intentdna 1.9.0 → 1.9.3

package/dist/runtime/workspace-isolation.js

@@ -6,9 +6,12 @@
  * Team naming, CLI parsing, generated shell, and automatic rollback are excluded.
  */
 import { spawnSync } from "node:child_process";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { existsSync, lstatSync, mkdirSync, realpathSync, } from "node:fs";
+import { link, lstat, mkdir, readFile, rename, rm, stat, unlink, utimes, writeFile, } from "node:fs/promises";
+import { tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, } from "node:path";
+import { canonicalizeJson } from "./canonical-json.js";
 export class WorkspaceIsolationError extends Error {
     code;
     constructor(code, message) {
@@ -35,6 +38,17 @@ function git(cwd, args, allowFailure = false) {
     }
     return output;
 }
+function sharedWorkspaceGitState(root) {
+    const topLevel = git(root, ["rev-parse", "--show-toplevel"], true);
+    const head = git(root, ["rev-parse", "--verify", "HEAD"], true);
+    if (topLevel.status !== 0 || head.status !== 0)
+        return null;
+    const branch = git(root, ["symbolic-ref", "--quiet", "HEAD"], true);
+    return {
+        head: head.stdout.trim(),
+        branch_ref: branch.status === 0 ? branch.stdout.trim() : null,
+    };
+}
 function requireText(value, label) {
     const trimmed = value.trim();
     if (!trimmed || trimmed.includes("\0")) {
@@ -53,6 +67,63 @@ function canonicalExistingDirectory(path, label) {
     }
     return realpathSync(requested);
 }
+function isContainedPath(root, candidate) {
+    const child = relative(root, candidate);
+    return child === "" || (!child.startsWith("..") && !isAbsolute(child));
+}
+/**
+ * Resolve an existing directory below a committed workspace without following
+ * symbolic-link components. This is suitable for verifier/process cwd values.
+ */
+export async function canonicalWorkspaceDirectory(workspaceRoot, relativeDirectory, label = "working_directory") {
+    return resolveCanonicalWorkspaceDirectory(workspaceRoot, relativeDirectory, label, false);
+}
+async function resolveCanonicalWorkspaceDirectory(workspaceRoot, relativeDirectory, label, createMissing) {
+    const root = canonicalExistingDirectory(workspaceRoot, "workspace_root");
+    const requested = requireText(relativeDirectory, label);
+    if (isAbsolute(requested)) {
+        throw new WorkspaceIsolationError("invalid_request", `${label} must be relative`);
+    }
+    const candidate = resolve(root, requested);
+    if (!isContainedPath(root, candidate)) {
+        throw new WorkspaceIsolationError("workspace_mismatch", `${label} escapes the committed workspace`);
+    }
+    const child = relative(root, candidate);
+    let current = root;
+    for (const segment of child.split(/[\\/]+/).filter(Boolean)) {
+        current = join(current, segment);
+        let status;
+        try {
+            status = await lstat(current);
+        }
+        catch (error) {
+            if (error.code === "ENOENT" && createMissing) {
+                try {
+                    await mkdir(current);
+                }
+                catch (mkdirError) {
+                    if (mkdirError.code !== "EEXIST")
+                        throw mkdirError;
+                }
+                status = await lstat(current);
+            }
+            else if (error.code === "ENOENT") {
+                throw new WorkspaceIsolationError("invalid_request", `${label} does not exist: ${candidate}`);
+            }
+            else {
+                throw error;
+            }
+        }
+        if (status.isSymbolicLink() || !status.isDirectory()) {
+            throw new WorkspaceIsolationError("workspace_mismatch", `${label} must contain only real directories: ${current}`);
+        }
+    }
+    const canonical = realpathSync(candidate);
+    if (!isContainedPath(root, canonical)) {
+        throw new WorkspaceIsolationError("workspace_mismatch", `${label} resolves outside the committed workspace`);
+    }
+    return canonical;
+}
 function repositoryRoot(cwd) {
     const result = git(cwd, ["rev-parse", "--show-toplevel"], true);
     if (result.status !== 0 || !result.stdout.trim()) {
@@ -187,8 +258,9 @@ function expectedBranchRef(plan) {
 }
 function assertMatchingWorktree(plan, entry) {
     if (entry.branch_ref !== expectedBranchRef(plan)
+        || entry.head !== plan.base_commit
         || !sameGitRepository(plan.repository_root, plan.working_directory)) {
-        throw new WorkspaceIsolationError("workspace_mismatch", `existing worktree is not owned by attempt ${plan.attempt_id}: ${plan.working_directory}`);
+        throw new WorkspaceIsolationError("workspace_conflict", `existing worktree is not owned by attempt ${plan.attempt_id}: ${plan.working_directory}`);
     }
 }
 export function planAttemptWorkspace(request) {
@@ -244,6 +316,9 @@ export function allocateAttemptWorkspace(plan) {
     if (existing) {
         assertMatchingWorktree(plan, existing);
         const state = workspaceState(plan.working_directory);
+        if (state.dirty || state.conflicted) {
+            throw new WorkspaceIsolationError("workspace_conflict", `existing pre-start worktree is ${state.conflicted ? "conflicted" : "dirty"}: ${plan.working_directory}`);
+        }
         return {
             ...plan,
             created: false,
@@ -261,16 +336,22 @@ export function allocateAttemptWorkspace(plan) {
     }
     const branchExists = git(plan.repository_root, ["show-ref", "--verify", "--quiet", expectedBranchRef(plan)], true).status === 0;
     if (branchExists) {
-        throw new WorkspaceIsolationError("branch_conflict", `attempt branch already exists without its owned worktree: ${plan.branch_name}`);
+        const tip = resolveCommit(plan.repository_root, plan.branch_name);
+        if (tip !== plan.base_commit) {
+            throw new WorkspaceIsolationError("branch_conflict", `attempt branch exists at unexpected commit: ${plan.branch_name}`);
+        }
+        git(plan.repository_root, ["worktree", "add", plan.working_directory, plan.branch_name]);
+    }
+    else {
+        git(plan.repository_root, [
+            "worktree",
+            "add",
+            "-b",
+            plan.branch_name,
+            plan.working_directory,
+            plan.base_commit,
+        ]);
     }
-    git(plan.repository_root, [
-        "worktree",
-        "add",
-        "-b",
-        plan.branch_name,
-        plan.working_directory,
-        plan.base_commit,
-    ]);
     return {
         ...plan,
         created: true,
@@ -279,6 +360,402 @@ export function allocateAttemptWorkspace(plan) {
         conflicted_at_allocation: false,
     };
 }
+function canonicalWorkspacePlan(payload) {
+    return {
+        workspace_plan_id: `sha256:${createHash("sha256").update(canonicalizeJson(payload)).digest("hex")}`,
+        payload,
+    };
+}
+function authorityKey(kind, path) {
+    return `${kind}:${createHash("sha256").update(realpathSync(path)).digest("hex")}`;
+}
+function committedSharedWorkspaceRoot(allocation) {
+    let candidate = resolve(allocation.working_directory);
+    for (;;) {
+        const lexicalKey = `none:${createHash("sha256").update(candidate).digest("hex")}`;
+        if (existsSync(candidate)
+            && (lexicalKey === allocation.authority_key || authorityKey("none", candidate) === allocation.authority_key)) {
+            return realpathSync(candidate);
+        }
+        const parent = dirname(candidate);
+        if (parent === candidate)
+            break;
+        candidate = parent;
+    }
+    throw new WorkspaceIsolationError("workspace_mismatch", "shared working_directory is no longer contained by its committed workspace root");
+}
+async function allocationFromPlan(plan) {
+    if (plan.payload.kind === "none") {
+        const root = committedSharedWorkspaceRoot(plan.payload);
+        const workingDirectory = await resolveCanonicalWorkspaceDirectory(root, relative(root, realpathSync(resolve(plan.payload.working_directory))) || ".", "working_directory", false);
+        const gitState = sharedWorkspaceGitState(root);
+        return {
+            ...plan.payload,
+            working_directory: workingDirectory,
+            workspace_plan_id: plan.workspace_plan_id,
+            observed_head: gitState?.head ?? null,
+            observed_branch_ref: gitState?.branch_ref ?? null,
+        };
+    }
+    const legacy = {
+        isolation: "worktree",
+        run_id: "workspace-authority",
+        step_id: "workspace-authority",
+        attempt_id: plan.payload.workspace_id,
+        repository_root: plan.payload.repository_root,
+        worktree_root: dirname(plan.payload.worktree_root),
+        working_directory: plan.payload.worktree_root,
+        branch_name: plan.payload.branch_name,
+        base_ref: plan.payload.base_ref,
+        base_commit: plan.payload.base_commit,
+        ownership_key: plan.payload.ownership_key,
+    };
+    allocateAttemptWorkspace(legacy);
+    const relativeWorkingDirectory = relative(plan.payload.worktree_root, plan.payload.working_directory);
+    if (!isContainedPath(resolve(plan.payload.worktree_root), resolve(plan.payload.working_directory))) {
+        throw new WorkspaceIsolationError("workspace_mismatch", "working_directory escapes the committed worktree");
+    }
+    const workingDirectory = await resolveCanonicalWorkspaceDirectory(plan.payload.worktree_root, relativeWorkingDirectory || ".", "working_directory", true);
+    const inspection = inspectAttemptWorkspace({
+        ...legacy,
+        created: false,
+        reused: true,
+        dirty_at_allocation: false,
+        conflicted_at_allocation: false,
+    });
+    if (!inspection.owned_by_attempt
+        || inspection.head !== plan.payload.base_commit
+        || inspection.branch_ref !== `refs/heads/${plan.payload.branch_name}`
+        || inspection.dirty
+        || inspection.conflicted) {
+        throw new WorkspaceIsolationError("workspace_conflict", "ensured worktree does not match the committed plan");
+    }
+    return {
+        ...plan.payload,
+        working_directory: workingDirectory,
+        workspace_plan_id: plan.workspace_plan_id,
+        observed_head: inspection.head,
+        observed_branch_ref: inspection.branch_ref,
+    };
+}
+function positiveInteger(value, label) {
+    if (!Number.isSafeInteger(value) || value <= 0) {
+        throw new WorkspaceIsolationError("invalid_request", `${label} must be a positive integer`);
+    }
+    return value;
+}
+function processIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+function parseLockOwner(text) {
+    try {
+        const value = JSON.parse(text);
+        return typeof value.owner === "string"
+            && typeof value.generation === "string"
+            && Number.isSafeInteger(value.pid)
+            && (value.pid ?? 0) > 0
+            && typeof value.acquired_at === "number"
+            ? value
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+export class LocalAttemptWorkspaceAuthority {
+    lockRoot;
+    lockWaitMs;
+    lockStaleMs;
+    lockRetryMs;
+    lockHeartbeatMs;
+    constructor(options = {}) {
+        this.lockRoot = resolve(options.lock_root ?? join(tmpdir(), "intentdna-workspace-authority-locks"));
+        this.lockWaitMs = positiveInteger(options.lock_wait_ms ?? 10_000, "lock_wait_ms");
+        this.lockStaleMs = positiveInteger(options.lock_stale_ms ?? 60_000, "lock_stale_ms");
+        this.lockRetryMs = positiveInteger(options.lock_retry_ms ?? 10, "lock_retry_ms");
+        this.lockHeartbeatMs = positiveInteger(options.lock_heartbeat_ms ?? 5_000, "lock_heartbeat_ms");
+        if (this.lockHeartbeatMs >= this.lockStaleMs) {
+            throw new WorkspaceIsolationError("invalid_request", "lock_heartbeat_ms must be less than lock_stale_ms");
+        }
+    }
+    async plan(request) {
+        const node = request.plan.plan.nodes.find((candidate) => candidate.node_id === request.activation.step_id);
+        if (!node || node.kind !== "worker") {
+            throw new WorkspaceIsolationError("invalid_request", "workspace planning requires a worker node");
+        }
+        const repositoryDirectory = request.run.run_binding.binding.workspace_root;
+        const legacy = planAttemptWorkspace({
+            isolation: node.workspace.isolation,
+            repository_directory: repositoryDirectory,
+            run_id: request.run.run_id,
+            step_id: request.activation.step_id,
+            attempt_id: request.attempt.attempt_id,
+            base_ref: "HEAD",
+        });
+        if (legacy.isolation === "none") {
+            const root = realpathSync(legacy.working_directory);
+            const workingDirectory = await resolveCanonicalWorkspaceDirectory(root, node.workspace.relative_working_directory, "relative_working_directory", true);
+            return canonicalWorkspacePlan({
+                kind: "none",
+                workspace_id: request.attempt.attempt_id,
+                working_directory: workingDirectory,
+                authority_key: authorityKey("none", root),
+            });
+        }
+        const workingDirectory = resolve(legacy.working_directory, node.workspace.relative_working_directory);
+        return canonicalWorkspacePlan({
+            kind: "worktree",
+            workspace_id: request.attempt.attempt_id,
+            working_directory: workingDirectory,
+            repository_root: legacy.repository_root,
+            worktree_root: legacy.working_directory,
+            branch_name: legacy.branch_name,
+            base_ref: legacy.base_ref,
+            base_commit: legacy.base_commit,
+            ownership_key: legacy.ownership_key,
+            authority_key: `worktree:${legacy.ownership_key}`,
+        });
+    }
+    async ensureWithExclusiveAuthority(plan, operation) {
+        return this.withLock(plan.payload.authority_key, async () => operation(await allocationFromPlan(plan)));
+    }
+    async withExclusiveMutationAuthority(request, operation) {
+        return this.withLock(request.allocation.authority_key, async () => {
+            await this.assertCommittedAllocation(request);
+            const fencingEpoch = await this.nextFencingEpoch(request.allocation.authority_key);
+            return operation({
+                workspace_id: request.allocation.workspace_id,
+                workspace_allocation_digest: `sha256:${createHash("sha256")
+                    .update(canonicalizeJson(request.allocation), "utf8")
+                    .digest("hex")}`,
+                authority_instance_id: `workspace-authority:${randomUUID()}`,
+                fencing_epoch: fencingEpoch,
+            });
+        });
+    }
+    async nextFencingEpoch(key) {
+        const digest = createHash("sha256").update(key).digest("hex");
+        const epochPath = join(this.lockRoot, `${digest}.epoch`);
+        let current = 0;
+        try {
+            const text = await readFile(epochPath, "utf8");
+            current = Number(text);
+            if (!Number.isSafeInteger(current) || current < 0) {
+                throw new WorkspaceIsolationError("workspace_conflict", `invalid workspace fencing epoch for ${key}`);
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        const next = current + 1;
+        if (!Number.isSafeInteger(next)) {
+            throw new WorkspaceIsolationError("workspace_conflict", `workspace fencing epoch exhausted for ${key}`);
+        }
+        await writeFile(epochPath, String(next), "utf8");
+        return next;
+    }
+    async assertCommittedAllocation(request) {
+        const allocation = request.allocation;
+        if (allocation.kind === "none") {
+            const root = committedSharedWorkspaceRoot(allocation);
+            await resolveCanonicalWorkspaceDirectory(root, relative(root, realpathSync(resolve(allocation.working_directory))) || ".", "working_directory", false);
+            return;
+        }
+        const inspection = inspectAttemptWorkspace({
+            isolation: "worktree",
+            run_id: "workspace-authority",
+            step_id: "workspace-authority",
+            attempt_id: allocation.workspace_id,
+            repository_root: allocation.repository_root,
+            worktree_root: dirname(allocation.worktree_root),
+            working_directory: allocation.worktree_root,
+            branch_name: allocation.branch_name,
+            base_ref: allocation.base_ref,
+            base_commit: allocation.base_commit,
+            ownership_key: allocation.ownership_key,
+            created: false,
+            reused: true,
+            dirty_at_allocation: false,
+            conflicted_at_allocation: false,
+        });
+        if (!inspection.owned_by_attempt || inspection.branch_ref !== allocation.observed_branch_ref) {
+            throw new WorkspaceIsolationError("workspace_mismatch", "committed worktree identity changed");
+        }
+        if (request.require_clean_worktree && (inspection.dirty || inspection.conflicted)) {
+            throw new WorkspaceIsolationError("workspace_conflict", "committed worktree is not clean");
+        }
+    }
+    async withLock(key, operation) {
+        await mkdir(this.lockRoot, { recursive: true });
+        const digest = createHash("sha256").update(key).digest("hex");
+        const lockDirectory = join(this.lockRoot, `${digest}.lock`);
+        const owner = randomUUID();
+        const generation = randomUUID();
+        const ownerState = {
+            owner,
+            generation,
+            pid: process.pid,
+            acquired_at: Date.now(),
+        };
+        const ownerPath = join(lockDirectory, "owner.json");
+        const leasePath = join(lockDirectory, `lease-${generation}`);
+        const transitionPath = join(this.lockRoot, `${digest}.transition-${generation}`);
+        const deadline = Date.now() + this.lockWaitMs;
+        for (;;) {
+            try {
+                await mkdir(lockDirectory);
+                await writeFile(ownerPath, JSON.stringify(ownerState), { encoding: "utf8", flag: "wx" });
+                await writeFile(leasePath, "", { encoding: "utf8", flag: "wx" });
+                break;
+            }
+            catch (error) {
+                const code = error.code;
+                if (code !== "EEXIST") {
+                    await rm(lockDirectory, { recursive: true, force: true });
+                    throw error;
+                }
+                try {
+                    const state = parseLockOwner(await readFile(ownerPath, "utf8"));
+                    const currentLease = state
+                        ? await stat(join(lockDirectory, `lease-${state.generation}`)).catch(() => null)
+                        : null;
+                    const heartbeatAt = currentLease?.mtimeMs ?? state?.acquired_at;
+                    if (state
+                        && heartbeatAt !== undefined
+                        && Date.now() - heartbeatAt > this.lockStaleMs
+                        && !processIsAlive(state.pid)) {
+                        const observedTransition = join(this.lockRoot, `${digest}.transition-${state.generation}`);
+                        try {
+                            await link(ownerPath, observedTransition);
+                        }
+                        catch (transitionError) {
+                            if (transitionError.code === "EEXIST") {
+                                await new Promise((resolvePromise) => setTimeout(resolvePromise, this.lockRetryMs));
+                                continue;
+                            }
+                            throw transitionError;
+                        }
+                        const quarantine = `${lockDirectory}.stale-${randomUUID()}`;
+                        try {
+                            const claimed = parseLockOwner(await readFile(observedTransition, "utf8"));
+                            if (claimed?.owner !== state.owner || claimed.generation !== state.generation) {
+                                throw new WorkspaceIsolationError("workspace_conflict", `workspace authority changed during stale-lock takeover ${key}`);
+                            }
+                            const claimedLease = await stat(join(lockDirectory, `lease-${state.generation}`)).catch(() => null);
+                            if (claimedLease
+                                && Date.now() - claimedLease.mtimeMs <= this.lockStaleMs) {
+                                continue;
+                            }
+                            await rename(lockDirectory, quarantine);
+                            const moved = parseLockOwner(await readFile(join(quarantine, "owner.json"), "utf8").catch(() => ""));
+                            if (moved?.owner !== state.owner || moved.generation !== state.generation) {
+                                throw new WorkspaceIsolationError("workspace_conflict", `workspace authority changed during stale-lock takeover ${key}`);
+                            }
+                            await rm(quarantine, { recursive: true, force: true });
+                        }
+                        finally {
+                            await unlink(observedTransition).catch(() => undefined);
+                        }
+                        continue;
+                    }
+                }
+                catch (readError) {
+                    if (readError.code === "ENOENT") {
+                        // Another holder is publishing or replacing the lock. Retry; never
+                        // delete a directory whose owner generation was not observed.
+                    }
+                    else if (readError instanceof WorkspaceIsolationError) {
+                        throw readError;
+                    }
+                }
+                if (Date.now() >= deadline) {
+                    throw new WorkspaceIsolationError("workspace_conflict", `timed out acquiring workspace authority ${key}`);
+                }
+                await new Promise((resolvePromise) => setTimeout(resolvePromise, this.lockRetryMs));
+            }
+        }
+        const heartbeat = setInterval(() => {
+            void (async () => {
+                try {
+                    await link(ownerPath, transitionPath);
+                }
+                catch (error) {
+                    if (["EEXIST", "ENOENT"].includes(error.code ?? ""))
+                        return;
+                    throw error;
+                }
+                try {
+                    const claimed = parseLockOwner(await readFile(transitionPath, "utf8"));
+                    const current = parseLockOwner(await readFile(ownerPath, "utf8"));
+                    if (claimed?.owner === owner
+                        && claimed.generation === generation
+                        && current?.owner === owner
+                        && current.generation === generation) {
+                        const now = new Date();
+                        await utimes(leasePath, now, now);
+                    }
+                }
+                finally {
+                    await unlink(transitionPath).catch(() => undefined);
+                }
+            })().catch(() => undefined);
+        }, this.lockHeartbeatMs);
+        heartbeat.unref();
+        try {
+            return await operation();
+        }
+        finally {
+            clearInterval(heartbeat);
+            try {
+                for (;;) {
+                    const state = parseLockOwner(await readFile(ownerPath, "utf8"));
+                    if (state?.owner !== owner || state.generation !== generation)
+                        break;
+                    try {
+                        await link(ownerPath, transitionPath);
+                    }
+                    catch (error) {
+                        if (error.code === "EEXIST") {
+                            await new Promise((resolvePromise) => setTimeout(resolvePromise, this.lockRetryMs));
+                            continue;
+                        }
+                        if (error.code === "ENOENT") {
+                            break;
+                        }
+                        else {
+                            throw error;
+                        }
+                    }
+                    try {
+                        const claimed = parseLockOwner(await readFile(transitionPath, "utf8"));
+                        const current = parseLockOwner(await readFile(ownerPath, "utf8"));
+                        if (claimed?.owner === owner
+                            && claimed.generation === generation
+                            && current?.owner === owner
+                            && current.generation === generation) {
+                            await rm(lockDirectory, { recursive: true, force: true });
+                        }
+                    }
+                    finally {
+                        await unlink(transitionPath).catch(() => undefined);
+                    }
+                    break;
+                }
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+        }
+    }
+}
 export function inspectAttemptWorkspace(workspace) {
     if (workspace.isolation === "none") {
         return {

package/dist/runtime/workspace-observation.d.ts

@@ -0,0 +1,44 @@
+export type WorkspaceObservationErrorCode = "source_drift" | "verification_failed" | "observation_limit_exceeded";
+export declare class WorkspaceObservationError extends Error {
+    readonly code: WorkspaceObservationErrorCode;
+    constructor(code: WorkspaceObservationErrorCode, message: string, options?: ErrorOptions);
+}
+export interface WorkspaceObservationLimits {
+    readonly max_entries: number;
+    readonly max_bytes: number;
+    readonly max_depth: number;
+    readonly max_duration_ms: number;
+}
+export interface WorkspaceObservationHooks {
+    after_directory_read?(relativePath: string): Promise<void> | void;
+}
+export interface ObserveWorkspaceRequest {
+    readonly workspace_root: string;
+    readonly limits?: Partial<WorkspaceObservationLimits>;
+    readonly hooks?: WorkspaceObservationHooks;
+    readonly now_ms?: () => number;
+}
+export interface GitWorkspaceSnapshot {
+    readonly repository_identity_digest: `sha256:${string}`;
+    readonly head: string;
+    readonly symbolic_branch: string | null;
+    readonly porcelain_v2_digest: `sha256:${string}`;
+    readonly local_config_digest: `sha256:${string}`;
+}
+export interface WorkspaceObservation {
+    readonly schema_version: "intentdna.workspace_observation.v2";
+    readonly observed_digest: `sha256:${string}`;
+    readonly entry_count: number;
+    readonly byte_count: number;
+    readonly excluded_relative_paths: readonly [".dna/runtime", ".dna/worktrees/runtime"];
+    readonly git: GitWorkspaceSnapshot | null;
+}
+export declare const DEFAULT_WORKSPACE_OBSERVATION_LIMITS: WorkspaceObservationLimits;
+export declare const WORKSPACE_OBSERVATION_EXCLUDED_PATHS: readonly [".dna/runtime", ".dna/worktrees/runtime"];
+export declare function workspaceObservationPolicy(limits?: Partial<WorkspaceObservationLimits>): {
+    readonly schema_version: "intentdna.workspace_observation_policy.v1";
+    readonly limits: WorkspaceObservationLimits;
+    readonly excluded_relative_paths: typeof WORKSPACE_OBSERVATION_EXCLUDED_PATHS;
+    readonly git_observation: "head_branch_status_local_config";
+};
+export declare function observeWorkspace(request: ObserveWorkspaceRequest): Promise<WorkspaceObservation>;