patchwarden 1.5.1 → 1.6.2

package/dist/tools/workspace/listAgents.js

@@ -0,0 +1,56 @@
+import { existsSync, statSync } from "node:fs";
+import { basename, delimiter, extname, isAbsolute, join, resolve } from "node:path";
+import { getConfig } from "../../config.js";
+import { sanitizeTrustedPath } from "../../runner/processSecurity.js";
+export function listAgents() {
+    const config = getConfig();
+    const checkedAt = new Date().toISOString();
+    const configPath = process.env.PATCHWARDEN_CONFIG
+        ? resolve(process.env.PATCHWARDEN_CONFIG)
+        : resolve(process.cwd(), "patchwarden.config.json");
+    const agents = Object.entries(config.agents)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([name, agent]) => {
+        const available = commandExists(agent.command, config.workspaceRoot);
+        const modelArgumentPresent = typeof agent.model === "string"
+            ? agent.args.some((arg, index) => arg === "--model" && agent.args[index + 1] === agent.model)
+            : true;
+        return {
+            name,
+            configured: true,
+            available,
+            command: basename(agent.command),
+            reason: available ? null : "Configured executable was not found on disk or PATH.",
+            checked_at: checkedAt,
+            adapter: typeof agent.adapter === "string" ? agent.adapter : ["codex", "opencode"].includes(name) ? name : null,
+            model: typeof agent.model === "string" ? agent.model : null,
+            capabilities: { model_override: typeof agent.adapter === "string" || ["codex", "opencode"].includes(name) },
+            availability_scope: "executable_only",
+            provider_status: "not_checked",
+            invocation_ready: available && modelArgumentPresent,
+            model_argument_present: modelArgumentPresent,
+        };
+    });
+    return { agents, total: agents.length, config_path: configPath, workspace_root: config.workspaceRoot };
+}
+function commandExists(command, workspaceRoot) {
+    if (isAbsolute(command) || command.includes("/") || command.includes("\\")) {
+        return isFile(command);
+    }
+    const pathEntries = sanitizeTrustedPath(process.env.PATH || "", workspaceRoot).split(delimiter).filter(Boolean);
+    const extensions = process.platform === "win32"
+        ? (process.env.PATHEXT || ".EXE;.CMD;.BAT;.COM").split(";")
+        : [""];
+    const candidates = extname(command)
+        ? pathEntries.map((entry) => join(entry, command))
+        : pathEntries.flatMap((entry) => extensions.map((extension) => join(entry, `${command}${extension}`)));
+    return candidates.some(isFile);
+}
+function isFile(path) {
+    try {
+        return existsSync(path) && statSync(path).isFile();
+    }
+    catch {
+        return false;
+    }
+}

package/dist/tools/{listWorkspace.js → workspace/listWorkspace.js}

@@ -1,8 +1,8 @@
 import { readdirSync, statSync, existsSync } from "node:fs";
 import { resolve } from "node:path";
-import { getConfig } from "../config.js";
-import { guardPath } from "../security/pathGuard.js";
-import { guardSensitivePath } from "../security/sensitiveGuard.js";
+import { getConfig } from "../../config.js";
+import { guardPath } from "../../security/pathGuard.js";
+import { guardSensitivePath } from "../../security/sensitiveGuard.js";
 const MAX_LIST_FILES = 200;
 export function listWorkspace(relativePath) {
     const config = getConfig();

package/dist/tools/{mergeWorktree.js → workspace/mergeWorktree.js}

@@ -4,9 +4,9 @@
  *
  * 参考 src/tools/auditTask.ts 的导出/返回风格。
  */
-import { getConfig } from "../config.js";
-import { guardWorkspacePath } from "../security/pathGuard.js";
-import { mergeWorktree } from "../goal/worktreeManager.js";
+import { getConfig } from "../../config.js";
+import { guardWorkspacePath } from "../../security/pathGuard.js";
+import { mergeWorktree } from "../../goal/worktreeManager.js";
 /**
  * 合并指定 worktree 的 branch 回 repo_path（主工作区）。
  *

package/dist/tools/{readWorkspaceFile.js → workspace/readWorkspaceFile.js}

@@ -1,13 +1,13 @@
 import { readFileSync, statSync, existsSync } from "node:fs";
 import { createHash } from "node:crypto";
-import { getConfig } from "../config.js";
-import { guardReadPath } from "../security/pathGuard.js";
-import { guardSensitivePath } from "../security/sensitiveGuard.js";
-import { redactSensitiveContent } from "../security/contentRedaction.js";
-import { PatchWardenError } from "../errors.js";
-import { readDirectSession } from "../direct/directSessionStore.js";
-import { guardDirectSessionActive, guardDirectReadPath, isBinaryFile, guardDirectFileSize } from "../direct/directGuards.js";
-import { resolveToolProfile } from "./toolCatalog.js";
+import { getConfig } from "../../config.js";
+import { guardReadPath } from "../../security/pathGuard.js";
+import { guardSensitivePath } from "../../security/sensitiveGuard.js";
+import { redactSensitiveContent } from "../../security/contentRedaction.js";
+import { PatchWardenError } from "../../errors.js";
+import { readDirectSession } from "../../direct/directSessionStore.js";
+import { guardDirectSessionActive, guardDirectReadPath, isBinaryFile, guardDirectFileSize } from "../../direct/directGuards.js";
+import { resolveToolProfile } from "../catalog/toolCatalog.js";
 export function readWorkspaceFile(input) {
     const config = getConfig();
     // Support both old string API and new object API

package/dist/tools/{recommendAgentForTask.js → workspace/recommendAgentForTask.js}

@@ -1,6 +1,6 @@
-import { getConfig } from "../config.js";
-import { guardWorkspacePath } from "../security/pathGuard.js";
-import { routeAgent } from "../agents/agentRouter.js";
+import { getConfig } from "../../config.js";
+import { guardWorkspacePath } from "../../security/pathGuard.js";
+import { routeAgent } from "../../agents/agentRouter.js";
 export function recommendAgentForTask(input) {
     const config = getConfig();
     const repoPath = String(input.repo_path || "").trim();

package/dist/tools/{searchWorkspace.js → workspace/searchWorkspace.js}

@@ -1,10 +1,10 @@
 import { readdirSync, readFileSync, statSync, existsSync } from "node:fs";
 import { relative, join, extname } from "node:path";
-import { getConfig } from "../config.js";
-import { PatchWardenError } from "../errors.js";
-import { isSensitivePath } from "../security/sensitiveGuard.js";
-import { validateDirectSessionFreshness, } from "../direct/directSessionStore.js";
-import { guardDirectSessionActive } from "../direct/directGuards.js";
+import { getConfig } from "../../config.js";
+import { PatchWardenError } from "../../errors.js";
+import { isSensitivePath } from "../../security/sensitiveGuard.js";
+import { validateDirectSessionFreshness, } from "../../direct/directSessionStore.js";
+import { guardDirectSessionActive } from "../../direct/directGuards.js";
 // ── Constants ──────────────────────────────────────────────────────
 const SKIP_DIRECTORIES = new Set([
     ".git",

package/dist/tools/{syncFile.d.ts → workspace/syncFile.d.ts}

@@ -1,4 +1,4 @@
-import { type PatchWardenConfig } from "../config.js";
+import { type PatchWardenConfig } from "../../config.js";
 export interface SyncFileResult {
     source_path: string;
     target_path: string;

package/dist/tools/workspace/syncFile.js

@@ -0,0 +1,134 @@
+import { readFileSync, existsSync, mkdirSync, statSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { dirname } from "node:path";
+import { PatchWardenError } from "../../errors.js";
+import { getConfig } from "../../config.js";
+import { guardDirectReadPath, guardDirectFileSize, guardDirectSessionActive, guardDirectWritePath, } from "../../direct/directGuards.js";
+import { appendDirectSessionOperation, readDirectSession, withDirectSessionMutationLock, } from "../../direct/directSessionStore.js";
+import { computeFileSha256 } from "../../direct/directPatch.js";
+import { atomicWriteFileSync } from "../../utils/atomicFile.js";
+import { redactSensitiveContent } from "../../security/contentRedaction.js";
+/**
+ * Copy a file from source to target within the same session repo.
+ * Both source and target must be inside the session's repo_path.
+ */
+export function syncFile(sessionId, sourcePath, targetPath, options, config) {
+    const cfg = config || getConfig();
+    return withDirectSessionMutationLock(sessionId, () => {
+        const session = readDirectSession(sessionId, cfg);
+        guardDirectSessionActive(session);
+        const repoPath = session.resolved_repo_path;
+        const workspaceRoot = cfg.workspaceRoot;
+        // Guard source path — must be inside repo and not internal/sensitive/binary.
+        const resolvedSource = guardDirectReadPath(sourcePath, repoPath, workspaceRoot);
+        if (!existsSync(resolvedSource)) {
+            throw new PatchWardenError("source_file_not_found", `Source file does not exist: "${sourcePath}".`, "Ensure the source path is correct.", true, { source_path: sourcePath });
+        }
+        // Guard target path — must be inside repo, not in blocked dirs
+        const resolvedTarget = guardDirectWritePath(targetPath, repoPath, workspaceRoot);
+        const sourceMetadata = statSync(resolvedSource);
+        if (!sourceMetadata.isFile()) {
+            throw new PatchWardenError("direct_source_not_file", `Source path is not a regular file: "${sourcePath}".`, "Choose an existing text file inside the Direct session repository.", true, { source_path: sourcePath });
+        }
+        guardDirectFileSize(sourceMetadata.size, cfg);
+        // Read once, then hash the exact bytes that will be copied.
+        const sourceContent = readFileSync(resolvedSource);
+        guardDirectFileSize(sourceContent.length, cfg);
+        const sourceText = sourceContent.toString("utf-8");
+        if (!Buffer.from(sourceText, "utf-8").equals(sourceContent)) {
+            throw new PatchWardenError("unsupported_text_encoding", `Source file "${sourcePath}" is not valid UTF-8 text.`, "Use a normal task or convert the file to UTF-8 before Direct sync.", true, { source_path: sourcePath });
+        }
+        const sensitive = redactSensitiveContent(sourceText);
+        if (sensitive.redacted) {
+            throw new PatchWardenError("sensitive_content_blocked", `Source file contains credential-like content (${sensitive.redaction_categories.join(", ")}).`, "Remove the sensitive value and retry with placeholders or environment-variable references.", true, { source_path: sourcePath, redaction_categories: sensitive.redaction_categories });
+        }
+        const sourceSha256 = createHash("sha256").update(sourceContent).digest("hex");
+        if (options?.expected_source_sha256 && options.expected_source_sha256 !== sourceSha256) {
+            throw new PatchWardenError("source_hash_mismatch", `Source file hash mismatch. Expected "${options.expected_source_sha256}" but got "${sourceSha256}".`, "Re-read the source file to get the current sha256.", true, { expected_sha256: options.expected_source_sha256, actual_sha256: sourceSha256 });
+        }
+        // Get target sha256 before copy
+        let beforeTargetSha256 = null;
+        if (existsSync(resolvedTarget)) {
+            const targetMetadata = statSync(resolvedTarget);
+            if (!targetMetadata.isFile()) {
+                throw new PatchWardenError("direct_target_not_file", `Target path is not a regular file: "${targetPath}".`, "Choose a text-file target inside the Direct session repository.", true, { target_path: targetPath });
+            }
+            guardDirectFileSize(targetMetadata.size, cfg);
+            beforeTargetSha256 = computeFileSha256(resolvedTarget);
+            // Verify target sha256 if provided
+            if (options?.expected_target_sha256 && options.expected_target_sha256 !== beforeTargetSha256) {
+                throw new PatchWardenError("target_hash_mismatch", `Target file hash mismatch. Expected "${options.expected_target_sha256}" but got "${beforeTargetSha256}".`, "Re-read the target file to get the current sha256.", true, { expected_sha256: options.expected_target_sha256, actual_sha256: beforeTargetSha256 });
+            }
+        }
+        const copiedBytes = sourceContent.length;
+        if (beforeTargetSha256 === sourceSha256) {
+            assertSourceUnchanged(sourcePath, resolvedSource, sourceSha256, repoPath, workspaceRoot);
+            appendSyncOperation(sessionId, sourcePath, targetPath, beforeTargetSha256, sourceSha256, 0, 0, cfg);
+            return buildSyncResult(sourcePath, targetPath, beforeTargetSha256, sourceSha256, copiedBytes, false);
+        }
+        // Create target directory if needed
+        mkdirSync(dirname(resolvedTarget), { recursive: true });
+        // Re-resolve after directory creation so a newly exposed link/reparse point
+        // cannot reuse the earlier lexical decision. Replace atomically in the
+        // validated target directory and preserve an existing file's permissions.
+        const revalidatedTarget = guardDirectWritePath(resolvedTarget, repoPath, workspaceRoot);
+        const currentTargetSha256 = existsSync(revalidatedTarget)
+            ? computeFileSha256(revalidatedTarget)
+            : null;
+        if (currentTargetSha256 !== beforeTargetSha256) {
+            throw new PatchWardenError("direct_target_changed_during_sync", `Target file "${targetPath}" changed while sync_file was preparing the copy.`, "Re-read the target file and retry after concurrent filesystem changes stop.", true, {
+                path: targetPath,
+                before_sha256: beforeTargetSha256,
+                current_sha256: currentTargetSha256,
+            });
+        }
+        assertSourceUnchanged(sourcePath, resolvedSource, sourceSha256, repoPath, workspaceRoot);
+        const existingMode = existsSync(revalidatedTarget) ? statSync(revalidatedTarget).mode : undefined;
+        atomicWriteFileSync(revalidatedTarget, sourceContent, { mode: existingMode });
+        const finalTarget = guardDirectWritePath(revalidatedTarget, repoPath, workspaceRoot);
+        if (finalTarget !== revalidatedTarget) {
+            throw new PatchWardenError("direct_path_changed_during_write", `Target path "${targetPath}" changed while sync_file was writing it.`, "Inspect the repository path and retry only after concurrent filesystem changes stop.", true, { path: targetPath, operation: "sync_file" });
+        }
+        // Compute after hash
+        const afterTargetSha256 = computeFileSha256(finalTarget);
+        const changed = beforeTargetSha256 !== afterTargetSha256;
+        appendSyncOperation(sessionId, sourcePath, targetPath, beforeTargetSha256, afterTargetSha256, 1, copiedBytes, cfg);
+        return buildSyncResult(sourcePath, targetPath, beforeTargetSha256, afterTargetSha256, copiedBytes, changed);
+    }, cfg);
+}
+function assertSourceUnchanged(sourcePath, resolvedSource, expectedSha256, repoPath, workspaceRoot) {
+    const currentPath = guardDirectReadPath(sourcePath, repoPath, workspaceRoot);
+    const samePath = process.platform === "win32"
+        ? currentPath.toLowerCase() === resolvedSource.toLowerCase()
+        : currentPath === resolvedSource;
+    const currentSha256 = samePath && existsSync(currentPath)
+        ? computeFileSha256(currentPath)
+        : null;
+    if (!samePath || currentSha256 !== expectedSha256) {
+        throw new PatchWardenError("direct_source_changed_during_sync", `Source file "${sourcePath}" changed while sync_file was preparing the copy.`, "Re-read the source file and retry after concurrent filesystem changes stop.", true, { source_path: sourcePath, expected_sha256: expectedSha256, actual_sha256: currentSha256 });
+    }
+}
+function appendSyncOperation(sessionId, sourcePath, targetPath, beforeSha256, afterSha256, operationsApplied, bytesChanged, config) {
+    appendDirectSessionOperation(sessionId, {
+        index: 0,
+        timestamp: new Date().toISOString(),
+        path: targetPath,
+        source_path: sourcePath,
+        operation_type: "sync",
+        before_sha256: beforeSha256,
+        after_sha256: afterSha256,
+        operations_applied: operationsApplied,
+        bytes_changed: bytesChanged,
+    }, config);
+}
+function buildSyncResult(sourcePath, targetPath, beforeSha256, afterSha256, copiedBytes, changed) {
+    return {
+        source_path: sourcePath,
+        target_path: targetPath,
+        before_target_sha256: beforeSha256,
+        after_target_sha256: afterSha256,
+        source_sha256: afterSha256,
+        copied_bytes: copiedBytes,
+        changed,
+    };
+}

package/dist/utils/atomicFile.d.ts

@@ -0,0 +1,7 @@
+export interface AtomicWriteOptions {
+    encoding?: BufferEncoding;
+    mode?: number;
+}
+/** Replace a file from a complete same-directory temporary file. */
+export declare function atomicWriteFileSync(path: string, content: string | NodeJS.ArrayBufferView, options?: AtomicWriteOptions): void;
+export declare function atomicWriteJsonFileSync(path: string, value: unknown, mode?: number): void;

package/dist/utils/atomicFile.js

@@ -0,0 +1,67 @@
+import { randomBytes } from "node:crypto";
+import { closeSync, fsyncSync, openSync, renameSync, rmSync, writeFileSync } from "node:fs";
+const transientWindowsRenameErrors = new Set(["EACCES", "EBUSY", "EPERM"]);
+const renameRetryDeadlineMs = 1_000;
+const renameRetryDelayMs = 10;
+const waitArray = new Int32Array(new SharedArrayBuffer(4));
+/** Replace a file from a complete same-directory temporary file. */
+export function atomicWriteFileSync(path, content, options = {}) {
+    const temporaryPath = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+    try {
+        writeFileSync(temporaryPath, content, {
+            encoding: options.encoding ?? "utf-8",
+            flag: "wx",
+            ...(options.mode === undefined ? {} : { mode: options.mode }),
+        });
+        const descriptor = openSync(temporaryPath, "r");
+        try {
+            try {
+                fsyncSync(descriptor);
+            }
+            catch (error) {
+                const code = error && typeof error === "object" && "code" in error
+                    ? String(error.code || "")
+                    : "";
+                // Some Windows filesystems and restricted runtimes reject fsync even
+                // after a successful complete write. Keep the same-directory atomic
+                // rename guarantee there; unexpected I/O errors still fail closed.
+                if (!new Set(["EPERM", "EINVAL", "ENOSYS", "ENOTSUP"]).has(code))
+                    throw error;
+            }
+        }
+        finally {
+            closeSync(descriptor);
+        }
+        replaceFileSync(temporaryPath, path);
+    }
+    catch (error) {
+        try {
+            rmSync(temporaryPath, { force: true });
+        }
+        catch { /* best effort */ }
+        throw error;
+    }
+}
+function replaceFileSync(temporaryPath, path) {
+    const deadline = Date.now() + renameRetryDeadlineMs;
+    while (true) {
+        try {
+            renameSync(temporaryPath, path);
+            return;
+        }
+        catch (error) {
+            const code = error && typeof error === "object" && "code" in error
+                ? String(error.code || "")
+                : "";
+            if (process.platform !== "win32" ||
+                !transientWindowsRenameErrors.has(code) ||
+                Date.now() >= deadline) {
+                throw error;
+            }
+            Atomics.wait(waitArray, 0, 0, renameRetryDelayMs);
+        }
+    }
+}
+export function atomicWriteJsonFileSync(path, value, mode = 0o600) {
+    atomicWriteFileSync(path, `${JSON.stringify(value, null, 2)}\n`, { mode });
+}

package/dist/utils/boundedFile.d.ts

@@ -0,0 +1,8 @@
+export interface BoundedTextRead {
+    content: string;
+    totalBytes: number;
+    truncated: boolean;
+}
+export declare function readTextFilePrefixSync(path: string, maxBytes: number): BoundedTextRead;
+export declare function readTextFileTailLinesSync(path: string, lines: number, maxBytes?: number): string;
+export declare function appendBoundedTextFileSync(path: string, content: string, maxBytes?: number): void;

package/dist/utils/boundedFile.js

@@ -0,0 +1,93 @@
+import { appendFileSync, closeSync, existsSync, fstatSync, openSync, readSync, statSync, } from "node:fs";
+import { atomicWriteFileSync } from "./atomicFile.js";
+import { withFileLockSync } from "./lockedJsonFile.js";
+const TRUNCATION_MARKER = Buffer.from("[earlier content truncated]\n", "utf-8");
+export function readTextFilePrefixSync(path, maxBytes) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+        throw new Error("maxBytes must be a positive integer");
+    }
+    const descriptor = openSync(path, "r");
+    try {
+        const totalBytes = fstatSync(descriptor).size;
+        const length = Math.min(totalBytes, maxBytes);
+        const buffer = Buffer.alloc(length);
+        let offset = 0;
+        while (offset < length) {
+            const bytesRead = readSync(descriptor, buffer, offset, length - offset, offset);
+            if (bytesRead === 0)
+                break;
+            offset += bytesRead;
+        }
+        let content = buffer.subarray(0, offset).toString("utf-8");
+        if (totalBytes > offset && content.endsWith("\uFFFD"))
+            content = content.slice(0, -1);
+        return { content, totalBytes, truncated: totalBytes > offset };
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}
+export function readTextFileTailLinesSync(path, lines, maxBytes = 1024 * 1024) {
+    if (!existsSync(path))
+        return "";
+    const boundedLines = Number.isFinite(lines)
+        ? Math.max(1, Math.min(1000, Math.trunc(lines)))
+        : 100;
+    const suffix = readFileSuffix(path, maxBytes);
+    let text = suffix.content.toString("utf-8");
+    if (suffix.truncated) {
+        const firstNewline = text.indexOf("\n");
+        if (firstNewline >= 0)
+            text = text.slice(firstNewline + 1);
+    }
+    const allLines = text.split(/\r?\n/);
+    if (allLines.at(-1) === "")
+        allLines.pop();
+    return allLines.slice(-boundedLines).join("\n");
+}
+export function appendBoundedTextFileSync(path, content, maxBytes = 2 * 1024 * 1024) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes <= TRUNCATION_MARKER.length) {
+        throw new Error("maxBytes must exceed the truncation marker size");
+    }
+    withFileLockSync(path, () => {
+        const incoming = Buffer.from(content, "utf-8");
+        const existingSize = existsSync(path) ? statSync(path).size : 0;
+        if (existingSize + incoming.length <= maxBytes) {
+            appendFileSync(path, incoming, { mode: 0o600 });
+            return;
+        }
+        const incomingSuffix = incoming.subarray(Math.max(0, incoming.length - maxBytes + TRUNCATION_MARKER.length));
+        const existingBudget = Math.max(0, maxBytes - TRUNCATION_MARKER.length - incomingSuffix.length);
+        const existingSuffix = existingBudget > 0 && existingSize > 0
+            ? readFileSuffix(path, existingBudget).content
+            : Buffer.alloc(0);
+        const output = Buffer.concat([TRUNCATION_MARKER, existingSuffix, incomingSuffix]);
+        const mode = existsSync(path) ? statSync(path).mode : 0o600;
+        atomicWriteFileSync(path, output, { mode });
+    });
+}
+function readFileSuffix(path, maxBytes) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+        throw new Error("maxBytes must be a positive integer");
+    }
+    const descriptor = openSync(path, "r");
+    try {
+        const size = fstatSync(descriptor).size;
+        const length = Math.min(size, maxBytes);
+        const buffer = Buffer.alloc(length);
+        let offset = 0;
+        while (offset < length) {
+            const bytesRead = readSync(descriptor, buffer, offset, length - offset, size - length + offset);
+            if (bytesRead === 0)
+                break;
+            offset += bytesRead;
+        }
+        return {
+            content: offset === length ? buffer : buffer.subarray(0, offset),
+            truncated: size > length,
+        };
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}

package/dist/utils/lockedJsonFile.d.ts

@@ -0,0 +1,15 @@
+export interface LockedJsonMutation<T extends object, R> {
+    next?: T;
+    result: R;
+}
+export interface LockedJsonOptions {
+    waitMs?: number;
+    corruptLockStaleMs?: number;
+    busyError?: () => Error;
+}
+export declare function readJsonObjectFileSync<T extends object>(path: string): T;
+export declare function mutateLockedJsonFileSync<T extends object, R>(path: string, mutation: (current: T) => LockedJsonMutation<T, R>, options?: LockedJsonOptions): R;
+/** Serialize an arbitrary same-file read/modify/write sequence across processes. */
+export declare function withFileLockSync<R>(path: string, action: () => R, options?: LockedJsonOptions): R;
+/** Hold the same cross-process lock for the lifetime of an async operation. */
+export declare function withFileLock<R>(path: string, action: () => Promise<R>, options?: LockedJsonOptions): Promise<R>;