agentrinse 0.2.0 → 0.3.0

package/dist/contracts/finding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"finding.d.ts","sourceRoot":"","sources":["../../src/contracts/finding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,kBAAkB;;;;;;EAM7B,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;EAA0D,CAAC;AAE/F,eAAO,MAAM,kBAAkB;;;;;;iBAM7B,CAAC;AAEH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAcxB,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}
+{"version":3,"file":"finding.d.ts","sourceRoot":"","sources":["../../src/contracts/finding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,kBAAkB;;;;;;EAM7B,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;EAA0D,CAAC;AAE/F,eAAO,MAAM,kBAAkB;;;;;;iBAM7B,CAAC;AAEH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAcxB,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}

package/dist/contracts/plan.d.ts

@@ -45,8 +45,31 @@ export declare const cleanupPlanSchema: z.ZodObject<{
             newestMtimeMs: z.ZodNumber;
             fingerprint: z.ZodString;
         }, z.core.$strip>;
+    }, z.core.$strip>, z.ZodObject<{
+        actionId: z.ZodString;
+        type: z.ZodLiteral<"worktree.quarantine">;
+        adapter: z.ZodLiteral<"git">;
+        resourceId: z.ZodString;
+        risk: z.ZodLiteral<"recoverable">;
+        description: z.ZodString;
+        expectedReclaimBytes: z.ZodLiteral<0>;
+        pendingQuarantineBytes: z.ZodNumber;
+        quarantineTtlMinutes: z.ZodNumber;
+        target: z.ZodObject<{
+            path: z.ZodString;
+            repositoryCommonDir: z.ZodString;
+            head: z.ZodString;
+            branch: z.ZodOptional<z.ZodString>;
+            device: z.ZodNumber;
+            inode: z.ZodNumber;
+            mtimeMs: z.ZodNumber;
+            measuredBytes: z.ZodNumber;
+            newestMtimeMs: z.ZodNumber;
+            fingerprint: z.ZodString;
+        }, z.core.$strip>;
     }, z.core.$strip>], "type">>;
     expectedReclaimBytes: z.ZodNumber;
+    pendingQuarantineBytes: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 export type { ActionRisk, PlannedAction } from "./action.js";
 export type CleanupPlan = z.infer<typeof cleanupPlanSchema>;

package/dist/contracts/plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../src/contracts/plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwD1B,CAAC;AAEL,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../src/contracts/plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0E1B,CAAC;AAEL,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/contracts/plan.js

@@ -14,11 +14,13 @@ export const cleanupPlanSchema = z
     auditDigest: z.string().min(1),
     actions: z.array(plannedActionSchema),
     expectedReclaimBytes: z.number().int().nonnegative(),
+    pendingQuarantineBytes: z.number().int().nonnegative().optional(),
 })
     .superRefine((plan, context) => {
     const actionIds = new Set();
     const targetPaths = new Set();
     let expectedReclaimBytes = 0;
+    let pendingQuarantineBytes = 0;
     for (const [index, action] of plan.actions.entries()) {
         if (actionIds.has(action.actionId)) {
             context.addIssue({
@@ -36,7 +38,17 @@ export const cleanupPlanSchema = z
             });
         }
         targetPaths.add(action.target.path);
-        if (action.expectedReclaimBytes !== action.target.measuredBytes) {
+        if (action.type === "worktree.quarantine") {
+            if (action.pendingQuarantineBytes !== action.target.measuredBytes) {
+                context.addIssue({
+                    code: "custom",
+                    message: "quarantine estimate must match the measured target bytes",
+                    path: ["actions", index, "pendingQuarantineBytes"],
+                });
+            }
+            pendingQuarantineBytes += action.pendingQuarantineBytes;
+        }
+        else if (action.expectedReclaimBytes !== action.target.measuredBytes) {
             context.addIssue({
                 code: "custom",
                 message: "action reclaim estimate must match the measured target bytes",
@@ -52,5 +64,12 @@ export const cleanupPlanSchema = z
             path: ["expectedReclaimBytes"],
         });
     }
+    if ((plan.pendingQuarantineBytes ?? 0) !== pendingQuarantineBytes) {
+        context.addIssue({
+            code: "custom",
+            message: "plan pending quarantine bytes must equal the sum of recoverable actions",
+            path: ["pendingQuarantineBytes"],
+        });
+    }
 });
 //# sourceMappingURL=plan.js.map

package/dist/contracts/plan.js.map

@@ -1 +1 @@
-{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/contracts/plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEpE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,WAAW,EAAE,gBAAgB;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACrC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACrD,CAAC;KACD,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAE7B,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,4CAA4C;gBACrD,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,UAAU,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE/B,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,8CAA8C;gBACvD,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEpC,IAAI,MAAM,CAAC,oBAAoB,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAChE,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,8DAA8D;gBACvE,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,sBAAsB,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;QACD,oBAAoB,IAAI,MAAM,CAAC,oBAAoB,CAAC;IACtD,CAAC;IAED,IAAI,oBAAoB,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACvD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,yDAAyD;YAClE,IAAI,EAAE,CAAC,sBAAsB,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/contracts/plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEpE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,WAAW,EAAE,gBAAgB;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACrC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACpD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAClE,CAAC;KACD,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,IAAI,sBAAsB,GAAG,CAAC,CAAC;IAE/B,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,4CAA4C;gBACrD,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,UAAU,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE/B,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,8CAA8C;gBACvD,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEpC,IAAI,MAAM,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;YAC1C,IAAI,MAAM,CAAC,sBAAsB,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;gBAClE,OAAO,CAAC,QAAQ,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,0DAA0D;oBACnE,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,wBAAwB,CAAC;iBACnD,CAAC,CAAC;YACL,CAAC;YACD,sBAAsB,IAAI,MAAM,CAAC,sBAAsB,CAAC;QAC1D,CAAC;aAAM,IAAI,MAAM,CAAC,oBAAoB,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YACvE,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,8DAA8D;gBACvE,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,sBAAsB,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;QACD,oBAAoB,IAAI,MAAM,CAAC,oBAAoB,CAAC;IACtD,CAAC;IAED,IAAI,oBAAoB,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACvD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,yDAAyD;YAClE,IAAI,EAAE,CAAC,sBAAsB,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,CAAC,KAAK,sBAAsB,EAAE,CAAC;QAClE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,yEAAyE;YAClF,IAAI,EAAE,CAAC,wBAAwB,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/contracts/quarantine.d.ts

@@ -0,0 +1,79 @@
+import { z } from "zod";
+export declare const quarantineEntryIdSchema: z.ZodString;
+export declare function quarantineRecoveryRef(runId: string, resourceId: string): string;
+export declare const quarantineStatusSchema: z.ZodEnum<{
+    moved: "moved";
+    partial: "partial";
+    preparing: "preparing";
+    purged: "purged";
+    purging: "purging";
+    quarantined: "quarantined";
+    "recovery-ref-created": "recovery-ref-created";
+    restored: "restored";
+    restoring: "restoring";
+}>;
+export declare const quarantineEntrySchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    entryId: z.ZodString;
+    runId: z.ZodString;
+    actionId: z.ZodString;
+    resourceId: z.ZodString;
+    status: z.ZodEnum<{
+        moved: "moved";
+        partial: "partial";
+        preparing: "preparing";
+        purged: "purged";
+        purging: "purging";
+        quarantined: "quarantined";
+        "recovery-ref-created": "recovery-ref-created";
+        restored: "restored";
+        restoring: "restoring";
+    }>;
+    originalPath: z.ZodString;
+    quarantinePath: z.ZodString;
+    recoveryRef: z.ZodString;
+    createdAt: z.ZodString;
+    expiresAt: z.ZodString;
+    measurementMaxEntries: z.ZodNumber;
+    target: z.ZodObject<{
+        path: z.ZodString;
+        repositoryCommonDir: z.ZodString;
+        head: z.ZodString;
+        branch: z.ZodOptional<z.ZodString>;
+        device: z.ZodNumber;
+        inode: z.ZodNumber;
+        mtimeMs: z.ZodNumber;
+        measuredBytes: z.ZodNumber;
+        newestMtimeMs: z.ZodNumber;
+        fingerprint: z.ZodString;
+    }, z.core.$strip>;
+    quarantineIdentity: z.ZodOptional<z.ZodObject<{
+        path: z.ZodString;
+        repositoryCommonDir: z.ZodString;
+        head: z.ZodString;
+        branch: z.ZodOptional<z.ZodString>;
+        device: z.ZodNumber;
+        inode: z.ZodNumber;
+        mtimeMs: z.ZodNumber;
+        measuredBytes: z.ZodNumber;
+        newestMtimeMs: z.ZodNumber;
+        fingerprint: z.ZodString;
+    }, z.core.$strip>>;
+    restoredAt: z.ZodOptional<z.ZodString>;
+    purgedAt: z.ZodOptional<z.ZodString>;
+    diagnostic: z.ZodOptional<z.ZodObject<{
+        severity: z.ZodEnum<{
+            error: "error";
+            info: "info";
+            warning: "warning";
+        }>;
+        code: z.ZodString;
+        message: z.ZodString;
+        adapter: z.ZodOptional<z.ZodString>;
+        resourceId: z.ZodOptional<z.ZodString>;
+        remediation: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type QuarantineStatus = z.infer<typeof quarantineStatusSchema>;
+export type QuarantineEntry = z.infer<typeof quarantineEntrySchema>;
+//# sourceMappingURL=quarantine.d.ts.map

package/dist/contracts/quarantine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quarantine.d.ts","sourceRoot":"","sources":["../../src/contracts/quarantine.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,uBAAuB,aAE6C,CAAC;AAElF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAG/E;AAED,eAAO,MAAM,sBAAsB;;;;;;;;;;EAUjC,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsC9B,CAAC;AAEL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/contracts/quarantine.js

@@ -0,0 +1,60 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { diagnosticSchema } from "./diagnostic.js";
+import { worktreeIdentitySchema } from "./action.js";
+export const quarantineEntryIdSchema = z
+    .string()
+    .regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u, "entry ID must be filename-safe");
+export function quarantineRecoveryRef(runId, resourceId) {
+    const resourceHash = createHash("sha256").update(resourceId).digest("hex").slice(0, 16);
+    return `refs/agentrinse/quarantine/${runId}/${resourceHash}`;
+}
+export const quarantineStatusSchema = z.enum([
+    "preparing",
+    "recovery-ref-created",
+    "moved",
+    "quarantined",
+    "restoring",
+    "restored",
+    "purging",
+    "purged",
+    "partial",
+]);
+export const quarantineEntrySchema = z
+    .object({
+    schemaVersion: z.literal(1),
+    entryId: quarantineEntryIdSchema,
+    runId: quarantineEntryIdSchema,
+    actionId: z.string().min(1),
+    resourceId: z.string().min(1),
+    status: quarantineStatusSchema,
+    originalPath: z.string().min(1),
+    quarantinePath: z.string().min(1),
+    recoveryRef: z.string().startsWith("refs/agentrinse/quarantine/"),
+    createdAt: z.string().datetime(),
+    expiresAt: z.string().datetime(),
+    measurementMaxEntries: z.number().int().positive().max(1_000_000),
+    target: worktreeIdentitySchema,
+    quarantineIdentity: worktreeIdentitySchema.optional(),
+    restoredAt: z.string().datetime().optional(),
+    purgedAt: z.string().datetime().optional(),
+    diagnostic: diagnosticSchema.optional(),
+})
+    .superRefine((entry, context) => {
+    if (entry.recoveryRef !== quarantineRecoveryRef(entry.runId, entry.resourceId)) {
+        context.addIssue({
+            code: "custom",
+            message: "recovery ref must match the quarantine run and resource",
+            path: ["recoveryRef"],
+        });
+    }
+    if (["quarantined", "restoring", "purging", "purged"].includes(entry.status) &&
+        entry.quarantineIdentity === undefined) {
+        context.addIssue({
+            code: "custom",
+            message: "completed quarantine state requires post-repair identity",
+            path: ["quarantineIdentity"],
+        });
+    }
+});
+//# sourceMappingURL=quarantine.js.map

package/dist/contracts/quarantine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quarantine.js","sourceRoot":"","sources":["../../src/contracts/quarantine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,EAAE;KACR,KAAK,CAAC,qCAAqC,EAAE,gCAAgC,CAAC,CAAC;AAElF,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,UAAkB;IACrE,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxF,OAAO,8BAA8B,KAAK,IAAI,YAAY,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3C,WAAW;IACX,sBAAsB;IACtB,OAAO;IACP,aAAa;IACb,WAAW;IACX,UAAU;IACV,SAAS;IACT,QAAQ;IACR,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,uBAAuB;IAChC,KAAK,EAAE,uBAAuB;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,MAAM,EAAE,sBAAsB;IAC9B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,6BAA6B,CAAC;IACjE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;IACjE,MAAM,EAAE,sBAAsB;IAC9B,kBAAkB,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1C,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,IAAI,KAAK,CAAC,WAAW,KAAK,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/E,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,yDAAyD;YAClE,IAAI,EAAE,CAAC,aAAa,CAAC;SACtB,CAAC,CAAC;IACL,CAAC;IACD,IACE,CAAC,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QACxE,KAAK,CAAC,kBAAkB,KAAK,SAAS,EACtC,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,0DAA0D;YACnE,IAAI,EAAE,CAAC,oBAAoB,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/contracts/report.d.ts

@@ -142,6 +142,28 @@ export declare const auditReportSchema: z.ZodObject<{
                 newestMtimeMs: z.ZodNumber;
                 fingerprint: z.ZodString;
             }, z.core.$strip>;
+        }, z.core.$strip>, z.ZodObject<{
+            actionId: z.ZodString;
+            type: z.ZodLiteral<"worktree.quarantine">;
+            adapter: z.ZodLiteral<"git">;
+            resourceId: z.ZodString;
+            risk: z.ZodLiteral<"recoverable">;
+            description: z.ZodString;
+            expectedReclaimBytes: z.ZodLiteral<0>;
+            pendingQuarantineBytes: z.ZodNumber;
+            quarantineTtlMinutes: z.ZodNumber;
+            target: z.ZodObject<{
+                path: z.ZodString;
+                repositoryCommonDir: z.ZodString;
+                head: z.ZodString;
+                branch: z.ZodOptional<z.ZodString>;
+                device: z.ZodNumber;
+                inode: z.ZodNumber;
+                mtimeMs: z.ZodNumber;
+                measuredBytes: z.ZodNumber;
+                newestMtimeMs: z.ZodNumber;
+                fingerprint: z.ZodString;
+            }, z.core.$strip>;
         }, z.core.$strip>], "type">>>;
         measuredBytes: z.ZodOptional<z.ZodNumber>;
         estimatedReclaimBytes: z.ZodOptional<z.ZodNumber>;

package/dist/contracts/report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/contracts/report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,mBAAmB;;;;;;EAM9B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;iBAO7B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS5B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/contracts/report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,mBAAmB;;;;;;EAM9B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;iBAO7B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS5B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/contracts/run.d.ts

@@ -9,9 +9,8 @@ export declare const actionExecutionStatusSchema: z.ZodEnum<{
     "rolled-back": "rolled-back";
     "skipped-stale": "skipped-stale";
 }>;
-export declare const actionExecutionSchema: z.ZodObject<{
+export declare const artifactActionExecutionSchema: z.ZodObject<{
     actionId: z.ZodString;
-    type: z.ZodLiteral<"artifacts.remove">;
     status: z.ZodEnum<{
         applied: "applied";
         applying: "applying";
@@ -25,7 +24,36 @@ export declare const actionExecutionSchema: z.ZodObject<{
     startedAt: z.ZodOptional<z.ZodString>;
     completedAt: z.ZodOptional<z.ZodString>;
     reclaimedBytes: z.ZodOptional<z.ZodNumber>;
+    diagnostic: z.ZodOptional<z.ZodObject<{
+        severity: z.ZodEnum<{
+            error: "error";
+            info: "info";
+            warning: "warning";
+        }>;
+        code: z.ZodString;
+        message: z.ZodString;
+        adapter: z.ZodOptional<z.ZodString>;
+        resourceId: z.ZodOptional<z.ZodString>;
+        remediation: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    type: z.ZodLiteral<"artifacts.remove">;
     isolationPath: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const worktreeActionExecutionSchema: z.ZodObject<{
+    actionId: z.ZodString;
+    status: z.ZodEnum<{
+        applied: "applied";
+        applying: "applying";
+        failed: "failed";
+        "partially-applied": "partially-applied";
+        pending: "pending";
+        revalidating: "revalidating";
+        "rolled-back": "rolled-back";
+        "skipped-stale": "skipped-stale";
+    }>;
+    startedAt: z.ZodOptional<z.ZodString>;
+    completedAt: z.ZodOptional<z.ZodString>;
+    reclaimedBytes: z.ZodOptional<z.ZodNumber>;
     diagnostic: z.ZodOptional<z.ZodObject<{
         severity: z.ZodEnum<{
             error: "error";
@@ -38,7 +66,74 @@ export declare const actionExecutionSchema: z.ZodObject<{
         resourceId: z.ZodOptional<z.ZodString>;
         remediation: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
+    type: z.ZodLiteral<"worktree.quarantine">;
+    quarantineEntryId: z.ZodOptional<z.ZodString>;
+    quarantinePath: z.ZodOptional<z.ZodString>;
+    recoveryRef: z.ZodOptional<z.ZodString>;
+    quarantinedBytes: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
+export declare const actionExecutionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    actionId: z.ZodString;
+    status: z.ZodEnum<{
+        applied: "applied";
+        applying: "applying";
+        failed: "failed";
+        "partially-applied": "partially-applied";
+        pending: "pending";
+        revalidating: "revalidating";
+        "rolled-back": "rolled-back";
+        "skipped-stale": "skipped-stale";
+    }>;
+    startedAt: z.ZodOptional<z.ZodString>;
+    completedAt: z.ZodOptional<z.ZodString>;
+    reclaimedBytes: z.ZodOptional<z.ZodNumber>;
+    diagnostic: z.ZodOptional<z.ZodObject<{
+        severity: z.ZodEnum<{
+            error: "error";
+            info: "info";
+            warning: "warning";
+        }>;
+        code: z.ZodString;
+        message: z.ZodString;
+        adapter: z.ZodOptional<z.ZodString>;
+        resourceId: z.ZodOptional<z.ZodString>;
+        remediation: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    type: z.ZodLiteral<"artifacts.remove">;
+    isolationPath: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    actionId: z.ZodString;
+    status: z.ZodEnum<{
+        applied: "applied";
+        applying: "applying";
+        failed: "failed";
+        "partially-applied": "partially-applied";
+        pending: "pending";
+        revalidating: "revalidating";
+        "rolled-back": "rolled-back";
+        "skipped-stale": "skipped-stale";
+    }>;
+    startedAt: z.ZodOptional<z.ZodString>;
+    completedAt: z.ZodOptional<z.ZodString>;
+    reclaimedBytes: z.ZodOptional<z.ZodNumber>;
+    diagnostic: z.ZodOptional<z.ZodObject<{
+        severity: z.ZodEnum<{
+            error: "error";
+            info: "info";
+            warning: "warning";
+        }>;
+        code: z.ZodString;
+        message: z.ZodString;
+        adapter: z.ZodOptional<z.ZodString>;
+        resourceId: z.ZodOptional<z.ZodString>;
+        remediation: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    type: z.ZodLiteral<"worktree.quarantine">;
+    quarantineEntryId: z.ZodOptional<z.ZodString>;
+    quarantinePath: z.ZodOptional<z.ZodString>;
+    recoveryRef: z.ZodOptional<z.ZodString>;
+    quarantinedBytes: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>], "type">;
 export declare const runStatusSchema: z.ZodEnum<{
     completed: "completed";
     failed: "failed";
@@ -59,9 +154,8 @@ export declare const cleanupRunSchema: z.ZodObject<{
         partial: "partial";
         running: "running";
     }>;
-    actions: z.ZodArray<z.ZodObject<{
+    actions: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
         actionId: z.ZodString;
-        type: z.ZodLiteral<"artifacts.remove">;
         status: z.ZodEnum<{
             applied: "applied";
             applying: "applying";
@@ -75,7 +169,35 @@ export declare const cleanupRunSchema: z.ZodObject<{
         startedAt: z.ZodOptional<z.ZodString>;
         completedAt: z.ZodOptional<z.ZodString>;
         reclaimedBytes: z.ZodOptional<z.ZodNumber>;
+        diagnostic: z.ZodOptional<z.ZodObject<{
+            severity: z.ZodEnum<{
+                error: "error";
+                info: "info";
+                warning: "warning";
+            }>;
+            code: z.ZodString;
+            message: z.ZodString;
+            adapter: z.ZodOptional<z.ZodString>;
+            resourceId: z.ZodOptional<z.ZodString>;
+            remediation: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        type: z.ZodLiteral<"artifacts.remove">;
         isolationPath: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        actionId: z.ZodString;
+        status: z.ZodEnum<{
+            applied: "applied";
+            applying: "applying";
+            failed: "failed";
+            "partially-applied": "partially-applied";
+            pending: "pending";
+            revalidating: "revalidating";
+            "rolled-back": "rolled-back";
+            "skipped-stale": "skipped-stale";
+        }>;
+        startedAt: z.ZodOptional<z.ZodString>;
+        completedAt: z.ZodOptional<z.ZodString>;
+        reclaimedBytes: z.ZodOptional<z.ZodNumber>;
         diagnostic: z.ZodOptional<z.ZodObject<{
             severity: z.ZodEnum<{
                 error: "error";
@@ -88,8 +210,14 @@ export declare const cleanupRunSchema: z.ZodObject<{
             resourceId: z.ZodOptional<z.ZodString>;
             remediation: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
-    }, z.core.$strip>>;
+        type: z.ZodLiteral<"worktree.quarantine">;
+        quarantineEntryId: z.ZodOptional<z.ZodString>;
+        quarantinePath: z.ZodOptional<z.ZodString>;
+        recoveryRef: z.ZodOptional<z.ZodString>;
+        quarantinedBytes: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>], "type">>;
     reclaimedBytes: z.ZodNumber;
+    quarantinedBytes: z.ZodOptional<z.ZodNumber>;
     diagnostics: z.ZodArray<z.ZodObject<{
         severity: z.ZodEnum<{
             error: "error";

package/dist/contracts/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/contracts/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,2BAA2B;;;;;;;;;EAStC,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAShC,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;EAAuE,CAAC;AAEpG,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAU3B,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/contracts/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,2BAA2B;;;;;;;;;EAStC,CAAC;AAWH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGxC,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAMxC,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAGhC,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;EAAuE,CAAC;AAEpG,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAW3B,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}

package/dist/contracts/run.js

@@ -10,16 +10,29 @@ export const actionExecutionStatusSchema = z.enum([
     "rolled-back",
     "partially-applied",
 ]);
-export const actionExecutionSchema = z.object({
+const actionExecutionBaseSchema = z.object({
     actionId: z.string().min(1),
-    type: z.literal("artifacts.remove"),
     status: actionExecutionStatusSchema,
     startedAt: z.string().datetime().optional(),
     completedAt: z.string().datetime().optional(),
     reclaimedBytes: z.number().int().nonnegative().optional(),
-    isolationPath: z.string().min(1).optional(),
     diagnostic: diagnosticSchema.optional(),
 });
+export const artifactActionExecutionSchema = actionExecutionBaseSchema.extend({
+    type: z.literal("artifacts.remove"),
+    isolationPath: z.string().min(1).optional(),
+});
+export const worktreeActionExecutionSchema = actionExecutionBaseSchema.extend({
+    type: z.literal("worktree.quarantine"),
+    quarantineEntryId: z.string().min(1).optional(),
+    quarantinePath: z.string().min(1).optional(),
+    recoveryRef: z.string().min(1).optional(),
+    quarantinedBytes: z.number().int().nonnegative().optional(),
+});
+export const actionExecutionSchema = z.discriminatedUnion("type", [
+    artifactActionExecutionSchema,
+    worktreeActionExecutionSchema,
+]);
 export const runStatusSchema = z.enum(["running", "completed", "partial", "failed", "interrupted"]);
 export const cleanupRunSchema = z.object({
     schemaVersion: z.literal(1),
@@ -30,6 +43,7 @@ export const cleanupRunSchema = z.object({
     status: runStatusSchema,
     actions: z.array(actionExecutionSchema),
     reclaimedBytes: z.number().int().nonnegative(),
+    quarantinedBytes: z.number().int().nonnegative().optional(),
     diagnostics: z.array(diagnosticSchema),
 });
 //# sourceMappingURL=run.js.map

package/dist/contracts/run.js.map

@@ -1 +1 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/contracts/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,IAAI,CAAC;IAChD,SAAS;IACT,cAAc;IACd,eAAe;IACf,UAAU;IACV,SAAS;IACT,QAAQ;IACR,aAAa;IACb,mBAAmB;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IACnC,MAAM,EAAE,2BAA2B;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACzD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AAEpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,MAAM,EAAE,eAAe;IACvB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC9C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;CACvC,CAAC,CAAC"}
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/contracts/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,IAAI,CAAC;IAChD,SAAS;IACT,cAAc;IACd,eAAe;IACf,UAAU;IACV,SAAS;IACT,QAAQ;IACR,aAAa;IACb,mBAAmB;CACpB,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,2BAA2B;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACzD,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAC,MAAM,CAAC;IAC5E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAC,MAAM,CAAC;IAC5E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IACtC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAC5D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAChE,6BAA6B;IAC7B,6BAA6B;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AAEpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,MAAM,EAAE,eAAe;IACvB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC9C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC3D,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;CACvC,CAAC,CAAC"}

package/dist/core/apply.d.ts

@@ -1,10 +1,13 @@
 import { type AgentRinseConfig } from "../config/schema.js";
-import type { ArtifactRemoveAction } from "../contracts/action.js";
+import type { ArtifactRemoveAction, WorktreeQuarantineAction } from "../contracts/action.js";
 import type { CleanupPlan } from "../contracts/plan.js";
 import type { CleanupRun } from "../contracts/run.js";
 import { createRunJournal } from "../state/run-journal.js";
 import { type ArtifactExecutionResult } from "./artifact-executor.js";
 import { type ArtifactRevalidationResult } from "./artifact-revalidation.js";
+import { type ExecuteWorktreeQuarantineOptions, type WorktreeExecutionResult } from "./worktree-executor.js";
+import { type WorktreeRevalidationResult } from "./worktree-revalidation.js";
+import type { RootEvidence } from "../contracts/finding.js";
 export declare class ApplySafetyError extends Error {
     readonly name = "ApplySafetyError";
 }
@@ -16,8 +19,12 @@ export type ApplyResult = {
 export type ApplyDependencies = {
     clock?: () => Date;
     createJournal?: typeof createRunJournal;
+    loadCurrentConfig?: () => Promise<AgentRinseConfig>;
     revalidate?: (action: ArtifactRemoveAction, home: string, config: AgentRinseConfig) => Promise<ArtifactRevalidationResult>;
     execute?: (action: ArtifactRemoveAction, isolationId: string) => Promise<ArtifactExecutionResult>;
+    revalidateWorktree?: (action: WorktreeQuarantineAction, home: string, config: AgentRinseConfig) => Promise<WorktreeRevalidationResult>;
+    executeWorktree?: (action: WorktreeQuarantineAction, options: ExecuteWorktreeQuarantineOptions) => Promise<WorktreeExecutionResult>;
+    worktreeProtectionRoots?: (action: WorktreeQuarantineAction, home: string, config: AgentRinseConfig, now: Date) => Promise<RootEvidence[]>;
 };
 export type ApplyCleanupPlanOptions = {
     input: unknown;

package/dist/core/apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/core/apply.ts"],"names":[],"mappings":"AAEA,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAItD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,4BAA4B,CAAC;AAMpC,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,sBAAsB;CAC7C;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,EAAE,UAAU,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,gBAAgB,CAAC;IACxC,UAAU,CAAC,EAAE,CACX,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,gBAAgB,KACrB,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACzC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACnG,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,gBAAgB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,YAAY,CAAC,EAAE,iBAAiB,CAAC;CAClC,CAAC;AAWF,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,WAAW,CAAC,CAiK7F"}
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/core/apply.ts"],"names":[],"mappings":"AAEA,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,KAAK,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAItD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EAKL,KAAK,gCAAgC,EACrC,KAAK,uBAAuB,EAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAGL,KAAK,0BAA0B,EAChC,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,sBAAsB;CAC7C;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,EAAE,UAAU,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,gBAAgB,CAAC;IACxC,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpD,UAAU,CAAC,EAAE,CACX,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,gBAAgB,KACrB,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACzC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAClG,kBAAkB,CAAC,EAAE,CACnB,MAAM,EAAE,wBAAwB,EAChC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,gBAAgB,KACrB,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACzC,eAAe,CAAC,EAAE,CAChB,MAAM,EAAE,wBAAwB,EAChC,OAAO,EAAE,gCAAgC,KACtC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACtC,uBAAuB,CAAC,EAAE,CACxB,MAAM,EAAE,wBAAwB,EAChC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,IAAI,KACN,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,gBAAgB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,YAAY,CAAC,EAAE,iBAAiB,CAAC;CAClC,CAAC;AAWF,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,WAAW,CAAC,CA0Q7F"}