harness-dispatch 0.4.0 → 0.6.0

package/dist/workspace-resolve.js

@@ -0,0 +1,382 @@
+/**
+ * What happens to isolated work AFTER the agent finishes.
+ *
+ * `copy` and `git_worktree` gave you a workspace path, a changed-file list and
+ * a `cleanupHint` — a string telling you to run `git worktree remove`
+ * yourself. Isolation worked and nothing was ever applied automatically, but
+ * there was no way to see the actual change, no way to keep it, and no way to
+ * clean up but by hand. Isolated dispatches were effectively write-only: you
+ * could look at a summary and then abandon the result.
+ *
+ * This module is the missing half — inspect, then keep or throw away.
+ *
+ * THE DANGEROUS PART IS `apply`, and it is dangerous in one specific way:
+ * applying a patch into a directory that has moved on since the agent started
+ * can conflict with, or silently overwrite, work the user did in the meantime.
+ * So apply refuses when the target has uncommitted changes unless the caller
+ * explicitly overrides, and it always writes the patch to disk first so there
+ * is a manual path (`git apply`) even when the automatic one declines.
+ */
+import { execFile as execFileCb } from "node:child_process";
+import { existsSync } from "node:fs";
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+import { EXCLUDED_DIRS } from "./workspaces.js";
+const execFile = promisify(execFileCb);
+/** Patches are read into memory and returned over MCP, so they are bounded. */
+export const MAX_PATCH_BYTES = 2 * 1024 * 1024;
+/** How much of a patch is returned inline before it is truncated for display. */
+export const MAX_PATCH_CHARS = 60_000;
+async function git(args, cwd) {
+    const { stdout } = await execFile("git", args, {
+        cwd,
+        windowsHide: true,
+        maxBuffer: MAX_PATCH_BYTES,
+    });
+    return String(stdout);
+}
+/** `git diff` exits 1 when there ARE differences; that is success, not failure. */
+async function gitDiff(args, cwd) {
+    try {
+        return await git(args, cwd);
+    }
+    catch (err) {
+        const e = err;
+        if (e.code === 1 && typeof e.stdout === "string")
+            return e.stdout;
+        throw err;
+    }
+}
+/** The directory the agent actually worked in, for each isolation policy. */
+function isolatedRoot(run) {
+    if (run.policy === "git_worktree")
+        return path.join(run.workspaceRoot ?? "", "worktree");
+    return run.effectiveWorkingDir;
+}
+export function isResolvable(run) {
+    return run !== undefined && run.isolated && run.workspaceRoot !== undefined;
+}
+/**
+ * Produce a unified patch of what the agent changed, relative to the project
+ * root, so it applies with `git apply -p1` from `originalWorkingDir`.
+ *
+ * The two policies need different bases and getting this wrong is destructive:
+ *
+ *   git_worktree — diff against the COMMIT the worktree was created from.
+ *     A worktree starts at HEAD, not at the caller's working tree, so diffing
+ *     it against the original directory of a dirty project would report the
+ *     user's own uncommitted work as deletions.
+ *   copy — diff against the original directory, which is exactly what the
+ *     copy was made from, so the difference is the agent's work and nothing
+ *     else.
+ */
+export async function buildWorkspacePatch(run) {
+    const root = isolatedRoot(run);
+    if (!existsSync(root)) {
+        throw new Error(`The isolated workspace for this job is gone (${root}). Workspaces are pruned ` +
+            `once they age out, so inspect and resolve a job before that happens.`);
+    }
+    if (run.policy === "git_worktree") {
+        if (!run.baseCommit) {
+            throw new Error("This worktree job predates base-commit recording, so a safe patch cannot be " +
+                "produced — diffing it against a dirty project could report your own " +
+                "uncommitted work as deletions. Inspect it by hand at " +
+                `${root}, or re-run the dispatch.`);
+        }
+        // `add -A -N` registers untracked files as intent-to-add so they appear in
+        // the diff as additions. It touches only the throwaway worktree's index.
+        await git(["add", "-A", "-N"], root).catch(() => undefined);
+        return gitDiff(["diff", "--binary", run.baseCommit, "--"], root);
+    }
+    // --no-index works outside a repository and handles added/deleted files.
+    //
+    // The paths are handed to git in POSIX form deliberately. Given a Windows
+    // path, git quotes the whole filename and escapes the separators as `\\`,
+    // so the emitted header reads `"a/C:\\Users\\..."` — and any attempt to
+    // normalise that afterwards has to understand C-string escaping. Passing
+    // forward slashes means git emits a plain unquoted path that simple prefix
+    // stripping can handle.
+    const origPosix = toPosix(run.originalWorkingDir);
+    const isoPosix = toPosix(root);
+    const raw = await gitDiff(["diff", "--no-index", "--binary", "--", origPosix, isoPosix], path.dirname(run.originalWorkingDir));
+    // Order matters: the workspace itself is filtered out on ABSOLUTE paths,
+    // before normalisation collapses them.
+    const withoutWorkspace = dropSectionsUnder(raw, toPosix(run.workspaceRoot ?? ""));
+    return dropExcludedSections(normaliseNoIndexPaths(withoutWorkspace, origPosix, isoPosix));
+}
+/**
+ * Drop patch sections for files inside the workspace directory itself.
+ *
+ * A `copy` workspace lives INSIDE the project (.harness-dispatch/workspaces/),
+ * so `git diff --no-index <project> <copy>` walks into the copy while
+ * scanning the project and reports the copy's own files as project files.
+ * Normalisation then rewrites those paths — they contain the isolated root as
+ * a substring — down to the same names as the real ones, producing a patch
+ * with two conflicting sections per file: a spurious deletion of the copy's
+ * version, and the genuine edit.
+ *
+ * Observed live: `app.js` appeared twice, once "deleted file mode" and once
+ * modified. Applying that would have deleted the file it was meant to update.
+ * It never showed up in unit tests because the fixtures put the copy outside
+ * the project, which is not where the product puts it.
+ */
+function dropSectionsUnder(patch, absRoot) {
+    if (!patch || !absRoot)
+        return patch;
+    const lines = patch.split("\n");
+    // Section-wise, because the leaked entries cannot be told from legitimate
+    // ones by their header alone. A file the agent ADDED and a copy-of-the-copy
+    // artefact both carry the isolated root on BOTH sides of `diff --git` — the
+    // difference is direction. The artefacts are always deletions (the file
+    // exists under the workspace while scanning the project, and has no
+    // counterpart inside the copy, which excludes its own workspace directory),
+    // and a real addition is always `--- /dev/null`. Filtering on the header
+    // alone dropped every genuine change too, and produced an empty patch.
+    const sections = [];
+    let current = [];
+    for (const line of lines) {
+        if (line.startsWith("diff --git ") && current.length > 0) {
+            sections.push(current);
+            current = [];
+        }
+        current.push(line);
+    }
+    if (current.length > 0)
+        sections.push(current);
+    const kept = sections.filter((section) => {
+        const header = section[0] ?? "";
+        if (!header.startsWith("diff --git "))
+            return true;
+        const underWorkspace = header.includes(`${absRoot}/`);
+        if (!underWorkspace)
+            return true;
+        const isDeletion = section.some((l) => l.startsWith("+++ /dev/null"));
+        return !isDeletion;
+    });
+    return kept.map((s) => s.join("\n")).join("\n");
+}
+/**
+ * Remove patch sections for paths the COPY never contained.
+ *
+ * copyTree skips .git, node_modules and friends, so a plain directory diff
+ * reports every one of those files as deleted — and applying that patch would
+ * delete the user's repository. The exclusion set is imported from
+ * workspaces.ts rather than restated here: two lists would drift, and the
+ * failure mode of drifting is destroying a .git directory.
+ *
+ * Only the `copy` policy needs this. A worktree diff is bounded by a real
+ * commit, so it never sees these paths at all.
+ */
+function dropExcludedSections(patch) {
+    if (!patch)
+        return patch;
+    const out = [];
+    let skipping = false;
+    for (const line of patch.split("\n")) {
+        if (line.startsWith("diff --git ")) {
+            const rel = /^diff --git a\/(\S+)/.exec(line)?.[1] ?? "";
+            const top = rel.split("/")[0] ?? "";
+            skipping = EXCLUDED_DIRS.has(top);
+        }
+        if (!skipping)
+            out.push(line);
+    }
+    return out.join("\n");
+}
+function toPosix(p) {
+    return p.replace(/\\/g, "/").replace(/\/+$/, "");
+}
+/**
+ * Rewrite `git diff --no-index` headers so the patch is repo-relative.
+ *
+ * --no-index emits the absolute paths it was given (`--- a/C:/long/path/...`),
+ * which applies nowhere but this machine. Rewriting them to a/<rel> and
+ * b/<rel> makes the patch portable and applicable with -p1, which is what
+ * every other git patch in the world expects.
+ */
+export function normaliseNoIndexPaths(patch, origRoot, isoRoot) {
+    if (!patch)
+        return patch;
+    // Longest first: when one root is a prefix of the other, stripping the
+    // shorter one first would leave a fragment of the longer behind.
+    const roots = [origRoot, isoRoot].sort((a, b) => b.length - a.length);
+    return patch
+        .split("\n")
+        .map((line) => {
+        let out = line;
+        for (const r of roots) {
+            // The a/ and b/ prefixes are rebuilt explicitly rather than left to a
+            // blanket strip, because a POSIX root already starts with "/": git
+            // emits `a//tmp/proj/app.js`, and removing "/tmp/proj/" from that
+            // leaves "aapp.js" — the prefix eaten, the patch unusable. A Windows
+            // root starts with a drive letter, so the blanket version worked
+            // there and this only failed on POSIX, in CI.
+            out = out.split(`a${r}/`).join("a/").split(`b${r}/`).join("b/");
+            out = out.split(`a/${r}/`).join("a/").split(`b/${r}/`).join("b/");
+            // Anything left over (e.g. a bare path in a "similarity index" line).
+            out = out.split(`${r}/`).join("");
+        }
+        return out;
+    })
+        .join("\n");
+}
+/** Build the patch, cache it next to the job, and return it (bounded). */
+export async function workspaceDiff(jobId, jobDir, run) {
+    const patch = await buildWorkspacePatch(run);
+    const patchPath = path.join(jobDir, "output", "workspace.patch");
+    await mkdir(path.dirname(patchPath), { recursive: true });
+    await writeFile(patchPath, patch, { encoding: "utf8", mode: 0o600 });
+    const truncated = patch.length > MAX_PATCH_CHARS;
+    return {
+        jobId,
+        policy: run.policy,
+        patchPath,
+        bytes: Buffer.byteLength(patch, "utf8"),
+        patch: truncated
+            ? `${patch.slice(0, MAX_PATCH_CHARS)}\n[... truncated, full patch at ${patchPath}]`
+            : patch,
+        truncated,
+        ...(run.changedFiles !== undefined ? { changedFiles: run.changedFiles } : {}),
+    };
+}
+/**
+ * Uncommitted changes in the target, or undefined when it is not a repo.
+ *
+ * The tool's OWN directory is not the user's work. A `copy` workspace is
+ * created at <project>/.harness-dispatch/workspaces/..., so its mere existence
+ * made `git status` non-empty and apply refused every single time with "1
+ * uncommitted change" — the feature blocking itself with its own scratch
+ * space. Only real changes count toward the dirty check.
+ */
+async function dirtyPaths(dir) {
+    try {
+        const out = await git(["status", "--porcelain"], dir);
+        return out
+            .split("\n")
+            .map((l) => l.trim())
+            .filter(Boolean)
+            .filter((line) => {
+            // Porcelain lines are "XY path"; the path may be quoted.
+            const p = line.slice(2).trim().replace(/^"|"$/g, "").replace(/\\/g, "/");
+            return !(p === ".harness-dispatch" || p.startsWith(".harness-dispatch/"));
+        });
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Apply the agent's work into the real project.
+ *
+ * Refuses by default when the target has uncommitted changes: the patch was
+ * built against a specific base, and applying it over work done since can
+ * conflict or clobber. `force` overrides, and the patch file is written
+ * either way so `git apply` by hand is always available.
+ */
+export async function applyWorkspace(jobId, jobDir, run, opts = {}) {
+    const diff = await workspaceDiff(jobId, jobDir, run);
+    if (diff.bytes === 0) {
+        return {
+            jobId,
+            applied: false,
+            patchPath: diff.patchPath,
+            message: "The agent changed nothing, so there is nothing to apply.",
+        };
+    }
+    const target = run.originalWorkingDir;
+    const dirty = await dirtyPaths(target);
+    if (dirty !== undefined && dirty.length > 0 && opts.force !== true) {
+        return {
+            jobId,
+            applied: false,
+            patchPath: diff.patchPath,
+            message: `Refused: ${target} has ${dirty.length} uncommitted change(s), and this patch was ` +
+                `built against a clean base — applying it could conflict with or overwrite work ` +
+                `done since the dispatch started. Commit or stash first, re-run with force: true ` +
+                `to apply anyway, or apply by hand: git apply "${diff.patchPath}"`,
+        };
+    }
+    // --3way first: it merges when context has moved instead of failing
+    // outright. It needs the pre-image blobs to exist in the target repo, which
+    // holds for a worktree patch (same repo, real commit) but NOT for a copy
+    // patch — `git diff --no-index` writes index lines for blobs the repo has
+    // never seen, so --3way fails with "could not build fake ancestor". Plain
+    // apply handles that fine, so the strict-but-smarter mode is an attempt,
+    // not a requirement.
+    let applyError;
+    for (const args of [
+        ["apply", "--3way", "--whitespace=nowarn", diff.patchPath],
+        ["apply", "--whitespace=nowarn", diff.patchPath],
+    ]) {
+        try {
+            await git(args, target);
+            applyError = undefined;
+            break;
+        }
+        catch (err) {
+            applyError = err instanceof Error ? err.message : String(err);
+        }
+    }
+    if (applyError !== undefined) {
+        const firstLine = applyError.split("\n").find((l) => l.includes("error:")) ?? applyError.split("\n")[0];
+        return {
+            jobId,
+            applied: false,
+            patchPath: diff.patchPath,
+            message: `git apply failed: ${firstLine}. The patch is intact at ` +
+                `${diff.patchPath} — resolve by hand, or inspect the workspace directly.`,
+        };
+    }
+    return {
+        jobId,
+        applied: true,
+        patchPath: diff.patchPath,
+        message: `Applied ${diff.bytes} bytes of changes to ${target}. Review with git diff before committing.`,
+        ...(run.changedFiles !== undefined ? { changedFiles: run.changedFiles } : {}),
+    };
+}
+/**
+ * Throw the isolated workspace away.
+ *
+ * A git worktree is not just a directory: `rm -rf` on it leaves the parent
+ * repository's worktree metadata behind, and git then complains about a
+ * missing worktree until someone runs `git worktree prune`. So worktrees are
+ * removed through git, with a filesystem sweep afterwards for the wrapper
+ * directory git does not own.
+ */
+export async function discardWorkspace(jobId, run) {
+    const root = run.workspaceRoot;
+    if (!root) {
+        return { jobId, discarded: false, message: "This job has no isolated workspace to discard." };
+    }
+    if (!existsSync(root)) {
+        return { jobId, discarded: true, message: `Already gone: ${root}` };
+    }
+    if (run.policy === "git_worktree") {
+        const worktree = path.join(root, "worktree");
+        try {
+            await git(["worktree", "remove", "--force", worktree], run.originalWorkingDir);
+        }
+        catch {
+            // Fall through to the filesystem sweep; prune fixes the metadata.
+            await git(["worktree", "prune"], run.originalWorkingDir).catch(() => undefined);
+        }
+    }
+    await rm(root, { recursive: true, force: true });
+    return {
+        jobId,
+        discarded: true,
+        message: `Discarded the isolated workspace at ${root}. The original project was never modified.`,
+    };
+}
+/** Read a previously written patch, if one was cached. */
+export async function cachedPatch(jobDir) {
+    try {
+        return await readFile(path.join(jobDir, "output", "workspace.patch"), "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=workspace-resolve.js.map

package/dist/workspace-resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-resolve.js","sourceRoot":"","sources":["../src/workspace-resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;AAEvC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE/C,iFAAiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AAEtC,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAW;IAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE;QAC7C,GAAG;QACH,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,eAAe;KAC3B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,GAAW;IAChD,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAyC,CAAC;QACpD,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC,MAAM,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,GAAiB;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;IACzF,OAAO,GAAG,CAAC,mBAAmB,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAA6B;IACxD,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAiB;IACzD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,gDAAgD,IAAI,2BAA2B;YAC7E,sEAAsE,CACzE,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,8EAA8E;gBAC5E,sEAAsE;gBACtE,uDAAuD;gBACvD,GAAG,IAAI,2BAA2B,CACrC,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5D,OAAO,OAAO,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IAED,yEAAyE;IACzE,EAAE;IACF,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,2EAA2E;IAC3E,wBAAwB;IACxB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,EAC7D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CACrC,CAAC;IACF,yEAAyE;IACzE,uCAAuC;IACvC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;IAClF,OAAO,oBAAoB,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,iBAAiB,CAAC,KAAa,EAAE,OAAe;IACvD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEhC,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,wEAAwE;IACxE,oEAAoE;IACpE,4EAA4E;IAC5E,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,QAAQ,GAAe,EAAE,CAAC;IAChC,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE/C,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;QACvC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,UAAU,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACpC,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,QAAgB,EAAE,OAAe;IACpF,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,uEAAuE;IACvE,iEAAiE;IACjE,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACtE,OAAO,KAAK;SACT,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,IAAI,GAAG,GAAG,IAAI,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,sEAAsE;YACtE,mEAAmE;YACnE,kEAAkE;YAClE,qEAAqE;YACrE,iEAAiE;YACjE,8CAA8C;YAC9C,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClE,sEAAsE;YACtE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAcD,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAa,EACb,MAAc,EACd,GAAiB;IAEjB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IACjE,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC;IACjD,OAAO;QACL,KAAK;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,SAAS;QACT,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC;QACvC,KAAK,EAAE,SAAS;YACd,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,mCAAmC,SAAS,GAAG;YACnF,CAAC,CAAC,KAAK;QACT,SAAS;QACT,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,UAAU,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO,GAAG;aACP,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACf,yDAAyD;YACzD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACzE,OAAO,CAAC,CAAC,CAAC,KAAK,mBAAmB,IAAI,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACP,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAUD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,MAAc,EACd,GAAiB,EACjB,OAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,KAAK;YACL,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,0DAA0D;SACpE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACnE,OAAO;YACL,KAAK;YACL,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EACL,YAAY,MAAM,QAAQ,KAAK,CAAC,MAAM,6CAA6C;gBACnF,iFAAiF;gBACjF,kFAAkF;gBAClF,iDAAiD,IAAI,CAAC,SAAS,GAAG;SACrE,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,qBAAqB;IACrB,IAAI,UAA8B,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI;QACjB,CAAC,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC;QAC1D,CAAC,OAAO,EAAE,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC;KACjD,EAAE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACxB,UAAU,GAAG,SAAS,CAAC;YACvB,MAAM;QACR,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxG,OAAO;YACL,KAAK;YACL,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EACL,qBAAqB,SAAS,2BAA2B;gBACzD,GAAG,IAAI,CAAC,SAAS,wDAAwD;SAC5E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK;QACL,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,WAAW,IAAI,CAAC,KAAK,wBAAwB,MAAM,2CAA2C;QACvG,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC;AAQD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,GAAiB;IAEjB,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,OAAO;QACL,KAAK;QACL,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,uCAAuC,IAAI,4CAA4C;KACjG,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc;IAC9C,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/workspaces.d.ts

@@ -1,4 +1,5 @@
 import type { DispatchResult, SafetyProfile, ServiceConfig, WorkspacePolicy } from "./types.js";
+export declare const EXCLUDED_DIRS: Set<string>;
 export interface PreparedWorkspace {
     policy: WorkspacePolicy;
     originalWorkingDir: string;
@@ -10,6 +11,21 @@ export interface PreparedWorkspace {
 }
 export declare function workspacePolicyFor(svc: ServiceConfig, safetyProfile: SafetyProfile | undefined, requestedPolicy?: WorkspacePolicy): WorkspacePolicy;
 export declare function isIsolatedWorkspacePolicy(policy: WorkspacePolicy): boolean;
+/**
+ * Files that sit outside `workingDir`, i.e. the ones mapFiles cannot bring
+ * into an isolated workspace.
+ *
+ * These are not merely "still readable at their original path". On CLI routes
+ * each such file's PARENT DIRECTORY is passed to the spawned agent as an
+ * access grant (generic-cli.ts includedDirectories -> {{file_dirs}} ->
+ * `--add-dir`), so under workspace_policy copy/git_worktree a single
+ * out-of-tree entry silently widens the "isolated" workspace to include a
+ * host directory. files: ["~/.ssh/id_rsa"] grants ~/.ssh.
+ *
+ * Isolation is the caller's stated intent, so this is surfaced as a warning
+ * rather than silently honoured or silently dropped.
+ */
+export declare function escapedFiles(files: string[], originalWorkingDir: string): string[];
 export declare function prepareWorkspace(opts: {
     routeName: string;
     policy: WorkspacePolicy;

package/dist/workspaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspaces.d.ts","sourceRoot":"","sources":["../src/workspaces.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACb,aAAa,EAEb,eAAe,EAEhB,MAAM,YAAY,CAAC;AA2BpB,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,eAAe,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACzD;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,aAAa,EAClB,aAAa,EAAE,aAAa,GAAG,SAAS,EACxC,eAAe,CAAC,EAAE,eAAe,GAChC,eAAe,CAIjB;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAE1E;AA4UD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,eAAe,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAU7B"}
+{"version":3,"file":"workspaces.d.ts","sourceRoot":"","sources":["../src/workspaces.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACb,aAAa,EAEb,eAAe,EAEhB,MAAM,YAAY,CAAC;AAIpB,eAAO,MAAM,aAAa,aAcxB,CAAC;AASH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,eAAe,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACzD;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,aAAa,EAClB,aAAa,EAAE,aAAa,GAAG,SAAS,EACxC,eAAe,CAAC,EAAE,eAAe,GAChC,eAAe,CAIjB;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAE1E;AAkSD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,kBAAkB,EAAE,MAAM,GAAG,MAAM,EAAE,CAUlF;AA6KD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,eAAe,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAU7B"}