proceeding fresh would try to
+	* push a blank home over real history — a loud non-force rejection rather than
+	* silent destruction, but restore-first stays the invariant:
+	* a rejected capture is still a broken session.) The memo is cleared on failure so a
+	* later connection retries rather than inheriting a permanent rejection.
 	*/
 	async restore() {
 		if (!this.config.restore) return;
@@ -614,7 +648,8 @@ var ClaudeRepo = class ClaudeRepo {
 	}
 	/**
 	* The per-turn snapshot: serialized by the mutex — rebuild the index from the live
-	* home (when maintaining it), then force-push the whole dir. Capture failure is caught +
+	* home (when maintaining it), then push the whole dir (non-force; a home is
+	* single-writer so the push always fast-forwards). Capture failure is caught +
 	* logged **loud**, never propagated — the turn already happened and the next snapshot
 	* pushes the cumulative state. The one non-self-healing case is an expired token's 401:
 	* the push auth is the connection's upgrade-time user token (real mint TTL: 15 minutes),
@@ -628,7 +663,7 @@ var ClaudeRepo = class ClaudeRepo {
 			try {
 				await this.ensureGitignore();
 				if (this.config.maintainIndex) await this.writeSessionIndex();
-				await forcePushSnapshot(this.repo, { message: opts.message });
+				await pushSnapshot(this.repo, { message: opts.message });
 			} catch (err) {
 				console.error(`[ClaudeRepo] capture failed (${this.repo.remote.repoId}):`, err);
 			}
@@ -793,6 +828,40 @@ async function drainExecStream(handle, options) {
 		signal?.removeEventListener("abort", onAbort);
 	}
 }
+const MICROSANDBOX_HOST_ALIAS = "host.microsandbox.internal";
+const HOST_LOOPBACK_HOSTNAMES = new Set([
+	"localhost",
+	"127.0.0.1",
+	"0.0.0.0"
+]);
+const IPV6_LOOPBACK_HOSTNAMES = new Set(["[::1]", "[::]"]);
+function rewriteHostUrlForGuest(url) {
+	const parsed = new URL(url);
+	const hostname = parsed.hostname.toLowerCase();
+	if (HOST_LOOPBACK_HOSTNAMES.has(hostname) || IPV6_LOOPBACK_HOSTNAMES.has(hostname)) {
+		parsed.hostname = MICROSANDBOX_HOST_ALIAS;
+		return parsed.toString();
+	}
+	return url;
+}
+function guestGitEnv(input) {
+	const guestBase = rewriteHostUrlForGuest(input.platformUrl).replace(/\/+$/, "");
+	const configs = [];
+	if (guestBase !== input.platformUrl) configs.push([`url.${guestBase}/git/.insteadOf`, `${input.platformUrl}/git/`]);
+	configs.push([`http.${guestBase}/git/.extraHeader`, `Authorization: Bearer ${input.token}`]);
+	const env = {
+		GIT_AUTHOR_EMAIL: `${input.sub}@users.noreply.usecontextlayer.com`,
+		GIT_AUTHOR_NAME: input.sub,
+		GIT_COMMITTER_EMAIL: `${input.sub}@users.noreply.usecontextlayer.com`,
+		GIT_COMMITTER_NAME: input.sub,
+		GIT_CONFIG_COUNT: String(configs.length)
+	};
+	configs.forEach(([key, value], i) => {
+		env[`GIT_CONFIG_KEY_${i}`] = key;
+		env[`GIT_CONFIG_VALUE_${i}`] = value;
+	});
+	return env;
+}
 const DEBUG_SANDBOX_NAME = "ctx-sandbox-debug";
 const DEFAULT_BOOT_COMMAND = ["uname", "-a"];
 async function runSandbox(input) {
@@ -4559,6 +4628,63 @@ function refine$1(fn, _params = {}) {
 function superRefine$1(fn, params) {
 	return /* @__PURE__ */ _superRefine$1(fn, params);
 }
+`${JSON.stringify({ render: {
+	elements: {
+		body: {
+			props: { text: { $item: "body" } },
+			type: "Text"
+		},
+		card: {
+			children: ["body"],
+			props: { title: { $item: "title" } },
+			type: "Card"
+		},
+		detail: {
+			children: ["card"],
+			props: {
+				className: "mx-auto max-w-md p-8",
+				direction: "vertical",
+				gap: "md"
+			},
+			repeat: {
+				key: "path",
+				statePath: "/items"
+			},
+			type: "Stack"
+		}
+	},
+	root: "detail"
+} }, null, "	")}`, `${JSON.stringify({ render: {
+	elements: {
+		card: {
+			props: { title: { $item: "title" } },
+			type: "Card"
+		},
+		list: {
+			children: ["row"],
+			props: {
+				className: "mx-auto max-w-md p-8",
+				direction: "vertical",
+				gap: "md"
+			},
+			repeat: {
+				key: "path",
+				statePath: "/items"
+			},
+			type: "Stack"
+		},
+		row: {
+			children: ["card"],
+			on: { press: {
+				action: "navigate",
+				params: { path: { $template: "${path}" } }
+			} },
+			props: { className: null },
+			type: "Pressable"
+		}
+	},
+	root: "list"
+} }, null, "	")}`;
 const segmentSchema$1 = string$4().min(1, "a repoId segment must be non-empty").refine((s) => s !== "." && s !== ".." && !s.includes("/"), { message: "a repoId segment must not be '.'/'..' or contain '/'" });
 function segment$1(value, label) {
 	const result = segmentSchema$1.safeParse(value);
@@ -4578,7 +4704,7 @@ const sessionMetaSchema$1 = object$3({
 	sessionId: string$4()
 });
 record$2(string$4(), sessionMetaSchema$1);
-async function materializeWorkspaceTree(workspaceId, ctx) {
+async function ensureWorkspaceCheckout(workspaceId, ctx) {
 	const repo = await resolveRepo({
 		platformUrl: ctx.platformUrl,
 		repoId: buildRepoId$1({
@@ -4588,10 +4714,16 @@ async function materializeWorkspaceTree(workspaceId, ctx) {
 		}),
 		token: ctx.token
 	}, ctx.gitHostBaseDir);
-	if (await isCloned(repo.hostDir)) {
-		if (await remoteHead(repo) !== await localHead(repo)) await fetchToHead(repo);
-	} else await cloneRepo(repo);
 	return {
+		freshness: await (async () => {
+			if (!await isCloned(repo.hostDir)) {
+				await cloneRepo(repo);
+				return "cloned";
+			}
+			if (await hasUncommittedWork(repo)) return "held_dirty";
+			if (await remoteHead(repo) !== await localHead(repo)) return await fastForwardToRemote(repo) === "fast_forwarded" ? "fresh" : "held_diverged";
+			return "fresh";
+		})(),
 		head: await localHead(repo),
 		rootDir: repo.hostDir
 	};
@@ -4607,72 +4739,6 @@ async function isCloned(hostDir) {
 	}
 }
 
-//#endregion
-//#region ../slate-bridge/dist/goldens-Kp_c_7Kf.mjs
-const PARITY_SCENARIOS = [
-	{
-		name: "text-only",
-		turns: ["Reply with exactly one word: hello", "Now reply with exactly one word: goodbye"]
-	},
-	{
-		name: "code-writing",
-		turns: [
-			"Create a file calc.js that exports a function add(a, b) returning a + b. Use module.exports. Just write the file, no explanation.",
-			"Add a function sub(a, b) returning a - b to calc.js, keeping add. Export both.",
-			"Create run.js that requires ./calc.js and prints add(2, 3) and sub(5, 1), then run it with `node run.js` and show the output.",
-			"In one sentence, what does calc.js export now?"
-		]
-	},
-	{
-		name: "thinking-and-error",
-		turns: [
-			"Reason carefully step by step before answering: a train travels 90 km in 1 hour 12 minutes. What is its average speed in km/h? Show your reasoning, then the answer.",
-			"Read the file /tmp/definitely-does-not-exist-9f3a.txt and tell me its contents.",
-			"In one short sentence, acknowledge that the file could not be read."
-		]
-	},
-	{
-		name: "compaction",
-		turns: [
-			"In two short paragraphs, explain how the TCP three-way handshake works.",
-			"Now, in two short paragraphs, explain how a TLS 1.3 handshake works.",
-			"List three concrete differences between TCP and UDP.",
-			"/compact",
-			"What topics were we just discussing? Answer in one sentence.",
-			"Reply with exactly one word: done"
-		]
-	},
-	{
-		name: "multi-file-tools",
-		turns: ["Create three files in the current directory: a.txt containing exactly `alpha`, b.txt containing exactly `beta`, c.txt containing exactly `gamma`. Just create them, no explanation.", "Read a.txt, b.txt, and c.txt and tell me what each one contains."]
-	},
-	{
-		name: "web-tools",
-		turns: ["Use web search to find the current latest stable Node.js LTS major version. Report just the version number.", "In one sentence, what did you search for?"]
-	},
-	{
-		name: "long-conversation",
-		turns: [
-			"Name a primary color. Reply with one word.",
-			"Name a different primary color. Reply with one word.",
-			"Name the third primary color. Reply with one word.",
-			"What color do you get mixing red and blue? Reply with one word.",
-			"Summarize this conversation in one short sentence.",
-			"Reply with exactly one word: bye"
-		]
-	}
-];
-function resolveGoldensDir() {
-	let dir = path.dirname(fileURLToPath(import.meta.url));
-	while (true) {
-		const candidate = path.join(dir, "slate-shared", "lib", "__goldens__");
-		if (existsSync(candidate)) return candidate;
-		const parent = path.dirname(dir);
-		if (parent === dir) throw new Error(`[parity] could not locate slate-shared/lib/__goldens__ above ${fileURLToPath(import.meta.url)}`);
-		dir = parent;
-	}
-}
-
 //#endregion
 //#region ../base-client/dist/index.mjs
 /**
@@ -4757,6 +4823,19 @@ var ForbiddenError$1 = class extends BaseAPIError {
 		this.name = "ForbiddenError";
 	}
 };
+var NotFoundError$1 = class extends BaseAPIError {
+	constructor(body, rawResponse) {
+		super({
+			message: "NotFoundError",
+			statusCode: 404,
+			body,
+			rawResponse
+		});
+		Object.setPrototypeOf(this, new.target.prototype);
+		if (Error.captureStackTrace) Error.captureStackTrace(this, this.constructor);
+		this.name = "NotFoundError";
+	}
+};
 function mergeHeaders$1(...headersArray) {
 	const result = {};
 	for (const [key, value] of headersArray.filter((headers) => headers != null).flatMap((headers) => Object.entries(headers))) {
@@ -5976,7 +6055,7 @@ function createIdentitySchemaCreator$1(schemaType, validate) {
 		};
 	};
 }
-function enum_(values) {
+function enum_$1(values) {
 	const validValues = new Set(values);
 	return createIdentitySchemaCreator$1(SchemaType$1.ENUM, (value, { allowUnrecognizedEnumValues, breadcrumbsPrefix = [] } = {}) => {
 		if (typeof value !== "string") return {
@@ -6542,7 +6621,7 @@ const _hasOwn$4 = Object.prototype.hasOwnProperty;
 function union$1(discriminant, union) {
 	const rawDiscriminant = typeof discriminant === "string" ? discriminant : discriminant.rawDiscriminant;
 	const parsedDiscriminant = typeof discriminant === "string" ? discriminant : discriminant.parsedDiscriminant;
-	const discriminantValueSchema = enum_(keys$1(union));
+	const discriminantValueSchema = enum_$1(keys$1(union));
 	const baseSchema = {
 		parse: (raw, opts) => {
 			return transformAndValidateUnion({
@@ -6795,7 +6874,7 @@ const Binding = object$2({
 	updatedAt: property$1("updated_at", date$3())
 });
 const ListBindingsResponse = object$2({ bindings: list$1(Binding) });
-const RunStatus = enum_([
+const RunStatus = enum_$1([
 	"QUEUED",
 	"NOT_STARTED",
 	"MANAGED",
@@ -6844,7 +6923,7 @@ const BindingStateResponse = object$2({
 	bindings: record$1(string$3(), BindingState),
 	version: number$3()
 });
-const DagsterAllPlanBindingMode = enum_(["dagster"]);
+const DagsterAllPlanBindingMode = enum_$1(["dagster"]);
 const DagsterAllPlanBinding = object$2({
 	auth: BindingAuth,
 	bindingId: property$1("binding_id", string$3()),
@@ -7026,6 +7105,62 @@ var BasesClient = class {
 		}
 		return handleNonStatusCodeError$1(_response.error, _response.rawResponse, "GET", "/base/bases/{base_id}");
 	}
+	/**
+	* @param {BaseAPI.DeleteBaseRequest} request
+	* @param {BasesClient.RequestOptions} requestOptions - Request-specific configuration.
+	*
+	* @throws {@link BaseAPI.ForbiddenError}
+	* @throws {@link BaseAPI.NotFoundError}
+	*
+	* @example
+	*     await client.bases.deleteBase({
+	*         baseId: "base_id"
+	*     })
+	*/
+	deleteBase(request, requestOptions) {
+		return HttpResponsePromise$1.fromPromise(this.__deleteBase(request, requestOptions));
+	}
+	async __deleteBase(request, requestOptions) {
+		const { baseId } = request;
+		const _headers = mergeHeaders$1(this._options?.headers, requestOptions?.headers);
+		const _response = await fetcher$1({
+			url: join$1(await Supplier$1.get(this._options.baseUrl) ?? await Supplier$1.get(this._options.environment), `base/bases/${encodePathParam$1(baseId)}`),
+			method: "DELETE",
+			headers: _headers,
+			queryString: queryBuilder$1().mergeAdditional(requestOptions?.queryParams).build(),
+			timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+			maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+			abortSignal: requestOptions?.abortSignal,
+			fetchFn: this._options?.fetch,
+			logging: this._options.logging
+		});
+		if (_response.ok) return {
+			data: void 0,
+			rawResponse: _response.rawResponse
+		};
+		if (_response.error.reason === "status-code") switch (_response.error.statusCode) {
+			case 403: throw new ForbiddenError$1(Error_$1.parseOrThrow(_response.error.body, {
+				unrecognizedObjectKeys: "passthrough",
+				allowUnrecognizedUnionMembers: true,
+				allowUnrecognizedEnumValues: true,
+				skipValidation: true,
+				breadcrumbsPrefix: ["response"]
+			}), _response.rawResponse);
+			case 404: throw new NotFoundError$1(Error_$1.parseOrThrow(_response.error.body, {
+				unrecognizedObjectKeys: "passthrough",
+				allowUnrecognizedUnionMembers: true,
+				allowUnrecognizedEnumValues: true,
+				skipValidation: true,
+				breadcrumbsPrefix: ["response"]
+			}), _response.rawResponse);
+			default: throw new BaseAPIError({
+				statusCode: _response.error.statusCode,
+				body: _response.error.body,
+				rawResponse: _response.rawResponse
+			});
+		}
+		return handleNonStatusCodeError$1(_response.error, _response.rawResponse, "DELETE", "/base/bases/{base_id}");
+	}
 };
 var BindingPlanClient = class {
 	_options;
@@ -8662,7 +8797,7 @@ function decodeJwt(jwt) {
 }
 
 //#endregion
-//#region ../shared/dist/index.mjs
+//#region ../shared/dist/verify-ctx-token-BbswNLaV.mjs
 /**
 * Global authentication middleware for a platform resource server: require a
 * Bearer `aud=ctx` token and verify it offline via the injected verifier. A
@@ -8689,6 +8824,7 @@ function createCtxAuthMiddleware(verify, machineAzpAllowlist) {
 		if (!token) return c.json({ error: "Missing bearer token." }, 401);
 		const result = await verify(token);
 		if (!result.ok) return c.json({ error: "Invalid token." }, 401);
+		c.set("bearer", token);
 		if (result.kind === "machine") {
 			if (!machineAzpAllowlist.has(result.azp)) return c.json({ error: "Machine client not allowed." }, 403);
 			c.set("machine", true);
@@ -8696,10 +8832,6 @@ function createCtxAuthMiddleware(verify, machineAzpAllowlist) {
 		await next();
 	};
 }
-function ctxAuthHeaders(tokenProvider) {
-	if (!tokenProvider) return {};
-	return { headers: { Authorization: async () => `Bearer ${await tokenProvider()}` } };
-}
 /**
 * jose error codes that mean "the presented token is invalid" → reject (401),
 * `reason` is the code (for logging only). Anything else — a JWKS timeout, a
@@ -8811,6 +8943,13 @@ function createDevJwtVerifier() {
 	};
 }
 
+//#endregion
+//#region ../shared/dist/index.mjs
+function ctxAuthHeaders(tokenProvider) {
+	if (!tokenProvider) return {};
+	return { headers: { Authorization: async () => `Bearer ${await tokenProvider()}` } };
+}
+
 //#endregion
 //#region ../slate-client/dist/index.mjs
 /**
@@ -8895,6 +9034,19 @@ var ForbiddenError = class extends SlateAPIError {
 		this.name = "ForbiddenError";
 	}
 };
+var NotFoundError = class extends SlateAPIError {
+	constructor(body, rawResponse) {
+		super({
+			message: "NotFoundError",
+			statusCode: 404,
+			body,
+			rawResponse
+		});
+		Object.setPrototypeOf(this, new.target.prototype);
+		if (Error.captureStackTrace) Error.captureStackTrace(this, this.constructor);
+		this.name = "NotFoundError";
+	}
+};
 function mergeHeaders(...headersArray) {
 	const result = {};
 	for (const [key, value] of headersArray.filter((headers) => headers != null).flatMap((headers) => Object.entries(headers))) {
@@ -10114,6 +10266,29 @@ function createIdentitySchemaCreator(schemaType, validate) {
 		};
 	};
 }
+function enum_(values) {
+	const validValues = new Set(values);
+	return createIdentitySchemaCreator(SchemaType.ENUM, (value, { allowUnrecognizedEnumValues, breadcrumbsPrefix = [] } = {}) => {
+		if (typeof value !== "string") return {
+			ok: false,
+			errors: [{
+				path: breadcrumbsPrefix,
+				message: getErrorMessageForIncorrectType(value, "string")
+			}]
+		};
+		if (!validValues.has(value) && !allowUnrecognizedEnumValues) return {
+			ok: false,
+			errors: [{
+				path: breadcrumbsPrefix,
+				message: getErrorMessageForIncorrectType(value, "enum")
+			}]
+		};
+		return {
+			ok: true,
+			value
+		};
+	})();
+}
 function entries(object) {
 	return Object.entries(object);
 }
@@ -10688,6 +10863,8 @@ const CreateWorkspaceInput = object$1({
 	synthesizerImage: property("synthesizer_image", string$2().optional()),
 	tick: string$2().optional()
 });
+const DeleteWorkspaceRequestDeleteBases = enum_(["true", "false"]);
+const DeleteWorkspaceRequestDeleteRepos = enum_(["true", "false"]);
 const BridgePlan = object$1({
 	baseIds: property("base_ids", list(string$2())),
 	claudeOauthToken: property("claude_oauth_token", string$2().nullable()),
@@ -11129,6 +11306,72 @@ var WorkspacesClient = class {
 		}
 		return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/slate/workspaces");
 	}
+	/**
+	* @param {SlateAPI.DeleteWorkspaceRequest} request
+	* @param {WorkspacesClient.RequestOptions} requestOptions - Request-specific configuration.
+	*
+	* @throws {@link SlateAPI.ForbiddenError}
+	* @throws {@link SlateAPI.NotFoundError}
+	*
+	* @example
+	*     await client.workspaces.deleteWorkspace({
+	*         workspaceId: "workspace_id"
+	*     })
+	*/
+	deleteWorkspace(request, requestOptions) {
+		return HttpResponsePromise.fromPromise(this.__deleteWorkspace(request, requestOptions));
+	}
+	async __deleteWorkspace(request, requestOptions) {
+		const { workspaceId, deleteBases, deleteRepos } = request;
+		const _queryParams = {
+			delete_bases: deleteBases != null ? DeleteWorkspaceRequestDeleteBases.jsonOrThrow(deleteBases, {
+				unrecognizedObjectKeys: "strip",
+				omitUndefined: true
+			}) : void 0,
+			delete_repos: deleteRepos != null ? DeleteWorkspaceRequestDeleteRepos.jsonOrThrow(deleteRepos, {
+				unrecognizedObjectKeys: "strip",
+				omitUndefined: true
+			}) : void 0
+		};
+		const _headers = mergeHeaders(this._options?.headers, requestOptions?.headers);
+		const _response = await fetcher({
+			url: join(await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment), `slate/workspaces/${encodePathParam(workspaceId)}`),
+			method: "DELETE",
+			headers: _headers,
+			queryString: queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
+			timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+			maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+			abortSignal: requestOptions?.abortSignal,
+			fetchFn: this._options?.fetch,
+			logging: this._options.logging
+		});
+		if (_response.ok) return {
+			data: void 0,
+			rawResponse: _response.rawResponse
+		};
+		if (_response.error.reason === "status-code") switch (_response.error.statusCode) {
+			case 403: throw new ForbiddenError(Error_.parseOrThrow(_response.error.body, {
+				unrecognizedObjectKeys: "passthrough",
+				allowUnrecognizedUnionMembers: true,
+				allowUnrecognizedEnumValues: true,
+				skipValidation: true,
+				breadcrumbsPrefix: ["response"]
+			}), _response.rawResponse);
+			case 404: throw new NotFoundError(Error_.parseOrThrow(_response.error.body, {
+				unrecognizedObjectKeys: "passthrough",
+				allowUnrecognizedUnionMembers: true,
+				allowUnrecognizedEnumValues: true,
+				skipValidation: true,
+				breadcrumbsPrefix: ["response"]
+			}), _response.rawResponse);
+			default: throw new SlateAPIError({
+				statusCode: _response.error.statusCode,
+				body: _response.error.body,
+				rawResponse: _response.rawResponse
+			});
+		}
+		return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/slate/workspaces/{workspace_id}");
+	}
 };
 var SlateAPIClient = class {
 	_options;
@@ -14811,6 +15054,9 @@ const ZodURL = /*@__PURE__*/ $constructor("ZodURL", (inst, def) => {
 	$ZodURL.init(inst, def);
 	ZodStringFormat.init(inst, def);
 });
+function url(params) {
+	return _url(ZodURL, params);
+}
 const ZodEmoji = /*@__PURE__*/ $constructor("ZodEmoji", (inst, def) => {
 	$ZodEmoji.init(inst, def);
 	ZodStringFormat.init(inst, def);
@@ -15320,6 +15566,82 @@ function number(params) {
 //#endregion
 //#region ../slate-shared/dist/index.mjs
 const WORKSPACE_DOCS_SUBDIR = "output";
+const INBOX_CONTENT_TREE = {
+	"output/actions/reply-dana-uat-escalation.md": "---\ntype: Action\nstatus: open\n---\n# Reply to Dana Whitfield's UAT currency escalation\n\nDana escalated the multi-currency UAT blocker; reply today.\n",
+	"output/actions/ship-final-invoice.md": "---\ntype: Action\nstatus: open\n---\n# Ship the final invoice\n\nClose out the quarter: send the last invoice and file it.\n",
+	"output/types/action.loader.js": `export default async ({ vault, path }) => {
+	const node = vault.get(path)
+	return { items: [{ body: node.body, path: node.path, title: node.title }] }
+}
+`,
+	"output/types/action.render-spec.json": `${JSON.stringify({ render: {
+		elements: {
+			body: {
+				props: { text: { $item: "body" } },
+				type: "Text"
+			},
+			card: {
+				children: ["body"],
+				props: { title: { $item: "title" } },
+				type: "Card"
+			},
+			detail: {
+				children: ["card"],
+				props: {
+					className: "mx-auto max-w-md p-8",
+					direction: "vertical",
+					gap: "md"
+				},
+				repeat: {
+					key: "path",
+					statePath: "/items"
+				},
+				type: "Stack"
+			}
+		},
+		root: "detail"
+	} }, null, "	")}\n`,
+	"output/views/inbox.loader.js": `export default async ({ vault }) => {
+	const items = vault
+		.all()
+		.filter((entry) => entry.type === "Action")
+		.map((entry) => ({ path: entry.path, title: entry.title }))
+		.sort((a, b) => a.title.localeCompare(b.title))
+	return { items }
+}
+`,
+	"output/views/inbox.render-spec.json": `${JSON.stringify({ render: {
+		elements: {
+			card: {
+				props: { title: { $item: "title" } },
+				type: "Card"
+			},
+			list: {
+				children: ["row"],
+				props: {
+					className: "mx-auto max-w-md p-8",
+					direction: "vertical",
+					gap: "md"
+				},
+				repeat: {
+					key: "path",
+					statePath: "/items"
+				},
+				type: "Stack"
+			},
+			row: {
+				children: ["card"],
+				on: { press: {
+					action: "navigate",
+					params: { path: { $template: "${path}" } }
+				} },
+				props: { className: null },
+				type: "Pressable"
+			}
+		},
+		root: "list"
+	} }, null, "	")}\n`
+};
 const segmentSchema = string().min(1, "a repoId segment must be non-empty").refine((s) => s !== "." && s !== ".." && !s.includes("/"), { message: "a repoId segment must not be '.'/'..' or contain '/'" });
 function segment(value, label) {
 	const result = segmentSchema.safeParse(value);
@@ -42900,16 +43222,16 @@ function osUsername() {
 }
 
 //#endregion
-//#region ../slate-bridge/dist/index.mjs
+//#region ../slate-bridge/dist/goldens-C7JkwekQ.mjs
 const nonEmptyStringSchema = string().trim().min(1);
 const portSchema = number().int().min(0).max(65535).default(7777);
 const envSchema = object({
 	CTX_AUTH_SKIP_VERIFY_JWT: string().optional().transform((v) => v === "true"),
 	CTX_GIT_HOST_BASE_DIR: nonEmptyStringSchema.default(() => path.join(os.homedir(), ".contextlayer", "repos")),
-	CTX_PLATFORM_URL: nonEmptyStringSchema.default("http://127.0.0.1:3010"),
-	CTX_WEB_URL: nonEmptyStringSchema.default("http://localhost:3000").transform((url) => url.replace(/\/+$/, "")),
+	CTX_PLATFORM_URL: url().default("http://127.0.0.1:3010").transform((url) => url.replace(/\/+$/, "")),
+	CTX_WEB_URL: url().default("http://localhost:3000").transform((url) => url.replace(/\/+$/, "")),
 	CTXS_BRIDGE_PORT: portSchema,
-	CTXS_CLAUDE_IMAGE: nonEmptyStringSchema.default("ghcr.io/usecontextlayer/ctx-sandbox:0.5.4"),
+	CTXS_CLAUDE_IMAGE: nonEmptyStringSchema.default("ghcr.io/usecontextlayer/ctx-sandbox:0.5.6"),
 	CTXS_CLAUDE_MODEL: nonEmptyStringSchema.default("opus"),
 	CTXS_HOST_CLAUDE_JSON_PATH: nonEmptyStringSchema.default(() => path.join(os.homedir(), ".claude.json")),
 	NODE_ENV: _enum([
@@ -43263,7 +43585,21 @@ const CLAUDE_ARGS = [
 	"--thinking-display",
 	"summarized",
 	"--permission-mode",
-	"bypassPermissions"
+	"bypassPermissions",
+	"--append-system-prompt",
+	`You are working in the user's workspace: a directory of documents that is also a shared git repository. The synthesis engine, other sessions, and operators write to this same repository through its remote. Git is how your work persists and how everyone else learns about it — an edit that is not pushed does not exist yet.
+
+1. When you complete a change the user asked for, immediately commit and push it: \`git add -A && git commit -m "<message>" && git push\`. Never use \`--force\` on a push, ever.
+
+2. Commit messages carry your reasoning, not just a summary. They are how this workspace remembers why things changed — future sessions, the synthesis engine, and the user read them. When you change a document's status or make a judgment call, put the why in the message. When you need context on how the workspace got into its current state, read \`git log\`.
+
+3. If a push is rejected, someone else pushed first. Run \`git pull --no-rebase\`. If the merge is clean, push again. If there are conflicts, resolve them together with the user: show what collided, prefer preserving the user's intent, ask when unsure — then commit and push. Never resolve a conflict by discarding someone else's work wholesale.
+
+4. At session start the tree may already hold uncommitted changes, unpushed commits, or a merge a previous session left in flight. This is normal. Never discard that work — fold uncommitted changes into your next commit, and finish an in-flight merge before starting new work.
+
+5. The \`.engine/\` directory is the synthesis engine's private state. Leave it alone unless the user explicitly asks.
+
+Do this bookkeeping quietly. Don't narrate routine git operations — mention git only when something needs the user's attention: a conflict, a rejected push you cannot heal, or work you found and preserved.`
 ];
 function bearerToken(c) {
 	const header = c.req.header("Authorization") ?? "";
@@ -43288,6 +43624,15 @@ function assertSingleBaseId(baseIds, workspaceId) {
 	if (baseId === void 0 || rest.length > 0) throw new Error(`render: workspace ${workspaceId} resolves to ${baseIds.length} base(s), but render-SQL requires exactly one (a sql() call runs against a single base DB). Link exactly one base to this workspace; multi-base render is deferred.`);
 	return baseId;
 }
+function noteDivergedCheckout(workspaceId) {
+	console.error(`[slate-bridge] workspace ${workspaceId} checkout has unpushed commits while origin moved (unfinished heal) — serving the local tree`);
+	Sentry.addBreadcrumb({
+		category: "workspace-checkout",
+		data: { workspaceId },
+		level: "warning",
+		message: "diverged workspace checkout served as-is"
+	});
+}
 function isTurnResult(line) {
 	if (!line.includes("\"type\":\"result\"")) return false;
 	try {
@@ -43337,11 +43682,12 @@ async function createBridgeServer(opts) {
 		const rawParams = (await c.req.json()).params ?? {};
 		try {
 			const userToken = bearerToken(c);
-			const { head, rootDir } = await materializeWorkspaceTree(workspaceId, {
+			const { head, rootDir, freshness } = await ensureWorkspaceCheckout(workspaceId, {
 				gitHostBaseDir,
 				platformUrl,
 				token: userToken
 			});
+			if (freshness === "held_diverged") noteDivergedCheckout(workspaceId);
 			const result = await runWorkspaceView({
 				rawParams,
 				resolveDsn: () => resolveRenderDsn(platformUrl, workspaceId, userToken),
@@ -43361,11 +43707,12 @@ async function createBridgeServer(opts) {
 		const rawParams = body.params ?? {};
 		try {
 			const userToken = bearerToken(c);
-			const { head, rootDir } = await materializeWorkspaceTree(workspaceId, {
+			const { head, rootDir, freshness } = await ensureWorkspaceCheckout(workspaceId, {
 				gitHostBaseDir,
 				platformUrl,
 				token: userToken
 			});
+			if (freshness === "held_diverged") noteDivergedCheckout(workspaceId);
 			const vault = await vaults.get(rootDir, head);
 			const result = await runWorkspaceContent({
 				contentPath: body.path,
@@ -43411,11 +43758,13 @@ async function createBridgeServer(opts) {
 			let phase = "boot";
 			try {
 				const plan = await fetchBridgePlan(platformUrl, workspaceId, userToken);
-				const [, { rootDir }] = await Promise.all([claudeRepo.restore(), materializeWorkspaceTree(workspaceId, {
+				const [, checkout] = await Promise.all([claudeRepo.restore(), ensureWorkspaceCheckout(workspaceId, {
 					gitHostBaseDir,
 					platformUrl,
 					token: userToken
 				})]);
+				if (checkout.freshness === "held_diverged") noteDivergedCheckout(workspaceId);
+				const rootDir = checkout.rootDir;
 				if (ac.signal.aborted) return;
 				session = await createClaudeMicrosandbox({
 					claudeHomeHostDir: claudeRepo.hostDir,
@@ -43435,7 +43784,12 @@ async function createBridgeServer(opts) {
 					],
 					env: {
 						CLAUDE_CODE_ENTRYPOINT: "sdk-ts",
-						...plan.claudeOauthToken ? { CLAUDE_CODE_OAUTH_TOKEN: plan.claudeOauthToken } : {}
+						...plan.claudeOauthToken ? { CLAUDE_CODE_OAUTH_TOKEN: plan.claudeOauthToken } : {},
+						...guestGitEnv({
+							platformUrl,
+							sub: r.sub,
+							token: userToken
+						})
 					},
 					signal: ac.signal
 				});
@@ -43513,6 +43867,72 @@ async function createBridgeServer(opts) {
 		port: address.port
 	};
 }
+const PARITY_SCENARIOS = [
+	{
+		name: "text-only",
+		turns: ["Reply with exactly one word: hello", "Now reply with exactly one word: goodbye"]
+	},
+	{
+		name: "code-writing",
+		turns: [
+			"Create a file calc.js that exports a function add(a, b) returning a + b. Use module.exports. Just write the file, no explanation.",
+			"Add a function sub(a, b) returning a - b to calc.js, keeping add. Export both.",
+			"Create run.js that requires ./calc.js and prints add(2, 3) and sub(5, 1), then run it with `node run.js` and show the output.",
+			"In one sentence, what does calc.js export now?"
+		]
+	},
+	{
+		name: "thinking-and-error",
+		turns: [
+			"Reason carefully step by step before answering: a train travels 90 km in 1 hour 12 minutes. What is its average speed in km/h? Show your reasoning, then the answer.",
+			"Read the file /tmp/definitely-does-not-exist-9f3a.txt and tell me its contents.",
+			"In one short sentence, acknowledge that the file could not be read."
+		]
+	},
+	{
+		name: "compaction",
+		turns: [
+			"In two short paragraphs, explain how the TCP three-way handshake works.",
+			"Now, in two short paragraphs, explain how a TLS 1.3 handshake works.",
+			"List three concrete differences between TCP and UDP.",
+			"/compact",
+			"What topics were we just discussing? Answer in one sentence.",
+			"Reply with exactly one word: done"
+		]
+	},
+	{
+		name: "multi-file-tools",
+		turns: ["Create three files in the current directory: a.txt containing exactly `alpha`, b.txt containing exactly `beta`, c.txt containing exactly `gamma`. Just create them, no explanation.", "Read a.txt, b.txt, and c.txt and tell me what each one contains."]
+	},
+	{
+		name: "web-tools",
+		turns: ["Use web search to find the current latest stable Node.js LTS major version. Report just the version number.", "In one sentence, what did you search for?"]
+	},
+	{
+		name: "long-conversation",
+		turns: [
+			"Name a primary color. Reply with one word.",
+			"Name a different primary color. Reply with one word.",
+			"Name the third primary color. Reply with one word.",
+			"What color do you get mixing red and blue? Reply with one word.",
+			"Summarize this conversation in one short sentence.",
+			"Reply with exactly one word: bye"
+		]
+	}
+];
+function resolveGoldensDir() {
+	let dir = path.dirname(fileURLToPath(import.meta.url));
+	while (true) {
+		const candidate = path.join(dir, "slate-shared", "lib", "__goldens__");
+		if (existsSync(candidate)) return candidate;
+		const parent = path.dirname(dir);
+		if (parent === dir) throw new Error(`[parity] could not locate slate-shared/lib/__goldens__ above ${fileURLToPath(import.meta.url)}`);
+		dir = parent;
+	}
+}
+
+//#endregion
+//#region ../slate-bridge/dist/index.mjs
 async function writeJsonAtomic(filePath, value) {
 	const tmp = `${filePath}.tmp`;
 	await writeFile(tmp, `${JSON.stringify(value, null, 2)}\n`);
@@ -47661,4 +48081,4 @@ runCli().catch((error) => {
 //#endregion
 export { createProgram, runCli };
 //# sourceMappingURL=cli.mjs.map
-//# debugId=203202bf-ce01-592c-a003-11e98e6ee3f4
+//# debugId=3dbc3cff-70da-5d01-b6fc-a83d63e0c3f3