dodo-mcp 1.0.0

package/dist/workspace/fs.js

@@ -0,0 +1,305 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { DodoError } from '../errors.js';
+import { IgnoreEngine } from './ignores.js';
+import { sha256Bytes } from '../util/hash.js';
+import { decodeUtf8Strict, looksBinary } from '../util/bytes.js';
+import { assertWindowsSegment, isWithinPath } from '../platform/pathPolicy.js';
+const MAX_PATH_LENGTH = 1024;
+const MAX_SEGMENTS = 64;
+export class WorkspaceFS {
+    root;
+    ignores;
+    constructor(rootRealPath, ignores) {
+        // Windows may expose the same directory through an 8.3 path (notably
+        // os.tmpdir() on service accounts) while realpathSync.native() returns
+        // its long spelling.  Keep one canonical spelling inside the policy so
+        // containment checks compare like with like.  Relative tool input is
+        // still checked component-by-component below and aliases remain denied.
+        this.root = process.platform === 'win32' ? fs.realpathSync.native(rootRealPath) : rootRealPath;
+        this.ignores = ignores;
+    }
+    /**
+     * Lexical validation only — no filesystem access. Rejects traversal,
+     * absolute/drive/UNC forms, NUL, backslashes, oversize.
+     */
+    normalizeRel(input) {
+        if (typeof input !== 'string')
+            throw new DodoError('PATH_DENIED', 'path must be a string');
+        if (input.length === 0)
+            throw new DodoError('PATH_DENIED', 'path must not be empty (use "." for the root)');
+        if (input.length > MAX_PATH_LENGTH)
+            throw new DodoError('PATH_DENIED', 'path too long');
+        if (input.includes('\0'))
+            throw new DodoError('PATH_DENIED', 'path contains NUL');
+        if (input.includes('\\'))
+            throw new DodoError('PATH_DENIED', 'use forward slashes; backslash paths are rejected');
+        if (input.startsWith('/') || input.startsWith('~')) {
+            throw new DodoError('PATH_DENIED', 'absolute and home paths are rejected; paths are workspace-relative');
+        }
+        if (/^[A-Za-z]:/.test(input))
+            throw new DodoError('PATH_DENIED', 'drive-letter paths are rejected');
+        if (input === '.')
+            return '.';
+        const segments = [];
+        for (const seg of input.split('/')) {
+            if (seg === '' || seg === '.')
+                continue;
+            if (seg === '..')
+                throw new DodoError('PATH_DENIED', 'path traversal ("..") is rejected');
+            if (process.platform === 'win32')
+                assertWindowsSegment(seg);
+            segments.push(seg);
+        }
+        if (segments.length === 0)
+            return '.';
+        if (segments.length > MAX_SEGMENTS)
+            throw new DodoError('PATH_DENIED', 'too many path segments');
+        const rel = segments.join('/');
+        // Defense in depth: segment-aware containment (never bare startsWith).
+        const abs = path.resolve(this.root, rel);
+        if (!isWithinPath(this.root, abs)) {
+            throw new DodoError('PATH_DENIED', 'path escapes the workspace root');
+        }
+        return rel;
+    }
+    /** Canonicalize each existing Windows component and recheck secret policy.
+     * This rejects junction escapes and aliases, including 8.3 spellings that
+     * do not contain a recognizable tilde. No case-sensitive secret bypass. */
+    assertCanonicalComponent(abs) {
+        if (process.platform !== 'win32')
+            return;
+        const real = fs.realpathSync.native(abs);
+        if (!isWithinPath(this.root, real))
+            throw new DodoError('PATH_DENIED', 'canonical path escapes the workspace');
+        const rel = path.relative(this.root, real).split(path.sep).join('/') || '.';
+        if (this.ignores.isSecret(rel))
+            throw new DodoError('SECRET_PATH_DENIED', 'canonical path is denied by secret policy');
+        if (this.ignores.isProtected(rel))
+            throw new DodoError('PATH_DENIED', 'canonical path is protected');
+        if (path.resolve(abs).toLowerCase() !== path.resolve(real).toLowerCase())
+            throw new DodoError('PATH_DENIED', 'Windows path aliases/reparse redirections are refused; use the original long filename');
+    }
+    absOf(rel) {
+        return rel === '.' ? this.root : path.join(this.root, rel);
+    }
+    /**
+     * Validate a relative path against the full policy, walking every existing
+     * component with lstat (no symlink traversal anywhere on the path).
+     */
+    resolve(input, opts = {}) {
+        const rel = this.normalizeRel(input);
+        const rootStat = fs.lstatSync(this.root);
+        if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
+            throw new DodoError('PATH_DENIED', 'workspace root identity changed');
+        this.assertCanonicalComponent(this.root);
+        if (this.ignores.isSecret(rel)) {
+            throw new DodoError('SECRET_PATH_DENIED', `path is denied by secret policy`, { detail: { path: rel } });
+        }
+        if (this.ignores.isProtected(rel)) {
+            throw new DodoError('PATH_DENIED', 'path is protected', { detail: { path: rel } });
+        }
+        if (rel === '.') {
+            const st = fs.lstatSync(this.root);
+            return { rel, abs: this.root, stat: st };
+        }
+        const segments = rel.split('/');
+        let cur = this.root;
+        for (let i = 0; i < segments.length; i += 1) {
+            cur = path.join(cur, segments[i]);
+            let st;
+            try {
+                st = fs.lstatSync(cur);
+            }
+            catch (err) {
+                if (err.code === 'ENOENT') {
+                    if (opts.allowMissing) {
+                        // The missing suffix must not exist at all; the nearest existing
+                        // ancestor was already verified symlink-free above.
+                        return { rel, abs: path.join(this.root, rel), stat: undefined };
+                    }
+                    throw new DodoError('NOT_FOUND', `path not found`, { detail: { path: rel } });
+                }
+                throw new DodoError('PATH_DENIED', 'path is not accessible', { detail: { path: rel } });
+            }
+            if (st.isSymbolicLink()) {
+                throw new DodoError('PATH_DENIED', 'symlinks are not followed', { detail: { path: segments.slice(0, i + 1).join('/') } });
+            }
+            this.assertCanonicalComponent(cur);
+            const isFinal = i === segments.length - 1;
+            if (!isFinal && !st.isDirectory()) {
+                throw new DodoError('PATH_DENIED', 'path component is not a directory', { detail: { path: rel } });
+            }
+            if (isFinal) {
+                return { rel, abs: cur, stat: st };
+            }
+        }
+        /* istanbul ignore next -- unreachable */
+        throw new DodoError('INTERNAL_ERROR', 'path resolution failed');
+    }
+    /** Direct-file-tool guard: regular file, not hardlinked (nlink > 1 refused). */
+    assertRegularFileForDirectAccess(resolved) {
+        const st = resolved.stat;
+        if (!st)
+            throw new DodoError('NOT_FOUND', 'file not found', { detail: { path: resolved.rel } });
+        if (!st.isFile()) {
+            throw new DodoError('PATH_DENIED', 'not a regular file', { detail: { path: resolved.rel } });
+        }
+        if (st.nlink > 1) {
+            throw new DodoError('PATH_DENIED', 'hardlinked files are refused by policy', { detail: { path: resolved.rel } });
+        }
+        return st;
+    }
+    /**
+     * Read a file's raw bytes under policy. `maxBytes` refuses larger files
+     * with FILE_TOO_LARGE (typed, never a silent cut).
+     */
+    readFileBytes(input, maxBytes) {
+        const resolved = this.resolve(input);
+        const st = this.assertRegularFileForDirectAccess(resolved);
+        if (st.size > maxBytes) {
+            throw new DodoError('FILE_TOO_LARGE', `file exceeds ${maxBytes} bytes`, {
+                detail: { path: resolved.rel, size: st.size, maxBytes },
+            });
+        }
+        const bytes = fs.readFileSync(resolved.abs);
+        return { rel: resolved.rel, abs: resolved.abs, bytes, stat: st };
+    }
+    /** Read + strict UTF-8 decode; binary/undecodable input is a typed error. */
+    readTextFile(input, maxBytes) {
+        const { rel, bytes, stat } = this.readFileBytes(input, maxBytes);
+        if (looksBinary(bytes)) {
+            throw new DodoError('UNSUPPORTED_ENCODING', 'file appears to be binary', { detail: { path: rel } });
+        }
+        const text = decodeUtf8Strict(bytes);
+        if (text === undefined) {
+            throw new DodoError('UNSUPPORTED_ENCODING', 'file is not valid UTF-8', { detail: { path: rel } });
+        }
+        return { rel, text, bytes, hash: sha256Bytes(bytes), stat };
+    }
+    /** List one directory (lstat entries, no follow). Callers apply ignore classes. */
+    listDir(input) {
+        const resolved = this.resolve(input);
+        const st = resolved.stat;
+        if (!st?.isDirectory())
+            throw new DodoError('PATH_DENIED', 'not a directory', { detail: { path: resolved.rel } });
+        const names = fs.readdirSync(resolved.abs);
+        const out = [];
+        for (const name of names) {
+            if (name.includes('\0') || name.includes('/') || name.includes('\\'))
+                continue;
+            const rel = resolved.rel === '.' ? name : `${resolved.rel}/${name}`;
+            let est;
+            try {
+                est = fs.lstatSync(path.join(resolved.abs, name));
+            }
+            catch {
+                continue;
+            }
+            out.push({ name, rel, stat: est });
+        }
+        out.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+        return out;
+    }
+    /**
+     * Bounded workspace walk in deterministic order. Symlinks are never
+     * followed; secret/protected paths are never yielded; ordinary ignores are
+     * skipped unless includeIgnored.
+     */
+    *walk(opts) {
+        const includeIgnored = opts.includeIgnored ?? false;
+        const maxEntries = opts.maxEntries ?? 100_000;
+        const maxDepth = opts.maxDepth ?? 32;
+        const start = this.resolve(opts.startRel ?? '.');
+        if (!start.stat?.isDirectory()) {
+            throw new DodoError('PATH_DENIED', 'walk start is not a directory', { detail: { path: start.rel } });
+        }
+        let yielded = 0;
+        const stack = [{ rel: start.rel, depth: 0 }];
+        while (stack.length > 0) {
+            const cur = stack.pop();
+            let entries;
+            try {
+                entries = this.listDir(cur.rel);
+            }
+            catch {
+                continue;
+            }
+            // listDir sorts ascending; reverse-push so pop() visits ascending order.
+            for (let i = entries.length - 1; i >= 0; i -= 1) {
+                const e = entries[i];
+                if (e.stat.isSymbolicLink())
+                    continue;
+                const isDir = e.stat.isDirectory();
+                const cls = this.ignores.classify(e.rel, isDir, includeIgnored);
+                if (cls !== 'ok')
+                    continue;
+                if (isDir) {
+                    if (cur.depth + 1 < maxDepth)
+                        stack.push({ rel: e.rel, depth: cur.depth + 1 });
+                    continue;
+                }
+                if (!e.stat.isFile())
+                    continue;
+                yielded += 1;
+                yield { rel: e.rel, stat: e.stat, depth: cur.depth + 1, ignoredClass: 'ok' };
+                if (yielded >= maxEntries)
+                    return;
+            }
+        }
+    }
+    /**
+     * Validate a target for file creation: final component must be missing,
+     * every existing ancestor symlink-free; returns which parent dirs would
+     * need creating (all inside the root).
+     */
+    resolveForCreate(input, createParents) {
+        const rel = this.normalizeRel(input);
+        this.resolve('.');
+        if (rel === '.')
+            throw new DodoError('PATH_DENIED', 'cannot create the workspace root');
+        if (this.ignores.isSecret(rel))
+            throw new DodoError('SECRET_PATH_DENIED', 'target is denied by secret policy', { detail: { path: rel } });
+        if (this.ignores.isProtected(rel))
+            throw new DodoError('PATH_DENIED', 'target is protected', { detail: { path: rel } });
+        const segments = rel.split('/');
+        let cur = this.root;
+        const missingParents = [];
+        for (let i = 0; i < segments.length; i += 1) {
+            const isFinal = i === segments.length - 1;
+            cur = path.join(cur, segments[i]);
+            let st;
+            try {
+                st = fs.lstatSync(cur);
+            }
+            catch (err) {
+                if (err.code !== 'ENOENT') {
+                    throw new DodoError('PATH_DENIED', 'path is not accessible', { detail: { path: rel } });
+                }
+                st = undefined;
+            }
+            if (st) {
+                if (st.isSymbolicLink())
+                    throw new DodoError('PATH_DENIED', 'symlinks are not followed', { detail: { path: segments.slice(0, i + 1).join('/') } });
+                this.assertCanonicalComponent(cur);
+                if (isFinal) {
+                    throw new DodoError('CONFLICT', 'target already exists', { detail: { path: rel } });
+                }
+                if (!st.isDirectory())
+                    throw new DodoError('PATH_DENIED', 'path component is not a directory', { detail: { path: rel } });
+            }
+            else {
+                if (!isFinal) {
+                    if (!createParents) {
+                        throw new DodoError('NOT_FOUND', 'parent directory does not exist (createParents=false)', {
+                            detail: { path: segments.slice(0, i + 1).join('/') },
+                        });
+                    }
+                    missingParents.push(segments.slice(0, i + 1).join('/'));
+                }
+            }
+        }
+        return { rel, abs: path.join(this.root, rel), missingParents };
+    }
+}
+//# sourceMappingURL=fs.js.map

package/dist/workspace/fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../src/workspace/fs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAyC/E,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,MAAM,OAAO,WAAW;IACb,IAAI,CAAS;IACb,OAAO,CAAe;IAE/B,YAAY,YAAoB,EAAE,OAAqB;QACrD,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,wEAAwE;QACxE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;QAC/F,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,KAAa;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC;QAC3F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,+CAA+C,CAAC,CAAC;QAC5G,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACxF,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,mDAAmD,CAAC,CAAC;QAClH,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,oEAAoE,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,iCAAiC,CAAC,CAAC;QACpG,IAAI,KAAK,KAAK,GAAG;YAAE,OAAO,GAAG,CAAC;QAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG;gBAAE,SAAS;YACxC,IAAI,GAAG,KAAK,IAAI;gBAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,mCAAmC,CAAC,CAAC;YAC1F,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC5D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACtC,IAAI,QAAQ,CAAC,MAAM,GAAG,YAAY;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAC;QACjG,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,uEAAuE;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,iCAAiC,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;+EAE2E;IACnE,wBAAwB,CAAC,GAAW;QAC1C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO;QACzC,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,sCAAsC,CAAC,CAAC;QAC/G,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;QAC5E,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,2CAA2C,CAAC,CAAC;QACvH,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,6BAA6B,CAAC,CAAC;QACrG,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,uFAAuF,CAAC,CAAC;IACxM,CAAC;IAED,KAAK,CAAC,GAAW;QACf,OAAO,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,KAAa,EAAE,OAAuB,EAAE;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,iCAAiC,CAAC,CAAC;QAChI,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,iCAAiC,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YAChB,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC3C,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC;QACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAW,CAAC,CAAC;YAC5C,IAAI,EAAY,CAAC;YACjB,IAAI,CAAC;gBACH,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;wBACtB,iEAAiE;wBACjE,oDAAoD;wBACpD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;oBAClE,CAAC;oBACD,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBAChF,CAAC;gBACD,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,wBAAwB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;gBACxB,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,2BAA2B,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5H,CAAC;YACD,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,OAAO,GAAG,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBAClC,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,mCAAmC,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACrG,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;YACrC,CAAC;QACH,CAAC;QACD,yCAAyC;QACzC,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;IAClE,CAAC;IAED,gFAAgF;IAChF,gCAAgC,CAAC,QAAsB;QACrD,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,wCAAwC,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnH,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,KAAa,EAAE,QAAgB;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,gCAAgC,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,EAAE,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,QAAQ,QAAQ,EAAE;gBACtE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE;aACxD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnE,CAAC;IAED,6EAA6E;IAC7E,YAAY,CAAC,KAAa,EAAE,QAAgB;QAC1C,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACjE,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAAC,sBAAsB,EAAE,2BAA2B,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAAC,sBAAsB,EAAE,yBAAyB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;IAC9D,CAAC;IAED,mFAAmF;IACnF,OAAO,CAAC,KAAa;QACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,iBAAiB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClH,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAyD,EAAE,CAAC;QACrE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/E,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;YACpE,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,CAAC,IAAI,CAAC,IAKL;QACC,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,KAAK,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,+BAA+B,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,KAAK,GAA0C,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACpF,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAoC,CAAC;YAC1D,IAAI,OAA6D,CAAC;YAClE,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,yEAAyE;YACzE,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAkD,CAAC;gBACtE,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE;oBAAE,SAAS;gBACtC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;gBAChE,IAAI,GAAG,KAAK,IAAI;oBAAE,SAAS;gBAC3B,IAAI,KAAK,EAAE,CAAC;oBACV,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,GAAG,QAAQ;wBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC/E,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBAAE,SAAS;gBAC/B,OAAO,IAAI,CAAC,CAAC;gBACb,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;gBAC7E,IAAI,OAAO,IAAI,UAAU;oBAAE,OAAO;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,gBAAgB,CAAC,KAAa,EAAE,aAAsB;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClB,IAAI,GAAG,KAAK,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,kCAAkC,CAAC,CAAC;QACxF,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,mCAAmC,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1I,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,qBAAqB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACxH,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC;QACpB,MAAM,cAAc,GAAa,EAAE,CAAC;QACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAC1C,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAW,CAAC,CAAC;YAC5C,IAAI,EAAwB,CAAC;YAC7B,IAAI,CAAC;gBACH,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrD,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,wBAAwB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC1F,CAAC;gBACD,EAAE,GAAG,SAAS,CAAC;YACjB,CAAC;YACD,IAAI,EAAE,EAAE,CAAC;gBACP,IAAI,EAAE,CAAC,cAAc,EAAE;oBAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,2BAA2B,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;gBACnJ,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,IAAI,SAAS,CAAC,UAAU,EAAE,uBAAuB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBACtF,CAAC;gBACD,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;oBAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,mCAAmC,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC5H,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,IAAI,CAAC,aAAa,EAAE,CAAC;wBACnB,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,uDAAuD,EAAE;4BACxF,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;yBACrD,CAAC,CAAC;oBACL,CAAC;oBACD,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,cAAc,EAAE,CAAC;IACjE,CAAC;CACF"}

package/dist/workspace/identity.js

@@ -0,0 +1,17 @@
+import { createHash } from 'node:crypto';
+import { newId } from '../util/hash.js';
+/**
+ * Workspace identity (spec §6):
+ * - workspaceId: opaque, server-minted, stable per (canonical root, install);
+ *   derived with the install secret so the id itself reveals nothing about
+ *   the path and cannot be forged by a client.
+ * - workspaceEpoch: fresh random id per server boot.
+ */
+export function mintWorkspaceId(installSecret, rootRealPath) {
+    const digest = createHash('sha256').update(installSecret).update('\0').update(rootRealPath).digest('hex');
+    return `ws_${digest.slice(0, 20)}`;
+}
+export function mintEpoch() {
+    return newId('boot', 10);
+}
+//# sourceMappingURL=identity.js.map

package/dist/workspace/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/workspace/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,aAAqB,EAAE,YAAoB;IACzE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1G,OAAO,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC3B,CAAC"}

package/dist/workspace/ignores.js

@@ -0,0 +1,173 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import ignore, {} from 'ignore';
+/**
+ * Exclusion engine (spec §10.2), three independent layers:
+ *
+ * 1. SECRET DENY — hard denies that nothing bypasses (not `includeIgnored`,
+ *    not search, not git output, not semantic tools).
+ * 2. PROTECTED — `.git/` internals and DODO dev state; never listed or read
+ *    directly (no raw .git tool), not bypassable.
+ * 3. ORDINARY — default build/cache excludes, `.gitignore` (root + nested),
+ *    `.dodoignore`, and repo-config `exclude` globs. `includeIgnored` bypasses
+ *    only this layer.
+ */
+const DEFAULT_SECRET_PATTERNS = [
+    '.env',
+    '.env.*',
+    '*.env',
+    '.envrc',
+    '*.pem',
+    '*.key',
+    '*.p12',
+    '*.pfx',
+    '*.jks',
+    '*.keystore',
+    'id_rsa*',
+    'id_dsa*',
+    'id_ecdsa*',
+    'id_ed25519*',
+    '*.kdbx',
+    '.npmrc',
+    '.pypirc',
+    '.netrc',
+    '_netrc',
+    '.git-credentials',
+    '.ssh/',
+    '.gnupg/',
+    '.aws/',
+    '.kube/config',
+    '.docker/config.json',
+    'secrets.json',
+    'secrets.yml',
+    'secrets.yaml',
+    'credentials.json',
+    'service-account*.json',
+    '*.tfstate',
+    '*.tfstate.*',
+];
+const PROTECTED_PATTERNS = ['.git/', '.dodo-dev-state/'];
+const DEFAULT_ORDINARY_PATTERNS = [
+    'node_modules/',
+    'dist/',
+    'build/',
+    'out/',
+    '.next/',
+    '.nuxt/',
+    '.svelte-kit/',
+    '.cache/',
+    '.turbo/',
+    'coverage/',
+    'target/',
+    '__pycache__/',
+    '.venv/',
+    'venv/',
+    '.tox/',
+    '.DS_Store',
+    '*.min.js',
+    '*.map',
+];
+const MAX_IGNORE_FILE_BYTES = 256 * 1024;
+const MAX_NESTED_IGNORE_FILES = 200;
+export class IgnoreEngine {
+    root;
+    secret;
+    protected_;
+    ordinaryBase;
+    nested = new Map();
+    nestedCount = 0;
+    constructor(opts) {
+        this.root = opts.root;
+        this.secret = ignore().add(DEFAULT_SECRET_PATTERNS);
+        if (opts.extraSecretPatterns?.length)
+            this.secret.add(opts.extraSecretPatterns);
+        // Explicit owner exceptions only — never derived from repo config.
+        if (opts.secretAllow?.length)
+            this.secret.add(opts.secretAllow.map((p) => (p.startsWith('!') ? p : `!${p}`)));
+        this.protected_ = ignore().add(PROTECTED_PATTERNS);
+        this.ordinaryBase = ignore().add(DEFAULT_ORDINARY_PATTERNS);
+        for (const file of ['.gitignore', '.dodoignore']) {
+            const content = this.readIgnoreFile(path.join(this.root, file));
+            if (content !== undefined)
+                this.ordinaryBase.add(content);
+        }
+        if (opts.projectExcludes?.length)
+            this.ordinaryBase.add(opts.projectExcludes);
+    }
+    readIgnoreFile(absFile) {
+        try {
+            const st = fs.lstatSync(absFile);
+            if (!st.isFile() || st.size > MAX_IGNORE_FILE_BYTES)
+                return undefined;
+            return fs.readFileSync(absFile, 'utf8');
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /** Hard secret deny — includeIgnored can never bypass this. */
+    isSecret(rel) {
+        if (rel === '.' || rel === '')
+            return false;
+        return this.secret.ignores(rel) || (isDirLike(rel) && this.secret.ignores(rel + '/'));
+    }
+    /** Protected internals (.git etc.) — never listed, never read. */
+    isProtected(rel) {
+        if (rel === '.' || rel === '')
+            return false;
+        return this.protected_.ignores(rel) || this.protected_.ignores(rel + '/');
+    }
+    /**
+     * Ordinary ignore check. `isDir` improves gitignore directory-pattern
+     * fidelity. Nested .gitignore files are honored on the walked path.
+     */
+    isOrdinarilyIgnored(rel, isDir) {
+        const probe = isDir ? rel + '/' : rel;
+        if (this.ordinaryBase.ignores(probe))
+            return true;
+        // Nested .gitignore files: check each ancestor directory's rules.
+        let dir = path.posix.dirname(rel);
+        while (dir !== '.' && dir !== '') {
+            const rules = this.nestedRules(dir);
+            if (rules) {
+                const sub = rel.slice(dir.length + 1);
+                if (sub !== '' && rules.matcher.ignores(isDir ? sub + '/' : sub))
+                    return true;
+            }
+            dir = path.posix.dirname(dir);
+        }
+        return false;
+    }
+    nestedRules(dirRel) {
+        const cached = this.nested.get(dirRel);
+        if (cached !== undefined)
+            return cached;
+        if (this.nestedCount >= MAX_NESTED_IGNORE_FILES)
+            return null;
+        const content = this.readIgnoreFile(path.join(this.root, dirRel, '.gitignore'));
+        let rules = null;
+        if (content !== undefined) {
+            rules = { dirRel, matcher: ignore().add(content) };
+            this.nestedCount += 1;
+        }
+        this.nested.set(dirRel, rules);
+        return rules;
+    }
+    /**
+     * Combined visibility decision for listings/search/reads.
+     * Returns the strongest applicable class.
+     */
+    classify(rel, isDir, includeIgnored) {
+        if (this.isSecret(rel))
+            return 'secret';
+        if (this.isProtected(rel))
+            return 'protected';
+        if (!includeIgnored && this.isOrdinarilyIgnored(rel, isDir))
+            return 'ignored';
+        return 'ok';
+    }
+}
+function isDirLike(rel) {
+    return !path.posix.basename(rel).includes('.');
+}
+//# sourceMappingURL=ignores.js.map

package/dist/workspace/ignores.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ignores.js","sourceRoot":"","sources":["../../src/workspace/ignores.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,EAAE,EAAe,MAAM,QAAQ,CAAC;AAE7C;;;;;;;;;;GAUG;AAEH,MAAM,uBAAuB,GAAG;IAC9B,MAAM;IACN,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,YAAY;IACZ,SAAS;IACT,SAAS;IACT,WAAW;IACX,aAAa;IACb,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,kBAAkB;IAClB,OAAO;IACP,SAAS;IACT,OAAO;IACP,cAAc;IACd,qBAAqB;IACrB,cAAc;IACd,aAAa;IACb,cAAc;IACd,kBAAkB;IAClB,uBAAuB;IACvB,WAAW;IACX,aAAa;CACd,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;AAEzD,MAAM,yBAAyB,GAAG;IAChC,eAAe;IACf,OAAO;IACP,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,cAAc;IACd,SAAS;IACT,SAAS;IACT,WAAW;IACX,SAAS;IACT,cAAc;IACd,QAAQ;IACR,OAAO;IACP,OAAO;IACP,WAAW;IACX,UAAU;IACV,OAAO;CACR,CAAC;AAeF,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,CAAC;AACzC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,MAAM,OAAO,YAAY;IACN,IAAI,CAAS;IACb,MAAM,CAAS;IACf,UAAU,CAAS;IACnB,YAAY,CAAS;IACrB,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IACrD,WAAW,GAAG,CAAC,CAAC;IAExB,YAAY,IAAyB;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,mBAAmB,EAAE,MAAM;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChF,mEAAmE;QACnE,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9G,IAAI,CAAC,UAAU,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACnD,IAAI,CAAC,YAAY,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAChE,IAAI,OAAO,KAAK,SAAS;gBAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,IAAI,CAAC,eAAe,EAAE,MAAM;YAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChF,CAAC;IAEO,cAAc,CAAC,OAAe;QACpC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,qBAAqB;gBAAE,OAAO,SAAS,CAAC;YACtE,OAAO,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,QAAQ,CAAC,GAAW;QAClB,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,kEAAkE;IAClE,WAAW,CAAC,GAAW;QACrB,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IAC5E,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,GAAW,EAAE,KAAc;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACtC,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,kEAAkE;QAClE,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACtC,IAAI,GAAG,KAAK,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;YAChF,CAAC;YACD,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,WAAW,CAAC,MAAc;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,IAAI,IAAI,CAAC,WAAW,IAAI,uBAAuB;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;QAChF,IAAI,KAAK,GAAoB,IAAI,CAAC;QAClC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,KAAK,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,GAAW,EAAE,KAAc,EAAE,cAAuB;QAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC;QACxC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,WAAW,CAAC;QAC9C,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACjD,CAAC"}

package/dist/workspace/root.js

@@ -0,0 +1,59 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { DodoError } from '../errors.js';
+import { assertLocalWindowsRoot } from '../platform/pathPolicy.js';
+import { encodeFileIdentity } from '../platform/fileIdentity.js';
+export function resolveWorkspaceRoot(candidate, opts = {}) {
+    if (process.platform === 'win32')
+        assertLocalWindowsRoot(path.resolve(candidate));
+    let real;
+    try {
+        real = fs.realpathSync.native(candidate);
+    }
+    catch {
+        throw new DodoError('NOT_FOUND', `workspace root does not exist: ${candidate}`);
+    }
+    if (process.platform === 'win32')
+        assertLocalWindowsRoot(real);
+    let st;
+    try {
+        st = fs.statSync(real, { bigint: true });
+    }
+    catch {
+        throw new DodoError('NOT_FOUND', `workspace root is not accessible: ${candidate}`);
+    }
+    if (!st.isDirectory()) {
+        throw new DodoError('PATH_DENIED', 'workspace root must be a directory');
+    }
+    if (!opts.allowUnsafe) {
+        const home = safeRealpath(os.homedir());
+        const parsed = path.parse(real);
+        if (real === parsed.root) {
+            throw new DodoError('PATH_DENIED', 'refusing to use the filesystem root as a workspace (use --allow-unsafe-root only if you really mean it)');
+        }
+        if (home && (process.platform === 'win32' ? real.toLowerCase() === home.toLowerCase() : real === home)) {
+            throw new DodoError('PATH_DENIED', 'refusing to use the home directory as a workspace (cd into a project first; --allow-unsafe-root overrides)');
+        }
+        // Suspiciously broad roots: direct children of / like /Users, /home, /Volumes.
+        const rel = path.relative(parsed.root, real);
+        if (rel !== '' && !rel.includes(path.sep) && ['users', 'home', 'volumes', 'mnt', 'media', 'windows', 'program files', 'program files (x86)'].includes(rel.toLowerCase())) {
+            throw new DodoError('PATH_DENIED', `refusing unusually broad workspace root ${real} (--allow-unsafe-root overrides)`);
+        }
+    }
+    return {
+        root: real,
+        dev: encodeFileIdentity(st.dev),
+        ino: encodeFileIdentity(st.ino),
+        birthtimeNs: st.birthtimeNs > 0n ? st.birthtimeNs.toString() : null,
+    };
+}
+function safeRealpath(p) {
+    try {
+        return fs.realpathSync.native(p);
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=root.js.map

package/dist/workspace/root.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"root.js","sourceRoot":"","sources":["../../src/workspace/root.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAqB,MAAM,6BAA6B,CAAC;AAmBpF,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,OAAkC,EAAE;IAC1F,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAClF,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,kCAAkC,SAAS,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,EAAkB,CAAC;IACvB,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,qCAAqC,SAAS,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,oCAAoC,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,yGAAyG,CAAC,CAAC;QAChJ,CAAC;QACD,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACvG,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,4GAA4G,CAAC,CAAC;QACnJ,CAAC;QACD,+EAA+E;QAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACzK,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,2CAA2C,IAAI,kCAAkC,CAAC,CAAC;QACxH,CAAC;IACH,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,kBAAkB,CAAC,EAAE,CAAC,GAAG,CAAC;QAC/B,GAAG,EAAE,kBAAkB,CAAC,EAAE,CAAC,GAAG,CAAC;QAC/B,WAAW,EAAE,EAAE,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI;KACpE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}