@wjarka/cezarion 0.10.0-pr30.54

package/dist/workspace/agent-profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-profiles.js","sourceRoot":"","sources":["../../src/workspace/agent-profiles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAE5E,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,YAAY,GAGb,MAAM,qBAAqB,CAAC;AAwB7B;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAoB,EACpB,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAC7G,OAAO;QACL,EAAE,EAAE,wBAAwB;QAC5B,QAAQ;QACR,KAAK,EAAE,SAAS;QAChB,SAAS,EAAE,IAAI;QACf,IAAI;QACJ,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,oBAAoB,CAAC,OAAqB;IACxD,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,SAAS,EAAE,KAAK;KACjB,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,mBAAmB,CACjC,KAA0C,EAC1C,QAAoB,EACpB,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO;QACL,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC;QAClC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC;KACnF,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAC/B,KAA0C,EAC1C,SAAgC,EAChC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAwB,EACxB,OAAiG;IAEjG,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,MAAM,GAAG,SAAS,IAAI,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,wBAAwB;QAAE,OAAO,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC3G,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACtF,OAAO,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAA4B,EAC5B,QAAoB,EACpB,SAAkB,EAClB,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,KAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,iGAAiG;IACjG,iFAAiF;IACjF,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAoB,EACpB,IAAY;IAEZ,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,CAAS,EAAE,CAAS;IACvD,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/workspace/config.d.ts

@@ -0,0 +1,169 @@
+import { z } from 'zod';
+/**
+ * `~/.cezar/config.json` — the per-user workspace config + project registry
+ * (spec 2026-07-20-multi-project-workspace). House rules from the spec's Data
+ * Model, applied verbatim:
+ *
+ * - every field optional/defaulted with `.catch`, so a bad value degrades
+ *   per-key instead of discarding the file;
+ * - `.passthrough()` at every object level, so keys a *newer* cezar wrote
+ *   survive a round-trip through an older one;
+ * - `.max()` bounds on strings (this file is parsed on every boot);
+ * - atomic tmp+rename writes with mode `0600` (dir `0700`);
+ * - a corrupt file degrades to in-memory defaults plus ONE warning line — the
+ *   registry rebuilds as projects are opened, so losing it is an
+ *   inconvenience, not data loss. The corrupt file is left in place until the
+ *   next successful merge-write replaces it.
+ */
+/** `id` slug rule — mirrors the spec: `^[a-z0-9][a-z0-9-]{0,63}$`. */
+export declare const PROJECT_ID_RE: RegExp;
+/**
+ * One registry entry. `id` + `root` are load-bearing (an entry without them is
+ * useless and gets dropped by the per-entry salvage below); the display fields
+ * degrade per-key so one bad value never evicts the project.
+ */
+declare const workspaceProjectSchema: z.ZodObject<{
+    id: z.ZodString;
+    root: z.ZodString;
+    name: z.ZodCatch<z.ZodString>;
+    addedAt: z.ZodCatch<z.ZodString>;
+    lastOpenedAt: z.ZodCatch<z.ZodString>;
+    source: z.ZodCatch<z.ZodEnum<{
+        checkout: "checkout";
+        local: "local";
+    }>>;
+    maxParallel: z.ZodCatch<z.ZodOptional<z.ZodNumber>>;
+    tags: z.ZodCatch<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+}, z.core.$loose>;
+export type WorkspaceProject = z.infer<typeof workspaceProjectSchema>;
+/**
+ * Zero-config cadence, in minutes, for re-checking a run parked with
+ * `CEZ:MONITORING` (#810). The single source of truth for that default — the
+ * schema below and `WorkspaceSemaphore`'s fallback both read it, so an install
+ * with no `~/.cezar/config.json` and a semaphore built without boot wiring
+ * agree. `null` (explicit park) is a user choice and is never replaced by it.
+ */
+export declare const DEFAULT_MONITORING_WAKE_MINUTES = 5;
+declare const workspaceConfigSchema: z.ZodObject<{
+    schemaVersion: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+    browseRoot: z.ZodCatch<z.ZodDefault<z.ZodString>>;
+    projectsDir: z.ZodCatch<z.ZodDefault<z.ZodString>>;
+    skillsAutoUpdate: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+    modelsLocked: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+    resources: z.ZodCatch<z.ZodPrefault<z.ZodObject<{
+        maxParallel: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+        maxMonitoringSessions: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+        monitoringWakeIntervalMinutes: z.ZodCatch<z.ZodDefault<z.ZodNullable<z.ZodNumber>>>;
+        autoResumeOnUsageLimit: z.ZodCatch<z.ZodDefault<z.ZodBoolean>>;
+        memoryLimitMb: z.ZodCatch<z.ZodDefault<z.ZodNullable<z.ZodNumber>>>;
+        worktreeRetentionDefault: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+    }, z.core.$loose>>>;
+    composerDefaults: z.ZodCatch<z.ZodDefault<z.ZodObject<{
+        autonomous: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+        worktree: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+    }, z.core.$loose>>>;
+    disabledProviders: z.ZodPipe<z.ZodCatch<z.ZodDefault<z.ZodArray<z.ZodUnknown>>>, z.ZodTransform<("claude" | "codex" | "opencode" | "pi")[], unknown[]>>;
+    agentDefaults: z.ZodCatch<z.ZodDefault<z.ZodObject<{
+        runner: z.ZodCatch<z.ZodOptional<z.ZodEnum<{
+            claude: "claude";
+            codex: "codex";
+            opencode: "opencode";
+            pi: "pi";
+        }>>>;
+        models: z.ZodCatch<z.ZodOptional<z.ZodObject<{
+            claude: z.ZodCatch<z.ZodOptional<z.ZodString>>;
+            codex: z.ZodCatch<z.ZodOptional<z.ZodString>>;
+            opencode: z.ZodCatch<z.ZodOptional<z.ZodString>>;
+            pi: z.ZodCatch<z.ZodOptional<z.ZodString>>;
+        }, z.core.$loose>>>;
+    }, z.core.$loose>>>;
+    projects: z.ZodPipe<z.ZodCatch<z.ZodDefault<z.ZodArray<z.ZodUnknown>>>, z.ZodTransform<{
+        [x: string]: unknown;
+        id: string;
+        root: string;
+        name: string;
+        addedAt: string;
+        lastOpenedAt: string;
+        source: "checkout" | "local";
+        maxParallel?: number | undefined;
+        tags?: string[] | undefined;
+    }[], unknown[]>>;
+}, z.core.$loose>;
+export type WorkspaceConfig = z.infer<typeof workspaceConfigSchema>;
+/** Resolve the auto-update preference without mutating or materializing it. */
+export declare function effectiveSkillsAutoUpdate(config: Pick<WorkspaceConfig, 'skillsAutoUpdate'>, env?: NodeJS.ProcessEnv): boolean;
+export declare function effectiveComposerDefault(stored: boolean | undefined, envValue: string | undefined, fallback: boolean): boolean;
+/** The in-memory default — what a missing/corrupt file behaves like. */
+export declare function defaultWorkspaceConfig(): WorkspaceConfig;
+/**
+ * The last-known-good copy of a NON-EMPTY registry, written beside the config
+ * by every successful merge-write. The registry is cheap to rebuild in theory
+ * ("open the project again"), but in practice it is a hand-curated list, and a
+ * single bad write — a crash between `writeFileSync` and `rename`, a full
+ * disk, a stray process — costs the user every entry. One extra file, no
+ * configuration, and `loadWorkspaceConfig` falls back to it.
+ *
+ * Removing `~/.cezar` still resets cezar completely; removing only
+ * `config.json` no longer does, because this snapshot restores it.
+ *
+ * A cezar older than this change does not refresh the snapshot, so on a machine
+ * that alternates between versions it can lag behind the registry — which only
+ * shows if the config file is also lost, and the worst case is a project the
+ * user unregistered reappearing. Cheap next to losing the whole list.
+ */
+export declare function workspaceConfigBackupPath(path?: string): string;
+/**
+ * Read `~/.cezar/config.json` on demand — never cached, never throws. A
+ * missing file is the zero-config default (silent); an unreadable or
+ * malformed one degrades to the same default with a one-line warning and is
+ * left on disk untouched (the next successful merge-write replaces it).
+ *
+ * Before degrading, a missing, empty, or corrupt file is restored from the
+ * `config.json.bak` snapshot when that still holds projects. The restore is
+ * read-only: the recovered registry is handed back in memory and lands on disk
+ * again through the next merge-write, so a read never writes. A file that
+ * parses and simply has no projects is NOT restored — that is a user who
+ * removed their last project, not a lost registry.
+ *
+ * `path` defaults to the current `workspaceConfigPath()`, but a caller that
+ * will also WRITE passes the path it resolved itself — see
+ * `mergeWriteWorkspaceConfig` for why resolving it twice is a data-loss bug.
+ */
+export declare function loadWorkspaceConfig(path?: string): Promise<WorkspaceConfig>;
+/**
+ * The tmp path an atomic write stages through — UNIQUE PER WRITE, never a
+ * fixed `${path}.tmp`. `~/.cezar/` is shared by every cezar process on the
+ * machine (a `serve` per repo, `cezar run`s, a settings PUT), and two writers
+ * staging through the same tmp name interleave: writer B's `O_TRUNC` open can
+ * empty the file between writer A's write and rename, so A renames a
+ * truncated/half-written file into place — and B's own rename then throws
+ * `ENOENT` on the name A consumed. The pid + random suffix gives every writer
+ * its own staging file, so the only cross-process contention left is the
+ * rename itself, which is atomic.
+ */
+export declare function atomicTmpPath(path: string): string;
+/** Atomic JSON write (`0600`, dir `0700`) via a per-writer tmp + rename —
+ *  shared by the workspace config and ui-state writers. Throws on write
+ *  failure (e.g. a read-only home) — degrading is the caller's policy. */
+export declare function atomicWriteJsonSync(path: string, value: unknown): void;
+/**
+ * Read-modify-write merge: re-read the file, apply `mutator`, atomic-rename
+ * write (`0600`, dir `0700`). Because every writer re-reads immediately before
+ * writing, two processes registering different projects converge instead of
+ * dropping each other's entries (last-writer-wins only within the tiny
+ * read→rename window — acceptable for a registry that self-heals on next
+ * boot). The mutator may mutate its argument in place or return a replacement.
+ * Returns the config that was written. Throws on write failure (e.g. a
+ * read-only home) — degrading is the caller's policy, per house rules.
+ *
+ * The path is resolved ONCE, before the `await`, and the same value feeds the
+ * read and the write. Resolving it twice used to lose the whole registry:
+ * `workspaceConfigPath()` re-reads `CEZ_HOME` on every call, so if the variable
+ * changed while the read was in flight — a test's `afterEach` dropping its pin
+ * after a timeout is the way this happens in practice — the read came from one
+ * home and the write landed in another, replacing that file's registry with a
+ * config it never held. One resolution keeps a merge-write inside exactly one
+ * file, whatever the environment does mid-flight.
+ */
+export declare function mergeWriteWorkspaceConfig(mutator: (config: WorkspaceConfig) => WorkspaceConfig | void): Promise<WorkspaceConfig>;
+export {};

package/dist/workspace/config.js

@@ -0,0 +1,379 @@
+import { randomBytes } from 'node:crypto';
+import { chmodSync, mkdirSync, renameSync, writeFileSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { z } from 'zod';
+// Contract VALUES, like `workspaceUiStateSchema` in workspace/migrations.ts: the tag bounds this
+// file must not `.catch` away are the same constants the PATCH route validates against, so they
+// are imported rather than repeated.
+import { PROJECT_TAGS_MAX, PROJECT_TAG_MAX_LENGTH } from '../contract/index.js';
+import { PROVIDER_IDS } from '../core/provider-auth.js';
+import { assertCezarHomeWriteIsSandboxed, workspaceConfigPath } from '../paths.js';
+/**
+ * `~/.cezar/config.json` — the per-user workspace config + project registry
+ * (spec 2026-07-20-multi-project-workspace). House rules from the spec's Data
+ * Model, applied verbatim:
+ *
+ * - every field optional/defaulted with `.catch`, so a bad value degrades
+ *   per-key instead of discarding the file;
+ * - `.passthrough()` at every object level, so keys a *newer* cezar wrote
+ *   survive a round-trip through an older one;
+ * - `.max()` bounds on strings (this file is parsed on every boot);
+ * - atomic tmp+rename writes with mode `0600` (dir `0700`);
+ * - a corrupt file degrades to in-memory defaults plus ONE warning line — the
+ *   registry rebuilds as projects are opened, so losing it is an
+ *   inconvenience, not data loss. The corrupt file is left in place until the
+ *   next successful merge-write replaces it.
+ */
+/** `id` slug rule — mirrors the spec: `^[a-z0-9][a-z0-9-]{0,63}$`. */
+export const PROJECT_ID_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
+/**
+ * One registry entry. `id` + `root` are load-bearing (an entry without them is
+ * useless and gets dropped by the per-entry salvage below); the display fields
+ * degrade per-key so one bad value never evicts the project.
+ */
+const workspaceProjectSchema = z
+    .object({
+    /** Unique slug — URL segment, sidebar key, worktree namespace. */
+    id: z.string().regex(PROJECT_ID_RE),
+    /** Absolute, realpath-normalized repo root (normalization is the writer's
+     *  job — `registerProject` in step 1.3; the schema only demands absolute). */
+    root: z.string().min(1).max(4096).refine((p) => p.startsWith('/'), 'root must be absolute'),
+    /** Display name (basename by default). `''` = caller derives a fallback. */
+    name: z.string().max(200).catch(''),
+    addedAt: z.string().max(64).catch(''),
+    lastOpenedAt: z.string().max(64).catch(''),
+    source: z.enum(['local', 'checkout']).catch('local'),
+    /** Per-project cap on concurrently running tasks. Absent = inherit the
+     *  workspace `resources.maxParallel`. Bounded like the workspace cap; a bad
+     *  value degrades to "inherit" (`.catch(undefined)`) rather than a hard
+     *  default, and `.passthrough()` preserves the key across cezar round-trips. */
+    maxParallel: z.number().int().min(1).max(16).optional().catch(undefined),
+    /** Free-form labels grouping connected repositories (`storefront`, `infra`), used by the
+     *  global Tasks page to filter and group across projects. Absent = untagged; the writers
+     *  (`PATCH /api/projects/:id`, `cezar projects tag`) delete the key rather than storing `[]`,
+     *  so an untagged project costs nothing in the file. Bounds mirror the PATCH schema exactly,
+     *  so a value that route accepts can never be degraded away by the next load's `.catch`. */
+    tags: z
+        .array(z.string().trim().min(1).max(PROJECT_TAG_MAX_LENGTH))
+        .max(PROJECT_TAGS_MAX)
+        .optional()
+        .catch(undefined),
+})
+    .passthrough();
+/**
+ * Zero-config cadence, in minutes, for re-checking a run parked with
+ * `CEZ:MONITORING` (#810). The single source of truth for that default — the
+ * schema below and `WorkspaceSemaphore`'s fallback both read it, so an install
+ * with no `~/.cezar/config.json` and a semaphore built without boot wiring
+ * agree. `null` (explicit park) is a user choice and is never replaced by it.
+ */
+export const DEFAULT_MONITORING_WAKE_MINUTES = 5;
+const resourcesSchema = z
+    .object({
+    /** Workspace-wide parallel-task cap (moved from per-repo config.json). */
+    maxParallel: z.number().int().min(1).max(16).default(2).catch(2),
+    /** Extra durable `CEZ:MONITORING` sessions exempt from the active-task cap. */
+    maxMonitoringSessions: z.number().int().min(0).max(16).default(2).catch(2),
+    /**
+     * Cadence for re-checking monitored work; `null` parks at zero model cost until a
+     * user (or an external integration) resumes the session.
+     *
+     * Default-ON at 5 minutes (#810). It shipped as `null` and that made monitoring a
+     * dead end: #661 removed the 15-minute idle timer that used to bound a parked
+     * monitor, so with no wake timer a `CEZ:MONITORING` run has NO timer at all — and
+     * cezar has no other resume path (no process-exit callback, no CI webhook, no
+     * sub-agent-completion event). Tasks sat in `monitoring` for hours until a human
+     * typed something. Same reasoning as `autoResumeOnUsageLimit` below: it spends
+     * nothing while the downstream work is genuinely pending and it finishes the work
+     * the user already asked for. `MAX_AUTO_CONTINUES` still caps a forgotten loop, and
+     * an explicit `null` (Settings → Resources → "Park until resumed") is preserved.
+     */
+    monitoringWakeIntervalMinutes: z
+        .number()
+        .int()
+        .min(1)
+        .max(60)
+        .nullable()
+        .default(DEFAULT_MONITORING_WAKE_MINUTES)
+        .catch(DEFAULT_MONITORING_WAKE_MINUTES),
+    /**
+     * Resume a task the provider's usage limit stopped, once that limit resets
+     * (spec 2026-08-03-auto-resume-after-usage-limit). ON by default, which is the one
+     * cost-bearing automation in this file that is: it spends nothing while it waits, and it
+     * finishes the work the user already asked for rather than starting any of its own. Switching
+     * it off leaves the run `failed` with its Continue button, exactly as before the feature.
+     */
+    autoResumeOnUsageLimit: z.boolean().default(true).catch(true),
+    /** Per-task memory ceiling in MiB; null = no limit (matches the file's
+     *  literal `"memoryLimitMb": null` in the spec's Data Model). */
+    memoryLimitMb: z.number().int().min(0).max(1_048_576).nullable().default(null).catch(null),
+    /** Default worktree retention for projects that don't override it. */
+    worktreeRetentionDefault: z.number().int().min(0).max(1000).default(10).catch(10),
+})
+    .passthrough();
+const composerDefaultsSchema = z
+    .object({
+    autonomous: z.boolean().optional().catch(undefined),
+    worktree: z.boolean().optional().catch(undefined),
+})
+    .passthrough();
+/**
+ * What a repo that has said nothing runs (spec 2026-07-29-agent-profiles).
+ *
+ * The point is not to configure every checkout: a repo's own `.ai/cezar/config.json` still wins
+ * key by key, and this is only consulted where that file is SILENT. Which is why every key here is
+ * optional with no default — an absent `runner` has to stay distinguishable from one someone chose,
+ * or "fall back to the machine default" collapses into "always claude".
+ *
+ * Personal and per-machine, like everything else in this file. The repo config is the team's; this
+ * is yours.
+ */
+const agentDefaultsSchema = z
+    .object({
+    runner: z.enum(PROVIDER_IDS).optional().catch(undefined),
+    models: z
+        .object({
+        claude: z.string().trim().min(1).max(200).optional().catch(undefined),
+        codex: z.string().trim().min(1).max(200).optional().catch(undefined),
+        opencode: z.string().trim().min(1).max(200).optional().catch(undefined),
+        pi: z.string().trim().min(1).max(200).optional().catch(undefined),
+    })
+        .passthrough()
+        .optional()
+        .catch(undefined),
+})
+    .passthrough();
+const workspacePathSchema = (envName, fallback) => {
+    const defaultValue = () => process.env[envName]?.trim() || fallback;
+    return z.string().min(1).max(4096).default(defaultValue).catch(defaultValue);
+};
+const providerIdSet = new Set(PROVIDER_IDS);
+const disabledProvidersSchema = z
+    .array(z.unknown())
+    .default(() => [])
+    .catch(() => [])
+    .transform((values) => {
+    const seen = new Set();
+    for (const value of values) {
+        if (typeof value !== 'string' || !providerIdSet.has(value))
+            continue;
+        seen.add(value);
+    }
+    return PROVIDER_IDS.filter((provider) => seen.has(provider));
+});
+const workspaceConfigSchema = z
+    .object({
+    /** Migration cursor (src/workspace/migrations.ts). Absent/bad → 0, which
+     *  means "run every migration" — each one is idempotent, so that is safe. */
+    schemaVersion: z.number().int().min(0).default(0).catch(0),
+    /** Root exposed by the Add project folder browser. Environment supplies
+     *  the zero-config default; an explicit workspace value wins thereafter. */
+    browseRoot: workspacePathSchema('CEZ_BROWSE_ROOT', '~/'),
+    /** Checkout root for GUI-cloned projects. Stored as written (a literal
+     *  `~` is expanded by the checkout flow, not here); validated writable
+     *  when *changed*, never at load. */
+    projectsDir: workspacePathSchema('CEZ_PROJECTS_DIR', '~/cezar/projects'),
+    /** Optional auto-update override. Absence inherits the environment/default
+     *  and must stay absent on unrelated merge-writes. */
+    skillsAutoUpdate: z.boolean().optional().catch(undefined),
+    /** Global opt-in model policy. The native coding-agent model becomes
+     * authoritative while runner choice remains available. */
+    modelsLocked: z.boolean().optional().catch(undefined),
+    // Function-form default/catch: mutators (step 1.3's registerProject) edit
+    // these objects in place, so parses must never share one reference.
+    resources: resourcesSchema.prefault(() => ({})).catch(() => resourcesSchema.parse({})),
+    /** Optional New Task policy. Missing keys inherit exact 0/1 environment seeds. */
+    composerDefaults: composerDefaultsSchema.default(() => ({})).catch(() => ({})),
+    /** Host-wide provider preferences; absent means every provider is enabled. */
+    disabledProviders: disabledProvidersSchema,
+    /** Machine-wide agent/model defaults for repos that set none of their own. */
+    agentDefaults: agentDefaultsSchema.default(() => ({})).catch(() => ({})),
+    /** Per-entry salvage: a corrupt entry is dropped, the rest of the registry
+     *  survives (a whole-array `.catch([])` would evict every project over one
+     *  bad row). */
+    projects: z
+        .array(z.unknown())
+        .default(() => [])
+        .catch(() => [])
+        .transform((entries) => entries.flatMap((entry) => {
+        const parsed = workspaceProjectSchema.safeParse(entry);
+        return parsed.success ? [parsed.data] : [];
+    })),
+})
+    .passthrough();
+/** Resolve the auto-update preference without mutating or materializing it. */
+export function effectiveSkillsAutoUpdate(config, env = process.env) {
+    if (config.skillsAutoUpdate !== undefined)
+        return config.skillsAutoUpdate;
+    if (env.CEZ_SKILLS_AUTO_UPDATE === '0')
+        return false;
+    if (env.CEZ_SKILLS_AUTO_UPDATE === '1')
+        return true;
+    return true;
+}
+export function effectiveComposerDefault(stored, envValue, fallback) {
+    if (stored !== undefined)
+        return stored;
+    if (envValue === '0')
+        return false;
+    if (envValue === '1')
+        return true;
+    return fallback;
+}
+/** The in-memory default — what a missing/corrupt file behaves like. */
+export function defaultWorkspaceConfig() {
+    return workspaceConfigSchema.parse({});
+}
+/**
+ * The last-known-good copy of a NON-EMPTY registry, written beside the config
+ * by every successful merge-write. The registry is cheap to rebuild in theory
+ * ("open the project again"), but in practice it is a hand-curated list, and a
+ * single bad write — a crash between `writeFileSync` and `rename`, a full
+ * disk, a stray process — costs the user every entry. One extra file, no
+ * configuration, and `loadWorkspaceConfig` falls back to it.
+ *
+ * Removing `~/.cezar` still resets cezar completely; removing only
+ * `config.json` no longer does, because this snapshot restores it.
+ *
+ * A cezar older than this change does not refresh the snapshot, so on a machine
+ * that alternates between versions it can lag behind the registry — which only
+ * shows if the config file is also lost, and the worst case is a project the
+ * user unregistered reappearing. Cheap next to losing the whole list.
+ */
+export function workspaceConfigBackupPath(path = workspaceConfigPath()) {
+    return `${path}.bak`;
+}
+function parseWorkspaceConfig(raw) {
+    try {
+        const parsed = workspaceConfigSchema.safeParse(JSON.parse(raw));
+        return parsed.success ? parsed.data : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The snapshot is only worth restoring while it still holds projects — an
+ *  empty one carries no information the defaults do not already have. */
+async function loadWorkspaceConfigBackup(path) {
+    let raw;
+    try {
+        raw = await readFile(workspaceConfigBackupPath(path), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    const parsed = parseWorkspaceConfig(raw);
+    return parsed && parsed.projects.length > 0 ? parsed : null;
+}
+/**
+ * Read `~/.cezar/config.json` on demand — never cached, never throws. A
+ * missing file is the zero-config default (silent); an unreadable or
+ * malformed one degrades to the same default with a one-line warning and is
+ * left on disk untouched (the next successful merge-write replaces it).
+ *
+ * Before degrading, a missing, empty, or corrupt file is restored from the
+ * `config.json.bak` snapshot when that still holds projects. The restore is
+ * read-only: the recovered registry is handed back in memory and lands on disk
+ * again through the next merge-write, so a read never writes. A file that
+ * parses and simply has no projects is NOT restored — that is a user who
+ * removed their last project, not a lost registry.
+ *
+ * `path` defaults to the current `workspaceConfigPath()`, but a caller that
+ * will also WRITE passes the path it resolved itself — see
+ * `mergeWriteWorkspaceConfig` for why resolving it twice is a data-loss bug.
+ */
+export async function loadWorkspaceConfig(path = workspaceConfigPath()) {
+    let raw = null;
+    try {
+        raw = await readFile(path, 'utf8');
+    }
+    catch {
+        // missing/unreadable — the backup below is the next chance
+    }
+    if (raw !== null && raw.trim() !== '') {
+        const parsed = parseWorkspaceConfig(raw);
+        if (parsed)
+            return parsed;
+    }
+    const restored = await loadWorkspaceConfigBackup(path);
+    if (restored) {
+        const cause = raw === null ? 'is missing' : 'is empty or corrupt';
+        console.warn(`[cez] workspace config ${path} ${cause} — restored ${restored.projects.length} project(s) from ${workspaceConfigBackupPath(path)}`);
+        return restored;
+    }
+    if (raw === null)
+        return defaultWorkspaceConfig();
+    console.warn(`[cez] workspace config ${path} is corrupt — using defaults (registry rebuilds)`);
+    return defaultWorkspaceConfig();
+}
+/**
+ * The tmp path an atomic write stages through — UNIQUE PER WRITE, never a
+ * fixed `${path}.tmp`. `~/.cezar/` is shared by every cezar process on the
+ * machine (a `serve` per repo, `cezar run`s, a settings PUT), and two writers
+ * staging through the same tmp name interleave: writer B's `O_TRUNC` open can
+ * empty the file between writer A's write and rename, so A renames a
+ * truncated/half-written file into place — and B's own rename then throws
+ * `ENOENT` on the name A consumed. The pid + random suffix gives every writer
+ * its own staging file, so the only cross-process contention left is the
+ * rename itself, which is atomic.
+ */
+export function atomicTmpPath(path) {
+    return `${path}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+}
+/** Atomic JSON write (`0600`, dir `0700`) via a per-writer tmp + rename —
+ *  shared by the workspace config and ui-state writers. Throws on write
+ *  failure (e.g. a read-only home) — degrading is the caller's policy. */
+export function atomicWriteJsonSync(path, value) {
+    assertCezarHomeWriteIsSandboxed(path);
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const tmp = atomicTmpPath(path);
+    writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    renameSync(tmp, path);
+    try {
+        chmodSync(path, 0o600); // best-effort — ignored on some filesystems
+    }
+    catch {
+        // non-fatal
+    }
+}
+/**
+ * Read-modify-write merge: re-read the file, apply `mutator`, atomic-rename
+ * write (`0600`, dir `0700`). Because every writer re-reads immediately before
+ * writing, two processes registering different projects converge instead of
+ * dropping each other's entries (last-writer-wins only within the tiny
+ * read→rename window — acceptable for a registry that self-heals on next
+ * boot). The mutator may mutate its argument in place or return a replacement.
+ * Returns the config that was written. Throws on write failure (e.g. a
+ * read-only home) — degrading is the caller's policy, per house rules.
+ *
+ * The path is resolved ONCE, before the `await`, and the same value feeds the
+ * read and the write. Resolving it twice used to lose the whole registry:
+ * `workspaceConfigPath()` re-reads `CEZ_HOME` on every call, so if the variable
+ * changed while the read was in flight — a test's `afterEach` dropping its pin
+ * after a timeout is the way this happens in practice — the read came from one
+ * home and the write landed in another, replacing that file's registry with a
+ * config it never held. One resolution keeps a merge-write inside exactly one
+ * file, whatever the environment does mid-flight.
+ */
+export async function mergeWriteWorkspaceConfig(mutator) {
+    const path = workspaceConfigPath();
+    const current = await loadWorkspaceConfig(path);
+    const next = mutator(current) ?? current;
+    atomicWriteJsonSync(path, next);
+    // Refresh the snapshot after EVERY successful write, including an emptied
+    // registry (#731). Skipping the empty case left a stale non-empty backup:
+    // removing the last project, then losing config.json, resurrected the project
+    // the user had deliberately unregistered. An empty snapshot is not restored on
+    // load (see loadWorkspaceConfigBackup), so recovery now settles on the empty
+    // registry the user intended rather than the old projects.
+    try {
+        atomicWriteJsonSync(workspaceConfigBackupPath(path), next);
+    }
+    catch {
+        // Best-effort: the registry itself is already safely on disk, and a
+        // failed snapshot must never turn a successful write into an error.
+    }
+    return next;
+}
+//# sourceMappingURL=config.js.map

package/dist/workspace/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/workspace/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,iGAAiG;AACjG,gGAAgG;AAChG,qCAAqC;AACrC,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,YAAY,EAAmB,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEnF;;;;;;;;;;;;;;;GAeG;AAEH,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAEzD;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,kEAAkE;IAClE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IACnC;kFAC8E;IAC9E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IAC3F,4EAA4E;IAC5E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IACpD;;;oFAGgF;IAChF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACxE;;;;gGAI4F;IAC5F,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;SAC3D,GAAG,CAAC,gBAAgB,CAAC;SACrB,QAAQ,EAAE;SACV,KAAK,CAAC,SAAS,CAAC;CACpB,CAAC;KACD,WAAW,EAAE,CAAC;AAIjB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAEjD,MAAM,eAAe,GAAG,CAAC;KACtB,MAAM,CAAC;IACN,0EAA0E;IAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,+EAA+E;IAC/E,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1E;;;;;;;;;;;;;OAaG;IACH,6BAA6B,EAAE,CAAC;SAC7B,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;SACV,OAAO,CAAC,+BAA+B,CAAC;SACxC,KAAK,CAAC,+BAA+B,CAAC;IACzC;;;;;;OAMG;IACH,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IAC7D;qEACiE;IACjE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IAC1F,sEAAsE;IACtE,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;CAClF,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACnD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CAClD,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB;;;;;;;;;;GAUG;AACH,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACxD,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;QACrE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;QACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;QACvE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;KAClE,CAAC;SACD,WAAW,EAAE;SACb,QAAQ,EAAE;SACV,KAAK,CAAC,SAAS,CAAC;CACpB,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,mBAAmB,GAAG,CAAC,OAA+C,EAAE,QAAgB,EAAE,EAAE;IAChG,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;IACpE,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAC/E,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,YAAY,CAAC,CAAC;AAEpD,MAAM,uBAAuB,GAAG,CAAC;KAC9B,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;KAClB,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;KACjB,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;KACf,SAAS,CAAC,CAAC,MAAM,EAAgB,EAAE;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAc,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACrE,IAAI,CAAC,GAAG,CAAC,KAAmB,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/D,CAAC,CAAC,CAAC;AAEL,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN;iFAC6E;IAC7E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D;gFAC4E;IAC5E,UAAU,EAAE,mBAAmB,CAAC,iBAAiB,EAAE,IAAI,CAAC;IACxD;;yCAEqC;IACrC,WAAW,EAAE,mBAAmB,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IACxE;0DACsD;IACtD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACzD;8DAC0D;IAC1D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACrD,0EAA0E;IAC1E,oEAAoE;IACpE,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtF,kFAAkF;IAClF,gBAAgB,EAAE,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9E,8EAA8E;IAC9E,iBAAiB,EAAE,uBAAuB;IAC1C,8EAA8E;IAC9E,aAAa,EAAE,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACxE;;oBAEgB;IAChB,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;SAClB,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;SACjB,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;SACf,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CACrB,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,CAAC,CAAC,CACH;CACJ,CAAC;KACD,WAAW,EAAE,CAAC;AAIjB,+EAA+E;AAC/E,MAAM,UAAU,yBAAyB,CACvC,MAAiD,EACjD,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC;IAC1E,IAAI,GAAG,CAAC,sBAAsB,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,GAAG,CAAC,sBAAsB,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAA2B,EAC3B,QAA4B,EAC5B,QAAiB;IAEjB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,sBAAsB;IACpC,OAAO,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAI,GAAW,mBAAmB,EAAE;IAC5E,OAAO,GAAG,IAAI,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;yEACyE;AACzE,KAAK,UAAU,yBAAyB,CAAC,IAAY;IACnD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAI,GAAW,mBAAmB,EAAE;IAC5E,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC;QAClE,OAAO,CAAC,IAAI,CACV,0BAA0B,IAAI,IAAI,KAAK,eAAe,QAAQ,CAAC,QAAQ,CAAC,MAAM,oBAAoB,yBAAyB,CAAC,IAAI,CAAC,EAAE,CACpI,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,sBAAsB,EAAE,CAAC;IAClD,OAAO,CAAC,IAAI,CAAC,0BAA0B,IAAI,kDAAkD,CAAC,CAAC;IAC/F,OAAO,sBAAsB,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;AACxE,CAAC;AAED;;0EAE0E;AAC1E,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,KAAc;IAC9D,+BAA+B,CAAC,IAAI,CAAC,CAAC;IACtC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7F,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,4CAA4C;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAA4D;IAE5D,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;IACzC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,0EAA0E;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,2DAA2D;IAC3D,IAAI,CAAC;QACH,mBAAmB,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,oEAAoE;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/workspace/migrations.d.ts

@@ -0,0 +1,45 @@
+export { mergeWriteWorkspaceUiState } from './ui-state.ts';
+/**
+ * Workspace config migrations (spec 2026-07-20-multi-project-workspace,
+ * "Migrations"). Deliberately tiny and **config-files-only** — run state
+ * (`runs.json`, NDJSON) keeps the existing additive-zod convention and never
+ * migrates. Rules, verbatim from the spec:
+ *
+ * - **idempotent** — every migration is safe to re-run after a crash mid-way;
+ * - **additive** — never deletes or rewrites the user's per-repo files;
+ * - **non-blocking** — a failing migration logs ONE warning and boot proceeds
+ *   degraded with in-memory defaults; it is never a boot failure (the
+ *   zero-config law "a read-only home degrades to a smaller cockpit" holds);
+ * - **concurrency-safe** — every write takes the same read-modify-write +
+ *   atomic-rename path as all workspace writes (`mergeWriteWorkspaceConfig`),
+ *   and two processes racing the same idempotent step converge.
+ */
+export interface WorkspaceMigration {
+    /** `schemaVersion` this migration produces. */
+    to: number;
+    /** Stable id for the warning line, e.g. `'001-workspace-config'`. */
+    id: string;
+    /** The migration body — MUST be idempotent (see module docs). */
+    run(ctx: {
+        home: string;
+        bootRepoRoot: string | null;
+    }): Promise<void>;
+}
+/** All known migrations. Kept in ascending `to` order; `runMigrations` sorts
+ *  defensively anyway. */
+export declare const WORKSPACE_MIGRATIONS: readonly WorkspaceMigration[];
+/**
+ * Run every pending workspace migration — called at boot before anything else
+ * touches `~/.cezar`. Reads `schemaVersion` (absent file or key → 0, which
+ * means "run everything" — safe because every migration is idempotent), runs
+ * each migration with `to > current` in ascending order, and persists the new
+ * `schemaVersion` after EACH one, so a crash resumes exactly where it left
+ * off. A failing migration logs ONE warning and stops the chain (later
+ * migrations may depend on earlier ones); boot proceeds degraded on in-memory
+ * defaults. Never throws.
+ *
+ * `migrations` is injectable for tests only; production callers pass nothing.
+ */
+export declare function runMigrations(opts: {
+    bootRepoRoot: string | null;
+}, migrations?: readonly WorkspaceMigration[]): Promise<void>;