@xingular/harness 1.1.1 → 1.3.1-unstable.0

package/dist/sdk/core/workspaceSandbox.js

@@ -0,0 +1,360 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { accessSync, constants, existsSync, lstatSync, mkdtempSync, realpathSync, readdirSync, rmSync, statSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { hostShell, shellArguments } from "./shell.js";
+import { isWithinWorkspace, verifyWorkspaceRoot } from "./workspace.js";
+const MARKER_PREFIX = '__XINGULAR_WORKSPACE_SANDBOX_STARTED_';
+const bashWriteScope = new AsyncLocalStorage();
+export function runWithWorkspaceWriteScope(scope, action) {
+    return bashWriteScope.run(scope, action);
+}
+/** Why a Windows command asks first: Windows has no write-boundary sandbox the harness can use. */
+export const WINDOWS_UNSANDBOXED_REASON = 'Windows has no workspace write-boundary sandbox, so this command would run without one. It will not run until this one-call request is approved.';
+const SANDBOX_BACKENDS = {
+    darwin: ['/usr/bin/sandbox-exec'],
+    linux: ['/usr/bin/bwrap', '/bin/bwrap']
+};
+/**
+ * The operating system's write-boundary sandbox for this platform, or null when it is not
+ * installed. Bash cannot run without it, so readiness diagnostics report it before a command runs.
+ */
+export function workspaceSandboxBackend(platform = process.platform) {
+    const candidates = SANDBOX_BACKENDS[platform];
+    return candidates ? systemExecutable(candidates) : null;
+}
+function systemExecutable(candidates) {
+    for (const candidate of candidates) {
+        try {
+            accessSync(candidate, constants.X_OK);
+            if (statSync(candidate).isFile())
+                return candidate;
+        }
+        catch {
+            // Keep looking only at known system locations.
+        }
+    }
+    return null;
+}
+function shellPath() {
+    const shell = ['/bin/bash', '/usr/bin/bash'].find((candidate) => existsSync(candidate));
+    if (!shell)
+        throw new Error('The workspace write-boundary sandbox requires Bash, but no Bash executable was found.');
+    return shell;
+}
+function requireShell(resolve) {
+    const shell = resolve();
+    if (!shell) {
+        throw new Error(process.platform === 'win32'
+            ? 'No shell was found: neither Git Bash nor PowerShell is available. Bash was not run.'
+            : 'No Bash executable was found. Bash was not run.');
+    }
+    return shell;
+}
+function unconfinedCommand(shell, command) {
+    return { executable: shell.executable, args: shellArguments(shell, command), marker: '' };
+}
+function sbplString(value) {
+    return `"${value.replaceAll('\\', '\\\\').replaceAll('"', '\\"').replaceAll('\n', '\\n')}"`;
+}
+// Read-only commands need no mach services; denying them all keeps a command from acting through
+// system daemons (preferences, Apple Events, Launch Services), which the file rules do not cover.
+function macReadOnlyProfile(tempRoot) {
+    return [
+        '(version 1)',
+        '(deny default)',
+        '(allow file-read*)',
+        `(allow file-write* (subpath ${sbplString(tempRoot)}))`,
+        '(allow file-write* (literal "/dev/null"))',
+        '(allow file-write* (literal "/dev/tty"))',
+        '(deny file-link)',
+        '(allow process-fork)',
+        '(allow process-exec)',
+        '(allow signal (target same-sandbox))',
+        '(allow sysctl-read)'
+    ].join('');
+}
+function macSandboxProfile(writeRoots) {
+    return [
+        '(version 1)',
+        '(deny default)',
+        '(allow file-read*)',
+        ...writeRoots.map((root) => `(allow file-write* (subpath ${sbplString(root)}))`),
+        '(allow file-write* (literal "/dev/null"))',
+        '(allow file-write* (literal "/dev/tty"))',
+        '(deny file-link)',
+        '(allow process*)',
+        '(allow network*)',
+        '(allow sysctl-read)',
+        '(allow mach-lookup)'
+    ].join('');
+}
+export function workspaceSandboxCommand(platform, workspaceRoot, cwd, command, additionalWriteRoots = [], readOnlyTempRoot = null) {
+    const shell = shellPath();
+    const marker = `${MARKER_PREFIX}${randomUUID()}__`;
+    const wrappedCommand = `printf '%s\\n' '${marker}'\n${command}`;
+    if (readOnlyTempRoot !== null)
+        return readOnlySandboxCommand(platform, realpathSync(readOnlyTempRoot), cwd, shell, wrappedCommand, marker);
+    const writeRoots = [...new Set([workspaceRoot, ...additionalWriteRoots].map((root) => realpathSync(root)))].sort((left, right) => left.length - right.length);
+    if (platform === 'darwin') {
+        const executable = workspaceSandboxBackend(platform);
+        if (!executable)
+            throw new Error('Workspace write-boundary sandbox unavailable: sandbox-exec was not found. Bash was not run.');
+        return { executable, args: ['-p', macSandboxProfile(writeRoots), shell, '-c', wrappedCommand], marker };
+    }
+    if (platform === 'linux') {
+        const executable = workspaceSandboxBackend(platform);
+        if (!executable)
+            throw new Error('Workspace write-boundary sandbox unavailable: install bubblewrap (bwrap). Bash was not run.');
+        return {
+            executable,
+            marker,
+            args: [
+                '--die-with-parent', '--new-session', '--unshare-pid',
+                '--ro-bind', '/', '/',
+                '--dev', '/dev',
+                '--proc', '/proc',
+                ...writeRoots.flatMap((root) => ['--bind', root, root]),
+                '--chdir', cwd,
+                shell, '-c', wrappedCommand
+            ]
+        };
+    }
+    throw new Error(`Workspace write-boundary sandbox unavailable on ${platform}. Bash was not run.`);
+}
+function readOnlySandboxCommand(platform, tempRoot, cwd, shell, wrappedCommand, marker) {
+    if (platform === 'darwin') {
+        const executable = workspaceSandboxBackend(platform);
+        if (!executable)
+            throw new Error('Read-only Bash sandbox unavailable: sandbox-exec was not found. Bash was not run.');
+        return { executable, args: ['-p', macReadOnlyProfile(tempRoot), shell, '-c', wrappedCommand], marker };
+    }
+    if (platform === 'linux') {
+        const executable = workspaceSandboxBackend(platform);
+        if (!executable)
+            throw new Error('Read-only Bash sandbox unavailable: install bubblewrap (bwrap). Bash was not run.');
+        return {
+            executable,
+            marker,
+            args: [
+                '--die-with-parent', '--new-session', '--unshare-pid', '--unshare-net', '--unshare-ipc',
+                '--ro-bind', '/', '/',
+                '--dev', '/dev',
+                '--proc', '/proc',
+                // No session bus or other host sockets under /run.
+                '--tmpfs', '/run',
+                '--bind', tempRoot, tempRoot,
+                '--chdir', cwd,
+                shell, '-c', wrappedCommand
+            ]
+        };
+    }
+    throw new Error(`Read-only Bash sandbox unavailable on ${platform}. Bash was not run.`);
+}
+function killProcess(child) {
+    if (child.pid && process.platform === 'win32') {
+        // Git Bash and PowerShell start their own children; end the whole tree.
+        spawnSync('taskkill', ['/pid', String(child.pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true });
+        return;
+    }
+    if (child.pid) {
+        try {
+            process.kill(-child.pid, 'SIGKILL');
+            return;
+        }
+        catch {
+            // Fall back to the direct child if it has already left its process group.
+        }
+    }
+    child.kill('SIGKILL');
+}
+function runProcess(spec, cwd, options, marker) {
+    if (options.signal?.aborted)
+        return Promise.reject(new Error('aborted'));
+    return new Promise((resolve, reject) => {
+        const child = spawn(spec.executable, spec.args, {
+            cwd,
+            detached: process.platform !== 'win32',
+            env: options.env ?? process.env,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            windowsHide: true
+        });
+        let pending = '';
+        let started = marker === null;
+        let timedOut = false;
+        let settled = false;
+        let timeoutHandle;
+        const deliver = (chunk) => {
+            const text = chunk.toString('utf8');
+            if (!started && marker) {
+                pending += text;
+                const markerAt = pending.indexOf(marker);
+                if (markerAt === -1) {
+                    // Preserve only a short prefix in case the shell emitted a startup warning.
+                    if (pending.length > marker.length + 2048) {
+                        options.onData(Buffer.from(pending.slice(0, pending.length - marker.length - 2048)));
+                        pending = pending.slice(-(marker.length + 2048));
+                    }
+                    return;
+                }
+                const before = pending.slice(0, markerAt);
+                const after = pending.slice(markerAt + marker.length).replace(/^\r?\n/u, '');
+                if (before)
+                    options.onData(Buffer.from(before));
+                if (after)
+                    options.onData(Buffer.from(after));
+                pending = '';
+                started = true;
+                return;
+            }
+            options.onData(chunk);
+        };
+        const finish = (code) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timeoutHandle)
+                clearTimeout(timeoutHandle);
+            options.signal?.removeEventListener('abort', onAbort);
+            if (!started && pending)
+                options.onData(Buffer.from(pending));
+            if (options.signal?.aborted)
+                reject(new Error('aborted'));
+            else if (timedOut)
+                reject(new Error(`timeout:${options.timeout}`));
+            else
+                resolve({ exitCode: code });
+        };
+        const onAbort = () => killProcess(child);
+        if (options.timeout !== undefined && options.timeout > 0) {
+            timeoutHandle = setTimeout(() => {
+                timedOut = true;
+                killProcess(child);
+            }, options.timeout * 1000);
+        }
+        options.signal?.addEventListener('abort', onAbort, { once: true });
+        child.stdout?.on('data', deliver);
+        child.stderr?.on('data', deliver);
+        child.once('error', (error) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timeoutHandle)
+                clearTimeout(timeoutHandle);
+            options.signal?.removeEventListener('abort', onAbort);
+            reject(error);
+        });
+        child.once('close', finish);
+    });
+}
+function assertNoExternalHardlinks(workspaceRoot) {
+    const inodes = new Map();
+    const visit = (directory) => {
+        let entries;
+        try {
+            entries = readdirSync(directory, { withFileTypes: true });
+        }
+        catch (error) {
+            throw new Error(`Workspace hard-link inspection failed at ${directory}; Bash was not run: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        for (const entry of entries) {
+            const path = `${directory}/${entry.name}`;
+            let stats;
+            try {
+                stats = lstatSync(path);
+            }
+            catch (error) {
+                throw new Error(`Workspace hard-link inspection failed at ${path}; Bash was not run: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            if (stats.isSymbolicLink())
+                continue;
+            if (stats.isDirectory()) {
+                visit(path);
+                continue;
+            }
+            if (!stats.isFile())
+                continue;
+            const key = `${stats.dev}:${stats.ino}`;
+            const inode = inodes.get(key);
+            if (inode)
+                inode.internalLinks += 1;
+            else
+                inodes.set(key, { internalLinks: 1, totalLinks: stats.nlink, samplePath: path });
+        }
+    };
+    visit(workspaceRoot);
+    for (const inode of inodes.values()) {
+        if (inode.totalLinks > inode.internalLinks) {
+            throw new Error(`Workspace write-boundary sandbox cannot safely run Bash because ${inode.samplePath} has a hard-link alias outside the workspace; remove the alias or replace the file with a copy.`);
+        }
+    }
+}
+export function createWorkspaceBashOperations(workspaceRoot, options = {}) {
+    return {
+        async exec(command, cwd, execOptions) {
+            const rootValue = typeof workspaceRoot === 'function' ? workspaceRoot() : workspaceRoot;
+            if (!rootValue)
+                throw new Error('The active project workspace is not available. Bash was not run.');
+            const root = verifyWorkspaceRoot(rootValue);
+            const canonicalCwd = realpathSync(cwd);
+            if (!isWithinWorkspace(root, canonicalCwd))
+                throw new Error('The Bash working directory is outside the active project workspace.');
+            const scope = options.workspaceWriteScope?.() ?? bashWriteScope.getStore() ?? 'workspace';
+            const platform = options.platform ?? process.platform;
+            const shell = options.shell ?? hostShell;
+            // Nothing widens a read-only scope: no Full Permission bypass, no outside request.
+            if (scope === 'read-only') {
+                if (platform === 'win32')
+                    throw new Error('Plan-mode Bash needs a read-only sandbox, which Windows does not have. Bash was not run.');
+                const tempRoot = realpathSync(mkdtempSync(join(tmpdir(), 'harness-read-only-bash-')));
+                try {
+                    const spec = workspaceSandboxCommand(platform, root, canonicalCwd, command, [], tempRoot);
+                    const env = { ...(execOptions.env ?? process.env), TMPDIR: tempRoot };
+                    const result = await runProcess(spec, canonicalCwd, { ...execOptions, env }, spec.marker);
+                    return { exitCode: result.exitCode };
+                }
+                finally {
+                    rmSync(tempRoot, { recursive: true, force: true });
+                }
+            }
+            let bypass = false;
+            try {
+                bypass = await options.bypassWorkspaceBoundary?.({ command, cwd: canonicalCwd, workspaceRoot: root }) ?? false;
+            }
+            catch {
+                bypass = false;
+            }
+            if (bypass) {
+                const result = await runProcess(unconfinedCommand(requireShell(shell), command), canonicalCwd, execOptions, null);
+                return { exitCode: result.exitCode };
+            }
+            // Without a sandbox every Windows command is an outside request: a person approves it once.
+            if (scope === 'outside' || platform === 'win32') {
+                const resolved = requireShell(shell);
+                const reason = scope === 'outside'
+                    ? 'This command requests filesystem writes outside the active project workspace. It will not run until this one-call request is approved.'
+                    : WINDOWS_UNSANDBOXED_REASON;
+                let approved = false;
+                try {
+                    approved = await options.requestWorkspaceWriteScope?.({ command, cwd: canonicalCwd, workspaceRoot: root, reason }) ?? false;
+                }
+                catch {
+                    approved = false;
+                }
+                if (!approved)
+                    throw new Error(`${reason} Bash was not run.`);
+                if (scope === 'outside')
+                    execOptions.onData(Buffer.from('\n[Outside-workspace writes approved for this command; running once.]\n'));
+                const result = await runProcess(unconfinedCommand(resolved, command), canonicalCwd, execOptions, null);
+                return { exitCode: result.exitCode };
+            }
+            assertNoExternalHardlinks(root);
+            const spec = workspaceSandboxCommand(platform, root, canonicalCwd, command);
+            const result = await runProcess(spec, canonicalCwd, execOptions, spec.marker);
+            return { exitCode: result.exitCode };
+        }
+    };
+}

package/dist/sdk/core/workspaceWriteOperations.d.ts

@@ -0,0 +1,33 @@
+export interface WorkspaceWriteAuthorization {
+    workspaceRoot: string;
+    cwd: string;
+    path: string;
+    outside: boolean;
+    authorized: boolean;
+    expectedContentHash?: string;
+    signal?: AbortSignal;
+}
+export interface AtomicWriteLaunch {
+    executable: string;
+    args: string[];
+    env: NodeJS.ProcessEnv;
+}
+/**
+ * How the atomic write helper starts. macOS and Linux run it inside the write-boundary sandbox.
+ * Windows has none, so Node runs the helper directly; the target was still canonicalized and
+ * authorized, and the rename replaces the directory entry rather than writing through an alias.
+ */
+export declare function atomicWriteLaunch(platform: NodeJS.Platform, root: string, additionalRoots: readonly string[]): AtomicWriteLaunch;
+declare function writeWorkspaceFile(path: string, content: string): Promise<void>;
+export declare const workspaceWriteOperations: {
+    mkdir: (_directory: string) => Promise<void>;
+    writeFile: typeof writeWorkspaceFile;
+};
+export declare const workspaceEditOperations: {
+    access: (path: string) => Promise<void>;
+    readFile: (path: string) => Promise<Buffer>;
+    writeFile: typeof writeWorkspaceFile;
+};
+/** Binds one policy-approved path and abort signal to Pi's native write/edit operation. */
+export declare function withWorkspaceWriteAuthorization<T>(tool: T, authorizations: Map<string, WorkspaceWriteAuthorization>): T;
+export {};

package/dist/sdk/core/workspaceWriteOperations.js

@@ -0,0 +1,224 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { constants as fsConstants, realpathSync, statSync } from 'node:fs';
+import { access, readFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { isWithinWorkspace, resolveWritePath, verifyWorkspaceRoot } from "./workspace.js";
+import { workspaceSandboxCommand } from "./workspaceSandbox.js";
+const writeAuthorization = new AsyncLocalStorage();
+const atomicWriteScript = `
+const fs = require('node:fs')
+const path = require('node:path')
+const crypto = require('node:crypto')
+const input = JSON.parse(fs.readFileSync(0, 'utf8'))
+const target = input.path
+const parent = path.dirname(target)
+fs.mkdirSync(parent, { recursive: true })
+let mode = 0o666
+let preserveMode = false
+try {
+  const existing = fs.lstatSync(target)
+  if (existing.isSymbolicLink() || !existing.isFile()) throw new Error('The write target is not a regular file.')
+  fs.accessSync(target, fs.constants.W_OK)
+  if (input.expectedContentHash) {
+    const current = fs.readFileSync(target)
+    if (crypto.createHash('sha256').update(current).digest('hex') !== input.expectedContentHash) {
+      throw new Error('The file changed after the edit tool read it; retry against the current contents.')
+    }
+  }
+  mode = existing.mode & 0o7777
+  preserveMode = true
+} catch (error) {
+  if (error && error.code !== 'ENOENT') throw error
+}
+const temporary = path.join(parent, '.' + path.basename(target) + '.' + process.pid + '.' + crypto.randomBytes(8).toString('hex') + '.tmp')
+let descriptor
+try {
+  descriptor = fs.openSync(temporary, 'wx', mode)
+  fs.writeFileSync(descriptor, input.content, 'utf8')
+  if (preserveMode) fs.fchmodSync(descriptor, mode)
+  fs.fsyncSync(descriptor)
+  fs.closeSync(descriptor)
+  descriptor = undefined
+  fs.renameSync(temporary, target)
+  try {
+    const directory = fs.openSync(parent, 'r')
+    try { fs.fsyncSync(directory) } finally { fs.closeSync(directory) }
+  } catch {}
+} catch (error) {
+  if (descriptor !== undefined) fs.closeSync(descriptor)
+  try { fs.unlinkSync(temporary) } catch {}
+  throw error
+}
+`;
+/**
+ * How the atomic write helper starts. macOS and Linux run it inside the write-boundary sandbox.
+ * Windows has none, so Node runs the helper directly; the target was still canonicalized and
+ * authorized, and the rename replaces the directory entry rather than writing through an alias.
+ */
+export function atomicWriteLaunch(platform, root, additionalRoots) {
+    if (platform === 'win32') {
+        // Node needs SystemRoot to start on Windows; keep only what the helper requires.
+        const env = {};
+        for (const name of ['SystemRoot', 'windir', 'TEMP', 'TMP', 'USERPROFILE']) {
+            if (process.env[name])
+                env[name] = process.env[name];
+        }
+        return { executable: process.execPath, args: ['-e', atomicWriteScript], env };
+    }
+    const command = `exec ${shellQuote(process.execPath)} -e ${shellQuote(atomicWriteScript)}`;
+    const spec = workspaceSandboxCommand(platform, root, root, command, additionalRoots);
+    return {
+        executable: spec.executable,
+        args: spec.args,
+        env: { PATH: '/usr/bin:/bin', ...(process.env.HOME ? { HOME: process.env.HOME } : {}) }
+    };
+}
+function shellQuote(value) {
+    return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function nearestExistingDirectory(path) {
+    let current = dirname(path);
+    while (true) {
+        try {
+            const canonical = realpathSync(current);
+            if (!statSync(canonical).isDirectory())
+                throw new Error(`Write scope is not a directory: ${canonical}`);
+            return canonical;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            const parent = dirname(current);
+            if (parent === current)
+                throw new Error(`Could not find a writable parent for ${path}.`);
+            current = parent;
+        }
+    }
+}
+function killProcess(child) {
+    if (child.pid && process.platform !== 'win32') {
+        try {
+            process.kill(-child.pid, 'SIGKILL');
+            return;
+        }
+        catch {
+            // Fall back to the direct child if it has already left its process group.
+        }
+    }
+    child.kill('SIGKILL');
+}
+async function runAtomicWrite(authorization, path, content) {
+    const root = verifyWorkspaceRoot(authorization.workspaceRoot);
+    const canonicalPath = resolveWritePath(path, authorization.cwd);
+    if (canonicalPath !== authorization.path)
+        throw new Error('The write target changed after workspace approval; the write was blocked.');
+    const outside = !isWithinWorkspace(root, canonicalPath);
+    if (outside !== authorization.outside || (outside && !authorization.authorized)) {
+        throw new Error('The write authorization no longer matches the active workspace target.');
+    }
+    const additionalRoots = outside ? [nearestExistingDirectory(canonicalPath)] : [];
+    const launch = atomicWriteLaunch(process.platform, root, additionalRoots);
+    await new Promise((resolvePromise, rejectPromise) => {
+        const child = spawn(launch.executable, launch.args, {
+            cwd: root,
+            detached: process.platform !== 'win32',
+            env: launch.env,
+            stdio: ['pipe', 'pipe', 'pipe'],
+            windowsHide: true
+        });
+        const output = [];
+        let outputBytes = 0;
+        let settled = false;
+        const timeout = setTimeout(() => {
+            killProcess(child);
+            finish(new Error('Workspace-contained atomic write timed out.'));
+        }, 30_000);
+        const capture = (chunk) => {
+            if (outputBytes >= 8_192)
+                return;
+            const remaining = 8_192 - outputBytes;
+            output.push(chunk.subarray(0, remaining));
+            outputBytes += Math.min(chunk.length, remaining);
+        };
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeout);
+            authorization.signal?.removeEventListener('abort', abort);
+            if (error)
+                rejectPromise(error);
+            else
+                resolvePromise();
+        };
+        const abort = () => {
+            killProcess(child);
+            finish(new Error('Workspace-contained atomic write was aborted.'));
+        };
+        authorization.signal?.addEventListener('abort', abort, { once: true });
+        if (authorization.signal?.aborted) {
+            abort();
+            return;
+        }
+        child.stdout?.on('data', capture);
+        child.stderr?.on('data', capture);
+        child.once('error', (error) => finish(error));
+        child.once('close', (code) => {
+            if (code === 0) {
+                finish();
+                return;
+            }
+            const detail = Buffer.concat(output).toString('utf8').trim();
+            finish(new Error(`Workspace-contained atomic write failed${detail ? `: ${detail.slice(-2000)}` : ` with exit code ${code ?? 'unknown'}`}.`));
+        });
+        child.stdin?.on('error', () => { });
+        child.stdin?.end(JSON.stringify({
+            path: canonicalPath,
+            content,
+            ...(authorization.expectedContentHash ? { expectedContentHash: authorization.expectedContentHash } : {})
+        }));
+    });
+}
+async function writeWorkspaceFile(path, content) {
+    const authorization = writeAuthorization.getStore();
+    if (!authorization?.authorized)
+        throw new Error('The file write has no current workspace authorization.');
+    await runAtomicWrite(authorization, path, content);
+}
+export const workspaceWriteOperations = {
+    mkdir: async (_directory) => { },
+    writeFile: writeWorkspaceFile
+};
+export const workspaceEditOperations = {
+    access: async (path) => access(path, fsConstants.R_OK | fsConstants.W_OK),
+    readFile: async (path) => {
+        const content = await readFile(path);
+        const authorization = writeAuthorization.getStore();
+        if (authorization && resolve(path) === authorization.path) {
+            authorization.expectedContentHash = createHash('sha256').update(content).digest('hex');
+        }
+        return content;
+    },
+    writeFile: writeWorkspaceFile
+};
+/** Binds one policy-approved path and abort signal to Pi's native write/edit operation. */
+export function withWorkspaceWriteAuthorization(tool, authorizations) {
+    const native = tool;
+    const execute = native.execute.bind(tool);
+    return {
+        ...tool,
+        execute: (...args) => {
+            const toolCallId = String(args[0] ?? '');
+            const authorization = authorizations.get(toolCallId);
+            authorizations.delete(toolCallId);
+            if (!authorization?.authorized)
+                throw new Error('The file write has no current workspace authorization.');
+            const signal = args[2];
+            if (signal && typeof signal === 'object' && 'aborted' in signal)
+                authorization.signal = signal;
+            return writeAuthorization.run(authorization, () => execute(...args));
+        }
+    };
+}