codexgpt 1.0.0

package/dist/access/protectedRoots.js

@@ -0,0 +1,122 @@
+import path from "node:path";
+import { createHash } from "node:crypto";
+function comparisonPath(value, platform) {
+    const normalized = path.win32.normalize(value.replaceAll("/", "\\")).replace(/\\+$/, "");
+    return platform === "win32" ? normalized.toLocaleLowerCase("en-US") : path.resolve(value);
+}
+function fingerprint(value) {
+    return `sha256:${createHash("sha256").update(value, "utf8").digest("hex")}`;
+}
+export function assertConfirmedRootPathInput(value, platform = process.platform) {
+    if (value.includes("\0"))
+        throw new Error("Path contains a null byte.");
+    if (platform === "win32") {
+        const normalized = value.replace(/\//g, "\\");
+        if (/^\\\\[?.]\\/.test(normalized))
+            throw new Error("Windows device paths are not allowed.");
+        if (/^\\\\/.test(normalized))
+            throw new Error("UNC paths are not allowed.");
+        if (/^[A-Za-z]:(?!\\)/.test(normalized))
+            throw new Error("Drive-relative paths are not allowed.");
+        const withoutDrive = /^[A-Za-z]:/.test(normalized) ? normalized.slice(2) : normalized;
+        if (withoutDrive.includes(":"))
+            throw new Error("NTFS alternate data streams are not allowed.");
+        for (const segment of withoutDrive.split(/\\+/).filter(Boolean)) {
+            if (segment.endsWith(".") || segment.endsWith(" "))
+                throw new Error("Trailing dot or space path segments are not allowed.");
+            if (/^(?:CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(?:\.|$)/i.test(segment))
+                throw new Error("Windows reserved device names are not allowed.");
+        }
+    }
+    if (platform === "win32" && !/^[A-Za-z]:[\\/]/.test(value)) {
+        throw new Error("Confirmed roots require an absolute local drive path.");
+    }
+}
+export class ProtectedRootPolicy {
+    #platform;
+    #roots;
+    constructor(options = {}) {
+        this.#platform = options.platform ?? process.platform;
+        this.#roots = Object.freeze((options.protectedRoots ?? []).map((value) => {
+            assertConfirmedRootPathInput(value, this.#platform);
+            return comparisonPath(value, this.#platform);
+        }));
+    }
+    revision() {
+        return fingerprint(JSON.stringify({ platform: this.#platform, roots: this.#roots }));
+    }
+    classify(inputPath) {
+        assertConfirmedRootPathInput(inputPath, this.#platform);
+        const compared = comparisonPath(inputPath, this.#platform);
+        const segments = compared.split(/[\\/]+/).filter(Boolean);
+        let ruleId = null;
+        if (this.#roots.some((root) => compared === root || compared.startsWith(`${root}\\`))) {
+            ruleId = "protected.explicit-root";
+        }
+        else if (segments.some((segment) => segment === ".ssh")) {
+            ruleId = "protected.ssh";
+        }
+        else if (segments.some((segment) => segment === ".git")) {
+            ruleId = "protected.git-control";
+        }
+        else if (segments.some((segment) => [".codex", ".aws", ".azure", ".gnupg", ".kube"].includes(segment))) {
+            ruleId = "protected.codex-auth";
+        }
+        else if (/^[a-z]:\\windows\\system32\\config(?:\\|$)/i.test(compared)) {
+            ruleId = "protected.windows-credentials";
+        }
+        else if (/\\appdata\\(?:local|roaming)\\(?:google\\chrome|microsoft\\(?:edge|credentials|vault)|mozilla|codex|codexgpt)(?:\\|$)/i.test(compared)) {
+            ruleId = "protected.browser-or-codex-store";
+        }
+        return Object.freeze({
+            blocked: ruleId !== null,
+            ruleId,
+            pathFingerprint: fingerprint(compared)
+        });
+    }
+}
+function validateFileFacts(facts) {
+    if (!facts.volumeSerial || !facts.fileId || !Number.isSafeInteger(facts.numberOfLinks) || facts.numberOfLinks < 1) {
+        throw new Error("Stable file identity is unavailable.");
+    }
+    return Object.freeze({ ...facts });
+}
+export class ConfirmedRootFileGuard {
+    #inspect;
+    #protected;
+    constructor(options) {
+        this.#inspect = options.inspectFile;
+        this.#protected = options.protectedPolicy;
+    }
+    async inspectForRead(inputPath) {
+        if (this.#protected?.classify(inputPath).blocked) {
+            return { allowed: false, omissionCode: "PROTECTED_OR_LINKED_ENTRY", omitted: 1 };
+        }
+        const facts = validateFileFacts(await this.#inspect(inputPath));
+        if (facts.kind === "file" && facts.numberOfLinks !== 1) {
+            return { allowed: false, omissionCode: "PROTECTED_OR_LINKED_ENTRY", omitted: 1 };
+        }
+        return { allowed: true, binding: this.#binding(inputPath, facts) };
+    }
+    async bindForMutation(inputPath) {
+        if (this.#protected?.classify(inputPath).blocked)
+            throw new Error("Protected paths cannot be mutated.");
+        const facts = validateFileFacts(await this.#inspect(inputPath));
+        if (facts.kind === "file" && facts.numberOfLinks !== 1) {
+            throw new Error("Confirmed-root mutations reject hard links.");
+        }
+        return this.#binding(inputPath, facts);
+    }
+    async revalidate(binding) {
+        const facts = validateFileFacts(await this.#inspect(binding.canonicalPath));
+        if (facts.volumeSerial !== binding.volumeSerial ||
+            facts.fileId !== binding.fileId ||
+            facts.numberOfLinks !== binding.numberOfLinks ||
+            facts.kind !== binding.kind)
+            throw new Error("Confirmed-root file identity drift detected.");
+    }
+    #binding(inputPath, facts) {
+        return Object.freeze({ ...facts, canonicalPath: inputPath, pathFingerprint: fingerprint(comparisonPath(inputPath, process.platform)) });
+    }
+}
+//# sourceMappingURL=protectedRoots.js.map

package/dist/access/protectedRoots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protectedRoots.js","sourceRoot":"","sources":["../../src/access/protectedRoots.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAazC,SAAS,cAAc,CAAC,KAAa,EAAE,QAAyB;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzF,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAa,EAAE,WAA4B,OAAO,CAAC,QAAQ;IACtG,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACxE,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC7F,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC5E,IAAI,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAClG,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QACtF,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAChG,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAChE,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC5H,IAAI,iDAAiD,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACzI,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,MAAM,OAAO,mBAAmB;IACrB,SAAS,CAAkB;IAC3B,MAAM,CAAoB;IAEnC,YAAY,UAAsC,EAAE;QAClD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACvE,4BAA4B,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACpD,OAAO,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,QAAQ;QACN,OAAO,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,QAAQ,CAAC,SAAiB;QACxB,4BAA4B,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,MAAM,GAAkB,IAAI,CAAC;QAEjC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC;YACtF,MAAM,GAAG,yBAAyB,CAAC;QACrC,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,MAAM,CAAC,EAAE,CAAC;YAC1D,MAAM,GAAG,eAAe,CAAC;QAC3B,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,MAAM,CAAC,EAAE,CAAC;YAC1D,MAAM,GAAG,uBAAuB,CAAC;QACnC,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACzG,MAAM,GAAG,sBAAsB,CAAC;QAClC,CAAC;aAAM,IAAI,6CAA6C,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxE,MAAM,GAAG,+BAA+B,CAAC;QAC3C,CAAC;aAAM,IAAI,wHAAwH,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnJ,MAAM,GAAG,kCAAkC,CAAC;QAC9C,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,KAAK,IAAI;YACxB,MAAM;YACN,eAAe,EAAE,WAAW,CAAC,QAAQ,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;CACF;AAmBD,SAAS,iBAAiB,CAAC,KAA2B;IACpD,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;QAClH,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,OAAO,sBAAsB;IACxB,QAAQ,CAA+C;IACvD,UAAU,CAAuB;IAE1C,YAAY,OAAsC;QAChD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAiB;QAIpC,IAAI,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACnF,CAAC;QACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACnF,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,IAAI,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxG,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAA4B;QAC3C,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;QAC5E,IACE,KAAK,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY;YAC3C,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAC/B,KAAK,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa;YAC7C,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;YAC3B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACpE,CAAC;IAED,QAAQ,CAAC,SAAiB,EAAE,KAA2B;QACrD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1I,CAAC;CACF"}

package/dist/access/rootAdmission.js

@@ -0,0 +1,347 @@
+import { createHash, randomBytes as nodeRandomBytes } from "node:crypto";
+import { FullAccessLeaseManager } from "./fullAccessLease.js";
+import { ProtectedRootPolicy, assertConfirmedRootPathInput } from "./protectedRoots.js";
+import { describeProcessResource } from "../policy/resources.js";
+import { semanticDigest } from "../policy/authorizationFacts.js";
+function canonical(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    const object = value;
+    return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${canonical(object[key])}`).join(",")}}`;
+}
+function digest(value) {
+    return `sha256:${createHash("sha256").update(canonical(value), "utf8").digest("hex")}`;
+}
+function validateBinding(binding) {
+    if (binding.contractVersion !== 3)
+        throw new Error("Confirmed-root admission requires contract V3.");
+    for (const [key, value] of Object.entries(binding)) {
+        if (value === null || key === "contractVersion")
+            continue;
+        if (typeof value !== "string" || !value || /[\u0000-\u001f\u007f]/.test(value))
+            throw new Error(`Invalid root-admission binding: ${key}.`);
+    }
+    return Object.freeze({ ...binding });
+}
+function validateLeaseMs(value) {
+    if (!Number.isSafeInteger(value) || value < 60_000 || value > 30 * 60_000)
+        throw new Error("Root lease must be between one and thirty minutes.");
+    return value;
+}
+function stableRootIdentity(value) {
+    if (!value.canonicalRoot || !value.comparisonKey || !value.volumeSerial || !value.directoryId) {
+        throw new Error("Stable root identity is unavailable.");
+    }
+    if (value.reparsePoint)
+        throw new Error("Confirmed roots cannot be reparse points or junctions.");
+    if (value.mappedDrive)
+        throw new Error("Mapped drives are not eligible confirmed roots.");
+    return Object.freeze({ ...value });
+}
+export function createStatFreeRootAdmissionRequest(input) {
+    // Intentionally lexical only. The optional callback exists solely so tests can
+    // prove this boundary never asks an oracle to stat, enumerate, or canonicalize.
+    void input.onFilesystemProbe;
+    if (typeof input.root !== "string" || !input.root.trim() || input.root.includes("\0"))
+        throw new Error("Root input is invalid.");
+    if (input.access !== "read_only" && input.access !== "read_write")
+        throw new Error("Root access class is invalid.");
+    const binding = validateBinding(input.binding);
+    const leaseMs = validateLeaseMs(input.leaseMs);
+    const root = input.root.trim();
+    const bindingFingerprint = digest(binding);
+    const requestFingerprint = digest({ lexicalRoot: root, access: input.access, leaseMs, bindingFingerprint });
+    return Object.freeze({
+        publicRequest: Object.freeze({ schemaVersion: 1, access: input.access, leaseMs, requestFingerprint, bindingFingerprint }),
+        localRequest: Object.freeze({ schemaVersion: 1, root, access: input.access, leaseMs, requestFingerprint, bindingFingerprint, binding })
+    });
+}
+export class RootAdmissionCoordinator {
+    #oracle;
+    #leases;
+    #protectedPolicy;
+    #now;
+    #approvals = new Map();
+    #tail = Promise.resolve();
+    constructor(options) {
+        this.#oracle = options.identityOracle;
+        this.#now = options.now ?? Date.now;
+        this.#protectedPolicy = options.protectedPolicy ?? new ProtectedRootPolicy();
+        this.#leases = options.leases ?? new FullAccessLeaseManager({ now: this.#now, randomBytes: options.randomBytes ?? nodeRandomBytes });
+    }
+    request(input) {
+        return createStatFreeRootAdmissionRequest(input);
+    }
+    async prepareLocalApproval(localRequest) {
+        const expected = createStatFreeRootAdmissionRequest({
+            root: localRequest.root,
+            access: localRequest.access,
+            leaseMs: localRequest.leaseMs,
+            binding: localRequest.binding
+        });
+        if (expected.localRequest.requestFingerprint !== localRequest.requestFingerprint ||
+            expected.localRequest.bindingFingerprint !== localRequest.bindingFingerprint)
+            throw new Error("Root admission request was modified before local review.");
+        assertConfirmedRootPathInput(localRequest.root);
+        const rootIdentity = stableRootIdentity(await this.#oracle.inspectRoot(localRequest.root));
+        if (this.#protectedPolicy.classify(rootIdentity.canonicalRoot).blocked) {
+            throw new Error("Protected roots cannot be admitted.");
+        }
+        const approvalId = `root_approval_${digest({ request: localRequest.requestFingerprint, rootIdentity }).slice(-32)}`;
+        const approval = Object.freeze({
+            schemaVersion: 1,
+            approvalId,
+            state: "prepared",
+            access: localRequest.access,
+            leaseMs: localRequest.leaseMs,
+            rootIdentity,
+            binding: structuredClone(localRequest.binding),
+            bindingFingerprint: localRequest.bindingFingerprint,
+            protectedPolicyRevision: this.#protectedPolicy.revision(),
+            expiresAt: new Date(this.#now() + 2 * 60_000).toISOString()
+        });
+        const existing = this.#approvals.get(approvalId);
+        if (existing && canonical(existing) !== canonical(approval))
+            throw new Error("Root approval identity collision.");
+        this.#approvals.set(approvalId, approval);
+        return structuredClone(approval);
+    }
+    consumeApproval(input) {
+        return this.#serialized(async () => {
+            const approval = this.#approvals.get(input.approvalId);
+            if (!approval)
+                throw new Error("Root approval was already consumed or is unknown.");
+            if (approval.state !== "prepared")
+                throw new Error("Root approval was already consumed.");
+            if (this.#now() >= Date.parse(approval.expiresAt)) {
+                this.#approvals.delete(input.approvalId);
+                throw new Error("Root approval expired.");
+            }
+            const binding = validateBinding(input.binding);
+            if (digest(binding) !== approval.bindingFingerprint)
+                throw new Error("Root approval binding is stale.");
+            if (this.#protectedPolicy.revision() !== approval.protectedPolicyRevision)
+                throw new Error("Root approval policy is stale.");
+            const current = stableRootIdentity(await this.#oracle.inspectRoot(approval.rootIdentity.canonicalRoot));
+            if (canonical(current) !== canonical(approval.rootIdentity))
+                throw new Error("Root approval is stale because root identity changed.");
+            if (this.#protectedPolicy.classify(current.canonicalRoot).blocked)
+                throw new Error("Root approval is stale because protection changed.");
+            // Burn before any random public handle is created. A failed handle issue is
+            // therefore fail-closed and cannot replay the one-use root approval.
+            this.#approvals.delete(input.approvalId);
+            const lease = this.#leases.create({
+                rootIdentity: current,
+                access: approval.access,
+                requestedLeaseMs: approval.leaseMs,
+                bindingFingerprint: approval.bindingFingerprint,
+                approvalId: approval.approvalId,
+                grantId: input.grantId ?? approval.approvalId
+            });
+            return { workspace: { id: lease.workspaceId, root: current.canonicalRoot }, lease };
+        });
+    }
+    leases() {
+        return this.#leases;
+    }
+    #serialized(operation) {
+        let resolve;
+        let reject;
+        const result = new Promise((res, rej) => { resolve = res; reject = rej; });
+        this.#tail = this.#tail.then(async () => {
+            try {
+                resolve(await operation());
+            }
+            catch (error) {
+                reject(error);
+            }
+        });
+        return result;
+    }
+}
+/**
+ * Process-local bridge between generic V3 approval records and root-specific
+ * local inspection. It never persists roots or changes configured allowedRoots.
+ */
+export class RootAdmissionRuntimeV3 {
+    #coordinator;
+    #currentBinding;
+    #pending = new Map();
+    #preparedByRequest = new Map();
+    constructor(options) {
+        this.#coordinator = new RootAdmissionCoordinator(options);
+        this.#currentBinding = options.currentBinding;
+    }
+    describe(toolName, args) {
+        if (toolName !== "open_full_access_workspace")
+            throw new Error("Root admission resolver supports only open_full_access_workspace.");
+        const parsed = this.#input(args);
+        const binding = this.#currentBinding?.();
+        const publicRequest = binding
+            ? this.#coordinator.request({ root: parsed.root, access: parsed.access, leaseMs: parsed.lease_ms ?? 30 * 60_000, binding }).publicRequest
+            : {
+                schemaVersion: 1,
+                access: parsed.access,
+                leaseMs: parsed.lease_ms ?? 30 * 60_000,
+                requestFingerprint: semanticDigest({ lexicalRoot: parsed.root, access: parsed.access, leaseMs: parsed.lease_ms ?? 30 * 60_000 }),
+                bindingFingerprint: semanticDigest({ binding: "resolved-after-context" })
+            };
+        const resource = describeProcessResource({
+            operation: "inspect",
+            workspaceId: null,
+            processId: `root-admission-${publicRequest.requestFingerprint.replace(/^sha256:/, "").slice(0, 24)}`,
+            persistence: false,
+            executable: null
+        });
+        return {
+            resource,
+            requiredCapabilities: [
+                { name: "filesystemReadBoundary", minimum: "brokered" },
+                ...(parsed.access === "read_write" ? [{ name: "filesystemWriteBoundary", minimum: "brokered" }] : [])
+            ],
+            requiredScopes: ["workspace:full-access"],
+            semanticFactsDigest: semanticDigest(publicRequest),
+            riskClass: "R3"
+        };
+    }
+    registerPendingApproval(externalApprovalId, args, binding) {
+        const parsed = this.#input(args);
+        const request = this.#coordinator.request({
+            root: parsed.root,
+            access: parsed.access,
+            leaseMs: parsed.lease_ms ?? 30 * 60_000,
+            binding
+        });
+        const existing = this.#pending.get(externalApprovalId);
+        if (existing && existing.requestFingerprint !== request.localRequest.requestFingerprint) {
+            throw new Error("Generic approval ID was rebound to a different root request.");
+        }
+        this.#pending.set(externalApprovalId, request.localRequest);
+    }
+    async prepareApproval(record) {
+        if (record.facts.toolName !== "open_full_access_workspace")
+            return;
+        const request = this.#pending.get(record.approvalId);
+        if (!request)
+            throw new Error("Root admission details are unavailable for local review.");
+        const already = this.#preparedByRequest.get(request.requestFingerprint);
+        if (already?.externalApprovalId === record.approvalId)
+            return;
+        const prepared = await this.#coordinator.prepareLocalApproval(request);
+        this.#preparedByRequest.set(request.requestFingerprint, {
+            externalApprovalId: record.approvalId,
+            internalApprovalId: prepared.approvalId,
+            canonicalRoot: prepared.rootIdentity.canonicalRoot,
+            access: prepared.access,
+            leaseMs: prepared.leaseMs
+        });
+    }
+    approvalDisplay(record) {
+        if (record.facts.toolName !== "open_full_access_workspace")
+            return null;
+        const request = this.#pending.get(record.approvalId);
+        const prepared = request ? this.#preparedByRequest.get(request.requestFingerprint) : undefined;
+        if (!prepared)
+            return null;
+        return {
+            ...record.summary,
+            logicalScope: prepared.canonicalRoot,
+            authoritySummary: `${prepared.access === "read_write" ? "read-write" : "read-only"} confirmed root for ${prepared.leaseMs} ms; file broker only, not a process sandbox`,
+            revealArguments: [prepared.canonicalRoot]
+        };
+    }
+    async open(args, binding) {
+        const parsed = this.#input(args);
+        const activeBinding = binding ?? this.#currentBinding?.();
+        if (!activeBinding)
+            throw new Error("Root admission identity context is unavailable.");
+        const request = this.#coordinator.request({
+            root: parsed.root,
+            access: parsed.access,
+            leaseMs: parsed.lease_ms ?? 30 * 60_000,
+            binding: activeBinding
+        });
+        const prepared = this.#preparedByRequest.get(request.localRequest.requestFingerprint);
+        if (!prepared)
+            throw new Error("The locally approved root admission is stale or unavailable.");
+        const admitted = await this.#coordinator.consumeApproval({
+            approvalId: prepared.internalApprovalId,
+            binding: activeBinding,
+            grantId: prepared.externalApprovalId
+        });
+        this.#preparedByRequest.delete(request.localRequest.requestFingerprint);
+        this.#pending.delete(prepared.externalApprovalId);
+        return {
+            workspace_id: admitted.lease.workspaceId,
+            root: admitted.workspace.root,
+            access_class: "confirmed_root",
+            access: admitted.lease.access,
+            lease_id: admitted.lease.leaseId,
+            idle_expires_at: admitted.lease.idleExpiresAt,
+            absolute_expires_at: admitted.lease.absoluteExpiresAt
+        };
+    }
+    leases() {
+        return this.#coordinator.leases();
+    }
+    async close() {
+        for (const lease of this.#coordinator.leases().list())
+            this.#coordinator.leases().close(lease.workspaceId, "transport_closed");
+        await this.#coordinator.leases().drainRevocations();
+        this.#pending.clear();
+        this.#preparedByRequest.clear();
+    }
+    getWorkspace(workspaceId) {
+        const lease = this.#coordinator.leases().get(workspaceId);
+        const activeBinding = this.#currentBinding?.();
+        if (activeBinding && digest(activeBinding) !== lease.bindingFingerprint) {
+            this.#coordinator.leases().close(workspaceId, "policy_stale");
+            throw new Error("Confirmed-root workspace identity is stale.");
+        }
+        return {
+            id: lease.workspaceId,
+            root: lease.rootIdentity.canonicalRoot,
+            openedAt: lease.openedAt,
+            accessClass: "confirmed_root",
+            access: lease.access,
+            leaseId: lease.leaseId,
+            idleExpiresAt: lease.idleExpiresAt,
+            absoluteExpiresAt: lease.absoluteExpiresAt
+        };
+    }
+    listWorkspaces() {
+        const result = [];
+        for (const lease of this.#coordinator.leases().list()) {
+            try {
+                result.push(this.getWorkspace(lease.workspaceId));
+            }
+            catch { }
+        }
+        return result;
+    }
+    closeWorkspace(workspaceId) {
+        try {
+            this.getWorkspace(workspaceId);
+        }
+        catch {
+            return null;
+        }
+        this.#coordinator.leases().close(workspaceId, "closed");
+        return { workspaceId, closedAt: new Date().toISOString(), state: "closed" };
+    }
+    #input(args) {
+        const root = args.root;
+        const access = args.access;
+        const leaseMs = args.lease_ms;
+        if (typeof root !== "string" || (access !== "read_only" && access !== "read_write")) {
+            throw new Error("Invalid open_full_access_workspace input.");
+        }
+        if (leaseMs !== undefined && (!Number.isSafeInteger(leaseMs) || leaseMs < 60_000 || leaseMs > 30 * 60_000)) {
+            throw new Error("Invalid confirmed-root lease duration.");
+        }
+        return { root, access, ...(leaseMs === undefined ? {} : { lease_ms: leaseMs }) };
+    }
+}
+//# sourceMappingURL=rootAdmission.js.map

package/dist/access/rootAdmission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rootAdmission.js","sourceRoot":"","sources":["../../src/access/rootAdmission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAoD,MAAM,sBAAsB,CAAC;AAChH,OAAO,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AA+DjE,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACvE,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AACtH,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,eAAe,CAAC,OAA+B;IACtD,IAAI,OAAO,CAAC,eAAe,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACrG,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,IAAI,IAAI,GAAG,KAAK,iBAAiB;YAAE,SAAS;QAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,GAAG,CAAC,CAAC;IAC7I,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,MAAM,IAAI,KAAK,GAAG,EAAE,GAAG,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACjJ,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAqB;IAC/C,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,KAAK,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAClG,IAAI,KAAK,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC1F,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,KAMlD;IACC,+EAA+E;IAC/E,gFAAgF;IAChF,KAAK,KAAK,CAAC,iBAAiB,CAAC;IAC7B,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACjI,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACpH,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,kBAAkB,GAAG,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC5G,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,CAAC;QACzH,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;KACxI,CAAC,CAAC;AACL,CAAC;AAUD,MAAM,OAAO,wBAAwB;IAC1B,OAAO,CAAuB;IAC9B,OAAO,CAAyB;IAChC,gBAAgB,CAAsB;IACtC,IAAI,CAAe;IACnB,UAAU,GAAG,IAAI,GAAG,EAAkC,CAAC;IAChE,KAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEzC,YAAY,OAAwC;QAClD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,eAAe,IAAI,IAAI,mBAAmB,EAAE,CAAC;QAC7E,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,sBAAsB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,eAAe,EAAE,CAAC,CAAC;IACvI,CAAC;IAED,OAAO,CAAC,KAA+D;QACrE,OAAO,kCAAkC,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,YAAwD;QACjF,MAAM,QAAQ,GAAG,kCAAkC,CAAC;YAClD,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,OAAO,EAAE,YAAY,CAAC,OAAO;SAC9B,CAAC,CAAC;QACH,IACE,QAAQ,CAAC,YAAY,CAAC,kBAAkB,KAAK,YAAY,CAAC,kBAAkB;YAC5E,QAAQ,CAAC,YAAY,CAAC,kBAAkB,KAAK,YAAY,CAAC,kBAAkB;YAC5E,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,4BAA4B,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3F,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,UAAU,GAAG,iBAAiB,MAAM,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,kBAAkB,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACpH,MAAM,QAAQ,GAA2B,MAAM,CAAC,MAAM,CAAC;YACrD,aAAa,EAAE,CAAC;YAChB,UAAU;YACV,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,YAAY;YACZ,OAAO,EAAE,eAAe,CAAC,YAAY,CAAC,OAAO,CAAC;YAC9C,kBAAkB,EAAE,YAAY,CAAC,kBAAkB;YACnD,uBAAuB,EAAE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE;YACzD,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE;SAC5D,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAClH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC1C,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,eAAe,CAAC,KAAgF;QAC9F,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;YACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACvD,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACpF,IAAI,QAAQ,CAAC,KAAK,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAC1F,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,kBAAkB;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACxG,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,QAAQ,CAAC,uBAAuB;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAC7H,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC;YACxG,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACtI,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YAEzI,4EAA4E;YAC5E,qEAAqE;YACrE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBAChC,YAAY,EAAE,OAAO;gBACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,gBAAgB,EAAE,QAAQ,CAAC,OAAO;gBAClC,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;gBAC/C,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,UAAU;aAC9C,CAAC,CAAC;YACH,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC;QACtF,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,WAAW,CAAI,SAA2B;QACxC,IAAI,OAA6C,CAAC;QAClD,IAAI,MAAmC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,OAAO,CAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACtC,IAAI,CAAC;gBAAC,OAAO,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAMD;;;GAGG;AACH,MAAM,OAAO,sBAAsB;IACxB,YAAY,CAA2B;IACvC,eAAe,CAAgC;IAC/C,QAAQ,GAAG,IAAI,GAAG,EAAsD,CAAC;IACzE,kBAAkB,GAAG,IAAI,GAAG,EAMjC,CAAC;IAEL,YAAY,OAAsC;QAChD,IAAI,CAAC,YAAY,GAAG,IAAI,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;IAChD,CAAC;IAED,QAAQ,CAAC,QAAgB,EAAE,IAA6B;QACtD,IAAI,QAAQ,KAAK,4BAA4B;YAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACpI,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QACzC,MAAM,aAAa,GAAG,OAAO;YAC3B,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,aAAa;YACzI,CAAC,CAAC;gBACE,aAAa,EAAE,CAAU;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,GAAG,MAAM;gBACvC,kBAAkB,EAAE,cAAc,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;gBAChI,kBAAkB,EAAE,cAAc,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;aAC1E,CAAC;QACN,MAAM,QAAQ,GAAG,uBAAuB,CAAC;YACvC,SAAS,EAAE,SAAS;YACpB,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,kBAAkB,aAAa,CAAC,kBAAkB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;YACpG,WAAW,EAAE,KAAK;YAClB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,OAAO;YACL,QAAQ;YACR,oBAAoB,EAAE;gBACpB,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,UAAU,EAAE;gBACvD,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,yBAAkC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/G;YACD,cAAc,EAAE,CAAC,uBAAuB,CAAC;YACzC,mBAAmB,EAAE,cAAc,CAAC,aAAa,CAAC;YAClD,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,uBAAuB,CACrB,kBAA0B,EAC1B,IAA6B,EAC7B,OAA+B;QAE/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;YACxC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,GAAG,MAAM;YACvC,OAAO;SACR,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACvD,IAAI,QAAQ,IAAI,QAAQ,CAAC,kBAAkB,KAAK,OAAO,CAAC,YAAY,CAAC,kBAAkB,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAyB;QAC7C,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,4BAA4B;YAAE,OAAO;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC1F,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACxE,IAAI,OAAO,EAAE,kBAAkB,KAAK,MAAM,CAAC,UAAU;YAAE,OAAO;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE;YACtD,kBAAkB,EAAE,MAAM,CAAC,UAAU;YACrC,kBAAkB,EAAE,QAAQ,CAAC,UAAU;YACvC,aAAa,EAAE,QAAQ,CAAC,YAAY,CAAC,aAAa;YAClD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,eAAe,CAAC,MAAyB;QACvC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,4BAA4B;YAAE,OAAO,IAAI,CAAC;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO;YACL,GAAG,MAAM,CAAC,OAAO;YACjB,YAAY,EAAE,QAAQ,CAAC,aAAa;YACpC,gBAAgB,EAAE,GAAG,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,uBAAuB,QAAQ,CAAC,OAAO,8CAA8C;YACvK,eAAe,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC;SAC1C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAA6B,EAAE,OAAgC;QASxE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,aAAa,GAAG,OAAO,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QAC1D,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACvF,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;YACxC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,GAAG,MAAM;YACvC,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;QACtF,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAC/F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC;YACvD,UAAU,EAAE,QAAQ,CAAC,kBAAkB;YACvC,OAAO,EAAE,aAAa;YACtB,OAAO,EAAE,QAAQ,CAAC,kBAAkB;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAClD,OAAO;YACL,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW;YACxC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI;YAC7B,YAAY,EAAE,gBAAgB;YAC9B,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;YAC7B,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;YAChC,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa;YAC7C,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,iBAAiB;SACtD,CAAC;IACJ,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QAC/H,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,YAAY,CAAC,WAAmB;QAU9B,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1D,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QAC/C,IAAI,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACxE,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,WAAW;YACrB,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,aAAa;YACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,gBAAgB;YAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC3C,CAAC;IACJ,CAAC;IAED,cAAc;QACZ,MAAM,MAAM,GAAyD,EAAE,CAAC;QACxE,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YACtD,IAAI,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,cAAc,CAAC,WAAmB;QAChC,IAAI,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACxD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC9E,CAAC;IAED,MAAM,CAAC,IAA6B;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,YAAY,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAK,OAAkB,GAAG,MAAM,IAAK,OAAkB,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;YACnI,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAiB,EAAE,CAAC,EAAE,CAAC;IAC7F,CAAC;CACF"}

package/dist/analysis/cache.js

@@ -0,0 +1,27 @@
+const MAX_CACHE_ENTRIES = 8;
+const cache = new Map();
+export function getCachedWorkspaceAnalysis(key) {
+    const value = cache.get(key);
+    if (!value)
+        return undefined;
+    cache.delete(key);
+    cache.set(key, value);
+    return value;
+}
+export function setCachedWorkspaceAnalysis(key, value) {
+    cache.delete(key);
+    cache.set(key, value);
+    while (cache.size > MAX_CACHE_ENTRIES) {
+        const oldest = cache.keys().next().value;
+        if (!oldest)
+            break;
+        cache.delete(oldest);
+    }
+}
+export function invalidateWorkspaceAnalysis(workspaceId) {
+    for (const key of cache.keys()) {
+        if (key.startsWith(`${workspaceId}:`))
+            cache.delete(key);
+    }
+}
+//# sourceMappingURL=cache.js.map

package/dist/analysis/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/analysis/cache.ts"],"names":[],"mappings":"AAEA,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAA6B,CAAC;AAEnD,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,GAAW,EAAE,KAAwB;IAC9E,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,OAAO,KAAK,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAA2B,CAAC;QAC/D,IAAI,CAAC,MAAM;YAAE,MAAM;QACnB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,WAAmB;IAC7D,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/B,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}

package/dist/analysis/classify.js

@@ -0,0 +1,102 @@
+import path from "node:path";
+const LANGUAGE_BY_EXTENSION = {
+    ".ts": "typescript",
+    ".tsx": "typescript",
+    ".mts": "typescript",
+    ".cts": "typescript",
+    ".js": "javascript",
+    ".jsx": "javascript",
+    ".mjs": "javascript",
+    ".cjs": "javascript",
+    ".py": "python",
+    ".go": "go",
+    ".rs": "rust",
+    ".swift": "swift",
+    ".java": "java",
+    ".cs": "csharp",
+    ".c": "c",
+    ".h": "c",
+    ".cc": "cpp",
+    ".cpp": "cpp",
+    ".cxx": "cpp",
+    ".hpp": "cpp",
+    ".hh": "cpp",
+    ".json": "json",
+    ".yaml": "yaml",
+    ".yml": "yaml",
+    ".toml": "toml",
+    ".md": "markdown",
+    ".mdx": "markdown",
+    ".sh": "shell",
+    ".bash": "shell",
+    ".zsh": "shell"
+};
+const TEST_PATTERNS = [/(^|\/)(__tests__|test|tests|spec)\//i, /\.(test|spec)\.[^.]+$/i, /_test\.go$/i, /Tests?\.swift$/i];
+const GENERATED_PATTERNS = [/(^|\/)(generated|vendor|vendors|third_party)\//i, /\.generated\./i, /\.g\.(cs|dart)$/i];
+const INFRA_PATTERNS = [/(^|\/)(\.github|infra|infrastructure|terraform|deploy|k8s|helm)\//i, /(^|\/)Dockerfile$/i];
+const CONFIG_NAMES = new Set(["package.json", "tsconfig.json", "pyproject.toml", "Cargo.toml", "go.mod", "pom.xml", "build.gradle", "build.gradle.kts", "Package.swift"]);
+const ENTRYPOINT_NAMES = new Set(["index.ts", "index.js", "main.ts", "main.js", "main.py", "main.go", "main.rs", "lib.rs", "App.swift", "Program.cs"]);
+export function classifyLanguage(filePath) {
+    return LANGUAGE_BY_EXTENSION[path.extname(filePath).toLowerCase()] ?? "unknown";
+}
+export function isGeneratedFile(filePath) {
+    return GENERATED_PATTERNS.some((pattern) => pattern.test(filePath));
+}
+export function isEntrypoint(filePath) {
+    return ENTRYPOINT_NAMES.has(path.basename(filePath));
+}
+export function classifyFileRole(filePath, language = classifyLanguage(filePath)) {
+    const basename = path.basename(filePath);
+    if (isGeneratedFile(filePath))
+        return "generated";
+    if (TEST_PATTERNS.some((pattern) => pattern.test(filePath)))
+        return "test";
+    if (CONFIG_NAMES.has(basename) || /(^|\/)(config|configs)\//i.test(filePath))
+        return "config";
+    if (language === "markdown" || /(^|\/)docs?\//i.test(filePath))
+        return "docs";
+    if (INFRA_PATTERNS.some((pattern) => pattern.test(filePath)))
+        return "infrastructure";
+    if (["typescript", "javascript", "python", "go", "rust", "swift", "java", "csharp", "c", "cpp"].includes(language))
+        return "source";
+    return "other";
+}
+export function detectProjectTypes(files) {
+    const names = new Set(files.map((file) => path.basename(file.path)));
+    const detected = [];
+    if (names.has("package.json"))
+        detected.push("node");
+    if (names.has("pyproject.toml") || names.has("requirements.txt"))
+        detected.push("python");
+    if (names.has("go.mod"))
+        detected.push("go");
+    if (names.has("Cargo.toml"))
+        detected.push("rust");
+    if (names.has("Package.swift"))
+        detected.push("swift");
+    if (names.has("pom.xml") || names.has("build.gradle") || names.has("build.gradle.kts"))
+        detected.push("jvm");
+    if (files.some((file) => file.path.endsWith(".sln") || file.path.endsWith(".csproj")))
+        detected.push("dotnet");
+    if (names.has("CMakeLists.txt") || names.has("Makefile"))
+        detected.push("native");
+    return detected;
+}
+export function detectRiskSignals(filePath) {
+    const value = filePath.toLowerCase();
+    const risks = [];
+    if (/(auth|session|token|oauth|login)/.test(value))
+        risks.push("authentication");
+    if (/(migration|schema|prisma|drizzle)/.test(value))
+        risks.push("migration");
+    if (/(database|storage|repository|model)/.test(value))
+        risks.push("storage");
+    if (/(package\.json|lock|build|webpack|vite|tsconfig)/.test(value))
+        risks.push("build");
+    if (/(config|settings|\.ya?ml|\.toml)/.test(value))
+        risks.push("configuration");
+    if (/(api|public|export|route)/.test(value))
+        risks.push("public-api");
+    return [...new Set(risks)];
+}
+//# sourceMappingURL=classify.js.map

package/dist/analysis/classify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.js","sourceRoot":"","sources":["../../src/analysis/classify.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,qBAAqB,GAAqC;IAC9D,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,QAAQ;IACf,KAAK,EAAE,IAAI;IACX,KAAK,EAAE,MAAM;IACb,QAAQ,EAAE,OAAO;IACjB,OAAO,EAAE,MAAM;IACf,KAAK,EAAE,QAAQ;IACf,IAAI,EAAE,GAAG;IACT,IAAI,EAAE,GAAG;IACT,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,KAAK;IACb,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE,MAAM;IACf,OAAO,EAAE,MAAM;IACf,MAAM,EAAE,MAAM;IACd,OAAO,EAAE,MAAM;IACf,KAAK,EAAE,UAAU;IACjB,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,OAAO;IAChB,MAAM,EAAE,OAAO;CAChB,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,sCAAsC,EAAE,wBAAwB,EAAE,aAAa,EAAE,iBAAiB,CAAC,CAAC;AAC3H,MAAM,kBAAkB,GAAG,CAAC,iDAAiD,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;AACrH,MAAM,cAAc,GAAG,CAAC,oEAAoE,EAAE,oBAAoB,CAAC,CAAC;AACpH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,CAAC,CAAC,CAAC;AAC1K,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;AAEvJ,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,SAAS,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,OAAO,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC;IACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,eAAe,CAAC,QAAQ,CAAC;QAAE,OAAO,WAAW,CAAC;IAClD,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3E,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9F,IAAI,QAAQ,KAAK,UAAU,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9E,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACtF,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACpI,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAsB;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1F,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7G,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/G,IAAI,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjF,IAAI,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7E,IAAI,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7E,IAAI,kDAAkD,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxF,IAAI,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChF,IAAI,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC"}