@warlock.js/ai-workspace 5.31.0 → 5.32.0

package/esm/contracts/workspace-policy.type.d.mts

@@ -7,7 +7,7 @@
  * The worktree and container backends from the design doc are deferred
  * past the W1 surface and intentionally absent from this union.
  */
-type WorkspaceBackendType = "local" | "mock";
+export type WorkspaceBackendType = "local" | "mock";
 /**
  * How `run_shell` / `exec()` interpret a command line.
  *
@@ -23,7 +23,7 @@ type WorkspaceBackendType = "local" | "mock";
  *   redirection target and `cd` directory against the path jail. Syntax the
  *   parser cannot read with confidence is refused, never guessed at.
  */
-type WorkspaceShellInterpreter = "none" | "sh";
+export type WorkspaceShellInterpreter = "none" | "sh";
 /**
  * A command pattern in `shell.denyPatterns`.
  *
@@ -36,9 +36,9 @@ type WorkspaceShellInterpreter = "none" | "sh";
  *   is tested as `"git push"`). Use it for option orders and spellings:
  *   `/^git push\b.*(--force|-f\b)/`. A `g`/`y` flag is ignored.
  */
-type WorkspaceCommandPattern = string | RegExp;
+export type WorkspaceCommandPattern = string | RegExp;
 /** What {@link WorkspaceAllowCommand} is told about the command it checks. */
-interface WorkspaceCommandCheckContext {
+export interface WorkspaceCommandCheckContext {
   /** The full command line the checked command is part of. */
   command: string;
   /** The interpreter the line runs under. */
@@ -61,7 +61,7 @@ interface WorkspaceCommandCheckContext {
  * allowCommand: (argv) =>
  *   argv[0] === "git" && argv[1] === "push" ? "Pushing is done by the release job." : true
  */
-type WorkspaceAllowCommand = (argv: readonly string[], context: WorkspaceCommandCheckContext) => boolean | string;
+export type WorkspaceAllowCommand = (argv: readonly string[], context: WorkspaceCommandCheckContext) => boolean | string;
 /**
  * Background-command sub-policy. Present ⇒ `run_shell({ background: true })`
  * and `startShell()` may start long-running commands (dev servers,
@@ -69,7 +69,7 @@ type WorkspaceAllowCommand = (argv: readonly string[], context: WorkspaceCommand
  * refused. Every background command is killed — its whole process tree —
  * by `workspace.dispose()`, and when the Node process exits.
  */
-interface WorkspaceBackgroundPolicy {
+export interface WorkspaceBackgroundPolicy {
   /** Most background commands running at once. Default `4`. */
   maxJobs?: number;
   /**
@@ -103,7 +103,7 @@ interface WorkspaceBackgroundPolicy {
  * drops the variables that change how a shell parses or starts (`ENV`,
  * `BASH_ENV`, `SHELLOPTS`, `BASHOPTS`, `CDPATH`, `IFS`, `PS4`, `BASH_FUNC_*`).
  */
-interface WorkspaceShellPolicy {
+export interface WorkspaceShellPolicy {
   /** Allowed executable basenames (e.g. `["npm", "node"]`). */
   allow?: string[];
   /** Denied executable basenames — wins over `allow`. */
@@ -150,7 +150,7 @@ interface WorkspaceShellPolicy {
  * Read sub-policy controlling how much of a file a single read returns.
  * Applies equally to the `read_file` tool and the `readFile()` direct method.
  */
-interface WorkspaceReadPolicy {
+export interface WorkspaceReadPolicy {
   /**
    * Hard cap on the UTF-8 bytes of the `content` a single read returns,
    * line-number prefixes and newlines included. A window that would exceed
@@ -167,7 +167,7 @@ interface WorkspaceReadPolicy {
  * `denyPaths` are always hidden from listings; `ignore` hides more without
  * blocking access (an ignored file can still be read).
  */
-interface WorkspaceListPolicy {
+export interface WorkspaceListPolicy {
   /**
    * Globs (`*`, `**`, `?`; a bare name also hides its contents) left out of
    * listings. Default `["node_modules", ".git"]`; setting it replaces the
@@ -198,7 +198,7 @@ interface WorkspaceListPolicy {
  *   backend: "local",
  * };
  */
-interface WorkspacePolicy {
+export interface WorkspacePolicy {
   /** Absolute jail root — the workspace cannot read or write outside it. */
   cwd: string;
   /** Extra readable roots outside `cwd` (resolved absolute paths). */
@@ -215,5 +215,4 @@ interface WorkspacePolicy {
   backend?: WorkspaceBackendType;
 }
 //#endregion
-export { WorkspaceAllowCommand, WorkspaceBackendType, WorkspaceBackgroundPolicy, WorkspaceCommandCheckContext, WorkspaceCommandPattern, WorkspaceListPolicy, WorkspacePolicy, WorkspaceReadPolicy, WorkspaceShellInterpreter, WorkspaceShellPolicy };
 //# sourceMappingURL=workspace-policy.type.d.mts.map

package/esm/contracts/workspace-policy.type.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-policy.type.d.mts","names":[],"sources":["../../../../../../../../packages/ai-workspace/src/contracts/workspace-policy.type.ts"],"mappings":";;AAQA;;;;AAAgC;AAiBhC;;KAjBY,oBAAA;;AAiByB;AAcrC;;;;AAAqD;AAGrD;;;;;;;;KAjBY,yBAAA;AA2BJ;AAcR;;;;;;;;AAEuC;AAUvC;;AA1BQ,KAbI,uBAAA,YAAmC,MAAM;;UAGpC,4BAAA;EAuEA;EArEf,OAAA;;EAEA,WAAA,EAAa,yBAAyB;EAiFvB;;;;;EA3Ef,MAAA;AAAA;;;;;;;;;;;;KAcU,qBAAA,IACV,IAAA,qBACA,OAAA,EAAS,4BAA4B;;;;AAsFC;AAOxC;;;UAnFiB,yBAAA;EA6FH;EA3FZ,OAAA;EAmGkC;;;;;EA7FlC,SAAS;AAAA;AAuGC;AAsBZ;;;;;;;;;;;;;;;;;;;;;AAcgC;;AApCpB,UA5EK,oBAAA;;EAEf,KAAA;;EAEA,IAAA;;;;;EAKA,YAAA,GAAe,uBAAA;;;;;EAKf,YAAA,GAAe,qBAAA;;;;;;;EAOf,WAAA,GAAc,yBAAA;;EAEd,SAAA;;;;;;EAMA,cAAA;;EAEA,GAAA,GAAM,MAAA;;;;;EAKN,UAAA;;;;;EAKA,UAAA,GAAa,yBAAA;AAAA;;;;;UAOE,mBAAA;;;;;;;;EAQf,QAAA;;EAEA,YAAY;AAAA;;;;;;UAQG,mBAAA;;;;;;EAMf,MAAA;;EAEA,QAAA;;EAEA,UAAA;AAAA;;;;;;;;;;;;;;;;;;;;UAsBe,eAAA;;EAEf,GAAA;;EAEA,UAAA;;EAEA,SAAA;;EAEA,KAAA,GAAQ,oBAAA;;EAER,IAAA,GAAO,mBAAA;;EAEP,IAAA,GAAO,mBAAA;;EAEP,OAAA,GAAU,oBAAA;AAAA"}
+{"version":3,"file":"workspace-policy.type.d.mts","names":[],"sources":["../../../../../../../../packages/ai-workspace/src/contracts/workspace-policy.type.ts"],"mappings":";;;;;;;;;YAQY;;;;;;;;;;;;;;;;YAiBA;;;;;;;;;;;;;YAcA,mCAAmC;;iBAG9B;;EAEf;;EAEA,aAAa;;;;;;EAMb;;;;;;;;;;;;;YAcU,yBACV,yBACA,SAAS;;;;;;;;iBAUM;;EAEf;;;;;;EAMA;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2Be;;EAEf;;EAEA;;;;;EAKA,eAAe;;;;;EAKf,eAAe;;;;;;;EAOf,cAAc;;EAEd;;;;;;EAMA;;EAEA,MAAM;;;;;EAKN;;;;;EAKA,aAAa;;;;;;iBAOE;;;;;;;;EAQf;;EAEA;;;;;;;iBAQe;;;;;;EAMf;;EAEA;;EAEA;;;;;;;;;;;;;;;;;;;;;iBAsBe;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;EAER,OAAO;;EAEP,OAAO;;EAEP,UAAU"}

package/esm/contracts/workspace.contract.d.mts

@@ -1,7 +1,6 @@
 import { EditFileInput, EditFileResult, ExecOptions, GrepResult, ListDirOptions, ListDirResult, MultiEditInput, MultiEditResult, ReadFileResult, RunShellResult, ShellJobInfo, ShellOutputOptions, ShellOutputResult, StartShellOptions, TodoListResult, WorkspaceTodoInput, WorkspaceToolName } from "./tool-io.type.mjs";
 import { WorkspacePolicy } from "./workspace-policy.type.mjs";
 import { ToolContract } from "@warlock.js/ai";
-
 //#region ../../packages/ai-workspace/src/contracts/workspace.contract.d.ts
 /**
  * The agent-facing tool surface of a workspace. Each factory returns a
@@ -13,7 +12,7 @@ import { ToolContract } from "@warlock.js/ai";
  * expose the same capability under a custom tool name when wiring
  * multiple agents.
  */
-interface WorkspaceTools {
+export interface WorkspaceTools {
   /**
    * Every tool this workspace vends, as `ToolContract[]`, ready for
    * `ai.agent({ tools })`. `shell_output` / `shell_kill` are included only
@@ -98,7 +97,7 @@ interface WorkspaceTools {
  * await ws.writeFile("src/routes.ts", BOILERPLATE);
  * const files = await ws.glob("src/models/**\/*.ts");
  */
-interface Workspace {
+export interface Workspace {
   /** The immutable policy bounding this workspace. */
   readonly policy: WorkspacePolicy;
   /** Agent-facing tool factories. */
@@ -180,5 +179,4 @@ interface Workspace {
   scope(subdir: string): Workspace;
 }
 //#endregion
-export { Workspace, WorkspaceTools };
 //# sourceMappingURL=workspace.contract.d.mts.map

package/esm/contracts/workspace.contract.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.contract.d.mts","names":[],"sources":["../../../../../../../../packages/ai-workspace/src/contracts/workspace.contract.ts"],"mappings":";;;;;;;AAgCA;;;;;;;;UAAiB,cAAA;EAgBsB;;;;;EAVrC,GAAA,IAAO,YAAA;EAsByB;EApBhC,IAAA,IAAQ,KAAA,EAAO,iBAAA,KAAsB,YAAA;EAwBA;EAtBrC,QAAA,CAAS,IAAA;IAAS,IAAA;EAAA,IAAkB,YAAA;EAJpC;EAMA,QAAA,CAAS,IAAA;IAAS,IAAA;EAAA,IAAkB,YAAA;EAJrB;EAMf,SAAA,CAAU,IAAA;IAAS,IAAA;EAAA,IAAkB,YAAA;EAJ5B;EAMT,SAAA,CAAU,IAAA;IAAS,IAAA;EAAA,IAAkB,YAAA;EAJ5B;EAMT,OAAA,CAAQ,IAAA;IAAS,IAAA;EAAA,IAAkB,YAAA;EAJzB;EAMV,QAAA,CAAS,IAAA;IAAS,IAAA;EAAA,IAAkB,YAAA;EAJ1B;EAMV,WAAA,CAAY,IAAA;IAAS,IAAA;EAAA,IAAkB,YAAA;EAJ/B;EAMR,SAAA,CAAU,IAAA;IAAS,IAAA;EAAA,IAAkB,YAAA;EAJ5B;EAMT,QAAA,CAAS,IAAA;IAAS,IAAA;IAAe,OAAA;EAAA,IAAqB,YAAA;EAJf;EAMvC,IAAA,CAAK,IAAA;IAAS,IAAA;EAAA,IAAkB,YAAA;EAJK;EAMrC,IAAA,CAAK,IAAA;IAAS,IAAA;EAAA,IAAkB,YAAA;EAJvB;EAMT,SAAA,CAAU,IAAA;IAAS,IAAA;EAAA,IAAkB,YAAA;EAJhC;EAML,QAAA,CAAS,IAAA;IAAS,IAAA;EAAA,IAAkB,YAAA;AAAA;;;;;;;;;;;AAAY;AAyBlD;;;;;;;;;;;UAAiB,SAAA;EAsB2B;EAAA,SApBjC,MAAA,EAAQ,eAAA;EAuBa;EAAA,SApBrB,KAAA,EAAO,cAAA;EAoB+B;;;;;;EAZ/C,QAAA,CAAS,IAAA,UAAc,IAAA;IAAS,MAAA;IAAiB,KAAA;EAAA,IAAmB,OAAA,CAAQ,cAAA;EAgC7C;EA7B/B,SAAA,CAAU,IAAA,UAAc,OAAA,WAAkB,OAAA;IAAU,IAAA;IAAc,YAAA;EAAA;EAsCzB;EAnCzC,QAAA,CAAS,KAAA,EAAO,aAAA,GAAgB,OAAA,CAAQ,cAAA;EA8CuC;EA3C/E,SAAA,CAAU,KAAA,EAAO,cAAA,GAAiB,OAAA,CAAQ,eAAA;EA8CnB;EA3CvB,OAAA,CAAQ,IAAA,WAAe,IAAA,GAAO,cAAA,GAAiB,OAAA,CAAQ,aAAA;EAiDlC;;;;;EA1CrB,IAAA,CAAK,OAAA,UAAiB,IAAA,GAAO,WAAA,GAAc,OAAA,CAAQ,cAAA;EA9B1C;;;;;EAqCT,UAAA,CAAW,OAAA,UAAiB,IAAA,GAAO,iBAAA,GAAoB,OAAA,CAAQ,YAAA;EA1B/B;EA6BhC,WAAA,CAAY,EAAA,UAAY,IAAA,GAAO,kBAAA,GAAqB,OAAA,CAAQ,iBAAA;EA7BrC;EAgCvB,SAAA,CAAU,EAAA,WAAa,OAAA,CAAQ,YAAA;EAhC6C;EAmC5E,UAAA,IAAc,YAAA;EAhCJ;EAmCV,SAAA,IAAa,cAAA;EAnC6B;EAsC1C,UAAA,CAAW,KAAA,EAAO,kBAAA,KAAuB,cAAA;EAtCyB;;;;;;EA8ClE,OAAA,IAAW,OAAA;EAxCM;EA2CjB,IAAA,CAAK,OAAA,UAAiB,IAAA;IAAS,IAAA;IAAe,UAAA;EAAA,IAAyB,OAAA,CAAQ,UAAA;EAxCvE;EA2CR,IAAA,CAAK,OAAA,WAAkB,OAAA;EA3CA;EA8CvB,MAAA,CAAO,IAAA,WAAe,OAAA;EA9CiC;EAiDvD,KAAA,CAAM,IAAA,WAAe,OAAA;EA1ChB;EA6CL,MAAA,CAAO,IAAA,WAAe,OAAA;EA7CA;;;;;EAoDtB,QAAA,IAAY,SAAA;EA7CgB;;;;;EAoD5B,KAAA,CAAM,MAAA,WAAiB,SAAA;AAAA"}
+{"version":3,"file":"workspace.contract.d.mts","names":[],"sources":["../../../../../../../../packages/ai-workspace/src/contracts/workspace.contract.ts"],"mappings":";;;;;;;;;;;;;;iBAgCiB;;;;;;EAMf,OAAO;;EAEP,QAAQ,OAAO,sBAAsB;;EAErC,SAAS;IAAS;MAAkB;;EAEpC,SAAS;IAAS;MAAkB;;EAEpC,UAAU;IAAS;MAAkB;;EAErC,UAAU;IAAS;MAAkB;;EAErC,QAAQ;IAAS;MAAkB;;EAEnC,SAAS;IAAS;MAAkB;;EAEpC,YAAY;IAAS;MAAkB;;EAEvC,UAAU;IAAS;MAAkB;;EAErC,SAAS;IAAS;IAAe;MAAqB;;EAEtD,KAAK;IAAS;MAAkB;;EAEhC,KAAK;IAAS;MAAkB;;EAEhC,UAAU;IAAS;MAAkB;;EAErC,SAAS;IAAS;MAAkB;;;;;;;;;;;;;;;;;;;;;;;;iBAyBrB;;WAEN,QAAQ;;WAGR,OAAO;;;;;;;EAQhB,SAAS,cAAc;IAAS;IAAiB;MAAmB,QAAQ;;EAG5E,UAAU,cAAc,kBAAkB;IAAU;IAAc;;;EAGlE,SAAS,OAAO,gBAAgB,QAAQ;;EAGxC,UAAU,OAAO,iBAAiB,QAAQ;;EAG1C,QAAQ,eAAe,OAAO,iBAAiB,QAAQ;;;;;;EAOvD,KAAK,iBAAiB,OAAO,cAAc,QAAQ;;;;;;EAOnD,WAAW,iBAAiB,OAAO,oBAAoB,QAAQ;;EAG/D,YAAY,YAAY,OAAO,qBAAqB,QAAQ;;EAG5D,UAAU,aAAa,QAAQ;;EAG/B,cAAc;;EAGd,aAAa;;EAGb,WAAW,OAAO,uBAAuB;;;;;;;EAQzC,WAAW;;EAGX,KAAK,iBAAiB;IAAS;IAAe;MAAyB,QAAQ;;EAG/E,KAAK,kBAAkB;;EAGvB,OAAO,eAAe;;EAGtB,MAAM,eAAe;;EAGrB,OAAO,eAAe;;;;;;EAOtB,YAAY;;;;;;EAOZ,MAAM,iBAAiB"}

package/esm/errors.d.mts

@@ -1,5 +1,4 @@
 import { AIError, AIErrorOptions } from "@warlock.js/ai";
-
 //#region ../../packages/ai-workspace/src/errors.d.ts
 /**
  * Why a workspace policy check rejected an operation.
@@ -14,7 +13,7 @@ import { AIError, AIErrorOptions } from "@warlock.js/ai";
  *   catastrophic-backtracking shape (nested quantifiers) that could hang
  *   the process (ReDoS).
  */
-type WorkspacePolicyViolation = "path-escape" | "denied-command" | "unsafe-pattern";
+export type WorkspacePolicyViolation = "path-escape" | "denied-command" | "unsafe-pattern";
 /**
  * Why the shell policy refused a command. Set on every
  * {@link WorkspacePolicyError} of type `"denied-command"` raised for a
@@ -40,18 +39,24 @@ type WorkspacePolicyViolation = "path-escape" | "denied-command" | "unsafe-patte
  * - `"path-escape"` — shell mode: a redirection target or `cd` directory
  *   resolves outside the workspace jail or hits `denyPaths`.
  */
-type WorkspaceShellRefusalReason = "metacharacter" | "unbalanced-quotes" | "denied-executable" | "not-allowed" | "denied-pattern" | "nested-command" | "unsupported-syntax" | "path-escape";
+export type WorkspaceShellRefusalReason = "metacharacter" | "unbalanced-quotes" | "denied-executable" | "not-allowed" | "denied-pattern" | "nested-command" | "unsupported-syntax" | "path-escape";
 /**
  * Options for {@link WorkspacePolicyError} — the structured `type`
  * discriminator plus, where relevant, the offending path or command for
  * branchable diagnostics without parsing the message.
  */
-type WorkspacePolicyErrorOptions = AIErrorOptions & {
-  /** Which policy rule was violated. */type: WorkspacePolicyViolation; /** The offending workspace-relative path (for `"path-escape"`). */
-  path?: string; /** The offending command line (for `"denied-command"`). */
-  command?: string; /** The offending regex pattern (for `"unsafe-pattern"`). */
-  pattern?: string; /** Why the shell policy refused the command (for `"denied-command"`). */
-  reason?: WorkspaceShellRefusalReason; /** The executable the refusal is about, when there is one. */
+export type WorkspacePolicyErrorOptions = AIErrorOptions & {
+  /** Which policy rule was violated. */
+  type: WorkspacePolicyViolation;
+  /** The offending workspace-relative path (for `"path-escape"`). */
+  path?: string;
+  /** The offending command line (for `"denied-command"`). */
+  command?: string;
+  /** The offending regex pattern (for `"unsafe-pattern"`). */
+  pattern?: string;
+  /** Why the shell policy refused the command (for `"denied-command"`). */
+  reason?: WorkspaceShellRefusalReason;
+  /** The executable the refusal is about, when there is one. */
   executable?: string;
 };
 /**
@@ -71,7 +76,7 @@ type WorkspacePolicyErrorOptions = AIErrorOptions & {
  *   console.warn(`Blocked command: ${error.command}`);
  * }
  */
-declare class WorkspacePolicyError extends AIError {
+export declare class WorkspacePolicyError extends AIError {
   /** Which policy rule was violated. */
   readonly type: WorkspacePolicyViolation;
   /** The offending path, when the violation was a path escape. */
@@ -99,18 +104,24 @@ declare class WorkspacePolicyError extends AIError {
  * - `"stale-hash"` — the file's current hash did not match the supplied
  *   `expectHash`; the file changed since it was read.
  */
-type WorkspaceEditFailure = "not-found" | "not-unique" | "stale-hash";
+export type WorkspaceEditFailure = "not-found" | "not-unique" | "stale-hash";
 /**
  * Options for {@link WorkspaceEditError} — the structured `type`
  * discriminator plus optional match-count / hash context for the
  * `"not-unique"` and `"stale-hash"` cases.
  */
-type WorkspaceEditErrorOptions = AIErrorOptions & {
-  /** Why the edit was rejected. */type: WorkspaceEditFailure; /** The edited file's workspace-relative path. */
-  path: string; /** How many times `oldString` matched (for `"not-unique"`). */
-  matches?: number; /** The hash the caller expected (for `"stale-hash"`). */
-  expectedHash?: string; /** The file's actual current hash (for `"stale-hash"`). */
-  actualHash?: string; /** 0-based index of the failing edit, for a `multiEdit` rejection. */
+export type WorkspaceEditErrorOptions = AIErrorOptions & {
+  /** Why the edit was rejected. */
+  type: WorkspaceEditFailure;
+  /** The edited file's workspace-relative path. */
+  path: string;
+  /** How many times `oldString` matched (for `"not-unique"`). */
+  matches?: number;
+  /** The hash the caller expected (for `"stale-hash"`). */
+  expectedHash?: string;
+  /** The file's actual current hash (for `"stale-hash"`). */
+  actualHash?: string;
+  /** 0-based index of the failing edit, for a `multiEdit` rejection. */
   editIndex?: number;
 };
 /**
@@ -127,7 +138,7 @@ type WorkspaceEditErrorOptions = AIErrorOptions & {
  *   // re-read the file and retry the edit with the fresh hash
  * }
  */
-declare class WorkspaceEditError extends AIError {
+export declare class WorkspaceEditError extends AIError {
   /** Why the edit was rejected. */
   readonly type: WorkspaceEditFailure;
   /** The edited file's workspace-relative path. */
@@ -152,10 +163,12 @@ declare class WorkspaceEditError extends AIError {
  *   workspace (it never existed, or it finished long enough ago to be
  *   pruned).
  */
-type WorkspaceJobFailure = "not-found";
+export type WorkspaceJobFailure = "not-found";
 /** Options for {@link WorkspaceJobError}. */
-type WorkspaceJobErrorOptions = AIErrorOptions & {
-  /** Why the operation failed. */type: WorkspaceJobFailure; /** The background command id the caller asked for. */
+export type WorkspaceJobErrorOptions = AIErrorOptions & {
+  /** Why the operation failed. */
+  type: WorkspaceJobFailure;
+  /** The background command id the caller asked for. */
   jobId: string;
 };
 /**
@@ -168,7 +181,7 @@ type WorkspaceJobErrorOptions = AIErrorOptions & {
  *   console.warn(`No background command ${error.jobId}`);
  * }
  */
-declare class WorkspaceJobError extends AIError {
+export declare class WorkspaceJobError extends AIError {
   /** Why the operation failed. */
   readonly type: WorkspaceJobFailure;
   /** The background command id the caller asked for. */
@@ -176,5 +189,4 @@ declare class WorkspaceJobError extends AIError {
   constructor(message: string, options: WorkspaceJobErrorOptions);
 }
 //#endregion
-export { WorkspaceEditError, WorkspaceEditErrorOptions, WorkspaceEditFailure, WorkspaceJobError, WorkspaceJobErrorOptions, WorkspaceJobFailure, WorkspacePolicyError, WorkspacePolicyErrorOptions, WorkspacePolicyViolation, WorkspaceShellRefusalReason };
 //# sourceMappingURL=errors.d.mts.map

package/esm/errors.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.mts","names":[],"sources":["../../../../../../../packages/ai-workspace/src/errors.ts"],"mappings":";;;;;AAeA;;;;AAAoC;AA2BpC;;;;AAAuC;AAevC;KA1CY,wBAAA;;;;;;;;;;;;;;;;;AAsDA;AAoBZ;;;;;;;;KA/CY,2BAAA;;;;;;KAeA,2BAAA,GAA8B,cAAA;EA8CxB,sCA5ChB,IAAA,EAAM,wBAAA,EA8CU;EA5ChB,IAAA,WA8CmB;EA5CnB,OAAA,WA4CoC;EA1CpC,OAAA,WA0CwE;EAxCxE,MAAA,GAAS,2BAAA,EA8DqB;EA5D9B,UAAA;AAAA;AA4D8B;AAOhC;;;;;;;;;;;;;AAYW;AAiBX;;AApCgC,cAxCnB,oBAAA,SAA6B,OAAA;EA8ElB;EAAA,SA5EN,IAAA,EAAM,wBAAA;EA0EgB;EAAA,SAxEtB,IAAA;EAwE6B;EAAA,SAtE7B,OAAA;EAwEA;EAAA,SAtEA,OAAA;EAwEA;;;;;EAAA,SAlEA,MAAA,GAAS,2BAAA;EA+EN;EAAA,SA7EH,UAAA;cAEG,OAAA,UAAiB,OAAA,EAAS,2BAAA;AAAA;AA2EyB;AAoBxE;;;;AAA+B;AAG/B;;;AAvBwE,KArD5D,oBAAA;;;;;;KAOA,yBAAA,GAA4B,cAAA;EAsF3B,iCApFX,IAAA,EAAM,oBAAoB;EAE1B,IAAA,UAwF6C;EAtF7C,OAAA,WAgF4C;EA9E5C,YAAA,WA8EqC;EA5ErC,UAAA,WA8EsB;EA5EtB,SAAA;AAAA;;;;;AAgFqE;;;;;;;;;;cA/D1D,kBAAA,SAA2B,OAAA;;WAEtB,IAAA,EAAM,oBAAA;;WAEN,IAAA;;WAEA,OAAA;;WAEA,YAAA;;WAEA,UAAA;;;;;WAKA,SAAA;cAEG,OAAA,UAAiB,OAAA,EAAS,yBAAA;AAAA;;;;;;;;KAoBnC,mBAAA;;KAGA,wBAAA,GAA2B,cAAA;kCAErC,IAAA,EAAM,mBAAmB;EAEzB,KAAA;AAAA;;;;;;;;;;;cAaW,iBAAA,SAA0B,OAAA;;WAErB,IAAA,EAAM,mBAAA;;WAEN,KAAA;cAEG,OAAA,UAAiB,OAAA,EAAS,wBAAA;AAAA"}
+{"version":3,"file":"errors.d.mts","names":[],"sources":["../../../../../../../packages/ai-workspace/src/errors.ts"],"mappings":";;;;;;;;;;;;;;;YAeY;;;;;;;;;;;;;;;;;;;;;;;;;;YA2BA;;;;;;YAeA,8BAA8B;;EAExC,MAAM;;EAEN;;EAEA;;EAEA;;EAEA,SAAS;;EAET;;;;;;;;;;;;;;;;;;;qBAoBW,6BAA6B;;WAExB,MAAM;;WAEN;;WAEA;;WAEA;;;;;;WAMA,SAAS;;WAET;EAEhB,YAAmB,iBAAiB,SAAS;;;;;;;;;;;YAsBnC;;;;;;YAOA,4BAA4B;;EAEtC,MAAM;;EAEN;;EAEA;;EAEA;;EAEA;;EAEA;;;;;;;;;;;;;;;;qBAiBW,2BAA2B;;WAEtB,MAAM;;WAEN;;WAEA;;WAEA;;WAEA;;;;;WAKA;EAEhB,YAAmB,iBAAiB,SAAS;;;;;;;;;YAoBnC;;YAGA,2BAA2B;;EAErC,MAAM;;EAEN;;;;;;;;;;;;qBAaW,0BAA0B;;WAErB,MAAM;;WAEN;EAEhB,YAAmB,iBAAiB,SAAS"}

package/esm/index.d.mts

@@ -3,6 +3,7 @@ import { WorkspaceAllowCommand, WorkspaceBackendType, WorkspaceBackgroundPolicy,
 import { WorkspaceBackend, WorkspaceBackendExecOptions, WorkspaceBackendExecResult, WorkspaceBackendProcess, WorkspaceBackendStartOptions, WorkspaceBackendStat, WorkspaceOutputStream } from "./contracts/workspace-backend.contract.mjs";
 import { WorkspaceOps } from "./contracts/workspace-ops.contract.mjs";
 import { Workspace, WorkspaceTools } from "./contracts/workspace.contract.mjs";
+import "./contracts/index.mjs";
 import { WorkspaceEditError, WorkspaceEditErrorOptions, WorkspaceEditFailure, WorkspaceJobError, WorkspaceJobErrorOptions, WorkspaceJobFailure, WorkspacePolicyError, WorkspacePolicyErrorOptions, WorkspacePolicyViolation, WorkspaceShellRefusalReason } from "./errors.mjs";
 import { ResolvedPath, buildEnv, isCommandAllowed, resolveInJail } from "./policy/policy.mjs";
 import { WorkspaceShellCheck, WorkspaceShellPath, WorkspaceShellPathAccess, checkShellCommand } from "./policy/shell-check.mjs";

package/esm/ops.d.mts

@@ -1,8 +1,8 @@
 import { WorkspacePolicy } from "./contracts/workspace-policy.type.mjs";
 import { WorkspaceBackend } from "./contracts/workspace-backend.contract.mjs";
 import { WorkspaceOps } from "./contracts/workspace-ops.contract.mjs";
+import "./contracts/index.mjs";
 import { ShellJobs } from "./shell-jobs.mjs";
-
 //#region ../../packages/ai-workspace/src/ops.d.ts
 /**
  * The internal, single-instance implementation of {@link WorkspaceOps}.
@@ -15,7 +15,7 @@ import { ShellJobs } from "./shell-jobs.mjs";
  * State an ops layer shares with the other projections of the same
  * workspace (`readonly()`, `scope()`): the background commands it owns.
  */
-interface OpsRuntime {
+export interface OpsRuntime {
   /** The workspace's background commands. */
   jobs: ShellJobs;
 }
@@ -38,7 +38,6 @@ interface OpsRuntime {
  * const ops = createOps(localBackend, { cwd: "/srv/api", shell: { allow: ["npm"] } });
  * const { content, hash } = await ops.readFile("src/index.ts");
  */
-declare function createOps(backend: WorkspaceBackend, policy: WorkspacePolicy, runtime?: OpsRuntime): WorkspaceOps;
+export declare function createOps(backend: WorkspaceBackend, policy: WorkspacePolicy, runtime?: OpsRuntime): WorkspaceOps;
 //#endregion
-export { createOps };
 //# sourceMappingURL=ops.d.mts.map

package/esm/ops.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"ops.d.mts","names":[],"sources":["../../../../../../../packages/ai-workspace/src/ops.ts"],"mappings":";;;;;;;;;AA8LA;;;;AAEiB;AAitBjB;;;AAjtBiB,UAFA,UAAA;EAqtBP;EAntBR,IAAA,EAAM,SAAS;AAAA;;;;;;;;;;;AAqtBF;;;;;;;;;iBAJC,SAAA,CACd,OAAA,EAAS,gBAAA,EACT,MAAA,EAAQ,eAAA,EACR,OAAA,GAAU,UAAA,GACT,YAAA"}
+{"version":3,"file":"ops.d.mts","names":[],"sources":["../../../../../../../packages/ai-workspace/src/ops.ts"],"mappings":";;;;;;;;;;;;;;;;;iBA8LiB;;EAEf,MAAM;;;;;;;;;;;;;;;;;;;;;wBAitBQ,UACd,SAAS,kBACT,QAAQ,iBACR,UAAU,aACT"}

package/esm/policy/policy.d.mts

@@ -1,4 +1,5 @@
 import { WorkspacePolicy } from "../contracts/workspace-policy.type.mjs";
+import "../contracts/index.mjs";
 //#region ../../packages/ai-workspace/src/policy/policy.d.ts
 /**
  * The outcome of resolving a workspace-relative (or absolute) input path
@@ -6,7 +7,7 @@ import { WorkspacePolicy } from "../contracts/workspace-policy.type.mjs";
  * touch, plus the workspace-relative form (POSIX-style, `/`-separated)
  * the agent and tool results echo back.
  */
-interface ResolvedPath {
+export interface ResolvedPath {
   /** Canonical absolute path (symlinks in existing ancestors collapsed). */
   absolutePath: string;
   /**
@@ -45,7 +46,7 @@ interface ResolvedPath {
  * @example
  * const { absolutePath } = await resolveInJail(policy, "src/index.ts");
  */
-declare function resolveInJail(policy: WorkspacePolicy, inputPath: string): Promise<ResolvedPath>;
+export declare function resolveInJail(policy: WorkspacePolicy, inputPath: string): Promise<ResolvedPath>;
 /**
  * Whether a command line is permitted by the policy's `shell` sub-policy —
  * `checkShellCommand(policy, command).allowed`.
@@ -69,7 +70,7 @@ declare function resolveInJail(policy: WorkspacePolicy, inputPath: string): Prom
  * isCommandAllowed({ cwd, shell: { allow: ["npm"] } }, "rm -rf /"); // false
  * isCommandAllowed({ cwd, shell: { allow: ["npm"] } }, "npm test; rm -rf /"); // false
  */
-declare function isCommandAllowed(policy: WorkspacePolicy, command: string): boolean;
+export declare function isCommandAllowed(policy: WorkspacePolicy, command: string): boolean;
 /**
  * Build the exact environment a spawned process receives — `process.env`
  * is **never** inherited wholesale. The result is
@@ -82,7 +83,6 @@ declare function isCommandAllowed(policy: WorkspacePolicy, command: string): boo
  * buildEnv({ cwd, shell: { inheritEnv: ["PATH"], env: { CI: "1" } } });
  * // → { PATH: <process PATH>, CI: "1" }
  */
-declare function buildEnv(policy: WorkspacePolicy): Record<string, string>;
+export declare function buildEnv(policy: WorkspacePolicy): Record<string, string>;
 //#endregion
-export { ResolvedPath, buildEnv, isCommandAllowed, resolveInJail };
 //# sourceMappingURL=policy.d.mts.map

package/esm/policy/policy.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.mts","names":[],"sources":["../../../../../../../../packages/ai-workspace/src/policy/policy.ts"],"mappings":";;;;;AAaA;;;UAAiB,YAAA;EAQH;EANZ,YAAA;EA+EiC;;;;;EAzEjC,YAAY;AAAA;;;;;;;AA4ES;AAqEvB;;;;;;;;AAAyE;AAgBzE;;;;;;;;AAAyD;;;;;iBAxFnC,aAAA,CACpB,MAAA,EAAQ,eAAA,EACR,SAAA,WACC,OAAA,CAAQ,YAAA;;;;;;;;;;;;;;;;;;;;;;;;iBAqEK,gBAAA,CAAiB,MAAA,EAAQ,eAAe,EAAE,OAAA;;;;;;;;;;;;;iBAgB1C,QAAA,CAAS,MAAA,EAAQ,eAAA,GAAkB,MAAM"}
+{"version":3,"file":"policy.d.mts","names":[],"sources":["../../../../../../../../packages/ai-workspace/src/policy/policy.ts"],"mappings":";;;;;;;;;iBAaiB;;EAEf;;;;;;EAMA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAyEoB,cACpB,QAAQ,iBACR,oBACC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;wBAqEK,iBAAiB,QAAQ,iBAAiB;;;;;;;;;;;;;wBAgB1C,SAAS,QAAQ,kBAAkB"}

package/esm/policy/policy.mjs

@@ -61,8 +61,9 @@ async function resolveInJail(policy, inputPath) {
 	const insideCwd = isInside(absolutePath, jailRoot);
 	const allowRoots = policy.allowPaths ?? [];
 	let insideAllow = false;
-	if (!insideCwd) {
-		for (const root of allowRoots) if (isInside(absolutePath, await canonicalize(root))) {
+	if (!insideCwd) for (const root of allowRoots) {
+		const canonicalRoot = await canonicalize(root);
+		if (isInside(absolutePath, canonicalRoot)) {
 			insideAllow = true;
 			break;
 		}
@@ -139,7 +140,7 @@ function buildEnv(policy) {
 * `PS4` can run command substitutions, `BASH_FUNC_*` imports functions that
 * shadow commands, `CDPATH` moves `cd`, `IFS` re-splits words).
 */
-const SHELL_STARTUP_VARIABLES = new Set([
+const SHELL_STARTUP_VARIABLES = /* @__PURE__ */ new Set([
 	"ENV",
 	"BASH_ENV",
 	"SHELLOPTS",

package/esm/policy/policy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"policy.mjs","names":[],"sources":["../../../../../../../../packages/ai-workspace/src/policy/policy.ts"],"sourcesContent":["import path from \"node:path\";\nimport { realpath } from \"node:fs/promises\";\nimport { WorkspacePolicyError } from \"../errors\";\nimport type { WorkspacePolicy } from \"../contracts\";\nimport { isInside, matchesAnyGlob } from \"./jail\";\nimport { checkShellCommand } from \"./shell-check\";\n\n/**\n * The outcome of resolving a workspace-relative (or absolute) input path\n * against the jail — the canonical absolute location the backend should\n * touch, plus the workspace-relative form (POSIX-style, `/`-separated)\n * the agent and tool results echo back.\n */\nexport interface ResolvedPath {\n  /** Canonical absolute path (symlinks in existing ancestors collapsed). */\n  absolutePath: string;\n  /**\n   * The path relative to `policy.cwd`, `/`-separated regardless of OS,\n   * used in tool results so the agent always sees stable workspace paths.\n   * Empty string when the resolved path IS the jail root.\n   */\n  relativePath: string;\n}\n\n/**\n * Resolve the canonical absolute form of `target`, collapsing any\n * symlinks. `target` may not yet exist (a fresh `writeFile`/`mkdir`),\n * so we realpath the deepest **existing** ancestor and re-attach the\n * non-existent tail — a symlinked ancestor still cannot smuggle the\n * path out of the jail, while genuinely new leaves stay creatable.\n */\nasync function canonicalize(target: string): Promise<string> {\n  let resolvedTarget = path.resolve(target);\n  const tail: string[] = [];\n\n  // Walk up until an existing ancestor is found (or we hit the root).\n  // eslint-disable-next-line no-constant-condition\n  while (true) {\n    try {\n      const real = await realpath(resolvedTarget);\n\n      return tail.length > 0 ? path.join(real, ...tail) : real;\n    } catch (error) {\n      const code = (error as NodeJS.ErrnoException).code;\n\n      // Only ENOENT means \"this segment doesn't exist yet\" — keep\n      // walking up. Any other error (EACCES, ELOOP, …) is a real fault.\n      if (code !== \"ENOENT\") {\n        throw error;\n      }\n\n      const parent = path.dirname(resolvedTarget);\n\n      // Reached the filesystem root without finding an existing\n      // ancestor — give back the lexically-resolved path unchanged.\n      if (parent === resolvedTarget) {\n        return path.join(resolvedTarget, ...tail);\n      }\n\n      tail.unshift(path.basename(resolvedTarget));\n      resolvedTarget = parent;\n    }\n  }\n}\n\n/**\n * Resolve and jail a single input path against a {@link WorkspacePolicy}.\n *\n * The input is resolved against `policy.cwd`, canonicalized (symlinks in\n * existing ancestors collapsed so a symlinked directory cannot escape\n * the jail), then accepted **only** when it sits under `cwd` or one of\n * the `allowPaths` roots. A path that escapes, or that matches any\n * `denyPaths` glob even while inside `cwd`, is rejected with a\n * {@link WorkspacePolicyError} of type `\"path-escape\"`.\n *\n * Why this does not use `@warlock.js/fs`'s confined reader (`fs.confined`):\n * the two answer different questions. The confined reader refuses absolute\n * paths, refuses every symbolic link (or follows only links inside its one\n * root), requires the path to exist, and reads the file itself through a\n * no-follow, identity-checked open. This jail must instead accept absolute\n * paths inside `cwd`, several `allowPaths` roots, `denyPaths` globs, a\n * symlinked `cwd`, links whose target stays inside, and paths that do not\n * exist yet (`writeFile`, `mkdir`), and it returns a path that writes,\n * `exec`'s working directory and redirections use afterwards. Switching would\n * change what agents may touch, so the workspace keeps this resolver.\n *\n * @param policy - The bounding policy (its `cwd` is the jail root).\n * @param inputPath - A workspace-relative or absolute path to resolve.\n * @returns The canonical absolute path plus its `/`-separated relative form.\n * @throws {WorkspacePolicyError} When the path escapes the jail or hits a deny glob.\n *\n * @example\n * const { absolutePath } = await resolveInJail(policy, \"src/index.ts\");\n */\nexport async function resolveInJail(\n  policy: WorkspacePolicy,\n  inputPath: string,\n): Promise<ResolvedPath> {\n  const jailRoot = await canonicalize(policy.cwd);\n  const requested = path.isAbsolute(inputPath) ? inputPath : path.join(policy.cwd, inputPath);\n  const absolutePath = await canonicalize(requested);\n\n  const insideCwd = isInside(absolutePath, jailRoot);\n  const allowRoots = policy.allowPaths ?? [];\n  let insideAllow = false;\n\n  if (!insideCwd) {\n    for (const root of allowRoots) {\n      const canonicalRoot = await canonicalize(root);\n\n      if (isInside(absolutePath, canonicalRoot)) {\n        insideAllow = true;\n\n        break;\n      }\n    }\n  }\n\n  if (!insideCwd && !insideAllow) {\n    throw new WorkspacePolicyError(`Path \"${inputPath}\" resolves outside the workspace jail.`, {\n      type: \"path-escape\",\n      path: inputPath,\n    });\n  }\n\n  // `denyPaths` is evaluated relative to the jail root and wins even\n  // when the path is comfortably inside `cwd`.\n  const relativeToJail = insideCwd\n    ? path.relative(jailRoot, absolutePath).split(path.sep).join(\"/\")\n    : \"\";\n\n  if (insideCwd && policy.denyPaths && policy.denyPaths.length > 0) {\n    if (matchesAnyGlob(relativeToJail, policy.denyPaths)) {\n      throw new WorkspacePolicyError(`Path \"${inputPath}\" is blocked by the workspace deny list.`, {\n        type: \"path-escape\",\n        path: inputPath,\n      });\n    }\n  }\n\n  return { absolutePath, relativePath: relativeToJail };\n}\n\n/**\n * Whether a command line is permitted by the policy's `shell` sub-policy —\n * `checkShellCommand(policy, command).allowed`.\n *\n * In argv mode (the default) the command must tokenize into a single argv\n * (no unquoted `;`, `&&`, `|`, backticks, `$`, redirection, …): the backend\n * spawns it with no shell, and unquoted metacharacters were exactly how an\n * injected command chain used to ride past the allowlist. In shell mode\n * (`interpreter: \"sh\"`) every simple command in the line is checked. Each\n * argv's executable basename is matched against `shell.deny` (wins, case\n * insensitive) then `shell.allow` (exhaustive when non-empty), then\n * `shell.denyPatterns` and `shell.allowCommand`. An absent `shell` block\n * means no command may run at all.\n *\n * Returns a plain `boolean`; use {@link checkShellCommand} for the reason\n * and the model-facing message. Redirection targets are checked lexically\n * here; `exec` re-checks them with symlinks resolved.\n *\n * @example\n * isCommandAllowed({ cwd, shell: { allow: [\"npm\"] } }, \"npm test\"); // true\n * isCommandAllowed({ cwd, shell: { allow: [\"npm\"] } }, \"rm -rf /\"); // false\n * isCommandAllowed({ cwd, shell: { allow: [\"npm\"] } }, \"npm test; rm -rf /\"); // false\n */\nexport function isCommandAllowed(policy: WorkspacePolicy, command: string): boolean {\n  return checkShellCommand(policy, command).allowed;\n}\n\n/**\n * Build the exact environment a spawned process receives — `process.env`\n * is **never** inherited wholesale. The result is\n * `{ ...pick(process.env, inheritEnv), ...shell.env }`, so a command\n * cannot see `PATH` (and thus often cannot find `node`/`npm`) unless the\n * policy opts in via `shell.inheritEnv: [\"PATH\"]`. Explicit `shell.env`\n * values override inherited ones on key collision.\n *\n * @example\n * buildEnv({ cwd, shell: { inheritEnv: [\"PATH\"], env: { CI: \"1\" } } });\n * // → { PATH: <process PATH>, CI: \"1\" }\n */\nexport function buildEnv(policy: WorkspacePolicy): Record<string, string> {\n  const shell = policy.shell;\n  const env: Record<string, string> = {};\n\n  if (!shell) {\n    return env;\n  }\n\n  for (const key of shell.inheritEnv ?? []) {\n    const value = process.env[key];\n\n    if (value !== undefined) {\n      env[key] = value;\n    }\n  }\n\n  if (shell.env) {\n    for (const [key, value] of Object.entries(shell.env)) {\n      env[key] = value;\n    }\n  }\n\n  return env;\n}\n\n/**\n * Variables removed from the environment of a shell-mode (`interpreter:\n * \"sh\"`) command: each changes how the shell itself starts, parses or\n * resolves the line (`ENV`/`BASH_ENV` run a startup file, `SHELLOPTS` +\n * `PS4` can run command substitutions, `BASH_FUNC_*` imports functions that\n * shadow commands, `CDPATH` moves `cd`, `IFS` re-splits words).\n */\nconst SHELL_STARTUP_VARIABLES = new Set([\n  \"ENV\",\n  \"BASH_ENV\",\n  \"SHELLOPTS\",\n  \"BASHOPTS\",\n  \"CDPATH\",\n  \"IFS\",\n  \"PS4\",\n  \"GLOBIGNORE\",\n]);\n\n/**\n * The environment a command actually receives: {@link buildEnv}, minus the\n * shell start-up variables when the policy runs lines through a shell.\n * Compared case-insensitively, because Windows environment names are.\n */\nexport function buildCommandEnv(policy: WorkspacePolicy): Record<string, string> {\n  const env = buildEnv(policy);\n\n  if ((policy.shell?.interpreter ?? \"none\") !== \"sh\") {\n    return env;\n  }\n\n  for (const key of Object.keys(env)) {\n    const upper = key.toUpperCase();\n\n    if (SHELL_STARTUP_VARIABLES.has(upper) || upper.startsWith(\"BASH_FUNC_\")) {\n      delete env[key];\n    }\n  }\n\n  return env;\n}\n"],"mappings":";;;;;;;;;;;;;;AA+BA,eAAe,aAAa,QAAiC;CAC3D,IAAI,iBAAiB,KAAK,QAAQ,MAAM;CACxC,MAAM,OAAiB,CAAC;CAIxB,OAAO,MACL,IAAI;EACF,MAAM,OAAO,MAAM,SAAS,cAAc;EAE1C,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM,GAAG,IAAI,IAAI;CACtD,SAAS,OAAO;EAKd,IAJc,MAAgC,SAIjC,UACX,MAAM;EAGR,MAAM,SAAS,KAAK,QAAQ,cAAc;EAI1C,IAAI,WAAW,gBACb,OAAO,KAAK,KAAK,gBAAgB,GAAG,IAAI;EAG1C,KAAK,QAAQ,KAAK,SAAS,cAAc,CAAC;EAC1C,iBAAiB;CACnB;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,eAAsB,cACpB,QACA,WACuB;CACvB,MAAM,WAAW,MAAM,aAAa,OAAO,GAAG;CAE9C,MAAM,eAAe,MAAM,aADT,KAAK,WAAW,SAAS,IAAI,YAAY,KAAK,KAAK,OAAO,KAAK,SAAS,CACzC;CAEjD,MAAM,YAAY,SAAS,cAAc,QAAQ;CACjD,MAAM,aAAa,OAAO,cAAc,CAAC;CACzC,IAAI,cAAc;CAElB,IAAI,CAAC,WACH;OAAK,MAAM,QAAQ,YAGjB,IAAI,SAAS,cAAc,MAFC,aAAa,IAAI,CAEL,GAAG;GACzC,cAAc;GAEd;EACF;CACF;CAGF,IAAI,CAAC,aAAa,CAAC,aACjB,MAAM,IAAI,qBAAqB,SAAS,UAAU,yCAAyC;EACzF,MAAM;EACN,MAAM;CACR,CAAC;CAKH,MAAM,iBAAiB,YACnB,KAAK,SAAS,UAAU,YAAY,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,IAC9D;CAEJ,IAAI,aAAa,OAAO,aAAa,OAAO,UAAU,SAAS,GAC7D;MAAI,eAAe,gBAAgB,OAAO,SAAS,GACjD,MAAM,IAAI,qBAAqB,SAAS,UAAU,2CAA2C;GAC3F,MAAM;GACN,MAAM;EACR,CAAC;CACH;CAGF,OAAO;EAAE;EAAc,cAAc;CAAe;AACtD;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,iBAAiB,QAAyB,SAA0B;CAClF,OAAO,kBAAkB,QAAQ,OAAO,CAAC,CAAC;AAC5C;;;;;;;;;;;;;AAcA,SAAgB,SAAS,QAAiD;CACxE,MAAM,QAAQ,OAAO;CACrB,MAAM,MAA8B,CAAC;CAErC,IAAI,CAAC,OACH,OAAO;CAGT,KAAK,MAAM,OAAO,MAAM,cAAc,CAAC,GAAG;EACxC,MAAM,QAAQ,QAAQ,IAAI;EAE1B,IAAI,UAAU,QACZ,IAAI,OAAO;CAEf;CAEA,IAAI,MAAM,KACR,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG,GACjD,IAAI,OAAO;CAIf,OAAO;AACT;;;;;;;;AASA,MAAM,0BAA0B,IAAI,IAAI;CACtC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AAOD,SAAgB,gBAAgB,QAAiD;CAC/E,MAAM,MAAM,SAAS,MAAM;CAE3B,KAAK,OAAO,OAAO,eAAe,YAAY,MAC5C,OAAO;CAGT,KAAK,MAAM,OAAO,OAAO,KAAK,GAAG,GAAG;EAClC,MAAM,QAAQ,IAAI,YAAY;EAE9B,IAAI,wBAAwB,IAAI,KAAK,KAAK,MAAM,WAAW,YAAY,GACrE,OAAO,IAAI;CAEf;CAEA,OAAO;AACT"}
+{"version":3,"file":"policy.mjs","names":[],"sources":["../../../../../../../../packages/ai-workspace/src/policy/policy.ts"],"sourcesContent":["import path from \"node:path\";\nimport { realpath } from \"node:fs/promises\";\nimport { WorkspacePolicyError } from \"../errors\";\nimport type { WorkspacePolicy } from \"../contracts\";\nimport { isInside, matchesAnyGlob } from \"./jail\";\nimport { checkShellCommand } from \"./shell-check\";\n\n/**\n * The outcome of resolving a workspace-relative (or absolute) input path\n * against the jail — the canonical absolute location the backend should\n * touch, plus the workspace-relative form (POSIX-style, `/`-separated)\n * the agent and tool results echo back.\n */\nexport interface ResolvedPath {\n  /** Canonical absolute path (symlinks in existing ancestors collapsed). */\n  absolutePath: string;\n  /**\n   * The path relative to `policy.cwd`, `/`-separated regardless of OS,\n   * used in tool results so the agent always sees stable workspace paths.\n   * Empty string when the resolved path IS the jail root.\n   */\n  relativePath: string;\n}\n\n/**\n * Resolve the canonical absolute form of `target`, collapsing any\n * symlinks. `target` may not yet exist (a fresh `writeFile`/`mkdir`),\n * so we realpath the deepest **existing** ancestor and re-attach the\n * non-existent tail — a symlinked ancestor still cannot smuggle the\n * path out of the jail, while genuinely new leaves stay creatable.\n */\nasync function canonicalize(target: string): Promise<string> {\n  let resolvedTarget = path.resolve(target);\n  const tail: string[] = [];\n\n  // Walk up until an existing ancestor is found (or we hit the root).\n  // eslint-disable-next-line no-constant-condition\n  while (true) {\n    try {\n      const real = await realpath(resolvedTarget);\n\n      return tail.length > 0 ? path.join(real, ...tail) : real;\n    } catch (error) {\n      const code = (error as NodeJS.ErrnoException).code;\n\n      // Only ENOENT means \"this segment doesn't exist yet\" — keep\n      // walking up. Any other error (EACCES, ELOOP, …) is a real fault.\n      if (code !== \"ENOENT\") {\n        throw error;\n      }\n\n      const parent = path.dirname(resolvedTarget);\n\n      // Reached the filesystem root without finding an existing\n      // ancestor — give back the lexically-resolved path unchanged.\n      if (parent === resolvedTarget) {\n        return path.join(resolvedTarget, ...tail);\n      }\n\n      tail.unshift(path.basename(resolvedTarget));\n      resolvedTarget = parent;\n    }\n  }\n}\n\n/**\n * Resolve and jail a single input path against a {@link WorkspacePolicy}.\n *\n * The input is resolved against `policy.cwd`, canonicalized (symlinks in\n * existing ancestors collapsed so a symlinked directory cannot escape\n * the jail), then accepted **only** when it sits under `cwd` or one of\n * the `allowPaths` roots. A path that escapes, or that matches any\n * `denyPaths` glob even while inside `cwd`, is rejected with a\n * {@link WorkspacePolicyError} of type `\"path-escape\"`.\n *\n * Why this does not use `@warlock.js/fs`'s confined reader (`fs.confined`):\n * the two answer different questions. The confined reader refuses absolute\n * paths, refuses every symbolic link (or follows only links inside its one\n * root), requires the path to exist, and reads the file itself through a\n * no-follow, identity-checked open. This jail must instead accept absolute\n * paths inside `cwd`, several `allowPaths` roots, `denyPaths` globs, a\n * symlinked `cwd`, links whose target stays inside, and paths that do not\n * exist yet (`writeFile`, `mkdir`), and it returns a path that writes,\n * `exec`'s working directory and redirections use afterwards. Switching would\n * change what agents may touch, so the workspace keeps this resolver.\n *\n * @param policy - The bounding policy (its `cwd` is the jail root).\n * @param inputPath - A workspace-relative or absolute path to resolve.\n * @returns The canonical absolute path plus its `/`-separated relative form.\n * @throws {WorkspacePolicyError} When the path escapes the jail or hits a deny glob.\n *\n * @example\n * const { absolutePath } = await resolveInJail(policy, \"src/index.ts\");\n */\nexport async function resolveInJail(\n  policy: WorkspacePolicy,\n  inputPath: string,\n): Promise<ResolvedPath> {\n  const jailRoot = await canonicalize(policy.cwd);\n  const requested = path.isAbsolute(inputPath) ? inputPath : path.join(policy.cwd, inputPath);\n  const absolutePath = await canonicalize(requested);\n\n  const insideCwd = isInside(absolutePath, jailRoot);\n  const allowRoots = policy.allowPaths ?? [];\n  let insideAllow = false;\n\n  if (!insideCwd) {\n    for (const root of allowRoots) {\n      const canonicalRoot = await canonicalize(root);\n\n      if (isInside(absolutePath, canonicalRoot)) {\n        insideAllow = true;\n\n        break;\n      }\n    }\n  }\n\n  if (!insideCwd && !insideAllow) {\n    throw new WorkspacePolicyError(`Path \"${inputPath}\" resolves outside the workspace jail.`, {\n      type: \"path-escape\",\n      path: inputPath,\n    });\n  }\n\n  // `denyPaths` is evaluated relative to the jail root and wins even\n  // when the path is comfortably inside `cwd`.\n  const relativeToJail = insideCwd\n    ? path.relative(jailRoot, absolutePath).split(path.sep).join(\"/\")\n    : \"\";\n\n  if (insideCwd && policy.denyPaths && policy.denyPaths.length > 0) {\n    if (matchesAnyGlob(relativeToJail, policy.denyPaths)) {\n      throw new WorkspacePolicyError(`Path \"${inputPath}\" is blocked by the workspace deny list.`, {\n        type: \"path-escape\",\n        path: inputPath,\n      });\n    }\n  }\n\n  return { absolutePath, relativePath: relativeToJail };\n}\n\n/**\n * Whether a command line is permitted by the policy's `shell` sub-policy —\n * `checkShellCommand(policy, command).allowed`.\n *\n * In argv mode (the default) the command must tokenize into a single argv\n * (no unquoted `;`, `&&`, `|`, backticks, `$`, redirection, …): the backend\n * spawns it with no shell, and unquoted metacharacters were exactly how an\n * injected command chain used to ride past the allowlist. In shell mode\n * (`interpreter: \"sh\"`) every simple command in the line is checked. Each\n * argv's executable basename is matched against `shell.deny` (wins, case\n * insensitive) then `shell.allow` (exhaustive when non-empty), then\n * `shell.denyPatterns` and `shell.allowCommand`. An absent `shell` block\n * means no command may run at all.\n *\n * Returns a plain `boolean`; use {@link checkShellCommand} for the reason\n * and the model-facing message. Redirection targets are checked lexically\n * here; `exec` re-checks them with symlinks resolved.\n *\n * @example\n * isCommandAllowed({ cwd, shell: { allow: [\"npm\"] } }, \"npm test\"); // true\n * isCommandAllowed({ cwd, shell: { allow: [\"npm\"] } }, \"rm -rf /\"); // false\n * isCommandAllowed({ cwd, shell: { allow: [\"npm\"] } }, \"npm test; rm -rf /\"); // false\n */\nexport function isCommandAllowed(policy: WorkspacePolicy, command: string): boolean {\n  return checkShellCommand(policy, command).allowed;\n}\n\n/**\n * Build the exact environment a spawned process receives — `process.env`\n * is **never** inherited wholesale. The result is\n * `{ ...pick(process.env, inheritEnv), ...shell.env }`, so a command\n * cannot see `PATH` (and thus often cannot find `node`/`npm`) unless the\n * policy opts in via `shell.inheritEnv: [\"PATH\"]`. Explicit `shell.env`\n * values override inherited ones on key collision.\n *\n * @example\n * buildEnv({ cwd, shell: { inheritEnv: [\"PATH\"], env: { CI: \"1\" } } });\n * // → { PATH: <process PATH>, CI: \"1\" }\n */\nexport function buildEnv(policy: WorkspacePolicy): Record<string, string> {\n  const shell = policy.shell;\n  const env: Record<string, string> = {};\n\n  if (!shell) {\n    return env;\n  }\n\n  for (const key of shell.inheritEnv ?? []) {\n    const value = process.env[key];\n\n    if (value !== undefined) {\n      env[key] = value;\n    }\n  }\n\n  if (shell.env) {\n    for (const [key, value] of Object.entries(shell.env)) {\n      env[key] = value;\n    }\n  }\n\n  return env;\n}\n\n/**\n * Variables removed from the environment of a shell-mode (`interpreter:\n * \"sh\"`) command: each changes how the shell itself starts, parses or\n * resolves the line (`ENV`/`BASH_ENV` run a startup file, `SHELLOPTS` +\n * `PS4` can run command substitutions, `BASH_FUNC_*` imports functions that\n * shadow commands, `CDPATH` moves `cd`, `IFS` re-splits words).\n */\nconst SHELL_STARTUP_VARIABLES = new Set([\n  \"ENV\",\n  \"BASH_ENV\",\n  \"SHELLOPTS\",\n  \"BASHOPTS\",\n  \"CDPATH\",\n  \"IFS\",\n  \"PS4\",\n  \"GLOBIGNORE\",\n]);\n\n/**\n * The environment a command actually receives: {@link buildEnv}, minus the\n * shell start-up variables when the policy runs lines through a shell.\n * Compared case-insensitively, because Windows environment names are.\n */\nexport function buildCommandEnv(policy: WorkspacePolicy): Record<string, string> {\n  const env = buildEnv(policy);\n\n  if ((policy.shell?.interpreter ?? \"none\") !== \"sh\") {\n    return env;\n  }\n\n  for (const key of Object.keys(env)) {\n    const upper = key.toUpperCase();\n\n    if (SHELL_STARTUP_VARIABLES.has(upper) || upper.startsWith(\"BASH_FUNC_\")) {\n      delete env[key];\n    }\n  }\n\n  return env;\n}\n"],"mappings":";;;;;;;;;;;;;;AA+BA,eAAe,aAAa,QAAiC;CAC3D,IAAI,iBAAiB,KAAK,QAAQ,MAAM;CACxC,MAAM,OAAiB,CAAC;CAIxB,OAAO,MACL,IAAI;EACF,MAAM,OAAO,MAAM,SAAS,cAAc;EAE1C,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM,GAAG,IAAI,IAAI;CACtD,SAAS,OAAO;EAKd,IAJc,MAAgC,SAIjC,UACX,MAAM;EAGR,MAAM,SAAS,KAAK,QAAQ,cAAc;EAI1C,IAAI,WAAW,gBACb,OAAO,KAAK,KAAK,gBAAgB,GAAG,IAAI;EAG1C,KAAK,QAAQ,KAAK,SAAS,cAAc,CAAC;EAC1C,iBAAiB;CACnB;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,eAAsB,cACpB,QACA,WACuB;CACvB,MAAM,WAAW,MAAM,aAAa,OAAO,GAAG;CAE9C,MAAM,eAAe,MAAM,aADT,KAAK,WAAW,SAAS,IAAI,YAAY,KAAK,KAAK,OAAO,KAAK,SAAS,CACzC;CAEjD,MAAM,YAAY,SAAS,cAAc,QAAQ;CACjD,MAAM,aAAa,OAAO,cAAc,CAAC;CACzC,IAAI,cAAc;CAElB,IAAI,CAAC,WACH,KAAK,MAAM,QAAQ,YAAY;EAC7B,MAAM,gBAAgB,MAAM,aAAa,IAAI;EAE7C,IAAI,SAAS,cAAc,aAAa,GAAG;GACzC,cAAc;GAEd;EACF;CACF;CAGF,IAAI,CAAC,aAAa,CAAC,aACjB,MAAM,IAAI,qBAAqB,SAAS,UAAU,yCAAyC;EACzF,MAAM;EACN,MAAM;CACR,CAAC;CAKH,MAAM,iBAAiB,YACnB,KAAK,SAAS,UAAU,YAAY,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,IAC9D;CAEJ,IAAI,aAAa,OAAO,aAAa,OAAO,UAAU,SAAS,GAC7D;MAAI,eAAe,gBAAgB,OAAO,SAAS,GACjD,MAAM,IAAI,qBAAqB,SAAS,UAAU,2CAA2C;GAC3F,MAAM;GACN,MAAM;EACR,CAAC;CACH;CAGF,OAAO;EAAE;EAAc,cAAc;CAAe;AACtD;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,iBAAiB,QAAyB,SAA0B;CAClF,OAAO,kBAAkB,QAAQ,OAAO,CAAC,CAAC;AAC5C;;;;;;;;;;;;;AAcA,SAAgB,SAAS,QAAiD;CACxE,MAAM,QAAQ,OAAO;CACrB,MAAM,MAA8B,CAAC;CAErC,IAAI,CAAC,OACH,OAAO;CAGT,KAAK,MAAM,OAAO,MAAM,cAAc,CAAC,GAAG;EACxC,MAAM,QAAQ,QAAQ,IAAI;EAE1B,IAAI,UAAU,QACZ,IAAI,OAAO;CAEf;CAEA,IAAI,MAAM,KACR,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG,GACjD,IAAI,OAAO;CAIf,OAAO;AACT;;;;;;;;AASA,MAAM,0CAA0B,IAAI,IAAI;CACtC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AAOD,SAAgB,gBAAgB,QAAiD;CAC/E,MAAM,MAAM,SAAS,MAAM;CAE3B,KAAK,OAAO,OAAO,eAAe,YAAY,MAC5C,OAAO;CAGT,KAAK,MAAM,OAAO,OAAO,KAAK,GAAG,GAAG;EAClC,MAAM,QAAQ,IAAI,YAAY;EAE9B,IAAI,wBAAwB,IAAI,KAAK,KAAK,MAAM,WAAW,YAAY,GACrE,OAAO,IAAI;CAEf;CAEA,OAAO;AACT"}

package/esm/policy/shell-check.d.mts

@@ -1,11 +1,11 @@
 import { WorkspacePolicy } from "../contracts/workspace-policy.type.mjs";
+import "../contracts/index.mjs";
 import { WorkspaceShellRefusalReason } from "../errors.mjs";
-
 //#region ../../packages/ai-workspace/src/policy/shell-check.d.ts
 /** How a shell-mode line touches a path the jail has to vet. */
-type WorkspaceShellPathAccess = "read" | "write" | "cwd";
+export type WorkspaceShellPathAccess = "read" | "write" | "cwd";
 /** A path a shell-mode line redirects to/from or `cd`s into. */
-interface WorkspaceShellPath {
+export interface WorkspaceShellPath {
   /** Absolute path, resolved lexically against the workspace root (or an earlier `cd`). */
   path: string;
   /** What the line does with it. */
@@ -17,7 +17,7 @@ interface WorkspaceShellPath {
  * The shell policy's verdict on one command line — see
  * {@link checkShellCommand}.
  */
-interface WorkspaceShellCheck {
+export interface WorkspaceShellCheck {
   /** Whether the line may run (path targets still get a symlink-aware recheck in `exec`). */
   allowed: boolean;
   /** Why it was refused. */
@@ -58,7 +58,6 @@ interface WorkspaceShellCheck {
  * checkShellCommand({ cwd, shell: { allow: ["git"] } }, "git add -A && git commit -m wip");
  * // { allowed: false, reason: "metacharacter", message: "`&&` is not supported in argv mode: run `git add -A`, then `git commit -m wip`, …" }
  */
-declare function checkShellCommand(policy: WorkspacePolicy, command: string): WorkspaceShellCheck;
+export declare function checkShellCommand(policy: WorkspacePolicy, command: string): WorkspaceShellCheck;
 //#endregion
-export { WorkspaceShellCheck, WorkspaceShellPath, WorkspaceShellPathAccess, checkShellCommand };
 //# sourceMappingURL=shell-check.d.mts.map

package/esm/policy/shell-check.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"shell-check.d.mts","names":[],"sources":["../../../../../../../../packages/ai-workspace/src/policy/shell-check.ts"],"mappings":";;;;;KAmBY,wBAAA;AAAZ;AAAA,UAGiB,kBAAA;;EAEf,IAAA;EALkC;EAOlC,MAAA,EAAQ,wBAAwB;EAJC;EAMjC,MAAA;AAAA;;;;;UAOe,mBAAA;EAPT;EASN,OAAA;EAFkC;EAIlC,MAAA,GAAS,2BAAA;EAUgB;EARzB,OAAA;EAFA;EAIA,UAAA;EAFA;EAIA,IAAA;EAAA;EAEA,QAAA;EAEA;EAAA,KAAA,EAAO,kBAAkB;AAAA;;AA6hCqE;;;;;;;;;;;;;;;;;;;;;;;;iBAAhF,iBAAA,CAAkB,MAAA,EAAQ,eAAA,EAAiB,OAAA,WAAkB,mBAAmB"}
+{"version":3,"file":"shell-check.d.mts","names":[],"sources":["../../../../../../../../packages/ai-workspace/src/policy/shell-check.ts"],"mappings":";;;;;YAmBY;;iBAGK;;EAEf;;EAEA,QAAQ;;EAER;;;;;;iBAOe;;EAEf;;EAEA,SAAS;;EAET;;EAEA;;EAEA;;EAEA;;EAEA,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA6hCO,kBAAkB,QAAQ,iBAAiB,kBAAkB"}

package/esm/policy/shell-check.mjs

@@ -10,7 +10,7 @@ import path from "node:path";
 * With deny rules in force they would hide a denied command, so they are
 * refused unless the policy names them in `allow`.
 */
-const OPAQUE_RUNNERS = new Set([
+const OPAQUE_RUNNERS = /* @__PURE__ */ new Set([
 	"sh",
 	"bash",
 	"dash",
@@ -54,7 +54,7 @@ const OPAQUE_RUNNERS = new Set([
 	"flock"
 ]);
 /** POSIX shell builtins that evaluate code or change how later names resolve. */
-const SHELL_OPAQUE_BUILTINS = new Set([
+const SHELL_OPAQUE_BUILTINS = /* @__PURE__ */ new Set([
 	"eval",
 	".",
 	"source",
@@ -78,7 +78,7 @@ const SHELL_OPAQUE_BUILTINS = new Set([
 	"readarray"
 ]);
 /** cmd.exe builtins that run commands or change the environment. */
-const CMD_OPAQUE_BUILTINS = new Set([
+const CMD_OPAQUE_BUILTINS = /* @__PURE__ */ new Set([
 	"call",
 	"start",
 	"set",
@@ -90,7 +90,7 @@ const CMD_OPAQUE_BUILTINS = new Set([
 * subscripts such as `a[$(cmd)]`): their arguments must be literal and free
 * of `[`.
 */
-const ARITHMETIC_SENSITIVE_BUILTINS = new Set([
+const ARITHMETIC_SENSITIVE_BUILTINS = /* @__PURE__ */ new Set([
 	"test",
 	"[",
 	"printf",
@@ -114,7 +114,7 @@ const ARITHMETIC_SENSITIVE_BUILTINS = new Set([
 * the jail's sight, `PS4` is expanded — command substitutions included —
 * on every traced line, `IFS` re-splits expansions).
 */
-const SENSITIVE_VARIABLES = new Set([
+const SENSITIVE_VARIABLES = /* @__PURE__ */ new Set([
 	"CDPATH",
 	"ENV",
 	"BASH_ENV",
@@ -132,13 +132,13 @@ const SENSITIVE_VARIABLES = new Set([
 	"BASH_LOADABLES_PATH"
 ]);
 /** Redirection targets that are always fine even though they sit outside the jail. */
-const DEVICE_TARGETS = new Set([
+const DEVICE_TARGETS = /* @__PURE__ */ new Set([
 	"/dev/null",
 	"/dev/stdout",
 	"/dev/stderr"
 ]);
 /** cmd.exe's null device. */
-const CMD_DEVICE_TARGETS = new Set(["nul"]);
+const CMD_DEVICE_TARGETS = /* @__PURE__ */ new Set(["nul"]);
 /** Deepest chain of wrappers (`env time nice …`) the policy unwraps. */
 const MAX_WRAPPER_DEPTH = 8;
 /** Most distinct directories a line may `cd` between. */
@@ -237,7 +237,8 @@ var LineChecker = class {
 			verdict = false;
 		}
 		if (verdict === true) return;
-		throw new Refusal("not-allowed", `${shown} was refused by the workspace shell policy.${typeof verdict === "string" && verdict.trim() !== "" ? ` ${verdict.trim()}` : ""}`, executableBasename(argv[0] ?? "", this.dialect));
+		const explanation = typeof verdict === "string" && verdict.trim() !== "" ? ` ${verdict.trim()}` : "";
+		throw new Refusal("not-allowed", `${shown} was refused by the workspace shell policy.${explanation}`, executableBasename(argv[0] ?? "", this.dialect));
 	}
 	/** Whether the policy names `executable` in a non-empty `allow` list. */
 	explicitlyAllowed(executable) {
@@ -260,7 +261,10 @@ var LineChecker = class {
 		if (executable === "") throw new Refusal("not-allowed", "The command has no executable name.");
 		if (dynamic[0] === true) throw new Refusal("unsupported-syntax", `The command name \`${first}\` is decided when the line runs, so the workspace shell policy cannot check it. Write the command name literally.`);
 		if (this.deny.has(key)) throw new Refusal("denied-executable", `\`${executable}\` is denied by the workspace shell policy (in ${show(argv.join(" "))}).`, executable);
-		if (this.allow.length > 0 && !this.allow.includes(executable)) throw new Refusal("not-allowed", `\`${executable}\` is not in the workspace shell allowlist. Allowed commands: ${this.allow.slice(0, 20).join(", ")}${this.allow.length > 20 ? ", …" : ""}.`, executable);
+		if (this.allow.length > 0 && !this.allow.includes(executable)) {
+			const listed = this.allow.slice(0, 20).join(", ");
+			throw new Refusal("not-allowed", `\`${executable}\` is not in the workspace shell allowlist. Allowed commands: ${listed}${this.allow.length > 20 ? ", …" : ""}.`, executable);
+		}
 		this.checkHooks(argv, depth > 0);
 		this.commands.push([...argv]);
 		if (OPAQUE_RUNNERS.has(key) || this.shellMode && this.dialect === "posix" && SHELL_OPAQUE_BUILTINS.has(key) || this.shellMode && this.dialect === "cmd" && CMD_OPAQUE_BUILTINS.has(key)) {
@@ -504,16 +508,23 @@ function argvModeRefusal(command) {
 	const segments = parsed.ok ? parsed.segments : [];
 	if ((token === "&&" || token === "||" || token === ";" || token === "\n") && segments.length >= 2) {
 		const shownOperator = token === "\n" ? "A line break" : `\`${token}\``;
-		if ((segments[0]?.source ?? "").trim().split(/\s+/)[0] === "cd") return new Refusal("metacharacter", `${shownOperator} is not supported in argv mode, and \`cd\` does not carry over: every command starts in the workspace root. Run ${segments.slice(1).map((segment) => show(segment.source)).join(", then ")} on its own, with paths relative to the root.${suffix}`);
+		if ((segments[0]?.source ?? "").trim().split(/\s+/)[0] === "cd") {
+			const rest = segments.slice(1).map((segment) => show(segment.source));
+			return new Refusal("metacharacter", `${shownOperator} is not supported in argv mode, and \`cd\` does not carry over: every command starts in the workspace root. Run ${rest.join(", then ")} on its own, with paths relative to the root.${suffix}`);
+		}
 		const steps = segments.map((segment) => show(segment.source));
 		const joiner = token === "||" ? ", and if it fails, " : ", then ";
 		return new Refusal("metacharacter", `${shownOperator} is not supported in argv mode: run ${steps.join(joiner)}, as separate commands.${suffix}`);
 	}
 	if (token === "&" && segments.length >= 1) {
 		const steps = segments.map((segment) => show(segment.source));
-		return new Refusal("metacharacter", `\`&\` is not supported in argv mode: ${steps.length === 1 ? `run ${steps[0] ?? ""} without it` : `run ${steps.join(", then ")} as separate commands`}; start a long-running command with background: true.${suffix}`);
+		const run = steps.length === 1 ? `run ${steps[0] ?? ""} without it` : `run ${steps.join(", then ")} as separate commands`;
+		return new Refusal("metacharacter", `\`&\` is not supported in argv mode: ${run}; start a long-running command with background: true.${suffix}`);
+	}
+	if (token === "|") {
+		const pipeline = command.split("|").map((part) => part.trim()).filter(Boolean);
+		return new Refusal("metacharacter", `\`|\` (a pipe) is not supported in argv mode: run ${show(pipeline[0] ?? command)} on its own and read its output yourself.${suffix}`);
 	}
-	if (token === "|") return new Refusal("metacharacter", `\`|\` (a pipe) is not supported in argv mode: run ${show(command.split("|").map((part) => part.trim()).filter(Boolean)[0] ?? command)} on its own and read its output yourself.${suffix}`);
 	if (token === ">" || token === ">>" || token === ">&") return new Refusal("metacharacter", `\`${token}\` (redirection) is not supported in argv mode: run the command without it and save the output with write_file if you need it.${suffix}`);
 	if (token === "<" || token === "<<" || token === "<&") return new Refusal("metacharacter", `\`${token}\` (input redirection) is not supported in argv mode: pass the file path to the command as an argument.${suffix}`);
 	if (token === "$(" || token === "`") return new Refusal("metacharacter", `Command substitution (${token === "$(" ? "`$(…)`" : "backticks"}) is not supported in argv mode: run the inner command first, then pass its output literally.${suffix}`);
@@ -623,5 +634,5 @@ function checkShellCommandInDialect(policy, command, dialect) {
 }
 
 //#endregion
-export { checkShellCommand };
+export { checkShellCommand, checkShellCommandInDialect, executableBasename, shellDialect };
 //# sourceMappingURL=shell-check.mjs.map