codexgpt 1.0.0

package/dist/worktrees/service.js

@@ -0,0 +1,245 @@
+import { createGitResourceV4, gitV4PolicyDefinition } from "../git/resources.js";
+import { semanticDigestV4 } from "../policy/authorizationFacts.js";
+import { sha256Git } from "../git/mutationContext.js";
+function summary(record) {
+    return {
+        task_worktree_id: record.taskWorktreeId,
+        branch_id: record.branchId,
+        target_branch_id: record.targetBranchId,
+        base_oid: record.baseOid,
+        head_oid: record.headOid,
+        state: record.state,
+        created_at: record.createdAt,
+        updated_at: record.updatedAt
+    };
+}
+export class TaskWorktreeServiceV4 {
+    options;
+    gateRBound = true;
+    constructor(options) {
+        this.options = options;
+    }
+    async create(input) {
+        if (input.action === "prepare") {
+            return this.options.manager.prepareCreate({
+                ...input,
+                ownerFingerprint: this.options.ownerFingerprint()
+            });
+        }
+        const created = await this.options.manager.executeCreate({
+            ...input,
+            ownerFingerprint: this.options.ownerFingerprint(),
+            authorization: input.authorization
+        });
+        const workspace = await this.options.authority.issue(created.record.taskWorktreeId);
+        return {
+            action: "execute",
+            repository_id: created.record.repositoryId,
+            task: summary(created.record),
+            workspace_id: workspace.id,
+            materialization: "raw_git_blobs",
+            external_filters_hydrated: false,
+            submodules_initialized: false,
+            affected_entry_count: created.manifest.entries.length
+        };
+    }
+    async list(input) {
+        const repository = await this.options.manager.primaryRepository(input.workspace);
+        const records = this.options.manager.options.store
+            .list(this.options.ownerFingerprint(), repository.repositoryId)
+            .filter((record) => record.state !== "removed")
+            .slice(0, 32);
+        return {
+            repository_id: repository.repositoryId,
+            tasks: records.map(summary),
+            truncated: records.length >= 32
+        };
+    }
+    async get(input) {
+        const item = await this.options.manager.revalidate(input.taskWorktreeId, this.options.ownerFingerprint());
+        const workspace = await this.options.authority.issue(input.taskWorktreeId);
+        return {
+            repository_id: item.record.repositoryId,
+            task: summary(item.record),
+            workspace_id: workspace.id,
+            access_class: "task_worktree"
+        };
+    }
+    merge(input) {
+        if (this.options.integrationGate?.enabled &&
+            !input.integrationReviewToken &&
+            input.action !== "finalize") {
+            throw new Error("GIT_INTEGRATION_REQUIRED");
+        }
+        if (input.integrationReviewToken) {
+            const args = {
+                action: input.action,
+                workspace_id: input.workspace.id,
+                task_worktree_id: input.taskWorktreeId,
+                integration_review_token: input.integrationReviewToken
+            };
+            if (input.action === "prepare")
+                args.message = input.message;
+            else if (input.action === "finalize")
+                args.review_token = input.reviewToken;
+            else {
+                args.merge_plan_id = input.mergePlanId;
+                args.verification_receipts = input.verificationReceipts ?? [];
+                args.skip_checks = input.skipChecks === true;
+            }
+            const described = this.describe("merge_task_worktree", args);
+            if (input.authorization?.resourceFingerprint !== described.resource.resourceFingerprint) {
+                throw new Error("GIT_INTEGRATION_REQUIRED");
+            }
+        }
+        if (input.action === "prepare") {
+            if (!this.options.mergePrepare)
+                throw new Error("GIT_V4_HANDLER_UNAVAILABLE");
+            return this.options.mergePrepare.prepare(input);
+        }
+        if (input.action === "finalize") {
+            if (!this.options.mergePrepare)
+                throw new Error("GIT_V4_HANDLER_UNAVAILABLE");
+            return this.options.mergePrepare.finalize(input);
+        }
+        if (!this.options.mergeExecute)
+            throw new Error("GIT_V4_HANDLER_UNAVAILABLE");
+        return this.options.mergeExecute.execute(input);
+    }
+    remove(input) {
+        if (!this.options.remove)
+            throw new Error("GIT_V4_HANDLER_UNAVAILABLE");
+        return input.action === "prepare"
+            ? this.options.remove.prepare(input)
+            : this.options.remove.execute(input);
+    }
+    describe(toolName, args) {
+        const owner = this.options.ownerFingerprint();
+        let operation;
+        let repositoryId;
+        let worktreeId = null;
+        let stateTokenFingerprint = null;
+        let pathDigests = [];
+        let refDigests = [];
+        let objectIds = [];
+        let affectedPathCount = 0;
+        let affectedByteCount = 0;
+        let integrationMode = "off";
+        let approvalRevealArguments;
+        if (toolName === "create_task_worktree") {
+            if (args.action === "prepare") {
+                operation = "task_create_review";
+                const facts = this.options.manager.options.context.options.stateTokens.inspect(String(args.state_token));
+                repositoryId = facts.repositoryId;
+                stateTokenFingerprint = sha256Git(String(args.state_token));
+            }
+            else {
+                operation = "task_create";
+                const review = this.options.manager.options.reviews.inspect(String(args.review_token), "task_create");
+                repositoryId = String(review.repositoryId);
+                worktreeId = String(review.taskWorktreeId);
+                stateTokenFingerprint = sha256Git(String(args.review_token));
+            }
+        }
+        else if (toolName === "list_task_worktrees") {
+            operation = "task_list";
+            repositoryId = `repo_${sha256Git(String(args.workspace_id)).slice(0, 32)}`;
+        }
+        else {
+            const taskId = String(args.task_worktree_id);
+            const item = this.options.manager.options.store.read(taskId);
+            if (item.privateState.ownerFingerprint !== owner)
+                throw new Error("TASK_WORKTREE_NOT_FOUND");
+            repositoryId = item.record.repositoryId;
+            worktreeId = item.record.taskWorktreeId;
+            if (toolName === "get_task_worktree")
+                operation = "task_get";
+            else if (toolName === "merge_task_worktree") {
+                operation = args.action === "execute"
+                    ? "task_merge_execute"
+                    : args.action === "finalize"
+                        ? "task_merge_prepare_finalize"
+                        : "task_merge_prepare_review";
+                stateTokenFingerprint = args.action === "execute"
+                    ? sha256Git(JSON.stringify({
+                        mergePlanId: String(args.merge_plan_id),
+                        verificationReceipts: args.verification_receipts ?? [],
+                        skipChecks: args.skip_checks === true
+                    }))
+                    : args.action === "finalize"
+                        ? sha256Git(String(args.review_token))
+                        : null;
+                if (args.action === "execute" && this.options.mergeExecute) {
+                    const plan = this.options.mergeExecute.describePlan(String(args.merge_plan_id), owner);
+                    refDigests = [sha256Git(plan.targetRef), sha256Git(plan.taskRef)];
+                    objectIds = [...new Set([plan.targetOid, plan.taskOid, plan.candidateOid])];
+                    pathDigests = [plan.scanDigest];
+                    affectedPathCount = plan.affectedPathCount;
+                    affectedByteCount = plan.affectedByteCount;
+                }
+                if (typeof args.integration_review_token === "string") {
+                    const gate = this.options.integrationGate;
+                    if (!gate?.enabled)
+                        throw new Error("GIT_INTEGRATION_REQUIRED");
+                    const review = gate.inspect(args.integration_review_token);
+                    if (review.repositoryId !== repositoryId ||
+                        review.workspaceId !== String(args.workspace_id))
+                        throw new Error("GIT_STATE_TOKEN_INVALID");
+                    integrationMode = "approved_full_access";
+                    approvalRevealArguments = gate.approvalPreview(args.integration_review_token);
+                    refDigests = [
+                        ...refDigests,
+                        review.identitiesDigest,
+                        sha256Git(args.integration_review_token)
+                    ].sort();
+                    stateTokenFingerprint = sha256Git(JSON.stringify({
+                        previous: stateTokenFingerprint,
+                        integrationReviewToken: args.integration_review_token
+                    }));
+                }
+            }
+            else if (toolName === "remove_task_worktree") {
+                operation = "task_remove";
+                stateTokenFingerprint = args.action === "execute"
+                    ? sha256Git(String(args.review_token))
+                    : null;
+            }
+            else
+                throw new Error("GIT_V4_HANDLER_UNAVAILABLE");
+        }
+        const resource = createGitResourceV4({
+            operation,
+            repositoryId,
+            worktreeId,
+            branchId: null,
+            pathDigests,
+            refDigests,
+            objectIds,
+            affectedPathCount,
+            affectedByteCount,
+            stateTokenFingerprint,
+            integrationMode,
+            executionIsolation: "none"
+        });
+        const policy = gitV4PolicyDefinition(toolName, operation);
+        const requiredScopes = [...policy.requiredScopes];
+        if (integrationMode === "approved_full_access") {
+            for (const scope of ["shell:execute", "host:full-access"]) {
+                if (!requiredScopes.includes(scope))
+                    requiredScopes.push(scope);
+            }
+        }
+        return {
+            resource,
+            requiredCapabilities: [
+                { name: "filesystemWriteBoundary", minimum: "brokered" },
+                { name: "processTreeControl", minimum: "job_object" }
+            ],
+            requiredScopes,
+            semanticFactsDigest: semanticDigestV4(resource),
+            riskClass: integrationMode === "approved_full_access" ? "R3" : policy.riskClass,
+            approvalRevealArguments
+        };
+    }
+}
+//# sourceMappingURL=service.js.map

package/dist/worktrees/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/worktrees/service.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAKtD,SAAS,OAAO,CAAC,MAA4B;IAC3C,OAAO;QACL,gBAAgB,EAAE,MAAM,CAAC,cAAc;QACvC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,gBAAgB,EAAE,MAAM,CAAC,cAAc;QACvC,QAAQ,EAAE,MAAM,CAAC,OAAO;QACxB,QAAQ,EAAE,MAAM,CAAC,OAAO;QACxB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,UAAU,EAAE,MAAM,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,qBAAqB;IAGX;IAFZ,UAAU,GAAG,IAAa,CAAC;IAEpC,YAAqB,OAQpB;QARoB,YAAO,GAAP,OAAO,CAQ3B;IAAG,CAAC;IAEL,KAAK,CAAC,MAAM,CAAC,KAeR;QAEH,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;gBACxC,GAAG,KAAK;gBACR,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;YACvD,GAAG,KAAK;YACR,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE;YACjD,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACpF,OAAO;YACL,MAAM,EAAE,SAAkB;YAC1B,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;YAC1C,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YAC7B,YAAY,EAAE,SAAS,CAAC,EAAE;YAC1B,eAAe,EAAE,eAAwB;YACzC,yBAAyB,EAAE,KAAc;YACzC,sBAAsB,EAAE,KAAc;YACtC,oBAAoB,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM;SACtD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAA+B;QACxC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK;aAC/C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,UAAU,CAAC,YAAY,CAAC;aAC9D,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC;aAC9C,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChB,OAAO;YACL,aAAa,EAAE,UAAU,CAAC,YAAY;YACtC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAC3B,SAAS,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;SAChC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAiC;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAChD,KAAK,CAAC,cAAc,EACpB,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAChC,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC3E,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAC1B,YAAY,EAAE,SAAS,CAAC,EAAE;YAC1B,YAAY,EAAE,eAAwB;SACvC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KA6BD;QAEH,IACE,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO;YACrC,CAAC,KAAK,CAAC,sBAAsB;YAC7B,KAAK,CAAC,MAAM,KAAK,UAAU,EAC3B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;YACjC,MAAM,IAAI,GAA4B;gBACpC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE;gBAChC,gBAAgB,EAAE,KAAK,CAAC,cAAc;gBACtC,wBAAwB,EAAE,KAAK,CAAC,sBAAsB;aACvD,CAAC;YACF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;iBACxD,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU;gBAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC;iBACvE,CAAC;gBACJ,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,WAAW,CAAC;gBACvC,IAAI,CAAC,qBAAqB,GAAG,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC;gBAC9D,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC;YAC/C,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YAC7D,IAAI,KAAK,CAAC,aAAa,EAAE,mBAAmB,KAAK,SAAS,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC;gBACxF,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAC9E,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAC9E,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,CAAC,KAQF;QAEH,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACxE,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS;YAC/B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YACpC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,QAAQ,CAAC,QAAgB,EAAE,IAA6B;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC9C,IAAI,SAGoC,CAAC;QACzC,IAAI,YAAoB,CAAC;QACzB,IAAI,UAAU,GAAkB,IAAI,CAAC;QACrC,IAAI,qBAAqB,GAAkB,IAAI,CAAC;QAChD,IAAI,WAAW,GAAa,EAAE,CAAC;QAC/B,IAAI,UAAU,GAAa,EAAE,CAAC;QAC9B,IAAI,SAAS,GAAa,EAAE,CAAC;QAC7B,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,IAAI,eAAe,GAAmC,KAAK,CAAC;QAC5D,IAAI,uBAA6C,CAAC;QAClD,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC9B,SAAS,GAAG,oBAAoB,CAAC;gBACjC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;gBACzG,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;gBAClC,qBAAqB,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,aAAa,CAAC;gBAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CACzD,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EACzB,aAAa,CACd,CAAC;gBACF,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAC3C,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;gBAC3C,qBAAqB,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,KAAK,qBAAqB,EAAE,CAAC;YAC9C,SAAS,GAAG,WAAW,CAAC;YACxB,YAAY,GAAG,QAAQ,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC7E,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7D,IAAI,IAAI,CAAC,YAAY,CAAC,gBAAgB,KAAK,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC7F,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACxC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;YACxC,IAAI,QAAQ,KAAK,mBAAmB;gBAAE,SAAS,GAAG,UAAU,CAAC;iBACxD,IAAI,QAAQ,KAAK,qBAAqB,EAAE,CAAC;gBAC5C,SAAS,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS;oBACnC,CAAC,CAAC,oBAAoB;oBACtB,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,UAAU;wBAC1B,CAAC,CAAC,6BAA6B;wBAC/B,CAAC,CAAC,2BAA2B,CAAC;gBAClC,qBAAqB,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS;oBAC/C,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;wBACvB,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;wBACvC,oBAAoB,EAAE,IAAI,CAAC,qBAAqB,IAAI,EAAE;wBACtD,UAAU,EAAE,IAAI,CAAC,WAAW,KAAK,IAAI;qBACtC,CAAC,CAAC;oBACL,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,UAAU;wBAC1B,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;wBACtC,CAAC,CAAC,IAAI,CAAC;gBACX,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;oBAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;oBACvF,UAAU,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;oBAClE,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC5E,WAAW,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAChC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;oBAC3C,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;gBAC7C,CAAC;gBACD,IAAI,OAAO,IAAI,CAAC,wBAAwB,KAAK,QAAQ,EAAE,CAAC;oBACtD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;oBAC1C,IAAI,CAAC,IAAI,EAAE,OAAO;wBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;oBAChE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;oBAC3D,IACE,MAAM,CAAC,YAAY,KAAK,YAAY;wBACpC,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;wBAChD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;oBAC7C,eAAe,GAAG,sBAAsB,CAAC;oBACzC,uBAAuB,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;oBAC9E,UAAU,GAAG;wBACX,GAAG,UAAU;wBACb,MAAM,CAAC,gBAAgB;wBACvB,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC;qBACzC,CAAC,IAAI,EAAE,CAAC;oBACT,qBAAqB,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;wBAC/C,QAAQ,EAAE,qBAAqB;wBAC/B,sBAAsB,EAAE,IAAI,CAAC,wBAAwB;qBACtD,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;iBAAM,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;gBAC/C,SAAS,GAAG,aAAa,CAAC;gBAC1B,qBAAqB,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS;oBAC/C,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;oBACtC,CAAC,CAAC,IAAI,CAAC;YACX,CAAC;;gBAAM,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC;YACnC,SAAS;YACT,YAAY;YACZ,UAAU;YACV,QAAQ,EAAE,IAAI;YACd,WAAW;YACX,UAAU;YACV,SAAS;YACT,iBAAiB;YACjB,iBAAiB;YACjB,qBAAqB;YACrB,eAAe;YACf,kBAAkB,EAAE,MAAM;SAC3B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1D,MAAM,cAAc,GAAoB,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;QACnE,IAAI,eAAe,KAAK,sBAAsB,EAAE,CAAC;YAC/C,KAAK,MAAM,KAAK,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAU,EAAE,CAAC;gBACnE,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,OAAO;YACL,QAAQ;YACR,oBAAoB,EAAE;gBACpB,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,UAAU,EAAE;gBACxD,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,YAAY,EAAE;aACtD;YACD,cAAc;YACd,mBAAmB,EAAE,gBAAgB,CAAC,QAAQ,CAAC;YAC/C,SAAS,EAAE,eAAe,KAAK,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS;YAC/E,uBAAuB;SACxB,CAAC;IACJ,CAAC;CACF"}

package/dist/worktrees/store.js

@@ -0,0 +1,156 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHmac, randomBytes } from "node:crypto";
+import { z } from "zod";
+import { AtomicJsonFileStore } from "../transactions/atomicStateFile.js";
+import { canonicalGateRJson, deriveGateRSubkey, openGitState, sealGitState } from "../git/durableState.js";
+const sealed = z.object({
+    schemaVersion: z.literal(1),
+    iv: z.string(),
+    ciphertext: z.string(),
+    tag: z.string()
+}).strict();
+const recordSchema = z.object({
+    schemaVersion: z.literal(1),
+    taskWorktreeId: z.string().regex(/^task_[a-f0-9]{32}$/u),
+    ownerBindingVersion: z.literal(1),
+    repositoryId: z.string().regex(/^repo_[a-f0-9]{32}$/u),
+    branchId: z.string().regex(/^branch_[a-f0-9]{32}$/u),
+    targetBranchId: z.string().regex(/^branch_[a-f0-9]{32}$/u),
+    baseOid: z.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/u),
+    headOid: z.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/u),
+    generation: z.number().int().positive(),
+    state: z.enum(["preparing", "ready", "merge_prepared", "recovery_required", "removed"]),
+    privateState: sealed,
+    createdAt: z.string().datetime({ offset: true }),
+    updatedAt: z.string().datetime({ offset: true }),
+    recordMac: z.string().regex(/^[a-f0-9]{64}$/u)
+}).strict();
+function unsigned(record) {
+    const { recordMac: _ignored, ...rest } = record;
+    return rest;
+}
+export class TaskWorktreeStoreV1 {
+    options;
+    #directory;
+    #atomic;
+    #sealKey;
+    #macKey;
+    constructor(options) {
+        this.options = options;
+        this.#directory = path.join(path.resolve(options.stateRoot), "git", "task-worktrees");
+        this.#atomic = new AtomicJsonFileStore(options.stateRoot, recordSchema);
+        this.#sealKey = deriveGateRSubkey(options.masterKey, "task-worktree-private");
+        this.#macKey = deriveGateRSubkey(options.masterKey, "task-worktree-record");
+    }
+    create(input) {
+        const taskWorktreeId = input.taskWorktreeId ?? `task_${randomBytes(16).toString("hex")}`;
+        if (!/^task_[a-f0-9]{32}$/u.test(taskWorktreeId) || fs.existsSync(this.pathFor(taskWorktreeId))) {
+            throw new Error("TASK_WORKTREE_NOT_FOUND");
+        }
+        const now = new Date(this.options.now?.() ?? Date.now()).toISOString();
+        const privateState = {
+            ownerFingerprint: input.ownerFingerprint,
+            repositoryId: input.repositoryId,
+            worktreePath: path.join(input.managedRoot, taskWorktreeId),
+            adminDir: null,
+            branchRef: input.branchRef,
+            targetRef: input.targetRef
+        };
+        const base = {
+            schemaVersion: 1,
+            taskWorktreeId,
+            ownerBindingVersion: 1,
+            repositoryId: input.repositoryId,
+            branchId: input.branchId,
+            targetBranchId: input.targetBranchId,
+            baseOid: input.baseOid,
+            headOid: input.baseOid,
+            generation: 1,
+            state: "preparing",
+            privateState: sealGitState(this.#sealKey, `task-worktree:${taskWorktreeId}`, privateState, randomBytes),
+            createdAt: now,
+            updatedAt: now
+        };
+        const record = recordSchema.parse({
+            ...base,
+            recordMac: createHmac("sha256", this.#macKey).update(canonicalGateRJson(base)).digest("hex")
+        });
+        this.#atomic.write(this.pathFor(taskWorktreeId), record);
+        return { record, privateState };
+    }
+    read(taskWorktreeId) {
+        if (!fs.existsSync(this.pathFor(taskWorktreeId)))
+            throw new Error("TASK_WORKTREE_NOT_FOUND");
+        const record = this.#atomic.read(this.pathFor(taskWorktreeId));
+        const expected = createHmac("sha256", this.#macKey).update(canonicalGateRJson(unsigned(record))).digest("hex");
+        if (expected !== record.recordMac)
+            throw new Error("TASK_WORKTREE_NOT_FOUND");
+        const value = openGitState(this.#sealKey, `task-worktree:${taskWorktreeId}`, record.privateState);
+        if (!/^[a-f0-9]{64}$/u.test(value.ownerFingerprint) ||
+            value.repositoryId !== record.repositoryId ||
+            !path.isAbsolute(value.worktreePath) ||
+            !value.branchRef.startsWith("refs/heads/codex/") ||
+            !value.targetRef.startsWith("refs/heads/") ||
+            (value.removalReview !== undefined && (!/^[a-f0-9]{64}$/u.test(value.removalReview.worktreeInventoryDigest) ||
+                !Number.isInteger(value.removalReview.worktreeEntryCount) ||
+                value.removalReview.worktreeEntryCount < 1 ||
+                !/^[a-f0-9]{64}$/u.test(value.removalReview.adminInventoryDigest) ||
+                !Number.isInteger(value.removalReview.adminEntryCount) ||
+                value.removalReview.adminEntryCount < 1)))
+            throw new Error("TASK_WORKTREE_NOT_FOUND");
+        return { record, privateState: value };
+    }
+    list(ownerFingerprint, repositoryId) {
+        if (!/^[a-f0-9]{64}$/u.test(ownerFingerprint))
+            throw new Error("TASK_WORKTREE_NOT_FOUND");
+        return this.listAll()
+            .filter((item) => item.privateState.ownerFingerprint === ownerFingerprint &&
+            (!repositoryId || item.record.repositoryId === repositoryId))
+            .map((item) => item.record)
+            .sort((left, right) => left.createdAt.localeCompare(right.createdAt));
+    }
+    listAll() {
+        const names = fs.existsSync(this.#directory)
+            ? fs.readdirSync(this.#directory, { withFileTypes: true }).filter((entry) => entry.isFile())
+            : [];
+        const output = [];
+        for (const name of names) {
+            const match = /^(task_[a-f0-9]{32})\.json$/u.exec(name.name);
+            if (!match)
+                continue;
+            try {
+                const item = this.read(match[1]);
+                output.push(item);
+            }
+            catch {
+                throw new Error("GIT_RECOVERY_REQUIRED");
+            }
+        }
+        return output.sort((left, right) => left.record.createdAt.localeCompare(right.record.createdAt));
+    }
+    update(taskWorktreeId, input) {
+        const current = this.read(taskWorktreeId);
+        const nextPrivate = input.privateState ?? current.privateState;
+        const base = {
+            ...unsigned(current.record),
+            generation: current.record.generation + 1,
+            state: input.state,
+            headOid: input.headOid ?? current.record.headOid,
+            privateState: sealGitState(this.#sealKey, `task-worktree:${taskWorktreeId}`, nextPrivate, randomBytes),
+            updatedAt: new Date(this.options.now?.() ?? Date.now()).toISOString()
+        };
+        const next = recordSchema.parse({
+            ...base,
+            recordMac: createHmac("sha256", this.#macKey).update(canonicalGateRJson(base)).digest("hex")
+        });
+        this.#atomic.write(this.pathFor(taskWorktreeId), next);
+        return next;
+    }
+    pathFor(taskWorktreeId) {
+        if (!/^task_[a-f0-9]{32}$/u.test(taskWorktreeId))
+            throw new Error("TASK_WORKTREE_NOT_FOUND");
+        return path.join(this.#directory, `${taskWorktreeId}.json`);
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/worktrees/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/worktrees/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,YAAY,EAEb,MAAM,wBAAwB,CAAC;AAoChC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;CAChB,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,YAAY,GAAoC,CAAC,CAAC,MAAM,CAAC;IAC7D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sBAAsB,CAAC;IACxD,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sBAAsB,CAAC;IACtD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACpD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAC1D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kCAAkC,CAAC;IAC7D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kCAAkC,CAAC;IAC7D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAC;IACvF,YAAY,EAAE,MAAM;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC;CAC/C,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,SAAS,QAAQ,CAAC,MAA4B;IAC5C,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAChD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,mBAAmB;IAMD;IALpB,UAAU,CAAS;IACnB,OAAO,CAA4C;IACnD,QAAQ,CAAS;IACjB,OAAO,CAAS;IAEzB,YAA6B,OAI5B;QAJ4B,YAAO,GAAP,OAAO,CAInC;QACC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACtF,IAAI,CAAC,OAAO,GAAG,IAAI,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,CAAC,KAMN;QACC,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,QAAQ,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzF,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YAChG,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACvE,MAAM,YAAY,GAA+B;YAC/C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,cAAc,CAAC;YAC1D,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;QACF,MAAM,IAAI,GAAG;YACX,aAAa,EAAE,CAAU;YACzB,cAAc;YACd,mBAAmB,EAAE,CAAU;YAC/B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,WAAoB;YAC3B,YAAY,EAAE,YAAY,CACxB,IAAI,CAAC,QAAQ,EACb,iBAAiB,cAAc,EAAE,EACjC,YAAY,EACZ,WAAW,CACZ;YACD,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC;QACF,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC;YAChC,GAAG,IAAI;YACP,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC7F,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;QACzD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,cAAsB;QACzB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/G,IAAI,QAAQ,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,YAAY,CACxB,IAAI,CAAC,QAAQ,EACb,iBAAiB,cAAc,EAAE,EACjC,MAAM,CAAC,YAAY,CACU,CAAC;QAChC,IACE,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;YAC/C,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;YAC1C,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC;YACpC,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,mBAAmB,CAAC;YAChD,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC;YAC1C,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,CACpC,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,uBAAuB,CAAC;gBACpE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,kBAAkB,CAAC;gBACzD,KAAK,CAAC,aAAa,CAAC,kBAAkB,GAAG,CAAC;gBAC1C,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,oBAAoB,CAAC;gBACjE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC;gBACtD,KAAK,CAAC,aAAa,CAAC,eAAe,GAAG,CAAC,CACxC,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IAED,IAAI,CAAC,gBAAwB,EAAE,YAAqB;QAClD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC,OAAO,EAAE;aAClB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACf,IAAI,CAAC,YAAY,CAAC,gBAAgB,KAAK,gBAAgB;YACvD,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,YAAY,CAAC,CAC7D;aACA,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;aAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO;QACL,MAAM,KAAK,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAC1C,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5F,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,MAAM,GAAsF,EAAE,CAAC;QACrG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7D,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,CACJ,cAAsB,EACtB,KAIC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;QAC/D,MAAM,IAAI,GAAG;YACX,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;YAC3B,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC;YACzC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;YAChD,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,cAAc,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC;YACtG,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;SACtE,CAAC;QACF,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC;YAC9B,GAAG,IAAI;YACP,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC7F,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,cAAsB;QAC5B,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,cAAc,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,cAAc,OAAO,CAAC,CAAC;IAC9D,CAAC;CACF"}

package/dist/worktrees/treeManifest.js

@@ -0,0 +1,106 @@
+import { hasSecretValue } from "../redact.js";
+import { runGitRequired } from "../git/mutationContext.js";
+const UNSAFE_SEGMENT = /^(?:\.git|git~1|con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\..*)?$/iu;
+function validatePath(value, guard) {
+    if (!value ||
+        value.startsWith("/") ||
+        value.includes("\\") ||
+        value.includes("\0") ||
+        /[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/u.test(value) ||
+        hasSecretValue(value) ||
+        guard.isBlockedRelativePath(value))
+        throw new Error("TASK_WORKTREE_TREE_UNSAFE");
+    for (const segment of value.split("/")) {
+        if (!segment ||
+            segment === "." ||
+            segment === ".." ||
+            segment.includes(":") ||
+            /[. ]$/u.test(segment) ||
+            UNSAFE_SEGMENT.test(segment))
+            throw new Error("TASK_WORKTREE_TREE_UNSAFE");
+    }
+}
+export async function buildTaskTreeManifest(input) {
+    const treeOid = (await runGitRequired(input.executor, input.repository, [
+        "rev-parse", "--verify", `${input.treeish}^{tree}`
+    ], {
+        stdoutLimitBytes: 256,
+        objectDirectoryPath: input.objectDirectoryPath
+    })).stdout.toString("ascii").trim();
+    const listing = await runGitRequired(input.executor, input.repository, [
+        "ls-tree", "-r", "-z", "--full-tree", treeOid
+    ], {
+        stdoutLimitBytes: Math.min(64 * 1024 * 1024, Math.max(4096, input.maxFiles * 512)),
+        objectDirectoryPath: input.objectDirectoryPath
+    });
+    const entries = [];
+    const folded = new Set();
+    let totalBytes = 0;
+    let listingText;
+    try {
+        listingText = new TextDecoder("utf-8", { fatal: true }).decode(listing.stdout);
+    }
+    catch {
+        throw new Error("TASK_WORKTREE_TREE_UNSAFE");
+    }
+    for (const record of listingText.split("\0")) {
+        if (!record)
+            continue;
+        const match = /^(100644|100755|120000|160000) (blob|commit) ([a-f0-9]{40}|[a-f0-9]{64})\t(.+)$/u.exec(record);
+        if (!match || match[1] === "120000")
+            throw new Error("TASK_WORKTREE_TREE_UNSAFE");
+        const [, mode, type, oid, relativePath] = match;
+        validatePath(relativePath, input.guard);
+        const key = relativePath.normalize("NFC").toLocaleLowerCase("en-US");
+        if (folded.has(key))
+            throw new Error("TASK_WORKTREE_TREE_UNSAFE");
+        folded.add(key);
+        if (entries.length >= input.maxFiles)
+            throw new Error("GIT_SCAN_LIMIT");
+        if (mode === "160000") {
+            if (type !== "commit")
+                throw new Error("TASK_WORKTREE_TREE_UNSAFE");
+            entries.push({ path: relativePath, kind: "gitlink", mode, oid, size: 0 });
+            continue;
+        }
+        if (type !== "blob")
+            throw new Error("TASK_WORKTREE_TREE_UNSAFE");
+        const sizeText = (await runGitRequired(input.executor, input.repository, [
+            "cat-file", "-s", oid
+        ], {
+            stdoutLimitBytes: 64,
+            objectDirectoryPath: input.objectDirectoryPath
+        })).stdout.toString("ascii").trim();
+        const size = Number(sizeText);
+        if (!Number.isSafeInteger(size) || size < 0 || size > 32 * 1024 * 1024) {
+            throw new Error("GIT_SCAN_LIMIT");
+        }
+        totalBytes += size;
+        if (totalBytes > input.maxBytes)
+            throw new Error("GIT_SCAN_LIMIT");
+        const content = await runGitRequired(input.executor, input.repository, [
+            "cat-file", "blob", oid
+        ], {
+            stdoutLimitBytes: size + 1,
+            objectDirectoryPath: input.objectDirectoryPath
+        });
+        if (content.stdout.length !== size || hasSecretValue(content.stdout.toString("latin1"))) {
+            throw new Error("GIT_SECRET_BLOCKED");
+        }
+        entries.push({
+            path: relativePath,
+            kind: "blob",
+            mode: mode,
+            oid,
+            size
+        });
+    }
+    return Object.freeze({
+        schemaVersion: 1,
+        treeOid,
+        entries: Object.freeze(entries),
+        fileCount: entries.filter((entry) => entry.kind === "blob").length,
+        totalBytes
+    });
+}
+//# sourceMappingURL=treeManifest.js.map

package/dist/worktrees/treeManifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"treeManifest.js","sourceRoot":"","sources":["../../src/worktrees/treeManifest.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAG9C,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAkB3D,MAAM,cAAc,GAAG,gEAAgE,CAAC;AAExF,SAAS,YAAY,CAAC,KAAa,EAAE,KAAgB;IACnD,IACE,CAAC,KAAK;QACN,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,yDAAyD,CAAC,IAAI,CAAC,KAAK,CAAC;QACrE,cAAc,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,qBAAqB,CAAC,KAAK,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,IACE,CAAC,OAAO;YACR,OAAO,KAAK,GAAG;YACf,OAAO,KAAK,IAAI;YAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;YACtB,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAQ3C;IACC,MAAM,OAAO,GAAG,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE;QACtE,WAAW,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,OAAO,SAAS;KACnD,EAAE;QACD,gBAAgB,EAAE,GAAG;QACrB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;KAC/C,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE;QACrE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO;KAC9C,EAAE;QACD,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;QAClF,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;KAC/C,CAAC,CAAC;IACH,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,KAAK,GAAG,kFAAkF,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9G,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAClF,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;QAChD,YAAY,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAClE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACxE,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,IAAI,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1E,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE;YACvE,UAAU,EAAE,IAAI,EAAE,GAAG;SACtB,EAAE;YACD,gBAAgB,EAAE,EAAE;YACpB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;SAC/C,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QACD,UAAU,IAAI,IAAI,CAAC;QACnB,IAAI,UAAU,GAAG,KAAK,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE;YACrE,UAAU,EAAE,MAAM,EAAE,GAAG;SACxB,EAAE;YACD,gBAAgB,EAAE,IAAI,GAAG,CAAC;YAC1B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;SAC/C,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,IAA2B;YACjC,GAAG;YACH,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,CAAC;QAChB,OAAO;QACP,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QAC/B,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,MAAM;QAClE,UAAU;KACX,CAAC,CAAC;AACL,CAAC"}