@warlock.js/ai-workspace 5.31.0 → 5.32.0

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to `@warlock.js/ai-workspace` are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). `@warlock.js/*` packages are released in lockstep — every package shares the same version number, so a version below may list only the changes that affected this package.
 
+## 5.32.0 - 2026-10-18
+
+### Changed
+
+- Pin the package development compiler to TypeScript 7.0.2 and use explicit Node types and source roots with supported module resolution.
+
 ## 5.31.0 - 2026-10-18
 
 ### Upgrading

package/cjs/index.cjs

@@ -20,7 +20,7 @@ var __copyProps = (to, from, except, desc) => {
 	}
 	return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
 	value: mod,
 	enumerable: true
 }) : target, mod));
@@ -188,7 +188,7 @@ const MAX_NESTING = 16;
 * appear unquoted in command position. The parser does not read compound
 * commands, so a line using one is refused.
 */
-const RESERVED_WORDS = new Set([
+const RESERVED_WORDS = /* @__PURE__ */ new Set([
 	"!",
 	"{",
 	"}",
@@ -212,7 +212,7 @@ const RESERVED_WORDS = new Set([
 	"while"
 ]);
 /** cmd.exe keywords the `"cmd"` dialect refuses in command position. */
-const CMD_RESERVED_WORDS = new Set([
+const CMD_RESERVED_WORDS = /* @__PURE__ */ new Set([
 	"if",
 	"for",
 	"goto",
@@ -990,7 +990,7 @@ function parseShellLine(line, dialect) {
 * rejected instead of silently running commands past the allowlist. Inside
 * quotes they are ordinary literal bytes and pass through as argument data.
 */
-const UNQUOTED_METACHARACTERS = new Set([
+const UNQUOTED_METACHARACTERS = /* @__PURE__ */ new Set([
 	";",
 	"&",
 	"|",
@@ -1002,7 +1002,7 @@ const UNQUOTED_METACHARACTERS = new Set([
 	")"
 ]);
 /** Two-character operators reported as one token in a refusal. */
-const TWO_CHARACTER_OPERATORS = new Set([
+const TWO_CHARACTER_OPERATORS = /* @__PURE__ */ new Set([
 	"&&",
 	"||",
 	">>",
@@ -1115,7 +1115,7 @@ function tokenizeCommand(command) {
 * With deny rules in force they would hide a denied command, so they are
 * refused unless the policy names them in `allow`.
 */
-const OPAQUE_RUNNERS = new Set([
+const OPAQUE_RUNNERS = /* @__PURE__ */ new Set([
 	"sh",
 	"bash",
 	"dash",
@@ -1159,7 +1159,7 @@ const OPAQUE_RUNNERS = new Set([
 	"flock"
 ]);
 /** POSIX shell builtins that evaluate code or change how later names resolve. */
-const SHELL_OPAQUE_BUILTINS = new Set([
+const SHELL_OPAQUE_BUILTINS = /* @__PURE__ */ new Set([
 	"eval",
 	".",
 	"source",
@@ -1183,7 +1183,7 @@ const SHELL_OPAQUE_BUILTINS = new Set([
 	"readarray"
 ]);
 /** cmd.exe builtins that run commands or change the environment. */
-const CMD_OPAQUE_BUILTINS = new Set([
+const CMD_OPAQUE_BUILTINS = /* @__PURE__ */ new Set([
 	"call",
 	"start",
 	"set",
@@ -1195,7 +1195,7 @@ const CMD_OPAQUE_BUILTINS = new Set([
 * subscripts such as `a[$(cmd)]`): their arguments must be literal and free
 * of `[`.
 */
-const ARITHMETIC_SENSITIVE_BUILTINS = new Set([
+const ARITHMETIC_SENSITIVE_BUILTINS = /* @__PURE__ */ new Set([
 	"test",
 	"[",
 	"printf",
@@ -1219,7 +1219,7 @@ const ARITHMETIC_SENSITIVE_BUILTINS = new Set([
 * the jail's sight, `PS4` is expanded — command substitutions included —
 * on every traced line, `IFS` re-splits expansions).
 */
-const SENSITIVE_VARIABLES = new Set([
+const SENSITIVE_VARIABLES = /* @__PURE__ */ new Set([
 	"CDPATH",
 	"ENV",
 	"BASH_ENV",
@@ -1237,13 +1237,13 @@ const SENSITIVE_VARIABLES = new Set([
 	"BASH_LOADABLES_PATH"
 ]);
 /** Redirection targets that are always fine even though they sit outside the jail. */
-const DEVICE_TARGETS = new Set([
+const DEVICE_TARGETS = /* @__PURE__ */ new Set([
 	"/dev/null",
 	"/dev/stdout",
 	"/dev/stderr"
 ]);
 /** cmd.exe's null device. */
-const CMD_DEVICE_TARGETS = new Set(["nul"]);
+const CMD_DEVICE_TARGETS = /* @__PURE__ */ new Set(["nul"]);
 /** Deepest chain of wrappers (`env time nice …`) the policy unwraps. */
 const MAX_WRAPPER_DEPTH = 8;
 /** Most distinct directories a line may `cd` between. */
@@ -1342,7 +1342,8 @@ var LineChecker = class {
 			verdict = false;
 		}
 		if (verdict === true) return;
-		throw new Refusal("not-allowed", `${shown} was refused by the workspace shell policy.${typeof verdict === "string" && verdict.trim() !== "" ? ` ${verdict.trim()}` : ""}`, executableBasename(argv[0] ?? "", this.dialect));
+		const explanation = typeof verdict === "string" && verdict.trim() !== "" ? ` ${verdict.trim()}` : "";
+		throw new Refusal("not-allowed", `${shown} was refused by the workspace shell policy.${explanation}`, executableBasename(argv[0] ?? "", this.dialect));
 	}
 	/** Whether the policy names `executable` in a non-empty `allow` list. */
 	explicitlyAllowed(executable) {
@@ -1365,7 +1366,10 @@ var LineChecker = class {
 		if (executable === "") throw new Refusal("not-allowed", "The command has no executable name.");
 		if (dynamic[0] === true) throw new Refusal("unsupported-syntax", `The command name \`${first}\` is decided when the line runs, so the workspace shell policy cannot check it. Write the command name literally.`);
 		if (this.deny.has(key)) throw new Refusal("denied-executable", `\`${executable}\` is denied by the workspace shell policy (in ${show(argv.join(" "))}).`, executable);
-		if (this.allow.length > 0 && !this.allow.includes(executable)) throw new Refusal("not-allowed", `\`${executable}\` is not in the workspace shell allowlist. Allowed commands: ${this.allow.slice(0, 20).join(", ")}${this.allow.length > 20 ? ", …" : ""}.`, executable);
+		if (this.allow.length > 0 && !this.allow.includes(executable)) {
+			const listed = this.allow.slice(0, 20).join(", ");
+			throw new Refusal("not-allowed", `\`${executable}\` is not in the workspace shell allowlist. Allowed commands: ${listed}${this.allow.length > 20 ? ", …" : ""}.`, executable);
+		}
 		this.checkHooks(argv, depth > 0);
 		this.commands.push([...argv]);
 		if (OPAQUE_RUNNERS.has(key) || this.shellMode && this.dialect === "posix" && SHELL_OPAQUE_BUILTINS.has(key) || this.shellMode && this.dialect === "cmd" && CMD_OPAQUE_BUILTINS.has(key)) {
@@ -1609,16 +1613,23 @@ function argvModeRefusal(command) {
 	const segments = parsed.ok ? parsed.segments : [];
 	if ((token === "&&" || token === "||" || token === ";" || token === "\n") && segments.length >= 2) {
 		const shownOperator = token === "\n" ? "A line break" : `\`${token}\``;
-		if ((segments[0]?.source ?? "").trim().split(/\s+/)[0] === "cd") return new Refusal("metacharacter", `${shownOperator} is not supported in argv mode, and \`cd\` does not carry over: every command starts in the workspace root. Run ${segments.slice(1).map((segment) => show(segment.source)).join(", then ")} on its own, with paths relative to the root.${suffix}`);
+		if ((segments[0]?.source ?? "").trim().split(/\s+/)[0] === "cd") {
+			const rest = segments.slice(1).map((segment) => show(segment.source));
+			return new Refusal("metacharacter", `${shownOperator} is not supported in argv mode, and \`cd\` does not carry over: every command starts in the workspace root. Run ${rest.join(", then ")} on its own, with paths relative to the root.${suffix}`);
+		}
 		const steps = segments.map((segment) => show(segment.source));
 		const joiner = token === "||" ? ", and if it fails, " : ", then ";
 		return new Refusal("metacharacter", `${shownOperator} is not supported in argv mode: run ${steps.join(joiner)}, as separate commands.${suffix}`);
 	}
 	if (token === "&" && segments.length >= 1) {
 		const steps = segments.map((segment) => show(segment.source));
-		return new Refusal("metacharacter", `\`&\` is not supported in argv mode: ${steps.length === 1 ? `run ${steps[0] ?? ""} without it` : `run ${steps.join(", then ")} as separate commands`}; start a long-running command with background: true.${suffix}`);
+		const run = steps.length === 1 ? `run ${steps[0] ?? ""} without it` : `run ${steps.join(", then ")} as separate commands`;
+		return new Refusal("metacharacter", `\`&\` is not supported in argv mode: ${run}; start a long-running command with background: true.${suffix}`);
+	}
+	if (token === "|") {
+		const pipeline = command.split("|").map((part) => part.trim()).filter(Boolean);
+		return new Refusal("metacharacter", `\`|\` (a pipe) is not supported in argv mode: run ${show(pipeline[0] ?? command)} on its own and read its output yourself.${suffix}`);
 	}
-	if (token === "|") return new Refusal("metacharacter", `\`|\` (a pipe) is not supported in argv mode: run ${show(command.split("|").map((part) => part.trim()).filter(Boolean)[0] ?? command)} on its own and read its output yourself.${suffix}`);
 	if (token === ">" || token === ">>" || token === ">&") return new Refusal("metacharacter", `\`${token}\` (redirection) is not supported in argv mode: run the command without it and save the output with write_file if you need it.${suffix}`);
 	if (token === "<" || token === "<<" || token === "<&") return new Refusal("metacharacter", `\`${token}\` (input redirection) is not supported in argv mode: pass the file path to the command as an argument.${suffix}`);
 	if (token === "$(" || token === "`") return new Refusal("metacharacter", `Command substitution (${token === "$(" ? "`$(…)`" : "backticks"}) is not supported in argv mode: run the inner command first, then pass its output literally.${suffix}`);
@@ -1785,8 +1796,9 @@ async function resolveInJail(policy, inputPath) {
 	const insideCwd = isInside(absolutePath, jailRoot);
 	const allowRoots = policy.allowPaths ?? [];
 	let insideAllow = false;
-	if (!insideCwd) {
-		for (const root of allowRoots) if (isInside(absolutePath, await canonicalize$1(root))) {
+	if (!insideCwd) for (const root of allowRoots) {
+		const canonicalRoot = await canonicalize$1(root);
+		if (isInside(absolutePath, canonicalRoot)) {
 			insideAllow = true;
 			break;
 		}
@@ -1863,7 +1875,7 @@ function buildEnv(policy) {
 * `PS4` can run command substitutions, `BASH_FUNC_*` imports functions that
 * shadow commands, `CDPATH` moves `cd`, `IFS` re-splits words).
 */
-const SHELL_STARTUP_VARIABLES = new Set([
+const SHELL_STARTUP_VARIABLES = /* @__PURE__ */ new Set([
 	"ENV",
 	"BASH_ENV",
 	"SHELLOPTS",
@@ -2727,7 +2739,7 @@ function createOps(backend, policy, runtime) {
 * policy-driven cap (and the `truncated` flag) on top. Generous enough that
 * ordinary command output is never clipped here.
 */
-const MAX_STREAM_BYTES = 10 * 1024 * 1024;
+const MAX_STREAM_BYTES = 10485760;
 /**
 * Append a chunk to a capped list of buffers, tracking the running byte
 * total and stopping once {@link MAX_STREAM_BYTES} is reached. Trailing bytes
@@ -4485,7 +4497,7 @@ const READONLY_TOOL_NAMES = [
 	"todoRead"
 ];
 /** Tools vended only when the policy enables background commands. */
-const BACKGROUND_TOOL_NAMES = new Set(["shellOutput", "shellKill"]);
+const BACKGROUND_TOOL_NAMES = /* @__PURE__ */ new Set(["shellOutput", "shellKill"]);
 /**
 * Choose the dumb IO executor for a policy. `"mock"` selects the
 * in-memory backend (hermetic tests); anything else — including the