cool-workflow 0.1.97 → 0.2.0

package/dist/shell/run-store.js

@@ -0,0 +1,164 @@
+"use strict";
+// shell/run-store.ts — loadRunFromCwd, saveCheckpoint, compactCheckpoint.
+//
+// MILESTONE 3. The ONLY place state.json is read or written. Byte-exact
+// port of the old build's src/state.ts load/save/compact functions, now
+// split so the migration DECISION logic lives in core/state/migrations.ts
+// and this file is the thin impure shell around it (disk read, lock,
+// durable write).
+//
+// Evidence: SPEC/state-core.md "src/state.ts — persistence kernel",
+// "Write ordering and atomic rules", "compactCheckpoint on a run with no
+// empty optional arrays writes nothing".
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureRunDirs = exports.createRunPaths = void 0;
+exports.hashArtifactFile = hashArtifactFile;
+exports.loadRunStateFile = loadRunStateFile;
+exports.checkRunStateFile = checkRunStateFile;
+exports.migrateRunStateFile = migrateRunStateFile;
+exports.loadRunFromCwd = loadRunFromCwd;
+exports.saveCheckpoint = saveCheckpoint;
+exports.compactCheckpoint = compactCheckpoint;
+exports.createRun = createRun;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const fs_atomic_1 = require("./fs-atomic");
+const run_paths_1 = require("../core/state/run-paths");
+Object.defineProperty(exports, "createRunPaths", { enumerable: true, get: function () { return run_paths_1.createRunPaths; } });
+Object.defineProperty(exports, "ensureRunDirs", { enumerable: true, get: function () { return run_paths_1.ensureRunDirs; } });
+const migrations_1 = require("../core/state/migrations");
+const hash_1 = require("../core/hash");
+/** Read the file at artifact.path and stamp sha256 (the core `sha256:`+hex
+ *  form) + sizeBytes onto the StateArtifact. A missing/unreadable file is
+ *  silently skipped so hashing an absent artifact never throws. Byte-exact
+ *  port of the old flat src/state.ts:hashArtifactFile. */
+function hashArtifactFile(artifact) {
+    try {
+        const content = fs.readFileSync(artifact.path, "utf8");
+        artifact.sha256 = (0, hash_1.sha256)(content);
+        artifact.sizeBytes = Buffer.byteLength(content, "utf8");
+    }
+    catch {
+        /* file missing — silently skip */
+    }
+    return artifact;
+}
+/** Dry-run load + migrate a state.json at an explicit path. */
+function loadRunStateFile(statePath, options = {}) {
+    return (0, migrations_1.migrateRunState)((0, fs_atomic_1.readJson)(statePath), {
+        statePath,
+        dryRun: options.dryRun === undefined ? true : options.dryRun,
+    });
+}
+/** Same as `loadRunStateFile` with `dryRun: true`. */
+function checkRunStateFile(statePath) {
+    return loadRunStateFile(statePath, { dryRun: true });
+}
+/** Dry-run unless `write: true`; writes the migrated state back with
+ *  `writeJson` ONLY when status is not `unsupported` AND `write` AND
+ *  `report.writeRequired`. */
+function migrateRunStateFile(statePath, options = {}) {
+    const result = loadRunStateFile(statePath, { dryRun: !options.write });
+    if (result.report.status !== "unsupported" && options.write && result.report.writeRequired) {
+        (0, fs_atomic_1.writeJson)(statePath, result.run);
+    }
+    return result;
+}
+/** Refuses an empty id with `Missing run id`; loads
+ *  `<cwd>/.cw/runs/<runId>/state.json` (dry-run — never writes); throws
+ *  `Unsupported CW run state: <errors joined by "; ">` on an unsupported
+ *  verdict; else returns the migrated WorkflowRun in memory. */
+function loadRunFromCwd(runId, cwd = process.cwd()) {
+    if (!runId)
+        throw new Error("Missing run id");
+    (0, fs_atomic_1.assertSafeRunId)(runId);
+    const statePath = path.join(cwd, ".cw", "runs", runId, "state.json");
+    const result = loadRunStateFile(statePath, { dryRun: true });
+    if (result.report.status === "unsupported") {
+        throw new Error(`Unsupported CW run state: ${result.report.errors.join("; ")}`);
+    }
+    return result.run;
+}
+/** state.json is the single source of truth — set `updatedAt`, then write
+ *  it DURABLY with a lock so concurrent processes never lose an update. */
+function saveCheckpoint(run) {
+    run.updatedAt = new Date().toISOString();
+    (0, fs_atomic_1.withFileLock)(run.paths.state, () => {
+        (0, fs_atomic_1.writeJson)(run.paths.state, run, { durable: true });
+    });
+}
+const OPTIONAL_EMPTY_ARRAY_KEYS = ["nodes", "contracts", "feedback", "workers", "sandboxProfiles", "candidates", "candidateSelections"];
+/** Strip the 7 top-level optional-array keys when each is an empty array
+ *  (normalizeRunState backfills these on load, so stripping saves disk
+ *  without losing information). Returns the count stripped; writes nothing
+ *  (and calls `saveCheckpoint` zero times) when nothing was stripped. */
+function compactCheckpoint(run) {
+    let stripped = 0;
+    const state = run;
+    for (const key of OPTIONAL_EMPTY_ARRAY_KEYS) {
+        if (Array.isArray(state[key]) && state[key].length === 0) {
+            delete state[key];
+            stripped++;
+        }
+    }
+    if (stripped > 0)
+        saveCheckpoint(run);
+    return stripped;
+}
+/** Creates a brand-new run's initial `state.json` on disk: makes the run
+ *  directory tree, migrates `{}` through `normalizeRunState` (so every
+ *  default lands exactly like a real legacy-run migration would), stamps
+ *  `id`/`workflow.id`/`workflow.title`, and durably writes `state.json`.
+ *  This is the minimal "create a run" mechanism this milestone needs to
+ *  drive the state kernel end to end; the real `plan`/`quickstart`
+ *  pipeline (later milestones) layers phases/tasks/inputs on top of this
+ *  same primitive. */
+function createRun(runDir, runId, workflowId, cwd) {
+    const paths = (0, run_paths_1.createRunPaths)(runDir);
+    (0, run_paths_1.ensureRunDirs)(paths);
+    const seed = {
+        id: runId,
+        cwd,
+        workflowId,
+        paths: paths,
+    };
+    const { run, report } = (0, migrations_1.migrateRunState)(seed, { statePath: paths.state, dryRun: false });
+    if (report.status === "unsupported") {
+        throw new Error(`Unsupported CW run state: ${report.errors.join("; ")}`);
+    }
+    (0, fs_atomic_1.writeJson)(paths.state, run, { durable: true });
+    return run;
+}

package/dist/{sandbox-profile.js → shell/sandbox-profile.js}

@@ -1,7 +1,44 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
+// shell/sandbox-profile.ts — the 4 bundled sandbox profiles, resolution,
+// validation, and the runtime read/write/command/network checks.
+//
+// MILESTONE 5 (v2/PLAN.md build order, step 5). Byte-exact port of
+// plugins/cool-workflow/src/sandbox-profile.ts.
+//
+// Evidence: SPEC/execution-backend.md "Sandbox profiles".
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SandboxProfileError = exports.DEFAULT_SANDBOX_PROFILE_ID = exports.SANDBOX_PROFILE_SCHEMA_VERSION = void 0;
 exports.bundledSandboxProfileIds = bundledSandboxProfileIds;
@@ -18,12 +55,12 @@ exports.validateSandboxWrite = validateSandboxWrite;
 exports.validateSandboxRead = validateSandboxRead;
 exports.validateSandboxCommand = validateSandboxCommand;
 exports.validateSandboxNetwork = validateSandboxNetwork;
-exports.upsertRunSandboxPolicy = upsertRunSandboxPolicy;
-exports.sandboxContextForRun = sandboxContextForRun;
 exports.sandboxContextForValidation = sandboxContextForValidation;
-const node_fs_1 = __importDefault(require("node:fs"));
-const node_path_1 = __importDefault(require("node:path"));
-const state_1 = require("./state");
+exports.sandboxContextForRun = sandboxContextForRun;
+exports.persistCustomSandboxProfile = persistCustomSandboxProfile;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const fs_atomic_1 = require("./fs-atomic");
 exports.SANDBOX_PROFILE_SCHEMA_VERSION = 1;
 exports.DEFAULT_SANDBOX_PROFILE_ID = "default";
 class SandboxProfileError extends Error {
@@ -53,8 +90,8 @@ const BUNDLED_PROFILE_DEFINITIONS = [
         env: { inherit: false, expose: [] },
         hostInstructions: [
             "Run with the host's normal process policy.",
-            "Preserve CW output acceptance checks for result.md, artifacts/, and logs/."
-        ]
+            "Preserve CW output acceptance checks for result.md, artifacts/, and logs/.",
+        ],
     },
     {
         schemaVersion: exports.SANDBOX_PROFILE_SCHEMA_VERSION,
@@ -69,8 +106,8 @@ const BUNDLED_PROFILE_DEFINITIONS = [
         env: { inherit: false, expose: [] },
         hostInstructions: [
             "Deny network access unless the operator explicitly layers a site policy over this profile.",
-            "Mount or expose the workspace read-only when the agent host supports it."
-        ]
+            "Mount or expose the workspace read-only when the agent host supports it.",
+        ],
     },
     {
         schemaVersion: exports.SANDBOX_PROFILE_SCHEMA_VERSION,
@@ -85,8 +122,8 @@ const BUNDLED_PROFILE_DEFINITIONS = [
         env: { inherit: false, expose: [] },
         hostInstructions: [
             "Use only for workers that are expected to modify repository files.",
-            "Keep CW run state writes under CW control; workers should still return results through worker output."
-        ]
+            "Keep CW run state writes under CW control; workers should still return results through worker output.",
+        ],
     },
     {
         schemaVersion: exports.SANDBOX_PROFILE_SCHEMA_VERSION,
@@ -101,9 +138,9 @@ const BUNDLED_PROFILE_DEFINITIONS = [
         env: { inherit: false, expose: [] },
         hostInstructions: [
             "Expose only input.md and result.md to the worker when host sandboxing is available.",
-            "Do not provide shell command execution, network access, or inherited environment variables."
-        ]
-    }
+            "Do not provide shell command execution, network access, or inherited environment variables.",
+        ],
+    },
 ];
 function bundledSandboxProfileIds() {
     return BUNDLED_PROFILE_DEFINITIONS.map((profile) => profile.id).sort();
@@ -118,7 +155,7 @@ function showBundledSandboxProfile(id, context = defaultSandboxContext()) {
     const profile = BUNDLED_PROFILE_DEFINITIONS.find((candidate) => candidate.id === id);
     if (!profile) {
         throw new SandboxProfileError("sandbox-profile-not-found", `Sandbox profile not found: ${id}`, {
-            details: { requestedProfileId: id, bundledProfileIds: BUNDLED_PROFILE_DEFINITIONS.map((candidate) => candidate.id) }
+            details: { requestedProfileId: id, bundledProfileIds: BUNDLED_PROFILE_DEFINITIONS.map((candidate) => candidate.id) },
         });
     }
     return resolveSandboxProfile(profile, context);
@@ -127,34 +164,21 @@ function resolveSandboxProfileById(id, context = defaultSandboxContext()) {
     const requested = id || exports.DEFAULT_SANDBOX_PROFILE_ID;
     if (isBundledSandboxProfileId(requested))
         return showBundledSandboxProfile(requested, context);
-    // A non-bundled id that resolves to a readable profile FILE is a CUSTOM profile:
-    // validate and ENFORCE it (the resolved policy snapshots onto the worker scope).
-    // This closes the gap where `sandbox validate` accepted a custom profile that
-    // dispatch/worker-isolation then refused — validated but never enforceable.
-    // A non-bundled, non-file id still fails closed via showBundledSandboxProfile.
-    const absolute = node_path_1.default.resolve(context.cwd, requested);
-    if (!absolute.startsWith(node_path_1.default.resolve(context.cwd) + node_path_1.default.sep) && absolute !== node_path_1.default.resolve(context.cwd)) {
+    const absolute = path.resolve(context.cwd, requested);
+    if (!absolute.startsWith(path.resolve(context.cwd) + path.sep) && absolute !== path.resolve(context.cwd)) {
         throw new SandboxProfileError("sandbox-profile-path-escape", `Custom profile path traversal denied: ${requested}`, {
-            details: { requested }
+            details: { requested },
         });
     }
-    if (node_fs_1.default.existsSync(absolute) && node_fs_1.default.statSync(absolute).isFile()) {
+    if (fs.existsSync(absolute) && fs.statSync(absolute).isFile()) {
         const result = validateSandboxProfileFile(requested, context);
         if (!result.valid || !result.profile) {
             throw new SandboxProfileError("sandbox-profile-invalid", `Custom sandbox profile is invalid: ${requested}`, {
-                details: { issues: result.issues }
+                details: { issues: result.issues },
             });
         }
         return result.profile;
     }
-    // H7: a custom profile loaded from a FILE at dispatch persists as a DEFINITION
-    // in run.customSandboxProfiles (threaded here as context.customProfiles). After a
-    // worker scope snapshot is lost, the boundary re-resolves by the profile's
-    // LOGICAL id (e.g. "my-custom"), and the dispatch-time file path is gone. Resolve
-    // the persisted definition against the CURRENT (worker) context so worker-specific
-    // path tokens ($workerDir etc.) bind to THIS worker — re-enforcing the same
-    // policy instead of throwing not-found. This runs only after the bundled +
-    // file-path branches, so a custom id never shadows a bundled or on-disk profile.
     const customDefinition = context.customProfiles?.[requested];
     if (customDefinition) {
         return resolveSandboxProfile(customDefinition, context);
@@ -165,7 +189,7 @@ function resolveSandboxProfile(profile, context = defaultSandboxContext()) {
     const issues = validateSandboxProfileDefinition(profile, context);
     if (issues.length) {
         throw new SandboxProfileError("sandbox-profile-invalid", `Sandbox profile ${profile.id || "(unknown)"} is invalid`, {
-            details: { issues }
+            details: { issues },
         });
     }
     const workerOutput = normalizeWorkerOutput(profile.workerOutput, context);
@@ -190,44 +214,40 @@ function resolveSandboxProfile(profile, context = defaultSandboxContext()) {
                 "profile validation",
                 "path normalization",
                 "worker result acceptance against sandbox write policy",
-                "durable ErrorFeedback for denied worker output"
+                "durable ErrorFeedback for denied worker output",
             ],
             hostRequired: [
                 "OS-level read isolation",
                 "OS-level write isolation before result acceptance",
                 "process execution restrictions",
                 "network restrictions",
-                "environment variable filtering"
-            ]
+                "environment variable filtering",
+            ],
         },
         hostInstructions: profile.hostInstructions || [],
         resolvedAt: new Date().toISOString(),
-        metadata: profile.metadata
+        metadata: profile.metadata,
     };
 }
 function validateSandboxProfileFile(profileFile, context = defaultSandboxContext()) {
-    const absolutePath = node_path_1.default.resolve(profileFile);
+    const absolutePath = path.resolve(profileFile);
     const issues = [];
     if (hasTraversal(profileFile)) {
         issues.push(issue("sandbox-profile-invalid", `Profile file path contains traversal: ${profileFile}`, profileFile));
         return { valid: false, profileFile: absolutePath, issues };
     }
-    if (!node_fs_1.default.existsSync(absolutePath)) {
+    if (!fs.existsSync(absolutePath)) {
         issues.push(issue("sandbox-profile-invalid", `Profile file does not exist: ${absolutePath}`, absolutePath));
         return { valid: false, profileFile: absolutePath, issues };
     }
     let profile;
     try {
-        profile = JSON.parse(node_fs_1.default.readFileSync(absolutePath, "utf8"));
+        profile = JSON.parse(fs.readFileSync(absolutePath, "utf8"));
     }
     catch (error) {
         issues.push(issue("sandbox-profile-invalid", `Profile file is not valid JSON: ${messageOf(error)}`, absolutePath));
         return { valid: false, profileFile: absolutePath, issues };
     }
-    // Fail closed if a CUSTOM file reuses a BUNDLED id (H7 hardening): resolution is
-    // bundled-first, so a custom "default"/"workspace-write"/... would be silently
-    // shadowed by the WIDER bundled policy on a snapshot-loss re-resolve — widening
-    // the sandbox with no error. Reserve the bundled names for bundled profiles.
     if (profile && typeof profile.id === "string" && isBundledSandboxProfileId(profile.id)) {
         issues.push(issue("sandbox-profile-invalid", `Custom sandbox profile id "${profile.id}" is reserved (collides with a bundled profile); choose a different id`, absolutePath));
         return { valid: false, profileFile: absolutePath, issues };
@@ -260,7 +280,7 @@ function effectiveSandboxWritePaths(policy) {
     const workerPaths = [
         policy.workerOutput.result ? policy.metadata?.resultPath : undefined,
         policy.workerOutput.artifacts ? policy.metadata?.artifactsDir : undefined,
-        policy.workerOutput.logs ? policy.metadata?.logsDir : undefined
+        policy.workerOutput.logs ? policy.metadata?.logsDir : undefined,
     ].filter((value) => typeof value === "string" && value.length > 0);
     return uniqueResolvedPaths([...policy.writePaths, ...workerPaths], defaultSandboxContext());
 }
@@ -276,8 +296,8 @@ function sandboxPolicyForWorker(profileId, context) {
             inputPath: context.inputPath,
             resultPath: context.resultPath,
             artifactsDir: context.artifactsDir,
-            logsDir: context.logsDir
-        })
+            logsDir: context.logsDir,
+        }),
     };
 }
 function validateSandboxWrite(policy, rawPath, workerId = "") {
@@ -312,36 +332,65 @@ function validateSandboxNetwork(policy, target, workerId = "") {
     }
     return null;
 }
-function upsertRunSandboxPolicy(run, policy) {
-    run.sandboxProfiles = run.sandboxProfiles || [];
-    const existing = run.sandboxProfiles.findIndex((candidate) => candidate.id === policy.id);
-    run.sandboxProfiles =
-        existing >= 0
-            ? run.sandboxProfiles.map((candidate) => (candidate.id === policy.id ? policy : candidate))
-            : [...run.sandboxProfiles, policy];
+function sandboxContextForValidation(cwd = process.cwd()) {
+    const root = path.resolve(cwd);
+    const runDir = path.join(root, ".cw", "runs", "_sandbox-profile-validation");
+    const workerDir = path.join(runDir, "workers", "_worker");
+    return {
+        cwd: root,
+        runDir,
+        workerDir,
+        inputPath: path.join(workerDir, "input.md"),
+        resultPath: path.join(workerDir, "result.md"),
+        artifactsDir: path.join(workerDir, "artifacts"),
+        logsDir: path.join(workerDir, "logs"),
+    };
 }
+// H7: a run-scoped resolution context. Threads run.customSandboxProfiles as
+// customProfiles so a worker-boundary re-resolve by logical id can find and
+// re-resolve a CUSTOM profile after a scope snapshot is lost — re-resolving
+// against the worker context (not a dispatch-time file path).
 function sandboxContextForRun(run) {
     return {
         cwd: run.cwd,
         runDir: run.paths.runDir,
-        // H7: thread persisted custom profile DEFINITIONS so a boundary re-resolve by
-        // logical id can find + re-resolve a custom profile after snapshot loss.
-        customProfiles: run.customSandboxProfiles
+        customProfiles: run.customSandboxProfiles,
     };
 }
-function sandboxContextForValidation(cwd = process.cwd()) {
-    const root = node_path_1.default.resolve(cwd);
-    const runDir = node_path_1.default.join(root, ".cw", "runs", "_sandbox-profile-validation");
-    const workerDir = node_path_1.default.join(runDir, "workers", "_worker");
-    return {
-        cwd: root,
-        runDir,
-        workerDir,
-        inputPath: node_path_1.default.join(workerDir, "input.md"),
-        resultPath: node_path_1.default.join(workerDir, "result.md"),
-        artifactsDir: node_path_1.default.join(workerDir, "artifacts"),
-        logsDir: node_path_1.default.join(workerDir, "logs")
-    };
+// H7: if the requested profile is a CUSTOM profile loaded from a FILE (a
+// non-bundled id that resolves to a readable, valid profile file), persist its
+// raw DEFINITION onto run.customSandboxProfiles keyed by the definition's logical
+// id. We store the DEFINITION (path tokens intact), not a resolved policy, so
+// worker-specific tokens re-bind to the correct worker context on every later
+// re-resolve. Bundled ids and unknown ids are left untouched, so this never
+// shadows a bundled profile or masks a fail-closed. Throws on an id collision:
+// the same logical id mapped to a DIFFERENT profile file is a caller mistake.
+function persistCustomSandboxProfile(run, requested) {
+    if (!requested || isBundledSandboxProfileId(requested))
+        return;
+    const absolute = path.resolve(requested);
+    if (!fs.existsSync(absolute) || !fs.statSync(absolute).isFile())
+        return;
+    const validation = validateSandboxProfileFile(requested, sandboxContextForValidation(run.cwd));
+    if (!validation.valid || !validation.profile)
+        return;
+    let definition;
+    try {
+        definition = JSON.parse(fs.readFileSync(absolute, "utf8"));
+    }
+    catch {
+        return;
+    }
+    if (!definition || typeof definition !== "object" || typeof definition.id !== "string" || !definition.id)
+        return;
+    const profiles = (run.customSandboxProfiles || {});
+    const previous = profiles[definition.id];
+    if (previous && JSON.stringify(previous) !== JSON.stringify(definition)) {
+        throw new Error(`Sandbox profile id collision: "${definition.id}" is already defined by a different custom profile ` +
+            `(source: ${absolute}). Use a unique id in each custom profile file.`);
+    }
+    profiles[definition.id] = definition;
+    run.customSandboxProfiles = profiles;
 }
 function validateSandboxPathAccess(mode, policy, rawPath, allowedPaths, workerId) {
     if (hasTraversal(rawPath)) {
@@ -350,23 +399,15 @@ function validateSandboxPathAccess(mode, policy, rawPath, allowedPaths, workerId
     if (hasControlCharacters(rawPath)) {
         return denied(`sandbox-${mode}-denied`, `Worker ${workerId} ${mode} path is malformed: ${rawPath}`, rawPath, allowedPaths);
     }
-    const candidate = node_path_1.default.resolve(rawPath);
-    // Symlink-hardened (v0.1.40 self-audit P1): isContainedPath realpaths both sides
-    // so a planted symlink whose textual path looks "inside" an allowed root but
-    // whose real target escapes it is denied, not silently accepted.
-    const insideAllowedPath = allowedPaths.some((allowed) => (0, state_1.isContainedPath)(candidate, allowed));
+    const candidate = path.resolve(rawPath);
+    const insideAllowedPath = allowedPaths.some((allowed) => (0, fs_atomic_1.isContainedPath)(candidate, allowed));
     if (!insideAllowedPath) {
         return denied(`sandbox-${mode}-denied`, `Worker ${workerId} ${mode} path is outside sandbox profile ${policy.id}: ${candidate}`, candidate, allowedPaths);
     }
     return null;
 }
 function denied(code, message, candidatePath, allowedPaths) {
-    return {
-        code,
-        message,
-        path: candidatePath,
-        allowedPaths
-    };
+    return { code, message, path: candidatePath, allowedPaths };
 }
 function defaultSandboxContext() {
     return sandboxContextForValidation(process.cwd());
@@ -414,7 +455,7 @@ function resolveProfilePath(value, context) {
     if (hasTraversal(expanded)) {
         throw new SandboxProfileError("sandbox-profile-invalid", `Sandbox path contains traversal: ${value}`, { path: value });
     }
-    return node_path_1.default.resolve(context.cwd, expanded);
+    return path.resolve(context.cwd, expanded);
 }
 function expandPathToken(value, context) {
     const tokens = {
@@ -424,15 +465,13 @@ function expandPathToken(value, context) {
         $inputPath: context.inputPath,
         $resultPath: context.resultPath,
         $artifactsDir: context.artifactsDir,
-        $logsDir: context.logsDir
+        $logsDir: context.logsDir,
     };
     if (!value.startsWith("$"))
         return value;
     const replacement = tokens[value];
     if (!replacement) {
-        throw new SandboxProfileError("sandbox-profile-invalid", `Unknown or unavailable sandbox path token: ${value}`, {
-            path: value
-        });
+        throw new SandboxProfileError("sandbox-profile-invalid", `Unknown or unavailable sandbox path token: ${value}`, { path: value });
     }
     return replacement;
 }
@@ -440,27 +479,27 @@ function normalizeWorkerOutput(policy, context) {
     return {
         result: policy?.result ?? true,
         artifacts: context.allowArtifacts ?? policy?.artifacts ?? true,
-        logs: context.allowLogs ?? policy?.logs ?? true
+        logs: context.allowLogs ?? policy?.logs ?? true,
     };
 }
 function normalizeExecute(policy) {
     return {
         mode: policy?.mode || "none",
         allow: policy?.allow ? [...policy.allow] : undefined,
-        deny: policy?.deny ? [...policy.deny] : undefined
+        deny: policy?.deny ? [...policy.deny] : undefined,
     };
 }
 function normalizeNetwork(policy) {
     return {
         mode: policy?.mode || "none",
-        allow: policy?.allow ? [...policy.allow] : undefined
+        allow: policy?.allow ? [...policy.allow] : undefined,
     };
 }
 function normalizeEnv(policy) {
     return {
         inherit: Boolean(policy?.inherit),
         expose: policy?.expose ? [...policy.expose] : [],
-        deny: policy?.deny ? [...policy.deny] : undefined
+        deny: policy?.deny ? [...policy.deny] : undefined,
     };
 }
 function validateCommandPolicy(policy, issues) {
@@ -506,7 +545,7 @@ function hasTraversal(value) {
     return value.split(/[\\/]+/).includes("..");
 }
 function hasControlCharacters(value) {
-    return /[\u0000-\u001f]/.test(value);
+    return /[\x00-\x1f]/.test(value);
 }
 function compactMetadata(value) {
     const entries = Object.entries(value).filter(([, entry]) => entry !== undefined);