@vimhead.dev/norn-cli 0.1.0-tip.35359392805.1 → 0.1.0-tip.35436871363.1

package/dist/internal/file-coordinator.js

@@ -0,0 +1,162 @@
+// ../core/src/atomic-files.ts
+import { randomUUID } from "node:crypto";
+import { chmod, mkdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+
+// ../core/src/errors.ts
+function isNodeError(error) {
+  return error instanceof Error && "code" in error;
+}
+
+// ../core/src/atomic-files.ts
+async function writeTextAtomically(path, content) {
+  await mkdir(dirname(path), { recursive: true });
+  let existingMode;
+  try {
+    existingMode = (await stat(path)).mode & 511;
+  } catch (error) {
+    if (!isNodeError(error) || error.code !== "ENOENT") throw error;
+  }
+  const tmpPath = `${path}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(tmpPath, content, { encoding: "utf8", mode: existingMode });
+    if (existingMode !== void 0) await chmod(tmpPath, existingMode);
+    await rename(tmpPath, path);
+  } catch (error) {
+    await rm(tmpPath, { force: true }).catch(() => void 0);
+    throw error;
+  }
+}
+
+// src/internal/file-coordinator.ts
+import { createHash, randomUUID as randomUUID2 } from "node:crypto";
+import { lstat, mkdir as mkdir2, mkdtemp, readFile, readdir, realpath, rename as rename2, rm as rm2, rmdir, unlink, writeFile as writeFile2 } from "node:fs/promises";
+import { hostname } from "node:os";
+import { basename, dirname as dirname2, join, resolve } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { Type } from "typebox";
+import { Value } from "typebox/value";
+var ownerSchema = Type.Object({
+  token: Type.String({ format: "uuid" }),
+  pid: Type.Integer({ exclusiveMinimum: 0 }),
+  host: Type.String(),
+  target: Type.String()
+}, { additionalProperties: false });
+var NornFileCoordinator = class {
+  constructor(input) {
+    this.input = input;
+    if (!Number.isSafeInteger(input.waitTimeoutMs) || input.waitTimeoutMs <= 0) throw new Error("Lock wait timeout must be a positive integer");
+    this.lockRoot = resolve(input.lockRoot);
+  }
+  input;
+  lockRoot;
+  async withExclusiveLock(path, operation) {
+    const target = await this.resolveTarget(path);
+    await mkdir2(this.lockRoot, { recursive: true, mode: 448 });
+    const key = createHash("sha256").update(target).digest("hex");
+    const lockPath = join(this.lockRoot, `${key}.lock`);
+    const stagingPath = await mkdtemp(join(this.lockRoot, `${key}.pending-`));
+    const token = randomUUID2();
+    const marker = `${token}.json`;
+    return this.withCleanup({
+      operation: async () => {
+        await writeFile2(join(stagingPath, marker), JSON.stringify({ token, pid: process.pid, host: hostname(), target }), { mode: 384 });
+        await this.acquire({ stagingPath, lockPath, target });
+        return this.withCleanup({
+          operation: () => operation(target),
+          cleanup: async () => {
+            await unlink(join(lockPath, marker));
+            await this.removeEmptyLock(lockPath);
+          }
+        });
+      },
+      cleanup: () => rm2(stagingPath, { recursive: true, force: true })
+    });
+  }
+  async readText(path) {
+    return this.withExclusiveLock(path, (lockedPath) => readFile(lockedPath, "utf8"));
+  }
+  async writeText(path, content) {
+    await mkdir2(dirname2(path), { recursive: true });
+    await this.withExclusiveLock(path, (lockedPath) => writeTextAtomically(lockedPath, content));
+  }
+  async withCleanup(input) {
+    let result;
+    try {
+      result = await input.operation();
+    } catch (error) {
+      try {
+        await input.cleanup();
+      } catch (cleanupError) {
+        throw new AggregateError([error, cleanupError], "File operation and lock cleanup failed");
+      }
+      throw error;
+    }
+    await input.cleanup();
+    return result;
+  }
+  async resolveTarget(path) {
+    try {
+      return await realpath(path);
+    } catch (error) {
+      if (!isNodeError(error) || error.code !== "ENOENT") throw error;
+      const entry = await lstat(path).catch((error2) => {
+        if (isNodeError(error2) && error2.code === "ENOENT") return void 0;
+        throw error2;
+      });
+      if (entry?.isSymbolicLink()) throw new Error(`Cannot lock a dangling symbolic link: ${path}`);
+      return join(await realpath(dirname2(path)), basename(path));
+    }
+  }
+  async acquire(input) {
+    const deadline = Date.now() + this.input.waitTimeoutMs;
+    while (true) {
+      try {
+        await rename2(input.stagingPath, input.lockPath);
+        return;
+      } catch (error) {
+        if (!isNodeError(error) || !["ENOTEMPTY", "EEXIST"].includes(error.code ?? "")) throw error;
+      }
+      await this.reclaimDeadOwner(input);
+      if (Date.now() >= deadline) throw new Error(`Timed out waiting for file lock: ${input.target}`);
+      await delay(10);
+    }
+  }
+  async reclaimDeadOwner(input) {
+    try {
+      const entries = await readdir(input.lockPath);
+      if (entries.length === 0) return;
+      if (entries.length !== 1) throw new Error(`Invalid file lock ownership: ${input.lockPath}`);
+      const marker = entries[0];
+      const owner = Value.Parse(ownerSchema, JSON.parse(await readFile(join(input.lockPath, marker), "utf8")));
+      if (marker !== `${owner.token}.json` || owner.target !== input.target || owner.host !== hostname()) {
+        throw new Error(`Incompatible file lock ownership: ${input.lockPath}`);
+      }
+      try {
+        process.kill(owner.pid, 0);
+        return;
+      } catch (error) {
+        if (isNodeError(error) && error.code === "EPERM") return;
+        if (!isNodeError(error) || error.code !== "ESRCH") throw error;
+      }
+      await unlink(join(input.lockPath, marker));
+      await this.removeEmptyLock(input.lockPath);
+    } catch (error) {
+      if (!isNodeError(error) || error.code !== "ENOENT") throw error;
+    }
+  }
+  async removeEmptyLock(path) {
+    try {
+      await rmdir(path);
+    } catch (error) {
+      if (!isNodeError(error) || !["ENOENT", "ENOTEMPTY", "EEXIST"].includes(error.code ?? "")) throw error;
+    }
+  }
+};
+function createRunFileCoordinator(runRoot) {
+  return new NornFileCoordinator({ lockRoot: join(runRoot, "locks"), waitTimeoutMs: 3e4 });
+}
+export {
+  NornFileCoordinator,
+  createRunFileCoordinator
+};

package/dist/internal/launch-request.d.ts

@@ -3,21 +3,21 @@ export declare const LAUNCH_REQUEST_FILE_NAME = "launch-request.json";
 export declare const RESUME_REQUEST_FILE_NAME = "resume-request.json";
 export declare const RESUME_START_GRACE_MS = 60000;
 export type NornRunLaunchRequest = {
-    readonly version: 1;
+    readonly version: 2;
     readonly type: "run";
     readonly id: string;
     readonly name: string;
     readonly workflowId: string;
-    readonly params: unknown;
+    readonly args: unknown;
     readonly configOverride?: unknown;
     readonly createdAt: string;
 };
 export type NornRunResumeRequest = {
-    readonly version: 1;
+    readonly version: 2;
     readonly type: "resume";
     readonly id: string;
     readonly requestId?: string;
-    readonly params?: unknown;
+    readonly args?: unknown;
     readonly createdAt: string;
 };
 export declare function writeRunLaunchRequest(runRoot: string, request: NornRunLaunchRequest): Promise<void>;

package/dist/internal/launch-request.js

@@ -80,7 +80,7 @@ async function clearRunResumeRequest(input) {
 function parseRunLaunchRequest(value) {
   if (!value || typeof value !== "object") throw new Error("Invalid workflow launch request");
   const request = value;
-  if (request.version !== 1 || request.type !== "run") throw new Error("Unsupported workflow launch request");
+  if (request.version !== 2 || request.type !== "run") throw new Error("Unsupported workflow launch request");
   if (typeof request.id !== "string" || request.id.length === 0) throw new Error("Invalid workflow launch request id");
   if (typeof request.name !== "string" || request.name.length === 0) throw new Error("Invalid workflow launch request name");
   if (typeof request.workflowId !== "string" || request.workflowId.length === 0) throw new Error("Invalid workflow launch request workflow id");
@@ -90,7 +90,7 @@ function parseRunLaunchRequest(value) {
 function parseRunResumeRequest(value) {
   if (!value || typeof value !== "object") throw new Error("Invalid workflow resume request");
   const request = value;
-  if (request.version !== 1 || request.type !== "resume") throw new Error("Unsupported workflow resume request");
+  if (request.version !== 2 || request.type !== "resume") throw new Error("Unsupported workflow resume request");
   if (typeof request.id !== "string" || request.id.length === 0) throw new Error("Invalid workflow resume request id");
   if (request.requestId !== void 0 && (typeof request.requestId !== "string" || request.requestId.length === 0)) throw new Error("Invalid workflow resume request token");
   if (typeof request.createdAt !== "string" || Number.isNaN(Date.parse(request.createdAt))) throw new Error("Invalid workflow resume request timestamp");

package/dist/internal/logs.d.ts

@@ -1,5 +1,5 @@
 import { type WriteStream } from "node:fs";
-import type { NornFileCoordinator } from "@vimhead.dev/norn/files";
+import type { NornFileCoordinator } from "./file-coordinator.ts";
 import type { NornLogRef } from "@vimhead.dev/norn";
 export type NornLogWriteStream = {
     readonly log: NornLogRef;

package/dist/internal/run-log.d.ts

@@ -1,4 +1,4 @@
-import type { NornFileCoordinator } from "@vimhead.dev/norn/files";
+import type { NornFileCoordinator } from "./file-coordinator.ts";
 export type NornRunManifestEvent = {
     readonly at: string;
     readonly type: string;

package/dist/internal/run-state.d.ts

@@ -1,10 +1,10 @@
 import type { NornRunStatus, NornRunOutcomeMetadata, NornRunInfo } from "@vimhead.dev/norn";
 export declare const RUN_STATE_FILE_NAME = "run-state.json";
-export declare function mergeInterruptedWorkflowParams(currentParams: unknown, params: unknown, fields: readonly string[] | undefined): unknown;
-declare const RUN_STATE_VERSION = 1;
+export declare function mergeInterruptedWorkflowArgs(currentArgs: unknown, args: unknown, fields: readonly string[] | undefined): unknown;
+declare const RUN_STATE_VERSION = 2;
 type NornRunWorkflowStep = {
     readonly workflowId: string;
-    readonly params: unknown;
+    readonly args: unknown;
     readonly cwd: string;
     readonly env: Record<string, string>;
     readonly interruption?: RuntimeInterruption;
@@ -39,7 +39,8 @@ type NornRunWorkflowOutcome = {
     readonly metadata?: NornRunOutcomeMetadata;
 };
 export type NornRunState = {
-    readonly version: typeof RUN_STATE_VERSION;
+    readonly version: 1 | typeof RUN_STATE_VERSION;
+    readonly projectRoot?: string;
     readonly id: string;
     readonly name: string;
     readonly entrypointWorkflowId: string;
@@ -54,6 +55,7 @@ export type NornRunState = {
     readonly updatedAt: string;
 };
 type CreateNornRunStateInput = {
+    readonly projectRoot: string;
     readonly id: string;
     readonly name: string;
     readonly entrypointWorkflowId: string;
@@ -76,20 +78,21 @@ export declare class NornRunStateStore {
     failRun(workflowId: string, metadata: NornRunOutcomeMetadata & {
         readonly summary: string;
     }): Promise<void>;
-    interruptCurrent(params: unknown, interruption: {
+    interruptCurrent(args: unknown, interruption: {
         readonly description: string;
         readonly fields?: readonly string[];
     }): Promise<void>;
     prepareForResumeAfterRollback(): Promise<void>;
     stopCurrent(): Promise<void>;
-    replaceCurrentParams(params: unknown): Promise<void>;
-    failCurrent(errorOrMetadata: string | NornRunOutcomeMetadata & {
+    replaceCurrentArgs(args: unknown): Promise<void>;
+    failCurrent(errorOrMetadata: string | (NornRunOutcomeMetadata & {
         readonly summary: string;
-    }): Promise<void>;
+    })): Promise<void>;
     private update;
     private write;
 }
 export declare function listRuns(sessionCwd: string): Promise<NornRunInfo[]>;
 export declare function getRunInfo(runRoot: string): Promise<NornRunInfo>;
 export declare function resolveRunRoot(sessionCwd: string, run: string): Promise<string>;
+export declare function assertRunVersion(version: unknown): void;
 export {};

package/dist/internal/run-state.js

@@ -39,21 +39,21 @@ async function writeTextAtomically(path, content) {
 }
 
 // src/internal/run-state.ts
-import { createRunFileCoordinator } from "@vimhead.dev/norn/files";
+import { createRunFileCoordinator } from "./file-coordinator.js";
 import { runCurrentRoot } from "./run-store.js";
 import { jsonValueSchema } from "@vimhead.dev/norn/schema";
 import { Value } from "typebox/value";
 var RUN_STATE_FILE_NAME = "run-state.json";
 var LEGACY_RUN_STATE_FILE_NAME = "runtime-state.json";
-function mergeInterruptedWorkflowParams(currentParams, params, fields) {
-  if (!isRecord(currentParams) || !isRecord(params)) return params;
+function mergeInterruptedWorkflowArgs(currentArgs, args, fields) {
+  if (!isRecord(currentArgs) || !isRecord(args)) return args;
   if (fields) {
-    const unsupportedFields = Object.keys(params).filter((field) => !fields.includes(field));
-    if (unsupportedFields.length > 0) throw new Error(`Interrupted workflow params cannot update non-gate fields: ${unsupportedFields.join(", ")}`);
+    const unsupportedFields = Object.keys(args).filter((field) => !fields.includes(field));
+    if (unsupportedFields.length > 0) throw new Error(`Interrupted workflow args cannot update non-gate fields: ${unsupportedFields.join(", ")}`);
   }
-  return { ...currentParams, ...params };
+  return { ...currentArgs, ...args };
 }
-var RUN_STATE_VERSION = 1;
+var RUN_STATE_VERSION = 2;
 var NornRunStateStore = class _NornRunStateStore {
   path;
   state;
@@ -70,7 +70,8 @@ var NornRunStateStore = class _NornRunStateStore {
       id: input.id,
       name: input.name,
       entrypointWorkflowId: input.entrypointWorkflowId,
-      workspace: input.workspace,
+      projectRoot: resolve(input.projectRoot),
+      workspace: resolve(input.workspace),
       configOverride: input.configOverride,
       status: "running",
       current: input.current,
@@ -87,7 +88,7 @@ var NornRunStateStore = class _NornRunStateStore {
   static async load(runRoot) {
     const currentRoot = runCurrentRoot(runRoot);
     const files = createRunFileCoordinator(runRoot);
-    const state = await files.withExclusiveLock(join(currentRoot, RUN_STATE_FILE_NAME), async (path) => parseNornRunState(await readRunStateFile({ path, legacyPath: join(currentRoot, LEGACY_RUN_STATE_FILE_NAME) })));
+    const state = await files.withExclusiveLock(join(currentRoot, RUN_STATE_FILE_NAME), async (path) => parseNornRunState(await readRunStateFile({ path, legacyPath: join(currentRoot, LEGACY_RUN_STATE_FILE_NAME) }), "execute"));
     return new _NornRunStateStore({ path: join(currentRoot, RUN_STATE_FILE_NAME), state, files });
   }
   currentState() {
@@ -125,11 +126,11 @@ var NornRunStateStore = class _NornRunStateStore {
       failed: { workflowId, error: metadata.summary, metadata, failedAt }
     });
   }
-  async interruptCurrent(params, interruption) {
+  async interruptCurrent(args, interruption) {
     if (!this.state.current) throw new Error("Cannot interrupt run without current step");
     await this.update({
       status: "interrupted",
-      current: { ...this.state.current, params, interruption: { status: "pending", ...interruption } },
+      current: { ...this.state.current, args, interruption: { status: "pending", ...interruption } },
       outcome: null,
       failed: null
     });
@@ -144,11 +145,11 @@ var NornRunStateStore = class _NornRunStateStore {
     if (!this.state.current) throw new Error("Cannot stop run without current step");
     await this.update({ status: "stopped", outcome: null, failed: null });
   }
-  async replaceCurrentParams(params) {
+  async replaceCurrentArgs(args) {
     if (!this.state.current) throw new Error("Cannot resume run without current step");
     await this.update({
       status: "running",
-      current: { ...this.state.current, params, interruption: { ...this.state.current.interruption, status: "satisfied" } },
+      current: { ...this.state.current, args, interruption: { ...this.state.current.interruption, status: "satisfied" } },
       outcome: null,
       failed: null
     });
@@ -165,15 +166,15 @@ var NornRunStateStore = class _NornRunStateStore {
   }
   async update(patch) {
     await this.files.withExclusiveLock(this.path, async (path) => {
-      const current = parseNornRunState(await readRunStateFile({ path, legacyPath: join(dirname2(this.path), LEGACY_RUN_STATE_FILE_NAME) }));
+      const current = parseNornRunState(await readRunStateFile({ path, legacyPath: join(dirname2(this.path), LEGACY_RUN_STATE_FILE_NAME) }), "execute");
       const next = { ...current, ...patch, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
-      if (next.current?.params !== void 0) Value.Assert(jsonValueSchema, next.current.params);
+      if (next.current?.args !== void 0) Value.Assert(jsonValueSchema, next.current.args);
       await writeJsonAtomically(path, next);
       this.state = next;
     });
   }
   async write() {
-    if (this.state.current?.params !== void 0) Value.Assert(jsonValueSchema, this.state.current.params);
+    if (this.state.current?.args !== void 0) Value.Assert(jsonValueSchema, this.state.current.args);
     await mkdir2(dirname2(this.path), { recursive: true });
     await this.files.withExclusiveLock(this.path, (path) => writeJsonAtomically(path, this.state));
   }
@@ -192,13 +193,19 @@ async function listRuns(sessionCwd) {
 }
 async function getRunInfo(runRoot) {
   try {
-    const resumeRequest = await readOptionalRunResumeRequest(runRoot);
-    const state = parseNornRunState(await readRunStateJson(runCurrentRoot(runRoot)));
+    const pendingResume = await readOptionalRunResumeRequest(runRoot).then(
+      (request) => ({ status: "fulfilled", request }),
+      (error) => ({ status: "rejected", error })
+    );
+    const state = parseNornRunState(await readRunStateJson(runCurrentRoot(runRoot)), "inspect");
+    if (state.version === RUN_STATE_VERSION && pendingResume.status === "rejected") throw pendingResume.error;
+    const resumeRequest = state.version === RUN_STATE_VERSION && pendingResume.status === "fulfilled" ? pendingResume.request : void 0;
     return {
       version: state.version,
       id: state.id,
       name: state.name,
       path: runRoot,
+      paths: { project: state.projectRoot ?? resolve(runRoot, "../../.."), workspace: state.workspace },
       entrypointWorkflowId: state.entrypointWorkflowId,
       currentWorkflowId: state.current?.workflowId,
       status: resumeRequest ? "running" : state.status,
@@ -255,6 +262,7 @@ async function getLaunchedRunInfo(runRoot) {
     id: launchRequest.id,
     name: launchRequest.name,
     path: runRoot,
+    paths: { project: resolve(runRoot, "../../.."), workspace: join(runCurrentRoot(resolve(runRoot)), "workspace") },
     entrypointWorkflowId: launchRequest.workflowId,
     currentWorkflowId: launchRequest.workflowId,
     status: "running",
@@ -277,10 +285,13 @@ async function readRunStateFile(input) {
 function isRecord(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
-function parseNornRunState(value) {
+function assertRunVersion(version) {
+  if (version !== RUN_STATE_VERSION) throw new Error(`Incompatible saved run state version ${String(version)}; this alpha requires version ${RUN_STATE_VERSION}. Use the original Norn version to resume this run, or start a new run. Saved files have not been migrated.`);
+}
+function parseNornRunState(value, mode) {
   if (!value || typeof value !== "object") throw new Error("Invalid run state");
   const state = value;
-  if (state.version !== RUN_STATE_VERSION) throw new Error(`Unsupported run state version: ${String(state.version)}`);
+  if (mode === "execute" || state.version !== 1) assertRunVersion(state.version);
   if (typeof state.id !== "string" || state.id.length === 0) throw new Error("Invalid run state id");
   const normalizedState = state;
   if (typeof normalizedState.name !== "string" || normalizedState.name.length === 0) normalizedState.name = state.id;
@@ -306,7 +317,7 @@ function runInterruption(state) {
   if (state.status !== "interrupted" || !state.current?.interruption) return void 0;
   return {
     workflowId: state.current.workflowId,
-    params: state.current.params,
+    args: state.version === 1 ? state.current.params : state.current.args,
     description: state.current.interruption.description ?? "",
     fields: state.current.interruption.fields
   };
@@ -320,8 +331,9 @@ function runFailure(state) {
 export {
   NornRunStateStore,
   RUN_STATE_FILE_NAME,
+  assertRunVersion,
   getRunInfo,
   listRuns,
-  mergeInterruptedWorkflowParams,
+  mergeInterruptedWorkflowArgs,
   resolveRunRoot
 };

package/dist/internal/run.d.ts

@@ -1,51 +1,31 @@
 import type { CreateAgentSessionOptions } from "@earendil-works/pi-coding-agent";
-import type { NornAnyWorkflowDeclaration, NornProjectRun, NornRunOutcomeMetadata, NornWorkflowIsolationMode, NornRun } from "@vimhead.dev/norn";
+import type { NornRunOutcomeMetadata, NornRun } from "@vimhead.dev/norn";
 import type { NornAgentResponseCollector } from "./agent-response-tool.ts";
-import type { NornArtifacts } from "./artifacts.ts";
 import type { NornRunLogs } from "./logs.ts";
 import type { NornRunLogger } from "./run-log.ts";
-import type { NornRunResources } from "../resources.ts";
 type DefaultNornRunInput = {
     readonly id: string;
     readonly runRoot: string;
-    readonly projectRoot: string;
-    readonly workspace: string;
-    readonly cwd: string;
-    readonly isolationMode: NornWorkflowIsolationMode;
     readonly signal?: AbortSignal;
     readonly model?: CreateAgentSessionOptions["model"];
     readonly thinkingLevel?: CreateAgentSessionOptions["thinkingLevel"];
     readonly agentDir?: string;
     readonly responseCollector: NornAgentResponseCollector;
-    readonly resources: NornRunResources;
-    readonly state: NornRun["state"];
     readonly logger: NornRunLogger;
-    readonly artifacts: NornArtifacts;
     readonly logs: NornRunLogs;
 };
-export declare class NornRunContext implements NornProjectRun {
+export declare class NornRunContext implements NornRun {
     private readonly input;
-    readonly resources: NornRunResources;
-    readonly state: NornRun["state"];
-    readonly artifacts: NornRun["artifacts"];
     readonly logs: NornRun["logs"];
     readonly commands: NornRun["commands"];
     readonly agents: NornRun["agents"];
     readonly id: string;
-    readonly workspace: string;
-    readonly projectRoot: string;
-    readonly cwd: string;
     constructor(input: DefaultNornRunInput);
-    forWorkflow(workflow: NornAnyWorkflowDeclaration): NornRunContext;
-    private get boundaryRoot();
     private createAgentRunner;
-    path(relativePath: string): string;
-    projectPath(relativePath: string): string;
-    next(workflowId: string, params: unknown): ReturnType<NornRun["next"]>;
+    next(workflowId: string, args: unknown): ReturnType<NornRun["next"]>;
     complete(metadata?: NornRunOutcomeMetadata): ReturnType<NornRun["complete"]>;
     fail(metadata: NornRunOutcomeMetadata & {
         readonly summary: string;
     }): ReturnType<NornRun["fail"]>;
-    private resolveFromRoot;
 }
 export {};

package/dist/internal/run.js

@@ -1,33 +1,21 @@
-// src/internal/run.ts
-import { isAbsolute, relative, resolve, sep } from "node:path";
-
 // ../core/src/workflow-transition.ts
 function createWorkflowTransition(input) {
   if (typeof input.workflowId !== "string" || input.workflowId.trim().length === 0) throw new Error("Workflow transition requires a nonempty workflow ID");
-  return { type: "next", workflowId: input.workflowId, params: input.params };
+  return { type: "next", workflowId: input.workflowId, args: input.args };
 }
 
 // src/internal/run.ts
 import { NornAgentRunner } from "./agents.js";
 import { NornCommandRunner } from "./commands.js";
-var NornRunContext = class _NornRunContext {
+var NornRunContext = class {
   constructor(input) {
     this.input = input;
     this.id = input.id;
-    this.workspace = input.workspace;
-    this.projectRoot = input.projectRoot;
-    this.cwd = input.cwd;
-    this.resources = input.resources;
-    this.state = input.state;
-    this.artifacts = input.artifacts;
     this.logs = {
       read: (log) => this.input.logs.read(log)
     };
     this.commands = {
       run: (commandInput) => new NornCommandRunner({
-        boundaryRoot: this.boundaryRoot,
-        boundaryName: this.input.isolationMode,
-        cwd: this.cwd,
         signal: this.input.signal,
         logs: this.input.logs,
         logger: this.input.logger
@@ -39,34 +27,14 @@ var NornRunContext = class _NornRunContext {
     };
   }
   input;
-  resources;
-  state;
-  artifacts;
   logs;
   commands;
   agents;
   id;
-  workspace;
-  projectRoot;
-  cwd;
-  forWorkflow(workflow) {
-    const isolationMode = workflow.isolation.mode;
-    return new _NornRunContext({
-      ...this.input,
-      isolationMode,
-      cwd: isolationMode === "project" ? this.projectRoot : this.workspace
-    });
-  }
-  get boundaryRoot() {
-    return this.input.isolationMode === "project" ? this.projectRoot : this.workspace;
-  }
   createAgentRunner() {
     return new NornAgentRunner({
       id: this.id,
       runRoot: this.input.runRoot,
-      boundaryRoot: this.boundaryRoot,
-      boundaryName: this.input.isolationMode,
-      cwd: this.cwd,
       signal: this.input.signal,
       model: this.input.model,
       thinkingLevel: this.input.thinkingLevel,
@@ -76,14 +44,8 @@ var NornRunContext = class _NornRunContext {
       responseCollector: this.input.responseCollector
     });
   }
-  path(relativePath) {
-    return this.resolveFromRoot(this.cwd, this.boundaryRoot, relativePath);
-  }
-  projectPath(relativePath) {
-    return this.resolveFromRoot(this.projectRoot, this.projectRoot, relativePath);
-  }
-  next(workflowId, params) {
-    return createWorkflowTransition({ workflowId, params });
+  next(workflowId, args) {
+    return createWorkflowTransition({ workflowId, args });
   }
   complete(metadata) {
     return { type: "complete", metadata };
@@ -91,14 +53,6 @@ var NornRunContext = class _NornRunContext {
   fail(metadata) {
     return { type: "fail", metadata };
   }
-  resolveFromRoot(root, boundaryRoot, path) {
-    const resolvedPath = isAbsolute(path) ? path : resolve(root, path);
-    const pathFromBoundary = relative(boundaryRoot, resolvedPath);
-    if (pathFromBoundary === ".." || pathFromBoundary.startsWith(`..${sep}`) || isAbsolute(pathFromBoundary)) {
-      throw new Error(`Workflow path escapes ${this.input.isolationMode} isolation: ${path}`);
-    }
-    return resolvedPath;
-  }
 };
 export {
   NornRunContext

package/dist/internal/worker-directory.d.ts

@@ -0,0 +1 @@
+export declare function prepareRunWorkerDirectory(runRoot: string): Promise<string>;

package/dist/internal/worker-directory.js

@@ -0,0 +1,26 @@
+// src/internal/worker-directory.ts
+import { chmod, lstat, mkdir, readdir } from "node:fs/promises";
+import { join } from "node:path";
+
+// ../core/src/errors.ts
+function isNodeError(error) {
+  return error instanceof Error && "code" in error;
+}
+
+// src/internal/worker-directory.ts
+async function prepareRunWorkerDirectory(runRoot) {
+  const directory = join(runRoot, "worker");
+  try {
+    await mkdir(directory, { mode: 365 });
+  } catch (error) {
+    if (!isNodeError(error) || error.code !== "EEXIST") throw error;
+  }
+  const metadata = await lstat(directory);
+  if (!metadata.isDirectory() || metadata.isSymbolicLink()) throw new Error(`Run worker cwd must be a directory, not a symlink: ${directory}`);
+  if ((await readdir(directory)).length !== 0) throw new Error(`Run worker cwd must be empty: ${directory}`);
+  await chmod(directory, 365);
+  return directory;
+}
+export {
+  prepareRunWorkerDirectory
+};