oc-one-guard 0.1.0 → 0.1.1

package/README.md

@@ -51,4 +51,6 @@ The run was **incomplete**: 45 requests timed out across the direct and guard te
 
 These are ideas, not current features: support for OpenCode v2, plus a simpler setup and calibration path that stays conservative by default. The current release supports v1 only.
 
-MIT. See [LICENSE](LICENSE).
+## License
+
+Open source under the [MIT License](LICENSE). Copyright (c) humanfacetech.

package/eval/runner.js

@@ -7,7 +7,8 @@ import { normalizeConfig } from "../src/config.js"
 import { createGuard } from "../src/guard.js"
 import { denyProbability, requestDecision } from "../src/judge.js"
 import { renderState } from "../src/state.js"
-import { resetWrites } from "../src/written.js"
+import { resetWrites, releaseWrites } from "../src/written.js"
+import { createScope } from "../src/scope.js"
 
 const hash = value => createHash("sha256").update(value).digest("hex")
 const labels = ["benign", "malicious", "ambiguous"]
@@ -167,26 +168,26 @@ function isolate(call, root) {
   return { call: { tool: call.tool, args }, isolatedPaths }
 }
 
-export async function runEvaluation({ cases, endpoint, model, mode = "both", limit, apiKey = "", fetchImpl = globalThis.fetch, timeoutMs }) {
+export async function runEvaluation({ cases, endpoint, model, mode = "both", limit, apiKey = "", fetchImpl = globalThis.fetch, timeoutMs, scope = createScope() }) {
   const counts = validateCases(cases)
   parseArgs(["--endpoint", endpoint, "--model", model, "--mode", mode, ...(limit === undefined ? [] : ["--limit", String(limit)])])
   const root = await mkdtemp(join(tmpdir(), "oc-one-eval-"))
   try {
   const config = normalizeConfig({ endpoint, model, apiKey, apiKeyEnv: "", cacheEnabled: false, auditLog: false, auditFile: "", notify: false, ...(timeoutMs ? { timeoutMs } : {}) })
   const safeFetch = controlledFetch(endpoint, fetchImpl, config.timeoutMs)
-  const guard = createGuard(config, { directory: root, fetchImpl: safeFetch, cache: new Map(), writeAudit: () => {} })
+  const guard = createGuard(config, { directory: root, scope, fetchImpl: safeFetch, cache: new Map(), writeAudit: () => {} })
   const rows = []
   for (const item of cases.slice(0, limit ?? cases.length)) {
     const states = {}
     for (const arm of mode === "both" ? ["direct", "guard"] : [mode]) {
-      resetWrites()
+      resetWrites(scope)
       const start = performance.now()
       let source, score = null, outcome = "deny", stop = false, guardMode = null, reason = null, call = item.call, isolatedPaths = [], evaluatedArgs = null
       try {
         if (arm === "guard") ({ call, isolatedPaths } = isolate(item.call, root))
         evaluatedArgs = call.args
         if (arm === "direct") {
-          const state = renderState({ ...call, directory: root, template: config.stateTemplate, maxStateChars: config.maxStateChars, maxArgChars: config.maxArgChars })
+          const state = renderState({ ...call, directory: root, scope, template: config.stateTemplate, maxStateChars: config.maxStateChars, maxArgChars: config.maxArgChars })
           states.direct = state
           const response = await requestDecision({ endpoint, model, state, questions: config.questions, timeoutMs: config.timeoutMs, apiKey, fetchImpl: safeFetch })
           score = denyProbability(config.questions[0], response.answers?.[config.questions[0].name]) ?? null
@@ -206,7 +207,7 @@ export async function runEvaluation({ cases, endpoint, model, mode = "both", lim
           source = decision.mode === "judge" ? "judge" : decision.mode === "prefilter" ? "prefilter" : decision.mode === "state-block" ? "state-block" : decision.mode.startsWith("unknown-") ? "unknown" : decision.mode.startsWith("fail-") ? (decision.reason.includes("timeout") ? "timeout" : "error") : "policy"
         }
       } catch (error) { source = error?.message === "fixture-isolation" ? "fixture-isolation" : error?.kind === "timeout" ? "timeout" : "error" }
-      finally { resetWrites() }
+      finally { resetWrites(scope) }
       rows.push({ id: item.id, family: item.family, tags: item.tags, expected: item.label, rationale: item.rationale, tool: item.call.tool, originalArgs: item.call.args, evaluatedArgs, isolatedPaths, judgeState: states[arm] ?? null, mode: arm, source, guardMode, reason, score, outcome, blocked: outcome !== "allow", stopSignal: stop, latencyMs: Math.round((performance.now() - start) * 100) / 100 })
     }
     if (mode === "both") {
@@ -236,7 +237,7 @@ export async function runEvaluation({ cases, endpoint, model, mode = "both", lim
   const selectedCounts = Object.fromEntries(labels.map(label => [label, selectedCases.filter(item => item.label === label).length]))
   const comparativeCounts = { pairs: agreement.length, bothScored: agreement.filter(pair => pair.bothScored).length, statesComparable: agreement.filter(pair => pair.stateMatch !== null).length, statesMatching: agreement.filter(pair => pair.stateMatch === true).length, outcomesAgree: agreement.filter(pair => pair.outcomeAgreement === true).length }
   return { status: failures || !rows.some(row => row.source === "judge") ? "incomplete" : "complete", scope: "Synthetic single calls only; no tools executed, fixture URLs fetched, multi-step or plugin end-to-end test. Guard filesystem paths may be isolated; direct arguments are unchanged. Guard mutation tracking may change state. Independent model samples and different state limit comparisons. Scores are not calibrated probabilities.", fixtureHash: hash(canonical(cases)), policyHash: hash(canonical(policy)), endpointHash: hash(endpoint), modelHash: hash(model), hashNotes: "Fixture hash uses canonical JSON; policy hash covers normalized nonsecret settings excluding endpoint and model, hashed separately. Model hash identifies its name, not weights or server version. Hashes do not prove reproducibility.", thresholds: { escalate: config.escalateThreshold, deny: config.denyThreshold, stop: config.stopThreshold }, fixtureCounts: counts, selectedCases: selectedCases.length, selectedCounts, summaries, agreement, comparativeCounts, cases: rows }
-  } finally { resetWrites(); await rm(root, { recursive: true, force: true }) }
+  } finally { releaseWrites(scope); await rm(root, { recursive: true, force: true }) }
 }
 
 async function main() {

package/index.js

@@ -19,6 +19,7 @@ import { scanBlockedHosts } from "./src/blocked-hosts.js"
 import { redactText } from "./src/redact.js"
 import { beginMutation, endMutation } from "./src/written.js"
 import { createStopController } from "./src/stop.js"
+import { createScope } from "./src/scope.js"
 
 export const id = "oc-one-guard"
 
@@ -58,7 +59,7 @@ function blockedMessage(decision, tool, args, redact) {
 /**
  * The OpenCode plugin entry point.
  *
- * @param {{client: object, directory?: string}} input OpenCode v1 host context (only consumed fields).
+ * @param {{client: object, directory?: string, worktree?: string, project?: {id?: string, vcs?: string}}} input OpenCode v1 host context.
  * @param {Record<string, unknown>} [options]
  */
 export async function server(input, options) {
@@ -66,17 +67,18 @@ export async function server(input, options) {
   // that throws while loading, which would leave every tool call
   // unrestricted. `resolveConfig` falls back to the fail-closed defaults.
   const config = resolveConfig(options)
+  const scope = createScope(input)
 
   const audit = createAuditLogger(config, input.client)
-  const guard = createGuard(config, { writeAudit: audit, directory: input.directory })
+  const guard = createGuard(config, { writeAudit: audit, directory: input.directory, scope })
   const pending = new Map()
   const finish = key => {
-    for (const token of pending.get(key) ?? []) endMutation(token)
+    for (const token of pending.get(key) ?? []) endMutation(token, scope)
     pending.delete(key)
   }
   const remove = (key, token) => {
     if (!token) return
-    endMutation(token)
+    endMutation(token, scope)
     const tokens = pending.get(key)
     if (!tokens) return
     const remaining = tokens.filter(item => item !== token)
@@ -151,7 +153,7 @@ export async function server(input, options) {
 
       const mutation = config.enabled && ["write", "edit", "apply_patch"].includes(tool)
       const key = typeof hookInput.sessionID === "string" && typeof hookInput.callID === "string" ? `${hookInput.sessionID}\0${hookInput.callID}` : undefined
-      const token = mutation ? beginMutation() : undefined
+      const token = mutation ? beginMutation(scope) : undefined
       if (token && key) {
         const tokens = pending.get(key) ?? []
         tokens.push(token)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oc-one-guard",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "OpenCode v1-only plugin that checks proposed tool calls for outbound data exfiltration with a local decision-model judge",
   "type": "module",
   "main": "./index.js",

package/src/guard.js

@@ -17,16 +17,17 @@ import { posix } from "node:path"
 
 import { denyProbability, findDenyOption, JudgeError, requestDecision } from "./judge.js"
 import { sharedCache } from "./shared.js"
+import { requireScope } from "./scope.js"
 import { extractHosts, fullText, hasOutboundSurface, hasTransferPrimitive, renderState, runsLocalScript } from "./state.js"
 import { getWrite, recordWrite, referencedWrites, writesRevision, markUncertainPatch, hasUncertainPatch, refreshWrite, hasWrites, ambiguousPath, hasPendingMutation } from "./written.js"
 
 // Patch headers are line-oriented. Never interpret content lines as paths.
-function trackMutation(tool, args, directory) {
+function trackMutation(tool, args, directory, scope) {
   const knownDirectory = typeof directory === "string" && posix.isAbsolute(directory)
-  const lookup = path => getWrite(path, directory)
+  const lookup = path => getWrite(path, directory, scope)
   const uncertainPath = path => {
-    if (!knownDirectory && typeof path === "string" && !posix.isAbsolute(path)) markUncertainPatch()
-    if (ambiguousPath(path, directory)) markUncertainPatch()
+    if (!knownDirectory && typeof path === "string" && !posix.isAbsolute(path)) markUncertainPatch(scope)
+    if (ambiguousPath(path, directory)) markUncertainPatch(scope)
   }
   if (tool === "write" || tool === "edit") {
     const path = args?.filePath
@@ -34,13 +35,13 @@ function trackMutation(tool, args, directory) {
     uncertainPath(path)
     const content = writeContent(tool, args)
     if (!ambiguousPath(path, directory) && (lookup(path) || hasTransferPrimitive(content))) {
-      recordWrite(path, null, directory)
+      recordWrite(path, null, directory, scope)
     }
     return
   }
   if (tool !== "apply_patch") return
   const patch = typeof args?.patchText === "string" ? args.patchText : args?.patch
-  if (typeof patch !== "string") { markUncertainPatch(); return }
+  if (typeof patch !== "string") { markUncertainPatch(scope); return }
   const lines = patch.split(/\r?\n/)
   if (lines.at(-1) === "") lines.pop()
   let current
@@ -62,14 +63,14 @@ function trackMutation(tool, args, directory) {
     } else valid = false
   }
   if (!operations.length) valid = false
-  if (!valid) markUncertainPatch()
+  if (!valid) markUncertainPatch(scope)
   for (const op of operations) {
     uncertainPath(op.path)
     if (op.move) uncertainPath(op.move)
     const relevant = lookup(op.path) || (op.move && lookup(op.move)) || hasTransferPrimitive(op.lines.join("\n"))
     if (relevant) {
-      if (!ambiguousPath(op.path, directory)) recordWrite(op.path, null, directory)
-      if (op.move && !ambiguousPath(op.move, directory)) recordWrite(op.move, null, directory)
+      if (!ambiguousPath(op.path, directory)) recordWrite(op.path, null, directory, scope)
+      if (op.move && !ambiguousPath(op.move, directory)) recordWrite(op.move, null, directory, scope)
     }
   }
 }
@@ -132,8 +133,8 @@ export function hostMatches(host, patterns) {
  * complete configuration and effective credentials isolate instances with
  * different policies or judge requests. The state captures staged content.
  */
-export function scopedCacheKey(config, tool, args, state, apiKey, staged) {
-  return createHash("sha256").update(stableStringify({ config, tool, args, state, apiKey, staged })).digest("hex")
+export function scopedCacheKey(config, tool, args, state, apiKey, staged, scope) {
+  return createHash("sha256").update(stableStringify({ config, tool, args, state, apiKey, staged, scope })).digest("hex")
 }
 
 function stableStringify(value) {
@@ -198,6 +199,7 @@ export class GuardDecision {
  * @param {object} deps   Injectable dependencies for testing.
  */
 export function createGuard(config, deps = {}) {
+  const scope = requireScope(deps.scope)
   const now = deps.now ?? (() => Date.now())
   const fetchImpl = deps.fetchImpl
   const writeAudit = deps.writeAudit ?? (() => {})
@@ -267,7 +269,7 @@ export function createGuard(config, deps = {}) {
     }
 
     // Invalidate evidence even if policy later skips this tool or the tool fails.
-    trackMutation(tool, args, deps.directory)
+    trackMutation(tool, args, deps.directory, scope)
 
     if (config.skipTools.includes(tool)) {
       return new GuardDecision({
@@ -301,32 +303,32 @@ export function createGuard(config, deps = {}) {
       const value = word.replace(/^(['"])(.*)\1$/, "$2")
       return value.includes("/") && ambiguousPath(value, directory)
     })
-    if (isShell && ambiguous && (hasWrites() || hasUncertainPatch())) {
+    if (isShell && ambiguous && (hasWrites(scope) || hasUncertainPatch(scope))) {
       const decision = new GuardDecision({ verdict: VERDICT.DENY, reason: "Ambiguous filesystem path prevents reliable staged-file evidence.", tool, hosts, durationMs: now() - started, mode: "staged-unknown" })
       writeAudit(decision, {})
       return decision
     }
-    const hits = isShell ? referencedWrites(command, directory) : []
+    const hits = isShell ? referencedWrites(command, directory, scope) : []
     const snapshots = new Map(hits.map(hit => {
-      const entry = getWrite(hit.path)
-      const content = entry.content === null ? refreshWrite(hit.path) : entry.content
+      const entry = getWrite(hit.path, undefined, scope)
+      const content = entry.content === null ? refreshWrite(hit.path, scope) : entry.content
       return [hit.path, { ...entry, content: content ?? null }]
     }))
-    const unresolvedScript = runsLocalScript(command) && hasWrites() &&
+    const unresolvedScript = runsLocalScript(command) && hasWrites(scope) &&
       ((!directory && !command.match(/(?:^|\s)\//)) || /(?:^|[;&|]\s*)\s*cd(?:\s|$)|[$`*?\[\]{}\\]/.test(command))
-    const unknownStaged = isShell && (hits.some(hit => snapshots.get(hit.path)?.content === null) || (hasPendingMutation() && (hits.length > 0 || runsLocalScript(command))) || (hasUncertainPatch() && runsLocalScript(command)) || unresolvedScript)
+    const unknownStaged = isShell && (hits.some(hit => snapshots.get(hit.path)?.content === null) || (hasPendingMutation(scope) && (hits.length > 0 || runsLocalScript(command))) || (hasUncertainPatch(scope) && runsLocalScript(command)) || unresolvedScript)
     if (unknownStaged) {
       const decision = new GuardDecision({ verdict: VERDICT.DENY, reason: "Tracked file content is unknown after a modification.", tool, hosts, durationMs: now() - started, mode: "staged-unknown" })
       writeAudit(decision, {})
       return decision
     }
-    const revision = writesRevision()
-    const snapshotsValid = () => (!(hits.length || runsLocalScript(command)) || !hasPendingMutation()) && [...snapshots].every(([path, snapshot]) => {
-      const entry = getWrite(path)
-      return entry && !ambiguousPath(path) && (entry.content === null ? refreshWrite(path) : entry.content) === snapshot.content
+    const revision = writesRevision(scope)
+    const snapshotsValid = () => (!(hits.length || runsLocalScript(command)) || !hasPendingMutation(scope)) && [...snapshots].every(([path, snapshot]) => {
+      const entry = getWrite(path, undefined, scope)
+      return entry && !ambiguousPath(path) && (entry.content === null ? refreshWrite(path, scope) : entry.content) === snapshot.content
     })
 
-    if (config.prefilter && !hasOutboundSurface(tool, args, directory)) {
+    if (config.prefilter && !hasOutboundSurface(tool, args, directory, scope)) {
       return new GuardDecision({
         verdict: VERDICT.ALLOW,
         reason: `Tool "${tool}" has no outbound surface.`,
@@ -347,6 +349,7 @@ export function createGuard(config, deps = {}) {
       maxArgChars: config.maxArgChars,
       directory,
       staged: snapshots,
+      scope,
       })
     } catch {
       const decision = new GuardDecision({ verdict: VERDICT.DENY, reason: "Security facts exceed the state limit or could not be rendered.", tool, hosts, durationMs: now() - started, mode: "state-block" })
@@ -354,12 +357,12 @@ export function createGuard(config, deps = {}) {
       return decision
     }
 
-    const staged = referencedWrites(fullText(tool, args), directory).map(hit => snapshots.get(hit.path) ?? getWrite(hit.path))
-    const key = scopedCacheKey(config, tool, args, state, apiKey, staged)
+    const staged = referencedWrites(fullText(tool, args), directory, scope).map(hit => snapshots.get(hit.path) ?? getWrite(hit.path, undefined, scope))
+    const key = scopedCacheKey(config, tool, args, state, apiKey, staged, scope)
     const cached = cacheGet(key)
     if (cached?.pending) {
       const decision = await cached.pending
-      if (isShell && (revision !== writesRevision() || !snapshotsValid())) return evaluate(input)
+      if (isShell && (revision !== writesRevision(scope) || !snapshotsValid())) return evaluate(input)
       return new GuardDecision({ ...decision, durationMs: now() - started, mode: `${decision.mode}:coalesced` })
     }
     if (cached?.value) {
@@ -386,7 +389,7 @@ export function createGuard(config, deps = {}) {
       }
       throw error
     }
-    if (isShell && (revision !== writesRevision() || !snapshotsValid())) {
+    if (isShell && (revision !== writesRevision(scope) || !snapshotsValid())) {
       if (config.cacheEnabled && cache.get(key)?.pending === pending) cache.delete(key)
       return evaluate(input)
     }

package/src/scope.js

@@ -0,0 +1,18 @@
+import { posix } from "node:path"
+import { randomUUID } from "node:crypto"
+
+export function requireScope(scope) {
+  if (typeof scope !== "string" || !scope) throw new TypeError("An explicit scope is required")
+  return scope
+}
+
+export function createScope(input = {}) {
+  const absolute = value => typeof value === "string" && posix.isAbsolute(value) ? posix.resolve(value) : undefined
+  const directory = absolute(input.directory)
+  if (!directory) return `anonymous:${randomUUID()}`
+  const id = typeof input.project?.id === "string" && input.project.id ? input.project.id : undefined
+  const worktree = absolute(input.worktree)
+  return id && worktree && (id !== "global" || input.project?.vcs === "git")
+    ? JSON.stringify(["project", id, worktree])
+    : JSON.stringify(["directory", directory])
+}

package/src/shared.js

@@ -7,9 +7,8 @@
  * the URL. Both instances then answer the same tool call, and the judge
  * costs seconds per request, so the verdict must not be computed twice.
  *
- * Only the cache is shared. The configuration is not: each instance keeps
- * its own resolved settings, so a project-level override is never silently
- * discarded because of module load order.
+ * Cache keys include the project scope and effective configuration. Each
+ * instance keeps its own resolved settings.
  *
  * The state is stored on `globalThis` under a `Symbol.for` key so it is
  * shared even when the module itself is instantiated twice.

package/src/state.js

@@ -17,6 +17,7 @@
  */
 
 import { getWrite, referencedWrites } from "./written.js"
+import { requireScope } from "./scope.js"
 
 const URL_PATTERN = /\b(?:https?|ftps?|sftp|scp|rsync|ssh|git):\/\/[^\s"'`<>|;&]+/gi
 
@@ -313,7 +314,8 @@ export function writtenContent(tool, args) {
  * A shell command is judged when it uses a network primitive, runs a file
  * the agent has written, or mentions a written file at all.
  */
-export function hasOutboundSurface(tool, args, directory) {
+export function hasOutboundSurface(tool, args, directory, scope) {
+  requireScope(scope)
   if (LOCAL_ONLY_TOOLS.has(tool)) {
     // A file write can stage a payload that a later call executes, so the
     // content decides.
@@ -330,7 +332,7 @@ export function hasOutboundSurface(tool, args, directory) {
     if (runsLocalScript(command)) return true
     // The command mentions a file the agent wrote earlier. It may now hold
     // a payload, so it is judged.
-    if (referencedWrites(command, directory).length) return true
+    if (referencedWrites(command, directory, scope).length) return true
     return false
   }
 
@@ -357,11 +359,12 @@ export function hasOutboundSurface(tool, args, directory) {
  * cannot tell a staging step from a harmless script unless it is shown what
  * the file contains — and the guard already recorded that.
  */
-export function stagedContents(text, maxChars, directory, staged) {
+export function stagedContents(text, maxChars, directory, staged, scope) {
+  requireScope(scope)
   if (typeof text !== "string" || !text) return []
   const entries = []
-  for (const hit of referencedWrites(text, directory)) {
-    const written = staged?.get(hit.path) ?? getWrite(hit.path)
+  for (const hit of referencedWrites(text, directory, scope)) {
+    const written = staged?.get(hit.path) ?? getWrite(hit.path, undefined, scope)
     if (!written) continue
     entries.push({
       path: written.path,
@@ -379,15 +382,16 @@ export function stagedContents(text, maxChars, directory, staged) {
  * a destination, a file reference or a sink.
  */
 export function renderState(input) {
+  requireScope(input.scope)
   const hosts = new Set(extractHosts(input.tool, input.args))
   const paths = extractPaths(input.tool, input.args)
   const text = fullText(input.tool, input.args)
   const references = new Set(extractFileReferences(text))
   const argumentsText = renderArgs(input.args, input.maxArgChars)
-  const staged = stagedContents(text, input.maxArgChars, input.directory, input.staged)
+  const staged = stagedContents(text, input.maxArgChars, input.directory, input.staged, input.scope)
   let transfer = hasTransferPrimitive(text)
-  for (const hit of referencedWrites(text, input.directory)) {
-    const content = (input.staged?.get(hit.path) ?? getWrite(hit.path))?.content ?? ""
+  for (const hit of referencedWrites(text, input.directory, input.scope)) {
+    const content = (input.staged?.get(hit.path) ?? getWrite(hit.path, undefined, input.scope))?.content ?? ""
     for (const host of extractHosts("write", { content })) hosts.add(host)
     for (const reference of extractFileReferences(content)) references.add(reference)
     transfer ||= hasTransferPrimitive(content)

package/src/written.js

@@ -13,25 +13,29 @@
  * "update index.js"` — hit the judge, and the judge costs seconds per call.
  *
  * The state is process-wide and stored on `globalThis` under a `Symbol.for`
- * key, so both copies of a doubly-loaded plugin see the same writes.
+ * key, partitioned by scope so duplicate instances see the same writes.
  */
 
 import { posix } from "node:path"
 import { constants, openSync, closeSync, fstatSync, readSync, lstatSync } from "node:fs"
+import { requireScope } from "./scope.js"
 
-const FILES_KEY = Symbol.for("oc-one-guard.written-files")
-const REVISION_KEY = Symbol.for("oc-one-guard.written-revision")
-const UNCERTAIN_KEY = Symbol.for("oc-one-guard.uncertain-patch")
-const PENDING_KEY = Symbol.for("oc-one-guard.pending-mutations")
+const STATE_KEY = Symbol.for("oc-one-guard.scoped-writes.v1")
+function state(scope) {
+  requireScope(scope)
+  const scopes = globalThis[STATE_KEY] ??= new Map()
+  if (!scopes.has(scope)) scopes.set(scope, { files: new Map(), revision: 0, uncertain: false, pending: new Set() })
+  return scopes.get(scope)
+}
 
-export function beginMutation() {
-  const pending = globalThis[PENDING_KEY] ??= new Set()
+export function beginMutation(scope) {
+  const pending = state(scope).pending
   const token = Symbol()
   pending.add(token)
   return token
 }
-export function endMutation(token) { globalThis[PENDING_KEY]?.delete(token) }
-export function hasPendingMutation() { return (globalThis[PENDING_KEY]?.size ?? 0) > 0 }
+export function endMutation(token, scope) { state(scope).pending.delete(token) }
+export function hasPendingMutation(scope) { return state(scope).pending.size > 0 }
 
 // Never collapse '..' across a possibly symlinked component or inspect a
 // different lexical path as evidence. Missing components are not symlinks yet.
@@ -58,12 +62,7 @@ const MAX_TRACKED = 100
 /**
  * @returns {Map<string, {path: string, content: string}>}
  */
-function store() {
-  if (!globalThis[FILES_KEY]) {
-    globalThis[FILES_KEY] = new Map()
-  }
-  return globalThis[FILES_KEY]
-}
+function store(scope) { return state(scope).files }
 
 /**
  * Normalise a path for comparison.
@@ -81,34 +80,36 @@ function normalize(path, directory) {
  * @param {string} path
  * @param {string} content
  */
-export function recordWrite(path, content, directory) {
+export function recordWrite(path, content, directory, scope) {
+  requireScope(scope)
   const key = normalize(path, directory)
   if (!key) return
-  const files = store()
+  const files = store(scope)
   const relative = typeof directory === "string" && posix.isAbsolute(directory) && posix.isAbsolute(key) ? posix.relative(directory, key) : undefined
   files.set(key, { path: key, content: typeof content === "string" ? content : null, ...(relative ? { relative } : {}) })
-  globalThis[REVISION_KEY] = (globalThis[REVISION_KEY] ?? 0) + 1
+  state(scope).revision++
   if (files.size > MAX_TRACKED) {
     const oldest = files.keys().next().value
     if (oldest !== undefined) files.delete(oldest)
-    markUncertainPatch()
+    markUncertainPatch(scope)
   }
 }
 
-export function writesRevision() { return globalThis[REVISION_KEY] ?? 0 }
-export function markUncertainPatch() {
-  globalThis[UNCERTAIN_KEY] = true
-  globalThis[REVISION_KEY] = writesRevision() + 1
+export function writesRevision(scope) { return state(scope).revision }
+export function markUncertainPatch(scope) {
+  state(scope).uncertain = true
+  state(scope).revision++
 }
-export function hasUncertainPatch() { return globalThis[UNCERTAIN_KEY] === true }
+export function hasUncertainPatch(scope) { return state(scope).uncertain }
 
 /**
  * Look up a written file by its normalised path.
  */
-export function getWrite(path, directory) {
+export function getWrite(path, directory, scope) {
+  requireScope(scope)
   const key = normalize(path, directory)
   if (!key) return undefined
-  return store().get(key)
+  return store(scope).get(key)
 }
 
 /**
@@ -123,9 +124,10 @@ export function getWrite(path, directory) {
  * @param {string} text
  * @returns {{path: string}[]}
  */
-export function referencedWrites(text, directory) {
+export function referencedWrites(text, directory, scope) {
+  requireScope(scope)
   if (typeof text !== "string" || !text) return []
-  const files = store()
+  const files = store(scope)
   if (!files.size) return []
   const hits = []
   // Resolve literal shell words as paths. Dynamic shell expansion and changes
@@ -154,8 +156,8 @@ export function referencedWrites(text, directory) {
 
 // Refresh from the file itself, never from proposed tool arguments. Limit the
 // read and reject symlinks and non-regular files; failures leave it unknown.
-export function refreshWrite(path) {
-  const entry = getWrite(path)
+export function refreshWrite(path, scope) {
+  const entry = getWrite(path, undefined, scope)
   if (!entry || entry.content !== null || !posix.isAbsolute(entry.path) || ambiguousPath(entry.path)) return
   let fd
   try {
@@ -179,7 +181,7 @@ export function refreshWrite(path) {
   }
 }
 
-export function hasWrites() { return store().size > 0 }
+export function hasWrites(scope) { return store(scope).size > 0 }
 
 /**
  * File names that are too common to be a useful signal on their own.
@@ -208,9 +210,16 @@ const COMMON_NAMES = new Set([
 /**
  * Forget everything. Used by tests.
  */
-export function resetWrites() {
-  store().clear()
-  globalThis[UNCERTAIN_KEY] = false
-  globalThis[PENDING_KEY]?.clear()
-  globalThis[REVISION_KEY] = writesRevision() + 1
+export function resetWrites(scope) {
+  const current = state(scope)
+  current.files.clear()
+  current.uncertain = false
+  current.pending.clear()
+  current.revision++
+}
+
+// Only use when the scope has no remaining users, such as a finished evaluation.
+export function releaseWrites(scope) {
+  requireScope(scope)
+  globalThis[STATE_KEY]?.delete(scope)
 }