harnery 0.22.1 → 0.23.0

package/dist/core/workflow/workspaces/execution.js

@@ -0,0 +1,316 @@
+import { existsSync } from "node:fs";
+import { policyDigest } from "../../policy/index.js";
+import { WorkspaceAttestationError, workspaceAttestationFromError } from "./attestation-error.js";
+import { assertContainedExisting, containsPath, filesystemIdentity, sameFilesystemIdentity, validateConfiguredRoot, } from "./paths.js";
+import { appendWorkflowJournalEvent, stableDigest, writeWorkspaceRequest } from "./state.js";
+import { isWorkspaceAttestation, isWorkspaceBinding } from "./validate.js";
+export async function resolveWorkspaceBinding(input) {
+    if (input.isolation === "shared")
+        return undefined;
+    if (input.isolation !== "worktree" &&
+        input.isolation !== "sandbox" &&
+        input.isolation !== "remote") {
+        throw new Error(`unsupported workflow isolation ${JSON.stringify(input.isolation)}`);
+    }
+    if (input.resumeState && !input.resumeState.manifest.execution.workspace_binding) {
+        return undefined;
+    }
+    const capability = input.isolation;
+    const provider = input.provider;
+    if (!provider) {
+        if (input.resumeState?.manifest.execution.workspace_binding) {
+            throw new Error("isolated workflow resume requires the frozen workspace provider");
+        }
+        const fallback = {
+            schema_version: 1,
+            run_id: input.runId,
+            requested_isolation: capability,
+            effective_isolation: "shared",
+            selection_reason: "provider_not_configured",
+            terminal_lifecycle_state: "shared",
+            drift: [],
+            unsupported: [
+                {
+                    code: "provider_not_configured",
+                    message: "no workspace provider is configured; shared execution was selected",
+                },
+            ],
+            unknowns: [],
+            receipts: {},
+        };
+        appendWorkflowJournalEvent(input.opts.coordRoot, input.runId, "workspace.compatibility", {
+            requested_isolation: fallback.requested_isolation,
+            effective_isolation: fallback.effective_isolation,
+            selection_reason: fallback.selection_reason,
+            unsupported: fallback.unsupported,
+        });
+        input.onUnsupportedFallback?.(fallback);
+        return undefined;
+    }
+    const frozenBinding = input.resumeState?.manifest.execution.workspace_binding;
+    if (frozenBinding) {
+        const roots = input.opts.workspace?.writableRoots;
+        if (!roots || roots.length === 0) {
+            throw new Error("isolated workflow resume requires explicit writable roots");
+        }
+        assertWorkspaceRootAuthority(frozenBinding, roots, input.policy?.allowed_paths ?? []);
+        const probe = await provider.probe({
+            requested_cwd: frozenBinding.repository?.source_root.configured ?? input.cwd,
+            writable_roots: roots,
+        });
+        if (probe.capabilities.provider_id !== frozenBinding.provider.id ||
+            probe.capabilities.provider_version !== frozenBinding.provider.version ||
+            probe.capabilities.capability_digest !== frozenBinding.provider.capability_digest) {
+            throw new Error("parked workflow provider identity or capabilities drifted");
+        }
+        const providerBinding = await provider.readBinding(frozenBinding);
+        if (JSON.stringify(providerBinding) !== JSON.stringify(frozenBinding)) {
+            throw new Error("parked workflow binding differs from the immutable provider record");
+        }
+        const reattached = await provider.reattach(frozenBinding);
+        if (!isWorkspaceAttestation(reattached, frozenBinding) || reattached.status !== "ok") {
+            if (isWorkspaceAttestation(reattached, frozenBinding)) {
+                throw new WorkspaceAttestationError(`workflow run ${input.runId} could not reattach its frozen workspace`, reattached);
+            }
+            throw new Error(`workflow run ${input.runId} could not reattach its frozen workspace`);
+        }
+        appendWorkflowJournalEvent(input.opts.coordRoot, input.runId, "workspace.reattach", {
+            binding_id: frozenBinding.binding_id,
+            provider_id: frozenBinding.provider.id,
+            attestation_sha256: stableDigest(reattached),
+        });
+        return frozenBinding;
+    }
+    const roots = input.opts.workspace?.writableRoots;
+    if (roots?.length !== 1) {
+        throw new Error("isolated workflow allocation requires one explicitly selected writable root");
+    }
+    const selectedRoot = validateConfiguredRoot(roots[0]);
+    const sourceRoot = validateConfiguredRoot(input.cwd);
+    const allowedRoots = (input.policy?.allowed_paths ?? []).map((path) => validateConfiguredRoot(path));
+    if (sourceRoot.configured !== input.cwd ||
+        (allowedRoots.length > 0 &&
+            !allowedRoots.some((path) => containsPath(path.realpath, sourceRoot.realpath)))) {
+        throw new Error("workflow source root is outside frozen path authority");
+    }
+    if (allowedRoots.length > 0 &&
+        !allowedRoots.some((path) => containsPath(path.realpath, selectedRoot.realpath))) {
+        throw new Error("workspace writable root is outside frozen path authority");
+    }
+    const probe = await provider.probe({
+        requested_cwd: input.cwd,
+        writable_roots: [selectedRoot.configured],
+    });
+    if (!probe.supported ||
+        probe.unsupported.length > 0 ||
+        !probe.capabilities.isolation.includes(capability)) {
+        if (input.policy?.allowed_isolation?.includes("shared")) {
+            const unsupported = probe.unsupported.length > 0
+                ? [...probe.unsupported]
+                : [
+                    {
+                        code: "isolation_unsupported",
+                        message: `provider does not support ${capability} isolation`,
+                    },
+                ];
+            const fallback = {
+                schema_version: 1,
+                run_id: input.runId,
+                requested_isolation: capability,
+                effective_isolation: "shared",
+                selection_reason: "provider_unsupported",
+                provider: {
+                    id: probe.capabilities.provider_id,
+                    version: probe.capabilities.provider_version,
+                    capability_digest: probe.capabilities.capability_digest,
+                },
+                terminal_lifecycle_state: "shared",
+                drift: [],
+                unsupported,
+                unknowns: [...probe.unknowns],
+                receipts: {},
+            };
+            appendWorkflowJournalEvent(input.opts.coordRoot, input.runId, "workspace.fallback", {
+                requested_isolation: fallback.requested_isolation,
+                effective_isolation: fallback.effective_isolation,
+                selection_reason: fallback.selection_reason,
+                provider_id: fallback.provider?.id,
+                unsupported: fallback.unsupported,
+            });
+            input.onUnsupportedFallback?.(fallback);
+            return undefined;
+        }
+        throw new Error(`workspace provider ${probe.capabilities.provider_id} does not support ${capability}: ${probe.unsupported.map((item) => item.message).join("; ") || "unsupported capability"}`);
+    }
+    if (input.opts.workItemId && !input.attemptContext) {
+        throw new Error("isolated work-linked execution requires a frozen attempt identity");
+    }
+    const requestWithoutKey = {
+        schema_version: 1,
+        run_id: input.runId,
+        owner: input.opts.workItemId && input.attemptContext
+            ? {
+                kind: "work_attempt",
+                work_item_id: input.opts.workItemId,
+                attempt: input.attemptContext.number,
+            }
+            : { kind: "standalone", work_item_id: null, attempt: null },
+        requested_cwd: input.cwd,
+        requested_isolation: capability,
+        network_access: input.opts.networkAccess ?? "unknown",
+        script: { path: input.absScript, sha256: input.scriptSha256 },
+        policy_sha256: input.policy ? policyDigest(input.policy) : null,
+        allowed_paths: allowedRoots,
+        writable_roots: [selectedRoot],
+        selected_writable_root: selectedRoot,
+        provider_id: probe.capabilities.provider_id,
+        capability_digest: probe.capabilities.capability_digest,
+    };
+    const request = {
+        ...requestWithoutKey,
+        idempotency_key: stableDigest(requestWithoutKey),
+    };
+    writeWorkspaceRequest(input.opts.coordRoot, request);
+    appendWorkflowJournalEvent(input.opts.coordRoot, input.runId, "execution.allocate.start", {
+        provider_id: probe.capabilities.provider_id,
+        request_sha256: stableDigest(request),
+    });
+    const binding = await provider.allocate(request);
+    if (!isWorkspaceBinding(binding, input.runId) ||
+        binding.request_sha256 !== stableDigest(request) ||
+        stableDigest(binding.owner) !== stableDigest(request.owner) ||
+        binding.provider.id !== probe.capabilities.provider_id ||
+        binding.provider.version !== probe.capabilities.provider_version ||
+        binding.provider.capability_digest !== probe.capabilities.capability_digest ||
+        binding.isolation !== capability) {
+        throw new Error("workspace provider returned a binding that does not match the frozen request");
+    }
+    const providerBinding = await provider.readBinding(binding);
+    if (JSON.stringify(providerBinding) !== JSON.stringify(binding)) {
+        throw new Error("workspace provider returned bytes that differ from its immutable binding");
+    }
+    assertWorkspaceRootAuthority(binding, [selectedRoot.configured], input.policy?.allowed_paths ?? []);
+    const attestation = await provider.reattach(binding);
+    if (!isWorkspaceAttestation(attestation, binding) || attestation.status !== "ok") {
+        if (isWorkspaceAttestation(attestation, binding)) {
+            throw new WorkspaceAttestationError("workspace provider returned a binding that failed initial attestation", attestation);
+        }
+        throw new Error("workspace provider returned a binding that failed initial attestation");
+    }
+    appendWorkflowJournalEvent(input.opts.coordRoot, input.runId, "execution.allocate.end", {
+        binding_id: binding.binding_id,
+        provider_id: binding.provider.id,
+        active_root: binding.active_root,
+        attestation_sha256: stableDigest(attestation),
+    });
+    return binding;
+}
+function assertWorkspaceRootAuthority(binding, configuredRoots, allowedPaths) {
+    const roots = configuredRoots.map((root) => validateConfiguredRoot(root));
+    const authority = roots.find((root) => root.configured === binding.writable_root.configured &&
+        root.realpath === binding.writable_root.realpath &&
+        sameFilesystemIdentity(root.identity, binding.writable_root.identity));
+    if (!authority) {
+        throw new Error("workspace provider binding is outside the explicit writable-root authority");
+    }
+    if (allowedPaths.length > 0 &&
+        (!allowedPaths.some((root) => containsPath(root, binding.workspace_root)) ||
+            !allowedPaths.some((root) => containsPath(root, binding.active_root)) ||
+            (binding.repository !== undefined &&
+                (!allowedPaths.some((root) => containsPath(root, binding.repository.source_root.realpath)) ||
+                    !allowedPaths.some((root) => containsPath(root, binding.repository.common_dir.realpath)))))) {
+        throw new Error("workspace provider binding is outside frozen policy path authority");
+    }
+    assertContainedExisting(authority, binding.workspace_root, "workspace root");
+    assertContainedExisting(authority, binding.active_root, "active workspace root");
+    if (!sameFilesystemIdentity(filesystemIdentity(binding.workspace_root), binding.workspace_root_identity)) {
+        throw new Error("workspace root identity differs from the frozen binding");
+    }
+    if (!sameFilesystemIdentity(filesystemIdentity(binding.active_root), binding.active_root_identity)) {
+        throw new Error("active workspace root identity differs from the frozen binding");
+    }
+}
+export async function attestTerminal(provider, binding) {
+    if (!provider)
+        return failedWorkspaceAttestation(binding, "workspace provider is unavailable");
+    try {
+        const attestation = await provider.attest(binding);
+        return isWorkspaceAttestation(attestation, binding)
+            ? attestation
+            : failedWorkspaceAttestation(binding, "workspace provider returned invalid attestation");
+    }
+    catch (error) {
+        return (workspaceAttestationFromError(error, binding) ??
+            failedWorkspaceAttestation(binding, errorMessage(error)));
+    }
+}
+export async function attestWorkspaceFailure(provider, binding, error) {
+    const carried = workspaceAttestationFromError(error, binding);
+    if (carried)
+        return carried;
+    const observed = await attestTerminal(provider, binding);
+    if (observed.status !== "ok")
+        return observed;
+    return {
+        ...observed,
+        provider_drift: [...observed.provider_drift, errorMessage(error)],
+        resource_state: observed.workspace_exists ? "blocked" : "lost",
+        status: observed.workspace_exists ? "blocked" : "lost",
+    };
+}
+function failedWorkspaceAttestation(binding, message) {
+    const workspaceExists = existsSync(binding.workspace_root);
+    let rootMatch = false;
+    let workspaceContained = false;
+    let activeContained = false;
+    let workspaceIdentity;
+    let activeIdentity;
+    try {
+        const root = validateConfiguredRoot(binding.writable_root.configured);
+        rootMatch =
+            root.realpath === binding.writable_root.realpath &&
+                sameFilesystemIdentity(root.identity, binding.writable_root.identity);
+        if (workspaceExists) {
+            const workspaceReal = assertContainedExisting(root, binding.workspace_root, "workspace root");
+            workspaceContained = workspaceReal === binding.workspace_root;
+            workspaceIdentity = filesystemIdentity(workspaceReal);
+        }
+        if (existsSync(binding.active_root)) {
+            const activeReal = assertContainedExisting(root, binding.active_root, "active root");
+            activeContained = activeReal === binding.active_root;
+            activeIdentity = filesystemIdentity(activeReal);
+        }
+    }
+    catch {
+        // Preserve the facts that could be observed before path validation failed.
+    }
+    return {
+        schema_version: 1,
+        binding_id: binding.binding_id,
+        workspace_id: binding.workspace_id,
+        run_id: binding.run_id,
+        owner: binding.owner,
+        provider: binding.provider,
+        recorded_at: new Date().toISOString(),
+        containment: {
+            writable_root: rootMatch,
+            workspace_root: workspaceContained,
+            active_root: activeContained,
+            integration_root: null,
+        },
+        filesystem: {
+            root_identity_match: rootMatch,
+            workspace_identity: workspaceIdentity,
+            active_identity: activeIdentity,
+        },
+        provider_drift: [message],
+        workspace_exists: workspaceExists,
+        resource_state: workspaceExists ? "blocked" : "lost",
+        unsupported: [],
+        unknowns: [],
+        status: workspaceExists ? "blocked" : "lost",
+    };
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/core/workflow/workspaces/git.d.ts

@@ -0,0 +1,25 @@
+export type GitResult = {
+    ok: true;
+    out: string;
+} | {
+    ok: false;
+    err: string;
+};
+export declare function git(cwd: string, args: readonly string[]): string;
+export declare function gitMaybe(cwd: string, args: readonly string[]): GitResult;
+export declare function gitMaybeWithDirectoryDescriptor(cwd: string, args: readonly string[], fd: number): GitResult;
+export declare function worktreeInventory(cwd: string): Array<{
+    path: string;
+    ref?: string;
+    head?: string;
+}>;
+export declare function parseWorktreeInventory(body: string): Array<{
+    path: string;
+    ref?: string;
+    head?: string;
+}>;
+export declare function gitOperations(cwd: string): string[];
+export declare function overwriteRiskPaths(cwd: string, changed: readonly string[]): string[];
+export declare function isAncestor(cwd: string, ancestor: string, descendant: string): boolean;
+export declare function nulEntries(value: string): string[];
+//# sourceMappingURL=git.d.ts.map

package/dist/core/workflow/workspaces/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/git.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,SAAS,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/E,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAIhE;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAExE;AAED,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,MAAM,GACT,SAAS,CAKX;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,GACV,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAEtD;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,GACX,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBtD;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAenD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAOpF;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAErF;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAElD"}

package/dist/core/workflow/workspaces/git.js

@@ -0,0 +1,102 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, realpathSync } from "node:fs";
+import { join, resolve } from "node:path";
+const MAX_GIT_OUTPUT = 8 * 1024 * 1024;
+const GIT_TIMEOUT_MS = 30_000;
+export function git(cwd, args) {
+    const result = gitMaybe(cwd, args);
+    if (!result.ok)
+        throw new Error(result.err || `git ${args.join(" ")} failed`);
+    return result.out;
+}
+export function gitMaybe(cwd, args) {
+    return runGit(cwd, args);
+}
+export function gitMaybeWithDirectoryDescriptor(cwd, args, fd) {
+    const stdio = ["ignore", "pipe", "pipe"];
+    while (stdio.length <= fd)
+        stdio.push("ignore");
+    stdio[fd] = fd;
+    return runGit(cwd, args, stdio);
+}
+export function worktreeInventory(cwd) {
+    return parseWorktreeInventory(git(cwd, ["worktree", "list", "--porcelain"]));
+}
+export function parseWorktreeInventory(body) {
+    const entries = [];
+    let current;
+    const fields = body.includes("\0") ? body.split("\0") : body.split("\n");
+    for (const field of fields) {
+        if (field.startsWith("worktree ")) {
+            if (current)
+                entries.push(current);
+            current = { path: field.slice("worktree ".length) };
+        }
+        else if (current && field.startsWith("HEAD ")) {
+            current.head = field.slice("HEAD ".length);
+        }
+        else if (current && field.startsWith("branch ")) {
+            current.ref = field.slice("branch ".length);
+        }
+    }
+    if (current)
+        entries.push(current);
+    return entries;
+}
+export function gitOperations(cwd) {
+    const gitDir = realpathSync(resolve(cwd, git(cwd, ["rev-parse", "--git-dir"])));
+    const candidates = [
+        ["MERGE_HEAD", "merge"],
+        ["CHERRY_PICK_HEAD", "cherry-pick"],
+        ["REVERT_HEAD", "revert"],
+        ["BISECT_LOG", "bisect"],
+        ["rebase-merge", "rebase"],
+        ["rebase-apply", "rebase"],
+    ];
+    return [
+        ...new Set(candidates.filter(([entry]) => existsSync(join(gitDir, entry))).map(([, name]) => name)),
+    ];
+}
+export function overwriteRiskPaths(cwd, changed) {
+    const untracked = nulEntries(git(cwd, ["ls-files", "-z", "--others", "--exclude-standard"]));
+    const ignored = nulEntries(git(cwd, ["ls-files", "-z", "--others", "--ignored", "--exclude-standard"]));
+    const candidates = new Set([...untracked, ...ignored]);
+    return changed.filter((path) => candidates.has(path));
+}
+export function isAncestor(cwd, ancestor, descendant) {
+    return gitMaybe(cwd, ["merge-base", "--is-ancestor", ancestor, descendant]).ok;
+}
+export function nulEntries(value) {
+    return value.split("\0").filter(Boolean);
+}
+function runGit(cwd, args, stdio) {
+    const result = spawnSync("git", [...args], {
+        cwd,
+        encoding: "utf8",
+        env: isolatedGitEnvironment(),
+        maxBuffer: MAX_GIT_OUTPUT,
+        timeout: GIT_TIMEOUT_MS,
+        stdio,
+    });
+    if (result.status !== 0) {
+        return {
+            ok: false,
+            err: (result.stderr || result.stdout || result.error?.message || "git failed").trim(),
+        };
+    }
+    return { ok: true, out: result.stdout.replace(/\n$/, "") };
+}
+function isolatedGitEnvironment() {
+    const env = { ...process.env };
+    for (const key of Object.keys(env)) {
+        if (key.startsWith("GIT_"))
+            delete env[key];
+    }
+    env.GIT_TERMINAL_PROMPT = "0";
+    env.GIT_CONFIG_NOSYSTEM = "1";
+    env.GCM_INTERACTIVE = "Never";
+    env.GIT_CONFIG_COUNT = "1";
+    env.GIT_CONFIG_KEY_0 = "core.hooksPath";
+    env.GIT_CONFIG_VALUE_0 = process.platform === "win32" ? "NUL" : "/dev/null";
+    return env;
+}

package/dist/core/workflow/workspaces/index.d.ts

@@ -0,0 +1,15 @@
+export type { CancelWorkspaceInput } from "./cancellation.js";
+export { cancelWorkspace } from "./cancellation.js";
+export type { CleanupWorkspaceInput } from "./cleanup.js";
+export { cleanupWorkspace } from "./cleanup.js";
+export type { WorkflowWorkspaceInspection, WorkflowWorkspaceSelection, WorkflowWorkspaceStatus, WorkflowWorkspaceVerification, } from "./inspect.js";
+export { inspectWorkflowWorkspace, listWorkflowWorkspaceInspections, readWorkflowWorkspaceStatus, renderWorkflowWorkspaceStatus, } from "./inspect.js";
+export type { ApplyIntegrationInput, PrepareIntegrationInput } from "./integration.js";
+export { applyIntegration, prepareIntegration } from "./integration.js";
+export type { WorkspaceLifecycleProjection, WorkspaceLifecycleProjectionInput, } from "./lifecycle.js";
+export { assertWorkspaceLifecycleTransition, deriveWorkspaceLifecycle, isWorkspaceLifecycleState, validateProviderEventChain, } from "./lifecycle.js";
+export type { LocalGitWorktreeProviderOptions } from "./local-git.js";
+export { createLocalGitWorktreeProvider, probe as probeLocalGitWorktreeProvider, } from "./local-git.js";
+export type { AuthorizedIntegrationPlan, AuthorizedProviderIntegrationInput, FilesystemIdentity, GitRepositoryBinding, IntegrationApplyAttempt, IntegrationApplyReceipt, IntegrationAuthorization, IntegrationPlan, IntegrationReviewRecord, IntegrationTarget, ProviderIntegrationInput, ProviderIntegrationPreview, ProviderIntegrationResult, ProviderUnknown, ProviderUnsupportedReason, RepositoryBinding, RepositoryObservation, ValidatedFilesystemPath, ValidatedFilesystemRoot, WorkspaceAllocationRequest, WorkspaceAttestation, WorkspaceBinding, WorkspaceBoundExecutionEvidence, WorkspaceCancellationReceipt, WorkspaceCancellationResult, WorkspaceCleanupAttempt, WorkspaceCleanupIntent, WorkspaceCleanupMode, WorkspaceCleanupReceipt, WorkspaceCleanupResult, WorkspaceCompatibilityExecutionEvidence, WorkspaceExecutionEvidence, WorkspaceIntegrationState, WorkspaceIsolation, WorkspaceLifecycleState, WorkspaceObservation, WorkspaceOwner, WorkspaceProbeInput, WorkspaceProbeResult, WorkspaceProofLifecycleState, WorkspaceProofOutcome, WorkspaceProvider, WorkspaceProviderCapabilities, WorkspaceProviderRef, WorkspaceResourceState, WorkspaceUnsupportedExecutionEvidence, } from "./types.js";
+export { WORKSPACE_BINDING_SCHEMA_VERSION, WORKSPACE_RECEIPT_SCHEMA_VERSION, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/core/workflow/workspaces/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,YAAY,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EACV,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,EACxB,gCAAgC,EAChC,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACxE,YAAY,EACV,4BAA4B,EAC5B,iCAAiC,GAClC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EACL,8BAA8B,EAC9B,KAAK,IAAI,6BAA6B,GACvC,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,yBAAyB,EACzB,kCAAkC,EAClC,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,EAC1B,oBAAoB,EACpB,gBAAgB,EAChB,+BAA+B,EAC/B,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uCAAuC,EACvC,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,EACrB,iBAAiB,EACjB,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,qCAAqC,GACtC,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,YAAY,CAAC"}

package/dist/core/workflow/workspaces/index.js

@@ -0,0 +1,7 @@
+export { cancelWorkspace } from "./cancellation.js";
+export { cleanupWorkspace } from "./cleanup.js";
+export { inspectWorkflowWorkspace, listWorkflowWorkspaceInspections, readWorkflowWorkspaceStatus, renderWorkflowWorkspaceStatus, } from "./inspect.js";
+export { applyIntegration, prepareIntegration } from "./integration.js";
+export { assertWorkspaceLifecycleTransition, deriveWorkspaceLifecycle, isWorkspaceLifecycleState, validateProviderEventChain, } from "./lifecycle.js";
+export { createLocalGitWorktreeProvider, probe as probeLocalGitWorktreeProvider, } from "./local-git.js";
+export { WORKSPACE_BINDING_SCHEMA_VERSION, WORKSPACE_RECEIPT_SCHEMA_VERSION, } from "./types.js";

package/dist/core/workflow/workspaces/inspect.d.ts

@@ -0,0 +1,85 @@
+import type { WorkflowProof } from "../types.js";
+import { type WorkspaceLifecycleProjection } from "./lifecycle.js";
+import type { WorkspaceCompatibilityExecutionEvidence, WorkspaceIsolation, WorkspaceProviderRef } from "./types.js";
+export type WorkflowWorkspaceSelection = "shared" | "compatibility" | "isolated";
+export type WorkflowWorkspaceVerification = "not_applicable" | "pending" | "ok" | "blocked" | "lost";
+export interface WorkflowWorkspaceStatus {
+    schema_version: 1;
+    run_id: string;
+    run_name: string;
+    work_item_id?: string;
+    started_at: string;
+    selection: WorkflowWorkspaceSelection;
+    requested_isolation: "shared" | WorkspaceIsolation;
+    effective_isolation: "shared" | WorkspaceIsolation;
+    provider?: WorkspaceProviderRef;
+    compatibility?: {
+        reason: WorkspaceCompatibilityExecutionEvidence["selection_reason"];
+        unsupported: WorkspaceCompatibilityExecutionEvidence["unsupported"];
+        unknowns: WorkspaceCompatibilityExecutionEvidence["unknowns"];
+    };
+    allocation?: {
+        binding_id: string;
+        workspace_id: string;
+        workspace_root: string;
+        active_root: string;
+        created_at: string;
+    };
+    lifecycle: WorkspaceLifecycleProjection;
+    verification: {
+        status: WorkflowWorkspaceVerification;
+        workflow_status?: WorkflowProof["run"]["status"];
+        attested_at?: string;
+        drift: string[];
+        unsupported: Array<{
+            code: string;
+            message: string;
+        }>;
+        unknowns: Array<{
+            code: string;
+            message: string;
+        }>;
+    };
+    integration: {
+        state: WorkspaceLifecycleProjection["integration_state"];
+        changed_paths: string[];
+        target_ref?: string;
+        target_commit?: string;
+        receipt_id?: string;
+    };
+    cleanup: {
+        state: "not_requested" | "pending" | "released" | "preserved_dirty" | "blocked";
+        attempts: number;
+        reason?: string;
+        receipt_id?: string;
+    };
+    repository: {
+        dirty_paths: string[];
+        conflicts: string[];
+        operations_in_progress: string[];
+    };
+    integrity: {
+        status: "verified";
+        proof_sha256?: string;
+        provider_event_chain_sha256: string | null;
+    };
+}
+export type WorkflowWorkspaceInspection = {
+    ok: true;
+    value: WorkflowWorkspaceStatus;
+} | {
+    ok: false;
+    run_id: string;
+    error: string;
+};
+/**
+ * Read one workflow's workspace state from validated durable authority.
+ *
+ * Corrupt, contradictory, or foreign records throw instead of being projected
+ * as healthy. Use inspectWorkflowWorkspace when a UI needs a typed error row.
+ */
+export declare function readWorkflowWorkspaceStatus(coordRoot: string, runId: string): WorkflowWorkspaceStatus;
+export declare function inspectWorkflowWorkspace(coordRoot: string, runId: string): WorkflowWorkspaceInspection;
+export declare function listWorkflowWorkspaceInspections(coordRoot: string): WorkflowWorkspaceInspection[];
+export declare function renderWorkflowWorkspaceStatus(status: WorkflowWorkspaceStatus): string;
+//# sourceMappingURL=inspect.d.ts.map

package/dist/core/workflow/workspaces/inspect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspect.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/inspect.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAA4B,KAAK,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAS7F,OAAO,KAAK,EAQV,uCAAuC,EACvC,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAKpB,MAAM,MAAM,0BAA0B,GAAG,QAAQ,GAAG,eAAe,GAAG,UAAU,CAAC;AACjF,MAAM,MAAM,6BAA6B,GACrC,gBAAgB,GAChB,SAAS,GACT,IAAI,GACJ,SAAS,GACT,MAAM,CAAC;AAEX,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,CAAC,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,0BAA0B,CAAC;IACtC,mBAAmB,EAAE,QAAQ,GAAG,kBAAkB,CAAC;IACnD,mBAAmB,EAAE,QAAQ,GAAG,kBAAkB,CAAC;IACnD,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,aAAa,CAAC,EAAE;QACd,MAAM,EAAE,uCAAuC,CAAC,kBAAkB,CAAC,CAAC;QACpE,WAAW,EAAE,uCAAuC,CAAC,aAAa,CAAC,CAAC;QACpE,QAAQ,EAAE,uCAAuC,CAAC,UAAU,CAAC,CAAC;KAC/D,CAAC;IACF,UAAU,CAAC,EAAE;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,SAAS,EAAE,4BAA4B,CAAC;IACxC,YAAY,EAAE;QACZ,MAAM,EAAE,6BAA6B,CAAC;QACtC,eAAe,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjD,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,WAAW,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACtD,QAAQ,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACpD,CAAC;IACF,WAAW,EAAE;QACX,KAAK,EAAE,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;QACzD,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,OAAO,EAAE;QACP,KAAK,EAAE,eAAe,GAAG,SAAS,GAAG,UAAU,GAAG,iBAAiB,GAAG,SAAS,CAAC;QAChF,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,UAAU,EAAE;QACV,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,sBAAsB,EAAE,MAAM,EAAE,CAAC;KAClC,CAAC;IACF,SAAS,EAAE;QACT,MAAM,EAAE,UAAU,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5C,CAAC;CACH;AAED,MAAM,MAAM,2BAA2B,GACnC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,GAC5C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAUjD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,uBAAuB,CAqKzB;AAED,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,2BAA2B,CAU7B;AAED,wBAAgB,gCAAgC,CAAC,SAAS,EAAE,MAAM,GAAG,2BAA2B,EAAE,CAOjG;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,uBAAuB,GAAG,MAAM,CAiCrF"}