looply-cli 0.4.0 → 0.5.1

package/dist/sibling-repos.d.ts

@@ -0,0 +1,101 @@
+import type { GoalSibling, PacketRepository, RepositorySpan } from '@looply/core';
+/**
+ * WHERE A GOAL'S SIBLING REPOSITORIES ARE ON THIS MACHINE.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * The server stores a sibling as a PROJECT ID. It never knows a path — where
+ * code sits on disk is none of its business, which is why projects are keyed by
+ * `repoPathHash` in the first place. So the machine does the one thing only it
+ * can: take every checkout it knows about, hash each one exactly the way it did
+ * when it registered the project, and look the hash up in its own store.
+ *
+ * WHICH CHECKOUTS IT KNOWS ABOUT. Two lists, both written by a person on this
+ * machine and neither by a model or a server:
+ *
+ *   - the served registry (`~/.looply/served.json`) — every repository
+ *     `looply serve add` / `looply connect` put into service;
+ *   - the current project's own `repos:` declaration — the other repositories
+ *     its config already says this programme spans, resolved against the
+ *     project, as `selfRepoId` resolves them.
+ *
+ * ⚠️ NOTHING IS SEARCHED FOR. A sibling not in either list is "not available on
+ * this machine", and the run proceeds and says so. Walking the disk for a
+ * repository whose hash matches would make what a run can read depend on what
+ * happens to be lying around — the opposite of a grant.
+ *
+ * ⚠️ AND THE RUN'S OWN PROJECT IS NEVER A SIBLING. The server refuses a goal
+ * naming its own project, but a machine store can map two paths to one project
+ * (a moved checkout registered twice), so the own project id is excluded here
+ * too: the one repository a run may WRITE must never also arrive read-only
+ * under a second name.
+ */
+/** A resolved sibling: where its checkout is, and the key the tools address it by. */
+export interface SiblingMount {
+    /** The sibling's project id — the `repo` value `read`, `glob` and `grep` take. */
+    readonly key: string;
+    /** Absolute, physical, an existing directory. */
+    readonly path: string;
+}
+export interface SiblingResolution {
+    /** Every sibling, in the goal's order, each with its path or null. */
+    readonly repositories: readonly PacketRepository[];
+    /** Only the ones with a checkout here: what the tool bridge mounts read-only. */
+    readonly mounts: readonly SiblingMount[];
+}
+export interface SiblingResolveDeps {
+    /** `repoPathHash` of an absolute path. Production: sha256 over the repository identity. */
+    hashOf(path: string): string;
+    /** The machine store's map: hash → project id. Null for a hash it never registered. */
+    projectFor(hash: string): string | null;
+    /** Is this an existing directory? Overridable for tests. */
+    isDir?(path: string): boolean;
+    /** The physical path. Overridable for tests. */
+    physical?(path: string): string;
+}
+/**
+ * The siblings, resolved against the candidate checkouts. PURE given its deps.
+ *
+ * First candidate wins for a project, in the order given — the served registry
+ * first, because that is the list a person curates for exactly this machine.
+ * A candidate that is not a directory any more is skipped rather than lent: a
+ * mount of a path that is not there is a refusal waiting to happen at the
+ * first read.
+ */
+export declare function resolveSiblings(siblings: readonly GoalSibling[], candidates: readonly string[], ownProjectId: string | null, ownPath: string, deps: SiblingResolveDeps): SiblingResolution;
+/**
+ * The checkouts this machine knows about: the served registry, then the
+ * project's declared `repos:` (relative ones resolved against the project).
+ *
+ * ⚠️ AN UNREADABLE REGISTRY IS NO CANDIDATES, NOT A FAILED RUN. `readRegistry`
+ * is loud about a corrupt file because `serve add` must not overwrite it; here
+ * the cost of not finding a sibling is a line saying so, and stopping the run
+ * over it would turn a reference aid into an outage.
+ */
+export declare function candidateCheckouts(cwd: string, declared: readonly {
+    id: string;
+    path: string;
+}[], home?: string): string[];
+/** The machine's own answer, as production asks it. Null deps when this machine never paired. */
+export declare function machineResolveDeps(home?: string): SiblingResolveDeps | null;
+/**
+ * The span for a run's goal, as the packet and the implementer prompt carry it.
+ * Undefined when the goal names no sibling, so a single-repository goal's
+ * prompt is byte for byte what it was.
+ */
+export declare function spanFor(ownName: string, resolution: SiblingResolution): RepositorySpan | undefined;
+/**
+ * The mounts on the trusted argv the provider transport hands the bridge.
+ *
+ * base64url of JSON, because the value crosses the provider's MCP launch: it
+ * is serialised into a JSON config and re-quoted onto a Windows command line,
+ * and a path with a space or a quote in it would otherwise arrive as two
+ * arguments. base64url has nothing in it any layer re-quotes.
+ */
+export declare function encodeMounts(mounts: readonly SiblingMount[]): string;
+/**
+ * The mounts back off argv, CHECKED. Anything malformed is NO mounts, never a
+ * guess: this is the bridge deciding what a contained worker may read, and an
+ * argument it cannot read is an argument that grants nothing.
+ */
+export declare function decodeMounts(arg: string | undefined): SiblingMount[];
+//# sourceMappingURL=sibling-repos.d.ts.map

package/dist/sibling-repos.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sibling-repos.d.ts","sourceRoot":"","sources":["../src/sibling-repos.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAIlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,sFAAsF;AACtF,MAAM,WAAW,YAAY;IAC3B,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACnD,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,kBAAkB;IACjC,2FAA2F;IAC3F,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,uFAAuF;IACvF,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACxC,4DAA4D;IAC5D,KAAK,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,gDAAgD;IAChD,QAAQ,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;CACjC;AAKD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,SAAS,WAAW,EAAE,EAChC,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,kBAAkB,GACvB,iBAAiB,CAsCnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,EACjD,IAAI,GAAE,MAAkB,GACvB,MAAM,EAAE,CASV;AAED,iGAAiG;AACjG,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,MAAkB,GAAG,kBAAkB,GAAG,IAAI,CAatF;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,GAAG,cAAc,GAAG,SAAS,CAElG;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,CAEpE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,EAAE,CAqBpE"}

package/dist/sibling-repos.js

@@ -0,0 +1,160 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSiblings = resolveSiblings;
+exports.candidateCheckouts = candidateCheckouts;
+exports.machineResolveDeps = machineResolveDeps;
+exports.spanFor = spanFor;
+exports.encodeMounts = encodeMounts;
+exports.decodeMounts = decodeMounts;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const machine_store_1 = require("./machine-store");
+const serve_1 = require("./serve");
+const sameDir = (a, b) => process.platform === 'win32' ? a.toLowerCase() === b.toLowerCase() : a === b;
+/**
+ * The siblings, resolved against the candidate checkouts. PURE given its deps.
+ *
+ * First candidate wins for a project, in the order given — the served registry
+ * first, because that is the list a person curates for exactly this machine.
+ * A candidate that is not a directory any more is skipped rather than lent: a
+ * mount of a path that is not there is a refusal waiting to happen at the
+ * first read.
+ */
+function resolveSiblings(siblings, candidates, ownProjectId, ownPath, deps) {
+    if (siblings.length === 0)
+        return { repositories: [], mounts: [] };
+    const isDir = deps.isDir ??
+        ((p) => {
+            try {
+                return (0, node_fs_1.statSync)(p).isDirectory();
+            }
+            catch {
+                return false;
+            }
+        });
+    const physical = deps.physical ??
+        ((p) => {
+            try {
+                return node_fs_1.realpathSync.native(p);
+            }
+            catch {
+                return (0, node_path_1.resolve)(p);
+            }
+        });
+    const own = physical((0, node_path_1.resolve)(ownPath));
+    const wanted = new Set(siblings.map((s) => s.projectId));
+    const found = new Map();
+    for (const c of candidates) {
+        if (!(0, node_path_1.isAbsolute)(c) || !isDir(c))
+            continue;
+        const path = physical((0, node_path_1.resolve)(c));
+        // The run's own checkout, under whatever spelling, is never lent to itself.
+        if (sameDir(path, own))
+            continue;
+        // Hashed as SPELLED, the way `daemon-cmd` hashed the checkout when it
+        // registered the project; mounted PHYSICALLY, because the worker's
+        // containment checks compare physical paths.
+        const projectId = deps.projectFor(deps.hashOf((0, node_path_1.resolve)(c)));
+        if (projectId === null || projectId === ownProjectId || !wanted.has(projectId) || found.has(projectId))
+            continue;
+        found.set(projectId, path);
+    }
+    const repositories = siblings.map((s) => ({ projectId: s.projectId, label: s.label, path: found.get(s.projectId) ?? null }));
+    const mounts = repositories.flatMap((r) => (r.path === null ? [] : [{ key: r.projectId, path: r.path }]));
+    return { repositories, mounts };
+}
+/**
+ * The checkouts this machine knows about: the served registry, then the
+ * project's declared `repos:` (relative ones resolved against the project).
+ *
+ * ⚠️ AN UNREADABLE REGISTRY IS NO CANDIDATES, NOT A FAILED RUN. `readRegistry`
+ * is loud about a corrupt file because `serve add` must not overwrite it; here
+ * the cost of not finding a sibling is a line saying so, and stopping the run
+ * over it would turn a reference aid into an outage.
+ */
+function candidateCheckouts(cwd, declared, home = (0, node_os_1.homedir)()) {
+    const out = [];
+    try {
+        for (const r of (0, serve_1.readRegistry)(serve_1.nodeServeFs, (0, serve_1.servedFilePath)(home)).repos)
+            out.push(r.path);
+    }
+    catch {
+        // See above: no candidates from a registry that cannot be read.
+    }
+    for (const d of declared)
+        out.push((0, node_path_1.resolve)(cwd, d.path));
+    return out;
+}
+/** The machine's own answer, as production asks it. Null deps when this machine never paired. */
+function machineResolveDeps(home = (0, node_os_1.homedir)()) {
+    const path = (0, machine_store_1.machineFilePath)(home);
+    if (!(0, node_fs_1.existsSync)(path))
+        return null;
+    let projects;
+    try {
+        projects = new machine_store_1.MachineStore(path).load()?.projects ?? {};
+    }
+    catch {
+        return null;
+    }
+    return {
+        hashOf: (p) => (0, machine_store_1.repoPathHash)(p, (t) => (0, node_crypto_1.createHash)('sha256').update(t, 'utf8').digest('hex')),
+        projectFor: (h) => projects[h] ?? null,
+    };
+}
+/**
+ * The span for a run's goal, as the packet and the implementer prompt carry it.
+ * Undefined when the goal names no sibling, so a single-repository goal's
+ * prompt is byte for byte what it was.
+ */
+function spanFor(ownName, resolution) {
+    return resolution.repositories.length === 0 ? undefined : { own: ownName, siblings: resolution.repositories };
+}
+/**
+ * The mounts on the trusted argv the provider transport hands the bridge.
+ *
+ * base64url of JSON, because the value crosses the provider's MCP launch: it
+ * is serialised into a JSON config and re-quoted onto a Windows command line,
+ * and a path with a space or a quote in it would otherwise arrive as two
+ * arguments. base64url has nothing in it any layer re-quotes.
+ */
+function encodeMounts(mounts) {
+    return Buffer.from(JSON.stringify(mounts.map((m) => ({ key: m.key, path: m.path }))), 'utf8').toString('base64url');
+}
+/**
+ * The mounts back off argv, CHECKED. Anything malformed is NO mounts, never a
+ * guess: this is the bridge deciding what a contained worker may read, and an
+ * argument it cannot read is an argument that grants nothing.
+ */
+function decodeMounts(arg) {
+    if (typeof arg !== 'string' || arg.length === 0)
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(arg, 'base64url').toString('utf8'));
+    }
+    catch {
+        return [];
+    }
+    if (!Array.isArray(parsed))
+        return [];
+    const out = [];
+    const keys = new Set();
+    for (const e of parsed) {
+        const m = e;
+        if (typeof m !== 'object' || m === null)
+            return [];
+        if (typeof m.key !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/.test(m.key))
+            return [];
+        if (typeof m.path !== 'string' || !(0, node_path_1.isAbsolute)(m.path))
+            return [];
+        if (keys.has(m.key))
+            return [];
+        keys.add(m.key);
+        out.push({ key: m.key, path: m.path });
+    }
+    return out;
+}
+//# sourceMappingURL=sibling-repos.js.map

package/dist/sibling-repos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sibling-repos.js","sourceRoot":"","sources":["../src/sibling-repos.ts"],"names":[],"mappings":";;AA6EA,0CA4CC;AAWD,gDAaC;AAGD,gDAaC;AAOD,0BAEC;AAUD,oCAEC;AAOD,oCAqBC;AAlND,6CAAyC;AACzC,qCAA6D;AAC7D,qCAAkC;AAClC,yCAAgD;AAEhD,mDAA8E;AAC9E,mCAAoE;AA2DpE,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE,CAChD,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAE/E;;;;;;;;GAQG;AACH,SAAgB,eAAe,CAC7B,QAAgC,EAChC,UAA6B,EAC7B,YAA2B,EAC3B,OAAe,EACf,IAAwB;IAExB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACnE,MAAM,KAAK,GACT,IAAI,CAAC,KAAK;QACV,CAAC,CAAC,CAAS,EAAW,EAAE;YACtB,IAAI,CAAC;gBACH,OAAO,IAAA,kBAAQ,EAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,MAAM,QAAQ,GACZ,IAAI,CAAC,QAAQ;QACb,CAAC,CAAC,CAAS,EAAU,EAAE;YACrB,IAAI,CAAC;gBACH,OAAO,sBAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAA,mBAAO,EAAC,CAAC,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAA,mBAAO,EAAC,OAAO,CAAC,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAA,sBAAU,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,SAAS;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAA,mBAAO,EAAC,CAAC,CAAC,CAAC,CAAC;QAClC,4EAA4E;QAC5E,IAAI,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACjC,sEAAsE;QACtE,mEAAmE;QACnE,6CAA6C;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAA,mBAAO,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QACjH,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7H,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1G,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,kBAAkB,CAChC,GAAW,EACX,QAAiD,EACjD,OAAe,IAAA,iBAAO,GAAE;IAExB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,IAAA,oBAAY,EAAC,mBAAW,EAAE,IAAA,sBAAc,EAAC,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,IAAA,mBAAO,EAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iGAAiG;AACjG,SAAgB,kBAAkB,CAAC,OAAe,IAAA,iBAAO,GAAE;IACzD,MAAM,IAAI,GAAG,IAAA,+BAAe,EAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,QAAgC,CAAC;IACrC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,4BAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,4BAAY,EAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3F,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;KACvC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,OAAO,CAAC,OAAe,EAAE,UAA6B;IACpE,OAAO,UAAU,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;AAChH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,YAAY,CAAC,MAA+B;IAC1D,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtH,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,GAAuB;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAA6C,CAAC;QACxD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QACnD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QAClF,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAA,sBAAU,EAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACjE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/tool-bridge.d.ts

@@ -1,8 +1,9 @@
 import { type SharedGrantDeps } from './shared-grants';
 import { type ToolchainResult } from './toolchain-mirror';
 import { type ToolName, type ToolResponse } from './tool-protocol';
-import { type UntrustedExecutionBackend } from './untrusted-exec';
+import { type FsGrant, type UntrustedExecutionBackend } from './untrusted-exec';
 import { type ToolCallRecorder } from './tool-call-record';
+import type { SiblingMount } from './sibling-repos';
 import { type ActionRequest, type BuildActionErrorCode, type TrustedActionContext } from '@looply/core';
 /** The worker script, somewhere the container can read and cannot write. */
 export declare function toolWorkerRoot(deps?: ToolBridgeDeps): string;
@@ -58,7 +59,56 @@ export interface ToolBridgeDeps {
      * the machine ledger only.
      */
     sharedGrants?: SharedGrantDeps;
+    /**
+     * THE OTHER REPOSITORIES THIS RUN'S GOAL SPANS, LENT READ-ONLY.
+     *
+     * Resolved by the trusted run context (`sibling-repos.ts`) from the goal's
+     * siblings and this machine's own registry, handed over on argv by the
+     * launcher — never named by the model, which can only choose AMONG these by
+     * key. Absent or empty: the bridge serves this project and nothing else,
+     * byte for byte as before.
+     */
+    siblings?: readonly SiblingMount[];
+}
+/**
+ * 🔴 HOW A SIBLING IS LENT, AND WHY IT CANNOT BE WRITTEN.
+ *
+ * The worker for a sibling runs as the SAME container identity as this
+ * project's own worker — `containerName('agent', projectDir)` — so every grant
+ * it accumulates is retired with this workspace by the residue sweep, exactly
+ * like the toolchain's. What differs is what that identity holds on the
+ * sibling:
+ *
+ *   - READ AND EXECUTE, through the SHARED-GRANT LEDGER (`ensureSharedAccess`:
+ *     `icacls /grant (OI)(CI)(RX)`), never the per-launch grant list. A
+ *     per-launch grant is an `AddAccessRule` nothing ever removes; on a
+ *     person's real checkout, one ACE per workspace identity would accumulate
+ *     until the DACL hit its cap — the n122 failure, moved onto their repo.
+ *     The ledger records it and `releaseSharedGrants` takes it back when the
+ *     workspace retires.
+ *   - NO WRITE ANYWHERE IN IT. There is no grant on the sibling that carries
+ *     `write`, so a write by the worker is refused by Windows, not by us.
+ *   - ITS `.git`, `.looply/state` AND `.looply/config.yaml` ARE PROTECTED on
+ *     every launch of this bridge, as this project's are: inheritance broken,
+ *     this identity's entries purged. The inheritable RX on the sibling root
+ *     would otherwise reach them.
+ *   - `.env`, keys and credential files stay unreadable through the worker's
+ *     own compiled list, which applies under whatever root it is given.
+ *
+ * Returned as data so the shape is testable without a container: the
+ * behavioural proof — a write refused by the OS — is in `tool-bridge.spec.ts`.
+ */
+export interface SiblingLaunch {
+    /** Per-launch grants: the identity's own profile root, and nothing of the sibling. */
+    readonly grants: readonly FsGrant[];
+    /** Granted read-and-execute through the shared-grant ledger. */
+    readonly sharedReadOnly: readonly string[];
+    readonly argv: readonly string[];
+    readonly cwd: string;
 }
+export declare function siblingLaunch(projectDir: string, mount: SiblingMount, workerPath: string): SiblingLaunch;
+/** What every launch of a bridge protects: this project's authority paths, and every lent sibling's. */
+export declare function protectedFor(projectDir: string, siblings?: readonly SiblingMount[]): string[];
 /** What one role is allowed to ask for. */
 export interface ToolPolicy {
     readonly role: string;

package/dist/tool-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-bridge.d.ts","sourceRoot":"","sources":["../src/tool-bridge.ts"],"names":[],"mappings":"AAWA,OAAO,EAAsB,KAAK,eAAe,EAAkB,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAKL,KAAK,QAAQ,EAEb,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAa,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EAC1B,MAAM,cAAc,CAAC;AAwCtB,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,IAAI,GAAE,cAAmB,GAAG,MAAM,CAEhE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,cAAmB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAoBvH;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,yBAAyB,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,eAAe,CAAC;IAClC,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,eAAe,CAAC;CAChC;AAED,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;CACrC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,GAAG,YAAY,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzG,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1C;;;;;OAKG;IACH,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC;IAC7E,6DAA6D;IAC7D,KAAK,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CACrE;AAkDD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,UAAU,EAClB,IAAI,GAAE,cAAmB,GACxB,UAAU,CA0IZ;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;IAIxB;;;;;;;;;;;OAWG;;;;;IAEH;;;;;;;;;;;;;;OAcG;;;;;CAE0C,CAAC;AAEhD,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,aAAa,CAAC"}
+{"version":3,"file":"tool-bridge.d.ts","sourceRoot":"","sources":["../src/tool-bridge.ts"],"names":[],"mappings":"AAWA,OAAO,EAAsB,KAAK,eAAe,EAAkB,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAKL,KAAK,QAAQ,EAEb,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAGL,KAAK,OAAO,EACZ,KAAK,yBAAyB,EAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAa,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EAC1B,MAAM,cAAc,CAAC;AAwCtB,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,IAAI,GAAE,cAAmB,GAAG,MAAM,CAEhE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,cAAmB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAoBvH;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,yBAAyB,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,eAAe,CAAC;IAClC,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,WAAW,aAAa;IAC5B,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAC;IACpC,gEAAgE;IAChE,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,aAAa,CASxG;AAED,wGAAwG;AACxG,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,GAAE,SAAS,YAAY,EAAO,GAAG,MAAM,EAAE,CAMjG;AAED,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;CACrC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,GAAG,YAAY,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzG,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1C;;;;;OAKG;IACH,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC;IAC7E,6DAA6D;IAC7D,KAAK,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CACrE;AA4DD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,UAAU,EAClB,IAAI,GAAE,cAAmB,GACxB,UAAU,CAoKZ;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;IAIxB;;;;;;;;;;;OAWG;;;;;IAEH;;;;;;;;;;;;;;OAcG;;;;;CAE0C,CAAC;AAEhD,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,aAAa,CAAC"}

package/dist/tool-bridge.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.TOOL_POLICIES = void 0;
 exports.toolWorkerRoot = toolWorkerRoot;
 exports.ensureToolWorker = ensureToolWorker;
+exports.siblingLaunch = siblingLaunch;
+exports.protectedFor = protectedFor;
 exports.makeToolBridge = makeToolBridge;
 const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
@@ -14,6 +16,7 @@ const toolchain_mirror_1 = require("./toolchain-mirror");
 const tool_protocol_1 = require("./tool-protocol");
 const untrusted_exec_1 = require("./untrusted-exec");
 const tool_call_record_1 = require("./tool-call-record");
+const tool_worker_1 = require("./tool-worker");
 const core_1 = require("@looply/core");
 /**
  * THE TRUSTED HALF, WHICH DELIBERATELY DOES NO FILE WORK.
@@ -88,6 +91,26 @@ function ensureToolWorker(deps = {}) {
     }
     return { ok: true, path: dest };
 }
+function siblingLaunch(projectDir, mount, workerPath) {
+    return {
+        // The profile the container needs to start, and NOT the project: a sibling
+        // read has no business holding this project's write grant in its launch.
+        grants: (0, exec_domains_1.untrustedGrants)('agent', projectDir).filter((g) => g.path !== projectDir),
+        sharedReadOnly: [mount.path],
+        argv: [workerPath, mount.path, tool_worker_1.READ_ONLY_FLAG],
+        cwd: mount.path,
+    };
+}
+/** What every launch of a bridge protects: this project's authority paths, and every lent sibling's. */
+function protectedFor(projectDir, siblings = []) {
+    const out = (0, exec_domains_1.protectedPaths)(projectDir);
+    for (const s of siblings) {
+        for (const p of (0, exec_domains_1.protectedPaths)(s.path))
+            if (!out.includes(p))
+                out.push(p);
+    }
+    return out;
+}
 function refuse(tool, code, because) {
     return { ok: false, tool, because, code };
 }
@@ -97,6 +120,17 @@ function refuse(tool, code, because) {
  * worker's business, because the worker is the one inside the boundary.
  */
 function shapeTrouble(req) {
+    const repo = req.repo;
+    if (repo !== undefined) {
+        // The FIRST lock on a sibling write is that the protocol gives a write no
+        // field to name one with. A model that sends one anyway is told, by name,
+        // rather than having the field ignored and its write land HERE instead.
+        if (req.tool === 'edit' || req.tool === 'write') {
+            return 'edit and write change only this repository — another repository is read-only for this run';
+        }
+        if (typeof repo !== 'string' || repo.length === 0)
+            return 'repo, when given, is a repository key';
+    }
     switch (req.tool) {
         case 'read':
             return (0, tool_protocol_1.pathTrouble)(req.path);
@@ -157,6 +191,7 @@ function makeToolBridge(projectDir, policy, deps = {}) {
     const timeoutMs = deps.timeoutMs ?? 60_000;
     const now = deps.now ?? Date.now;
     const recorder = deps.record ?? tool_call_record_1.NO_RECORD;
+    const siblings = deps.siblings ?? [];
     let calls = 0;
     let bytesRead = 0;
     let bytesWritten = 0;
@@ -188,6 +223,15 @@ function makeToolBridge(projectDir, policy, deps = {}) {
         const bad = shapeTrouble(req);
         if (bad !== null)
             return refuse(name, 'bad_request', bad);
+        // WHICH REPOSITORY. The model chooses AMONG the mounts the run context
+        // lent, by key; a key that names nothing lent is a refusal, never a lookup.
+        const repo = req.repo;
+        const sibling = repo === undefined ? null : (siblings.find((s) => s.key === repo) ?? null);
+        if (repo !== undefined && sibling === null) {
+            return refuse(name, 'path_not_allowed', siblings.length === 0
+                ? 'no other repository is lent to this run'
+                : `no repository "${repo}" is lent to this run — the lent ones are ${siblings.map((s) => s.key).join(', ')}`);
+        }
         const tools = ensureToolchain();
         if (!tools.ok)
             return refuse(name, 'worker_failed', `no contained toolchain — ${tools.because}`);
@@ -203,26 +247,38 @@ function makeToolBridge(projectDir, policy, deps = {}) {
          * the thing running inside the boundary cannot rewrite the thing that will
          * run inside it next time.
          */
-        const shared = await (0, shared_grants_1.ensureSharedAccess)(backend instanceof untrusted_exec_1.AppContainerBackend ? backend : null, (0, untrusted_exec_1.containerName)('agent', projectDir), (0, exec_domains_1.sharedGrantPaths)(tools.path, [(0, node_path_1.join)(worker.path, '..')]), deps.sharedGrants ?? {});
+        const lent = sibling === null ? null : siblingLaunch(projectDir, sibling, worker.path);
+        const shared = await (0, shared_grants_1.ensureSharedAccess)(backend instanceof untrusted_exec_1.AppContainerBackend ? backend : null, (0, untrusted_exec_1.containerName)('agent', projectDir), 
+        // A sibling is shared READ-AND-EXECUTE only, through the same ledger as
+        // the toolchain — see `siblingLaunch` for why not per launch.
+        (0, exec_domains_1.sharedGrantPaths)(tools.path, [(0, node_path_1.join)(worker.path, '..')]).concat(lent?.sharedReadOnly ?? []), deps.sharedGrants ?? {});
         if (!shared.ok)
             return refuse(name, 'worker_failed', `shared grant failed — ${shared.because}`);
-        const grants = [...(0, exec_domains_1.untrustedGrants)('agent', projectDir)];
+        const grants = lent === null ? [...(0, exec_domains_1.untrustedGrants)('agent', projectDir)] : [...lent.grants];
+        // The request as the worker reads it: the key has done its job here, and
+        // the worker answers for whatever root it was launched on.
+        const forWorker = { ...req };
+        delete forWorker['repo'];
         const out = await backend.run({
             kind: 'agent',
             projectKey: projectDir,
             executable: (0, node_path_1.join)(tools.path, 'node.exe'),
-            argv: [worker.path, projectDir],
-            cwd: projectDir,
+            argv: lent === null ? [worker.path, projectDir] : [...lent.argv],
+            cwd: lent === null ? projectDir : lent.cwd,
             // The GATE environment, not the provider's: this process runs project
             // files' neighbourhood and needs no provider credential of any kind.
             env: (0, exec_domains_1.buildUntrustedGateEnv)(projectDir, tools.path),
             grants,
-            protect: (0, exec_domains_1.protectedPaths)(projectDir),
+            // EVERY launch protects every lent sibling's authority paths, not only a
+            // sibling launch: the RX grant is inheritable and outlives the launch
+            // that made it, so the identity must never hold a sibling's `.git`
+            // whichever worker it is running.
+            protect: protectedFor(projectDir, siblings),
             // NO NETWORK. The transport reaches the model; the thing that touches
             // files has no reason to reach anything, and this is stronger than the
             // contained-provider design it replaces.
             network: 'none',
-            stdin: JSON.stringify(req),
+            stdin: JSON.stringify(forWorker),
             timeoutMs,
         });
         if (!out.ok) {

package/dist/tool-bridge.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-bridge.js","sourceRoot":"","sources":["../src/tool-bridge.ts"],"names":[],"mappings":";;;AA2EA,wCAEC;AAUD,4CAoBC;AAsID,wCA8IC;AA/XD,6CAAyC;AACzC,qCAA4E;AAC5E,qCAAiC;AACjC,yCAAiC;AACjC,iDAMwB;AACxB,mDAA2F;AAC3F,yDAAiF;AACjF,mDAQyB;AACzB,qDAK0B;AAC1B,yDAAsE;AACtE,uCAKsB;AAEtB;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;;;GAQG;AACH,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACjD,IAAI,IAAA,oBAAU,EAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACtC,OAAO,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AACzD,CAAC;AAED,4EAA4E;AAC5E,SAAgB,cAAc,CAAC,OAAuB,EAAE;IACtD,OAAO,IAAI,CAAC,UAAU,IAAI,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,mBAAmB,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAAC,OAAuB,EAAE;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,IAAI,gBAAgB,EAAE,CAAC;IACpD,IAAI,CAAC,IAAA,oBAAU,EAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,GAAG,EAAE,EAAE,CAAC;IAChF,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAA,sBAAY,EAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,sCAAuC,CAAW,CAAC,OAAO,GAAG,EAAE,CAAC;IAC/F,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,gBAAI,EAAC,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,IAAA,mBAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,wEAAwE;QACxE,8DAA8D;QAC9D,IAAA,sBAAY,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,wCAAyC,CAAW,CAAC,OAAO,GAAG,EAAE,CAAC;IACjG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AA8ED,SAAS,MAAM,CAAC,IAA0B,EAAE,IAAmB,EAAE,OAAe;IAC9E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAkB,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAgB;IACpC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,MAAM;YACT,OAAO,IAAA,2BAAW,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,CAAC,GAAG,IAAA,2BAAW,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,CAAC,CAAC;YACzB,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,qBAAqB,CAAC;YAC9F,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;gBAAE,OAAO,qBAAqB,CAAC;YAClE,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC;gBACxF,OAAO,0CAA0C,CAAC;YACpD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,CAAC,GAAG,IAAA,2BAAW,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,CAAC,CAAC;YACzB,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAAE,OAAO,uBAAuB,CAAC;YACrE,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC1D,OAAO,oCAAoC,CAAC;YAC9C,CAAC;YACD,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,sBAAM,CAAC,UAAU;gBAAE,OAAO,4BAA4B,CAAC;YACrG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,MAAM;YACT,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,uBAAuB,CAAC;YAChG,OAAO,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,2BAAW,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjE,KAAK,MAAM;YACT,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,uBAAuB,CAAC;YAChG,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,CAAC,GAAG,IAAA,2BAAW,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACjC,IAAI,CAAC,KAAK,IAAI;oBAAE,OAAO,CAAC,CAAC;YAC3B,CAAC;YACD,OAAO,IAAI,CAAC;QACd;YACE,OAAO,cAAc,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,cAAc,CAC5B,UAAkB,EAClB,MAAkB,EAClB,OAAuB,EAAE;IAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,oCAAmB,EAAE,CAAC;IAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAoB,EAAE,CAAC,IAAA,wCAAqB,GAAE,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,4BAAS,CAAC;IAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB;;;;OAIG;IACH,MAAM,KAAK,GAAG,KAAK,EAAE,GAAY,EAAyB,EAAE;QAC1D,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,4BAA4B,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,GAAG,GAAG,GAAkB,CAAC;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAEtB,uEAAuE;QACvE,sDAAsD;QACtD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,MAAM,CAAC,IAAI,iBAAiB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,KAAK,IAAI,iCAAiB,CAAC,KAAK,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,8CAA8C,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,SAAS,IAAI,iCAAiB,CAAC,SAAS,EAAE,CAAC;YAC7C,OAAO,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,mCAAmC,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,YAAY,IAAI,iCAAiB,CAAC,YAAY,EAAE,CAAC;YACnD,OAAO,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,sCAAsC,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAE1D,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,4BAA4B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjG,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAErE,KAAK,IAAI,CAAC,CAAC;QAEX;;;;;;;WAOG;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,kCAAkB,EACrC,OAAO,YAAY,oCAAmB,CAAC,CAAC,CAAE,OAAgC,CAAC,CAAC,CAAC,IAAI,EACjF,IAAA,8BAAa,EAAC,OAAO,EAAE,UAAU,CAAC,EAClC,IAAA,+BAAgB,EAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAA,gBAAI,EAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EACvD,IAAI,CAAC,YAAY,IAAI,EAAE,CACxB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,yBAAyB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAEhG,MAAM,MAAM,GAAc,CAAC,GAAG,IAAA,8BAAe,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QAEpE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5B,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,UAAU;YACtB,UAAU,EAAE,IAAA,gBAAI,EAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC;YACxC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC;YAC/B,GAAG,EAAE,UAAU;YACf,sEAAsE;YACtE,qEAAqE;YACrE,GAAG,EAAE,IAAA,oCAAqB,EAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC;YAClD,MAAM;YACN,OAAO,EAAE,IAAA,6BAAc,EAAC,UAAU,CAAC;YACnC,sEAAsE;YACtE,uEAAuE;YACvE,yCAAyC;YACzC,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;YAC1B,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,wCAAwC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,wCAAwC,CAAC,CAAC;QAEjG,IAAI,MAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAiB,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,gCAAgC,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM;gBAAE,YAAY,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;;gBACtE,SAAS,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF;;;;;;;OAOG;IACH,MAAM,IAAI,GAAG,KAAK,EAAE,GAAY,EAAyB,EAAE;QACzD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,mEAAmE;QACnE,mEAAmE;QACnE,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;QACxD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,CAAC,IAAa,EAAE,OAAgB,EAAE,IAAa,EAAiB,EAAE;QACtF,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;QAC/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,+CAA+C;aACzD,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,gDAAgD;QAChD,MAAM,KAAK,GAAG,IAAA,yBAAkB,EAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,EAAE;YACb,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;YACtC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC9D,CAAC,CAAC;IAEF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;GAYG;AACU,QAAA,aAAa,GAAG;IAC3B,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IACtF,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;IAC/D,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;IAC7D;;;;;;;;;;;OAWG;IACH,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;IACzD;;;;;;;;;;;;;;OAcG;IACH,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;CACd,CAAC"}
+{"version":3,"file":"tool-bridge.js","sourceRoot":"","sources":["../src/tool-bridge.ts"],"names":[],"mappings":";;;AA6EA,wCAEC;AAUD,4CAoBC;AAwFD,sCASC;AAGD,oCAMC;AAyGD,wCAwKC;AAxeD,6CAAyC;AACzC,qCAA4E;AAC5E,qCAAiC;AACjC,yCAAiC;AACjC,iDAMwB;AACxB,mDAA2F;AAC3F,yDAAiF;AACjF,mDAQyB;AACzB,qDAK0B;AAC1B,yDAAsE;AACtE,+CAA+C;AAE/C,uCAKsB;AAEtB;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;;;GAQG;AACH,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACjD,IAAI,IAAA,oBAAU,EAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACtC,OAAO,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AACzD,CAAC;AAED,4EAA4E;AAC5E,SAAgB,cAAc,CAAC,OAAuB,EAAE;IACtD,OAAO,IAAI,CAAC,UAAU,IAAI,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,mBAAmB,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAAC,OAAuB,EAAE;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,IAAI,gBAAgB,EAAE,CAAC;IACpD,IAAI,CAAC,IAAA,oBAAU,EAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,GAAG,EAAE,EAAE,CAAC;IAChF,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAA,sBAAY,EAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,sCAAuC,CAAW,CAAC,OAAO,GAAG,EAAE,CAAC;IAC/F,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,gBAAI,EAAC,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,IAAA,mBAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,wEAAwE;QACxE,8DAA8D;QAC9D,IAAA,sBAAY,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,wCAAyC,CAAW,CAAC,OAAO,GAAG,EAAE,CAAC;IACjG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAwFD,SAAgB,aAAa,CAAC,UAAkB,EAAE,KAAmB,EAAE,UAAkB;IACvF,OAAO;QACL,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,EAAE,IAAA,8BAAe,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;QACjF,cAAc,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5B,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,4BAAc,CAAC;QAC9C,GAAG,EAAE,KAAK,CAAC,IAAI;KAChB,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAgB,YAAY,CAAC,UAAkB,EAAE,WAAoC,EAAE;IACrF,MAAM,GAAG,GAAG,IAAA,6BAAc,EAAC,UAAU,CAAC,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,IAAA,6BAAc,EAAC,CAAC,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAuCD,SAAS,MAAM,CAAC,IAA0B,EAAE,IAAmB,EAAE,OAAe;IAC9E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAkB,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAgB;IACpC,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAC;IAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChD,OAAO,2FAA2F,CAAC;QACrG,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,uCAAuC,CAAC;IACpG,CAAC;IACD,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,MAAM;YACT,OAAO,IAAA,2BAAW,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,CAAC,GAAG,IAAA,2BAAW,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,CAAC,CAAC;YACzB,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,qBAAqB,CAAC;YAC9F,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;gBAAE,OAAO,qBAAqB,CAAC;YAClE,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC;gBACxF,OAAO,0CAA0C,CAAC;YACpD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,CAAC,GAAG,IAAA,2BAAW,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,CAAC,CAAC;YACzB,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAAE,OAAO,uBAAuB,CAAC;YACrE,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC1D,OAAO,oCAAoC,CAAC;YAC9C,CAAC;YACD,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,sBAAM,CAAC,UAAU;gBAAE,OAAO,4BAA4B,CAAC;YACrG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,MAAM;YACT,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,uBAAuB,CAAC;YAChG,OAAO,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,2BAAW,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjE,KAAK,MAAM;YACT,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,uBAAuB,CAAC;YAChG,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,CAAC,GAAG,IAAA,2BAAW,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACjC,IAAI,CAAC,KAAK,IAAI;oBAAE,OAAO,CAAC,CAAC;YAC3B,CAAC;YACD,OAAO,IAAI,CAAC;QACd;YACE,OAAO,cAAc,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,cAAc,CAC5B,UAAkB,EAClB,MAAkB,EAClB,OAAuB,EAAE;IAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,oCAAmB,EAAE,CAAC;IAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAoB,EAAE,CAAC,IAAA,wCAAqB,GAAE,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,4BAAS,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB;;;;OAIG;IACH,MAAM,KAAK,GAAG,KAAK,EAAE,GAAY,EAAyB,EAAE;QAC1D,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,4BAA4B,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,GAAG,GAAG,GAAkB,CAAC;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAEtB,uEAAuE;QACvE,sDAAsD;QACtD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,MAAM,CAAC,IAAI,iBAAiB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,KAAK,IAAI,iCAAiB,CAAC,KAAK,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,8CAA8C,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,SAAS,IAAI,iCAAiB,CAAC,SAAS,EAAE,CAAC;YAC7C,OAAO,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,mCAAmC,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,YAAY,IAAI,iCAAiB,CAAC,YAAY,EAAE,CAAC;YACnD,OAAO,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,sCAAsC,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAE1D,uEAAuE;QACvE,4EAA4E;QAC5E,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;QAC3F,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3C,OAAO,MAAM,CACX,IAAI,EACJ,kBAAkB,EAClB,QAAQ,CAAC,MAAM,KAAK,CAAC;gBACnB,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,kBAAkB,IAAI,6CAA6C,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/G,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,4BAA4B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjG,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAErE,KAAK,IAAI,CAAC,CAAC;QAEX;;;;;;;WAOG;QACH,MAAM,IAAI,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,MAAM,IAAA,kCAAkB,EACrC,OAAO,YAAY,oCAAmB,CAAC,CAAC,CAAE,OAAgC,CAAC,CAAC,CAAC,IAAI,EACjF,IAAA,8BAAa,EAAC,OAAO,EAAE,UAAU,CAAC;QAClC,wEAAwE;QACxE,8DAA8D;QAC9D,IAAA,+BAAgB,EAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAA,gBAAI,EAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,IAAI,EAAE,CAAC,EAC1F,IAAI,CAAC,YAAY,IAAI,EAAE,CACxB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,yBAAyB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAEhG,MAAM,MAAM,GAAc,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAA,8BAAe,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACvG,yEAAyE;QACzE,2DAA2D;QAC3D,MAAM,SAAS,GAA4B,EAAE,GAAI,GAA0C,EAAE,CAAC;QAC9F,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;QAEzB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5B,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,UAAU;YACtB,UAAU,EAAE,IAAA,gBAAI,EAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC;YACxC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;YAChE,GAAG,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG;YAC1C,sEAAsE;YACtE,qEAAqE;YACrE,GAAG,EAAE,IAAA,oCAAqB,EAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC;YAClD,MAAM;YACN,yEAAyE;YACzE,sEAAsE;YACtE,mEAAmE;YACnE,kCAAkC;YAClC,OAAO,EAAE,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC;YAC3C,sEAAsE;YACtE,uEAAuE;YACvE,yCAAyC;YACzC,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;YAChC,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,wCAAwC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,wCAAwC,CAAC,CAAC;QAEjG,IAAI,MAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAiB,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,gCAAgC,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM;gBAAE,YAAY,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;;gBACtE,SAAS,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF;;;;;;;OAOG;IACH,MAAM,IAAI,GAAG,KAAK,EAAE,GAAY,EAAyB,EAAE;QACzD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,mEAAmE;QACnE,mEAAmE;QACnE,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;QACxD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,CAAC,IAAa,EAAE,OAAgB,EAAE,IAAa,EAAiB,EAAE;QACtF,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;QAC/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,+CAA+C;aACzD,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,gDAAgD;QAChD,MAAM,KAAK,GAAG,IAAA,yBAAkB,EAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,EAAE;YACb,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;YACtC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC9D,CAAC,CAAC;IAEF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;GAYG;AACU,QAAA,aAAa,GAAG;IAC3B,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IACtF,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;IAC/D,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;IAC7D;;;;;;;;;;;OAWG;IACH,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;IACzD;;;;;;;;;;;;;;OAcG;IACH,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;CACd,CAAC"}

package/dist/tool-protocol.d.ts

@@ -54,7 +54,25 @@ export declare const INVOCATION_BUDGET: {
     readonly bytesRead: number;
     readonly bytesWritten: number;
 };
-export interface ReadRequest {
+/**
+ * 🔴 A SIBLING REPOSITORY IS NAMED, NEVER PATHED — AND ONLY BY A READING TOOL.
+ *
+ * When a goal's change spans several repositories, the run may READ the others.
+ * The model names one by its project id in `repo`, on `read`, `glob` and `grep`
+ * only; the bridge maps that id to a checkout the TRUSTED run context resolved,
+ * and the path inside it stays relative exactly as it does in the project.
+ *
+ * ⚠️ `edit` AND `write` HAVE NO `repo`, AND THAT ABSENCE IS THE FIRST LOCK. A
+ * write cannot be pointed at a sibling because there is no field to point it
+ * with; the bridge refuses one that carries `repo` anyway, the worker for a
+ * sibling refuses every write, and the container is granted the sibling for
+ * read and execute only. Four layers, and each is meant to hold alone.
+ */
+export interface SiblingAddress {
+    /** A sibling repository's project id, as the run's instructions list it. Absent: this project. */
+    repo?: string;
+}
+export interface ReadRequest extends SiblingAddress {
     tool: 'read';
     /** Project-relative. Absolute, UNC, device and escaping paths are refused. */
     path: string;
@@ -63,14 +81,14 @@ export interface ReadRequest {
     /** 1-based, inclusive. Omitted means to the end, subject to the limits. */
     toLine?: number;
 }
-export interface GlobRequest {
+export interface GlobRequest extends SiblingAddress {
     tool: 'glob';
     /** A `*`/`**`/`?` pattern, matched against project-relative paths. */
     pattern: string;
     /** Project-relative subdirectory to search under. */
     under?: string;
 }
-export interface GrepRequest {
+export interface GrepRequest extends SiblingAddress {
     tool: 'grep';
     /** A JavaScript regular expression source. */
     pattern: string;

package/dist/tool-protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-protocol.d.ts","sourceRoot":"","sources":["../src/tool-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,qEAAqE;AACrE,eAAO,MAAM,UAAU,oDAAqD,CAAC;AAC7E,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,MAAM;IACjB,4EAA4E;;IAE5E,oCAAoC;;IAEpC,2BAA2B;;IAE3B,oCAAoC;;IAEpC,2CAA2C;;IAE3C,6EAA6E;;CAErE,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB;;;;CAIpB,CAAC;AAEX,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,MAAM,EAAE,QAAQ,GAAG,WAAW,CAAC;CAChC;AAED,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,YAAY,CAAC;AAE/F;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC;AAEpF,MAAM,MAAM,aAAa,GACrB,aAAa,GACb,kBAAkB,GAClB,WAAW,GACX,QAAQ,GACR,UAAU,GACV,qBAAqB,GACrB,WAAW,GACX,kBAAkB,GAClB,eAAe,CAAC;AAEpB;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2BpD"}
+{"version":3,"file":"tool-protocol.d.ts","sourceRoot":"","sources":["../src/tool-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,qEAAqE;AACrE,eAAO,MAAM,UAAU,oDAAqD,CAAC;AAC7E,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,MAAM;IACjB,4EAA4E;;IAE5E,oCAAoC;;IAEpC,2BAA2B;;IAE3B,oCAAoC;;IAEpC,2CAA2C;;IAE3C,6EAA6E;;CAErE,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB;;;;CAIpB,CAAC;AAEX;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC7B,kGAAkG;IAClG,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAY,SAAQ,cAAc;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAY,SAAQ,cAAc;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAY,SAAQ,cAAc;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,MAAM,EAAE,QAAQ,GAAG,WAAW,CAAC;CAChC;AAED,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,YAAY,CAAC;AAE/F;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC;AAEpF,MAAM,MAAM,aAAa,GACrB,aAAa,GACb,kBAAkB,GAClB,WAAW,GACX,QAAQ,GACR,UAAU,GACV,qBAAqB,GACrB,WAAW,GACX,kBAAkB,GAClB,eAAe,CAAC;AAEpB;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2BpD"}

package/dist/tool-protocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-protocol.js","sourceRoot":"","sources":["../src/tool-protocol.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AA+HH,kCA2BC;AAxJD,qEAAqE;AACxD,QAAA,UAAU,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAG7E;;;;;;GAMG;AACU,QAAA,MAAM,GAAG;IACpB,4EAA4E;IAC5E,SAAS,EAAE,GAAG,GAAG,IAAI;IACrB,oCAAoC;IACpC,SAAS,EAAE,IAAI;IACf,2BAA2B;IAC3B,SAAS,EAAE,IAAI;IACf,oCAAoC;IACpC,WAAW,EAAE,GAAG;IAChB,2CAA2C;IAC3C,UAAU,EAAE,IAAI,GAAG,IAAI;IACvB,6EAA6E;IAC7E,SAAS,EAAE,MAAM;CACT,CAAC;AAEX;;;;;;;GAOG;AACU,QAAA,iBAAiB,GAAG;IAC/B,KAAK,EAAE,GAAG;IACV,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAC3B,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;CACrB,CAAC;AA6EX;;;;;;;;;GASG;AACH,SAAgB,WAAW,CAAC,CAAS;IACnC,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,oBAAoB,CAAC;IACzE,IAAI,CAAC,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,uBAAuB,CAAC;IACpD,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,oCAAoC,CAAC;IACrE,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,iDAAiD,CAAC;IACnF,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACnD,OAAO,kCAAkC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC;QAC/D,OAAO,qCAAqC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QAAE,OAAO,4BAA4B,CAAC;IAC9E,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7C,4CAA4C;IAC5C,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,kCAAkC,CAAC;IAC7E,yEAAyE;IACzE,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,8BAA8B,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"tool-protocol.js","sourceRoot":"","sources":["../src/tool-protocol.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AAkJH,kCA2BC;AA3KD,qEAAqE;AACxD,QAAA,UAAU,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAG7E;;;;;;GAMG;AACU,QAAA,MAAM,GAAG;IACpB,4EAA4E;IAC5E,SAAS,EAAE,GAAG,GAAG,IAAI;IACrB,oCAAoC;IACpC,SAAS,EAAE,IAAI;IACf,2BAA2B;IAC3B,SAAS,EAAE,IAAI;IACf,oCAAoC;IACpC,WAAW,EAAE,GAAG;IAChB,2CAA2C;IAC3C,UAAU,EAAE,IAAI,GAAG,IAAI;IACvB,6EAA6E;IAC7E,SAAS,EAAE,MAAM;CACT,CAAC;AAEX;;;;;;;GAOG;AACU,QAAA,iBAAiB,GAAG;IAC/B,KAAK,EAAE,GAAG;IACV,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAC3B,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;CACrB,CAAC;AAgGX;;;;;;;;;GASG;AACH,SAAgB,WAAW,CAAC,CAAS;IACnC,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,oBAAoB,CAAC;IACzE,IAAI,CAAC,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,uBAAuB,CAAC;IACpD,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,oCAAoC,CAAC;IACrE,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,iDAAiD,CAAC;IACnF,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACnD,OAAO,kCAAkC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC;QAC/D,OAAO,qCAAqC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QAAE,OAAO,4BAA4B,CAAC;IAC9E,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7C,4CAA4C;IAC5C,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,kCAAkC,CAAC;IAC7E,yEAAyE;IACzE,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,8BAA8B,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/tool-worker.d.ts

@@ -1,3 +1,15 @@
 import type { ToolRequest, ToolResponse } from './tool-protocol';
-export declare function handle(root: string, req: ToolRequest): ToolResponse;
+/** How the worker was launched. Decided by the trusted bridge, on argv; nothing in a request reaches it. */
+export interface WorkerMode {
+    /**
+     * A SIBLING REPOSITORY, lent for reference. Every edit and write is refused
+     * here, before a path is even resolved — the THIRD lock, behind the protocol
+     * (no `repo` on a write) and the bridge, and in front of the container, which
+     * was granted the sibling read-and-execute only.
+     */
+    readOnly?: boolean;
+}
+/** The flag the bridge puts on argv after the root. Exact, so a typo grants nothing and refuses nothing. */
+export declare const READ_ONLY_FLAG = "--read-only";
+export declare function handle(root: string, req: ToolRequest, mode?: WorkerMode): ToolResponse;
 //# sourceMappingURL=tool-worker.d.ts.map

package/dist/tool-worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-worker.d.ts","sourceRoot":"","sources":["../src/tool-worker.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AA6RjE,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,YAAY,CA+JnE"}
+{"version":3,"file":"tool-worker.d.ts","sourceRoot":"","sources":["../src/tool-worker.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AA6RjE,4GAA4G;AAC5G,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,4GAA4G;AAC5G,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAE5C,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,GAAE,UAAe,GAAG,YAAY,CAmK1F"}