@wichayutdew/pi-workflows 1.0.1 → 2.0.0

package/src/harness.ts

@@ -53,6 +53,7 @@ import { createGateSubmissionAction } from './harness/gate-submission-action.ts'
 import { createPromptGateActions } from './harness/prompt-gate-actions.ts';
 import { createPlannotatorResultActions } from './harness/plannotator-result-actions.ts';
 import { createCoreActions } from './harness/core-actions.ts';
+import type { SettledStepReport } from './harness/step-reporting.ts';
 import {
   formatShortcutLabel,
   type WorkflowStatusSnapshot,
@@ -106,14 +107,16 @@ export class WorkflowHarness implements WorkflowCommandController {
     STATUS_ACTIONS.stopStatusRefresh;
   private readonly registerWorkflowStatusShortcut: () => void =
     STATUS_ACTIONS.registerWorkflowStatusShortcut;
-  private readonly openWorkflowStatus: (context: ExtensionContext) => void =
-    STATUS_ACTIONS.openWorkflowStatus;
   private readonly showWorkflowStatus: (
     context: ExtensionContext,
   ) => Promise<void> = STATUS_ACTIONS.showWorkflowStatus;
   private readonly listWorkflows: (
     context: ExtensionCommandContext,
   ) => Promise<void> = START_ACTIONS.listWorkflows;
+  private readonly doctorWorkflows: (
+    workflowId: string,
+    context: ExtensionCommandContext,
+  ) => Promise<void> = START_ACTIONS.doctorWorkflows;
   private readonly startNow: (
     workflowId: string,
     input: string,
@@ -133,6 +136,7 @@ export class WorkflowHarness implements WorkflowCommandController {
   ) => Promise<void> = PAUSE_ACTIONS.abortNow;
   private readonly resumeNow: (
     context: ExtensionCommandContext,
+    input?: string,
   ) => Promise<void> = RESUME_ACTION.resumeNow;
   private readonly registerMultilineCommandInput: () => void =
     LIFECYCLE_ACTIONS.registerMultilineCommandInput;
@@ -149,6 +153,16 @@ export class WorkflowHarness implements WorkflowCommandController {
     run: WorkflowRun,
     step: WorkflowStep,
   ) => void = STEP_EXECUTION_ACTIONS.launchMainStep;
+  private readonly queueMainStepLog: (
+    identity: MainStepIdentity,
+    lines: ReadonlyArray<string>,
+    context: ExtensionContext,
+  ) => Promise<void> = STEP_EXECUTION_ACTIONS.queueMainStepLog;
+  private readonly recordMainStepLog: (
+    identity: MainStepIdentity,
+    lines: ReadonlyArray<string>,
+    context: ExtensionContext,
+  ) => Promise<void> = STEP_EXECUTION_ACTIONS.recordMainStepLog;
   private readonly queueMainStepResult: (
     identity: MainStepIdentity,
     result: WorkflowStepResult | undefined,
@@ -186,11 +200,14 @@ export class WorkflowHarness implements WorkflowCommandController {
     failure: DelegationFailureDetails | undefined,
     reason: string,
   ) => boolean = DELEGATION_CONTROL_ACTIONS.retryDelegationAfterFailure;
-  private readonly pauseForDelegationFailure: (reason: string) => void =
-    DELEGATION_CONTROL_ACTIONS.pauseForDelegationFailure;
+  private readonly pauseForDelegationFailure: (
+    reason: string,
+    failureSummary?: string,
+  ) => void = DELEGATION_CONTROL_ACTIONS.pauseForDelegationFailure;
   private readonly pauseForExecutionFailure: (
     label: string,
     reason: string,
+    failureSummary?: string,
   ) => void = DELEGATION_CONTROL_ACTIONS.pauseForExecutionFailure;
   private readonly retainUnconfirmedDelegation: (
     active: ActiveDelegation,
@@ -203,6 +220,7 @@ export class WorkflowHarness implements WorkflowCommandController {
     workflow: LoadedWorkflow,
     originalRun: WorkflowRun,
     outcome: string,
+    summary: string,
     artifact: string,
   ) => Promise<void> = GATE_SUBMISSION_ACTION.submitGate;
   private readonly launchPromptReview: (
@@ -233,8 +251,10 @@ export class WorkflowHarness implements WorkflowCommandController {
     PLANNOTATOR_RESULT_ACTIONS.registerPlannotatorResults;
   private readonly handlePlannotatorResult: (data: unknown) => Promise<void> =
     PLANNOTATOR_RESULT_ACTIONS.handlePlannotatorResult;
-  private readonly settleAfterTransition: (workflow: LoadedWorkflow) => void =
-    CORE_ACTIONS.settleAfterTransition;
+  private readonly settleAfterTransition: (
+    workflow: LoadedWorkflow,
+    report: SettledStepReport,
+  ) => void = CORE_ACTIONS.settleAfterTransition;
   private readonly preflight: (
     workflow: LoadedWorkflow,
     stepId: string,
@@ -297,6 +317,14 @@ export class WorkflowHarness implements WorkflowCommandController {
     await this.listWorkflows(context);
   }
 
+  /** Diagnoses declarative completion paths and loop risks. */
+  async doctor(
+    workflowId: string,
+    context: ExtensionCommandContext,
+  ): Promise<void> {
+    await this.doctorWorkflows(workflowId, context);
+  }
+
   /** Starts a loaded workflow with the supplied user input. */
   start(
     workflowId: string,
@@ -322,9 +350,9 @@ export class WorkflowHarness implements WorkflowCommandController {
     return this.enqueueMutation(context, () => this.pauseNow(reason, context));
   }
 
-  /** Resumes the active paused workflow after reconciling configuration. */
-  resume(context: ExtensionCommandContext): Promise<void> {
-    return this.enqueueMutation(context, () => this.resumeNow(context));
+  /** Resumes the active paused workflow with optional user guidance. */
+  resume(input: string, context: ExtensionCommandContext): Promise<void> {
+    return this.enqueueMutation(context, () => this.resumeNow(context, input));
   }
 
   /** Aborts the active workflow and cancels any delegated execution. */

package/src/integrations/plannotator-requests.ts

@@ -35,6 +35,7 @@ type RequestResponseOptions<TResponse> = {
   readonly timeoutMs: number;
   readonly timeoutResponse: TResponse;
   readonly normalize: (response: unknown) => TResponse;
+  readonly ignoreResponse?: (response: unknown) => boolean;
   readonly dependencies: PlannotatorDependencies;
 };
 
@@ -44,12 +45,13 @@ const requestResponse = <TResponse>({
   timeoutMs,
   timeoutResponse,
   normalize,
+  ignoreResponse,
   dependencies,
 }: RequestResponseOptions<TResponse>): Promise<TResponse> =>
   new Promise((resolve) => {
     let isSettled = false;
     const finish = (response: unknown): void => {
-      if (isSettled) return;
+      if (isSettled || ignoreResponse?.(response)) return;
       isSettled = true;
       dependencies.cancelTimeout(timer);
       resolve(normalize(response));
@@ -65,6 +67,39 @@ const requestResponse = <TResponse>({
     });
   });
 
+const MISSING_PLAN_CONTENT_RESPONSE =
+  'Missing planContent for plan-review request.';
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  value !== null && typeof value === 'object' && !Array.isArray(value);
+
+const isUnclaimedPlanReviewResponse = (response: unknown): boolean =>
+  isRecord(response) &&
+  response.status === 'error' &&
+  response.error === MISSING_PLAN_CONTENT_RESPONSE;
+
+/**
+ * Pi keeps its shared event bus across extension reloads. Plannotator versions
+ * that do not dispose their request listener can therefore receive one request
+ * multiple times and open one browser pane per stale listener. A consumable
+ * plan value lets exactly one listener claim the side-effecting request.
+ */
+const singleConsumerPlanPayload = (
+  planContent: string,
+  origin: string,
+): Readonly<Record<string, unknown>> => {
+  let claimed = false;
+
+  return {
+    get planContent(): string | undefined {
+      if (claimed) return undefined;
+      claimed = true;
+      return planContent;
+    },
+    origin,
+  };
+};
+
 /**
  * Requests a new Plannotator plan review through the injected event bus.
  *
@@ -83,10 +118,7 @@ export const requestPlannotatorReview = (
     request: {
       requestId,
       action: 'plan-review',
-      payload: {
-        planContent: content,
-        origin,
-      },
+      payload: singleConsumerPlanPayload(content, origin),
     },
     timeoutMs,
     timeoutResponse: {
@@ -94,6 +126,9 @@ export const requestPlannotatorReview = (
       error: `Plannotator did not respond within ${timeoutMs}ms`,
     },
     normalize: normalizePlannotatorStartResponse,
+    ...(content.trim()
+      ? { ignoreResponse: isUnclaimedPlanReviewResponse }
+      : {}),
     dependencies,
   });
 

package/src/integrations/subagents/child-policy-sections.ts

@@ -1,17 +1,19 @@
-import { isAbsolute, resolve } from 'node:path';
-import type { StepPermissions } from '../../config/types.ts';
+import { isAbsolute, win32 } from 'node:path';
+import {
+  MAX_WORKSPACE_ALLOWED_ROOTS,
+  MAX_WORKSPACE_PATH_CHARS,
+  type StepPermissions,
+} from '../../config/types.ts';
 import type { ChildStepPolicy } from './child-policy-types.ts';
 
 type PolicySections = Pick<
   ChildStepPolicy,
   | 'permissions'
-  | 'approvedBashCommands'
-  | 'repositoryCwd'
-  | 'bootstrapCwd'
   | 'outcomes'
   | 'pauseOutcomes'
   | 'summaryMaxChars'
   | 'gateSubmitOutcome'
+  | 'workspace'
 >;
 
 const isRecord = (value: unknown): value is Record<string, unknown> =>
@@ -20,6 +22,11 @@ const isRecord = (value: unknown): value is Record<string, unknown> =>
 const isStringArray = (value: unknown): value is Array<string> =>
   Array.isArray(value) && value.every((item) => typeof item === 'string');
 
+const hasOnlyKeys = (
+  value: Readonly<Record<string, unknown>>,
+  allowed: ReadonlySet<string>,
+): boolean => Object.keys(value).every((key) => allowed.has(key));
+
 const isStepPermissions = (value: unknown): value is StepPermissions => {
   if (!isRecord(value) || !isRecord(value.bash)) return false;
 
@@ -27,7 +34,6 @@ const isStepPermissions = (value: unknown): value is StepPermissions => {
   const bashRules = Array.isArray(bash.allow) ? bash.allow : undefined;
   const isValidMode =
     bash.mode === 'deny' ||
-    bash.mode === 'read-only' ||
     bash.mode === 'allow-list' ||
     bash.mode === 'unrestricted';
   const hasValidRules =
@@ -35,96 +41,33 @@ const isStepPermissions = (value: unknown): value is StepPermissions => {
     bashRules.every(
       (rule) =>
         isRecord(rule) &&
+        hasOnlyKeys(rule, new Set(['executable', 'argsPrefix'])) &&
         typeof rule.executable === 'string' &&
         isStringArray(rule.argsPrefix),
     );
-  const hasValidApprovedSources =
-    bash.approvedSources === undefined ||
-    (isStringArray(bash.approvedSources) &&
-      new Set(bash.approvedSources).size === bash.approvedSources.length &&
-      bash.approvedSources.every(
-        (source) =>
-          source === 'verification-worker' ||
-          source === 'verification-reviewer' ||
-          source === 'remote-actions' ||
-          source === 'remote-push' ||
-          source === 'remote-drafts',
-      ));
-  const hasValidHandoffSources =
-    bash.handoffSources === undefined ||
-    (isStringArray(bash.handoffSources) &&
-      new Set(bash.handoffSources).size === bash.handoffSources.length &&
-      bash.handoffSources.every(
-        (source) =>
-          source === 'verification-worker' ||
-          source === 'verification-reviewer',
-      ));
-  const hasValidApprovalShape =
-    bash.mode === 'allow-list'
-      ? (bashRules?.length ?? 0) > 0 ||
-        (Array.isArray(bash.approvedSources) && bash.approvedSources.length > 0)
-      : bash.approvedSources === undefined;
-
   return (
+    hasOnlyKeys(
+      value,
+      new Set(['tools', 'mcp', 'extensions', 'skills', 'bash']),
+    ) &&
+    hasOnlyKeys(bash, new Set(['mode', 'allow'])) &&
     isStringArray(value.tools) &&
     isStringArray(value.mcp) &&
     isStringArray(value.extensions) &&
     isStringArray(value.skills) &&
     isValidMode &&
     hasValidRules &&
-    hasValidApprovedSources &&
-    hasValidHandoffSources &&
-    hasValidApprovalShape
+    (bash.mode !== 'allow-list' || bashRules.length > 0)
   );
 };
 
 const parsePermissions = (
   value: Readonly<Record<string, unknown>>,
-): Pick<PolicySections, 'permissions' | 'approvedBashCommands'> => {
+): Pick<PolicySections, 'permissions'> => {
   if (!isStepPermissions(value.permissions)) {
     throw new Error('child policy permissions are invalid');
   }
-  const approvedBashCommands = value.approvedBashCommands;
-  if (
-    approvedBashCommands !== undefined &&
-    (!isStringArray(approvedBashCommands) ||
-      new Set(approvedBashCommands).size !== approvedBashCommands.length)
-  ) {
-    throw new Error('child policy approved Bash commands are invalid');
-  }
-  return {
-    permissions: value.permissions,
-    ...(approvedBashCommands === undefined ? {} : { approvedBashCommands }),
-  };
-};
-
-const parseRepositoryPaths = (
-  value: Readonly<Record<string, unknown>>,
-): Pick<PolicySections, 'repositoryCwd' | 'bootstrapCwd'> => {
-  const repositoryCwd = value.repositoryCwd;
-  const bootstrapCwd = value.bootstrapCwd;
-  if (
-    repositoryCwd !== undefined &&
-    (typeof repositoryCwd !== 'string' ||
-      !isAbsolute(repositoryCwd) ||
-      repositoryCwd.includes('\0'))
-  ) {
-    throw new Error('child policy repository cwd is invalid');
-  }
-  if (
-    bootstrapCwd !== undefined &&
-    (typeof bootstrapCwd !== 'string' ||
-      !isAbsolute(bootstrapCwd) ||
-      bootstrapCwd.includes('\0') ||
-      typeof repositoryCwd !== 'string' ||
-      resolve(bootstrapCwd) === resolve(repositoryCwd))
-  ) {
-    throw new Error('child policy bootstrap cwd is invalid');
-  }
-  return {
-    ...(repositoryCwd === undefined ? {} : { repositoryCwd }),
-    ...(bootstrapCwd === undefined ? {} : { bootstrapCwd }),
-  };
+  return { permissions: value.permissions };
 };
 
 const parseOutcomes = (
@@ -174,13 +117,57 @@ const parseOutcomes = (
   };
 };
 
+const parseWorkspace = (
+  value: Readonly<Record<string, unknown>>,
+  outcomes: ReadonlyArray<string>,
+): Pick<PolicySections, 'workspace'> => {
+  if (value.workspace === undefined) return {};
+  if (
+    !isRecord(value.workspace) ||
+    !hasOnlyKeys(value.workspace, new Set(['bindOn', 'allowedRoots']))
+  ) {
+    throw new Error('child policy workspace is invalid');
+  }
+  const bindOn = value.workspace.bindOn;
+  const allowedRoots = value.workspace.allowedRoots;
+  if (
+    !isStringArray(bindOn) ||
+    bindOn.length === 0 ||
+    new Set(bindOn).size !== bindOn.length ||
+    bindOn.some((outcome) => !outcomes.includes(outcome))
+  ) {
+    throw new Error('child policy workspace bindOn outcomes are invalid');
+  }
+  if (
+    !isStringArray(allowedRoots) ||
+    allowedRoots.length === 0 ||
+    allowedRoots.length > MAX_WORKSPACE_ALLOWED_ROOTS ||
+    new Set(allowedRoots).size !== allowedRoots.length ||
+    allowedRoots.some(
+      (root) =>
+        !root.trim() ||
+        root !== root.trim() ||
+        root.length > MAX_WORKSPACE_PATH_CHARS ||
+        root.includes('\0') ||
+        isAbsolute(root) ||
+        win32.parse(root).root !== '',
+    )
+  ) {
+    throw new Error('child policy workspace allowed roots are invalid');
+  }
+  return { workspace: { bindOn, allowedRoots } };
+};
+
 /**
- * Parses permission, repository, and outcome sections of a child policy.
+ * Parses permission and outcome sections of a child policy.
  */
 export const parseChildPolicySections = (
   value: Readonly<Record<string, unknown>>,
-): PolicySections => ({
-  ...parsePermissions(value),
-  ...parseRepositoryPaths(value),
-  ...parseOutcomes(value),
-});
+): PolicySections => {
+  const outcomeSections = parseOutcomes(value);
+  return {
+    ...parsePermissions(value),
+    ...outcomeSections,
+    ...parseWorkspace(value, outcomeSections.outcomes),
+  };
+};

package/src/integrations/subagents/child-policy-types.ts

@@ -1,4 +1,7 @@
-import type { StepPermissions } from '../../config/types.ts';
+import type {
+  StepPermissions,
+  StepWorkspaceBinding,
+} from '../../config/types.ts';
 
 export type ChildStepPolicy = {
   readonly version: 1;
@@ -8,22 +11,19 @@ export type ChildStepPolicy = {
   readonly runId: string;
   readonly stepId: string;
   readonly stepTitle: string;
+  /** Effective run directory: the captured start cwd or accepted binding. */
+  readonly cwd: string;
   readonly policyDigest: string;
   readonly capabilityPath: string;
   readonly capabilityToken: string;
   readonly resultPath: string;
   readonly permissions: StepPermissions;
-  /** Exact Bash command strings extracted from a reviewed gate artifact. */
-  readonly approvedBashCommands?: ReadonlyArray<string>;
-  /** Reviewed repository root that file mutations must remain inside. */
-  readonly repositoryCwd?: string;
-  /** Existing reviewed source directory used only to bootstrap repositoryCwd. */
-  readonly bootstrapCwd?: string;
   readonly outcomes: ReadonlyArray<string>;
   /** Outcomes that pause instead of advancing to another workflow step. */
   readonly pauseOutcomes: ReadonlyArray<string>;
   readonly summaryMaxChars: number;
   readonly gateSubmitOutcome?: string;
+  readonly workspace?: StepWorkspaceBinding;
 };
 
 export type ExtractedChildPolicy = {

package/src/integrations/subagents/child-policy-validation.ts

@@ -1,4 +1,4 @@
-import { dirname, resolve } from 'node:path';
+import { dirname, isAbsolute, resolve } from 'node:path';
 import { SUBAGENT_RUNTIME_NAME_PATTERN } from '../../config/types.ts';
 import {
   DEFAULT_CHILD_POLICY_ENVIRONMENT,
@@ -19,18 +19,17 @@ const POLICY_KEYS: ReadonlySet<string> = new Set([
   'runId',
   'stepId',
   'stepTitle',
+  'cwd',
   'policyDigest',
   'capabilityPath',
   'capabilityToken',
   'resultPath',
   'permissions',
-  'approvedBashCommands',
-  'repositoryCwd',
-  'bootstrapCwd',
   'outcomes',
   'pauseOutcomes',
   'summaryMaxChars',
   'gateSubmitOutcome',
+  'workspace',
 ]);
 
 type RequiredStringField =
@@ -40,6 +39,7 @@ type RequiredStringField =
   | 'runId'
   | 'stepId'
   | 'stepTitle'
+  | 'cwd'
   | 'policyDigest'
   | 'capabilityPath'
   | 'capabilityToken'
@@ -85,6 +85,7 @@ type IdentityAndPaths = Pick<
   | 'runId'
   | 'stepId'
   | 'stepTitle'
+  | 'cwd'
   | 'policyDigest'
   | 'capabilityPath'
   | 'capabilityToken'
@@ -101,12 +102,16 @@ const parseIdentityAndPaths = (
   const runId = requiredString(value, 'runId');
   const stepId = requiredString(value, 'stepId');
   const stepTitle = requiredString(value, 'stepTitle');
+  const cwd = requiredString(value, 'cwd');
   const policyDigest = requiredString(value, 'policyDigest');
   const capabilityPath = requiredString(value, 'capabilityPath');
   const capabilityToken = requiredString(value, 'capabilityToken');
   const resultPath = requiredString(value, 'resultPath');
 
   if (value.version !== 1) throw new Error('unsupported child policy version');
+  if (!isAbsolute(cwd)) {
+    throw new Error('child policy cwd must be an absolute path');
+  }
   if (!POLICY_DIGEST_PATTERN.test(policyDigest)) {
     throw new Error('child policy digest is invalid');
   }
@@ -137,6 +142,7 @@ const parseIdentityAndPaths = (
     runId,
     stepId,
     stepTitle,
+    cwd,
     policyDigest,
     capabilityPath,
     capabilityToken,

package/src/integrations/subagents/child-runtime-completion.ts

@@ -12,6 +12,7 @@ const STRUCTURED_RESULT_KEYS: ReadonlySet<string> = new Set([
   'outcome',
   'summary',
   'artifact',
+  'workspace',
 ]);
 
 const isRecord = (value: unknown): value is Record<string, unknown> =>

package/src/integrations/subagents/child-runtime-files.ts

@@ -1,52 +1,41 @@
-import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
 import type { ChildStepPolicy } from './child-policy-types.ts';
 import type { SubagentChildRuntimeDependencies } from './child-runtime-types.ts';
 
-const FILE_MUTATION_TOOLS: ReadonlySet<string> = new Set(['edit', 'write']);
-
-const errorCode = (error: unknown): unknown =>
-  error !== null && typeof error === 'object' && 'code' in error
-    ? error.code
-    : undefined;
-
-const pathIsInside = (root: string, candidate: string): boolean => {
-  const relativePath = relative(root, candidate);
-  return (
-    relativePath !== '..' &&
-    !relativePath.startsWith(`..${sep}`) &&
-    !isAbsolute(relativePath)
-  );
-};
-
-const nearestCanonicalAncestor = (
-  path: string,
-  dependencies: SubagentChildRuntimeDependencies,
-): string | undefined => {
-  let candidate = path;
-  while (true) {
-    try {
-      dependencies.fileSystem.inspect(candidate);
-    } catch (error) {
-      if (errorCode(error) !== 'ENOENT') return undefined;
-      const parent = dirname(candidate);
-      if (parent === candidate) return undefined;
-      candidate = parent;
-      continue;
-    }
-    try {
-      return dependencies.fileSystem.realPath(candidate);
-    } catch {
-      return undefined;
-    }
-  }
-};
-
 type VerifyChildCapabilityOptions = {
   readonly policy: ChildStepPolicy;
   readonly childAgent: string;
   readonly dependencies: SubagentChildRuntimeDependencies;
 };
 
+/**
+ * Verifies that the delegated child started in the workflow run's captured
+ * working directory.
+ *
+ * @throws When either directory cannot be resolved or they differ.
+ */
+export const verifyChildWorkingDirectory = (
+  policy: ChildStepPolicy,
+  dependencies: SubagentChildRuntimeDependencies,
+): void => {
+  let expected: string;
+  let actual: string;
+  try {
+    expected = dependencies.fileSystem.realPath(policy.cwd);
+    actual = dependencies.fileSystem.realPath(
+      dependencies.currentWorkingDirectory(),
+    );
+  } catch {
+    throw new Error(
+      'child working directory does not match the delegated workflow policy',
+    );
+  }
+  if (expected !== policy.cwd || actual !== expected) {
+    throw new Error(
+      'child working directory does not match the delegated workflow policy',
+    );
+  }
+};
+
 /**
  * Verifies and consumes the one-time capability for a delegated child.
  *
@@ -108,49 +97,3 @@ export const writeChildResult = ({
     throw error;
   }
 };
-
-type RepositoryMutationOptions = {
-  readonly toolName: string;
-  readonly input: Readonly<Record<string, unknown>>;
-  readonly policy: ChildStepPolicy;
-  readonly dependencies: SubagentChildRuntimeDependencies;
-};
-
-/**
- * Returns a policy error when a file mutation escapes the reviewed repository.
- */
-export const repositoryMutationError = ({
-  toolName,
-  input,
-  policy,
-  dependencies,
-}: RepositoryMutationOptions): string | undefined => {
-  if (!policy.repositoryCwd || !FILE_MUTATION_TOOLS.has(toolName)) return;
-  if (typeof input.path !== 'string' || !input.path.trim()) {
-    return `${toolName} must name a path inside the reviewed repository root`;
-  }
-
-  const candidate = resolve(dependencies.currentWorkingDirectory(), input.path);
-  const root = resolve(policy.repositoryCwd);
-  if (!pathIsInside(root, candidate)) {
-    return `${toolName} path is outside the reviewed repository root "${policy.repositoryCwd}"`;
-  }
-
-  let canonicalRoot: string;
-  try {
-    if (!dependencies.fileSystem.stat(root).isDirectory()) {
-      throw new Error('not a directory');
-    }
-    canonicalRoot = dependencies.fileSystem.realPath(root);
-  } catch {
-    return `reviewed repository root is not an existing directory: ${policy.repositoryCwd}`;
-  }
-  const canonicalAncestor = nearestCanonicalAncestor(candidate, dependencies);
-  if (
-    canonicalAncestor === undefined ||
-    !pathIsInside(canonicalRoot, canonicalAncestor)
-  ) {
-    return `${toolName} path is outside the reviewed repository root "${policy.repositoryCwd}"`;
-  }
-  return;
-};