pi-daddy 0.28.0 → 0.32.0

package/dist/workspace-lease.js

@@ -1,333 +0,0 @@
-import { createHash, randomUUID } from "node:crypto";
-import { atomicMetadata, leasePaths, readMetadata, } from "./lease-record.js";
-import { once } from "node:events";
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { GovernanceRefusal, refusal } from "./refusals.js";
-import { assertCloseBounds, HELPER_SOURCE, LEASE_READY, unrefStream } from "./lease-helper.js";
-export const ENV_WORKSPACE_LEASE_DIR = "PI_GRANTS_WORKSPACE_LEASE_DIR";
-export function defaultWorkspaceLeaseDir(env = process.env) {
-    const agentDir = env.PI_CODING_AGENT_DIR ?? join(homedir(), ".pi", "agent");
-    return env[ENV_WORKSPACE_LEASE_DIR] ?? join(agentDir, "pi-daddy", "workspace-leases");
-}
-/**
- * The ledger outcome for a release. Exported because call sites had their own copies and the check runner's
- * asserted `released` unconditionally — reproducing in the evidence path the exact defect this union was
- * added to expose (R-100/R-103).
- *
- * **It is NOT the only definition, and saying so here was wrong.** `extensions/workspace-runtime.ts` keeps a
- * private copy with no `not-held` arm, and it is the one the whole delegation path uses — so releasing a
- * *read* lease on a delegated child is still recorded `released`, a handover the kernel never performed.
- * Measured; open as R-141; the sentence claiming a single definition survived two review passes because
- * `test/workspace.test.ts` pins the `not-held` arm on THIS function, which no delegation path calls.
- */
-export function leaseReleaseLedgerOutcome(outcome, reason) {
-    if (outcome === "retained")
-        return "retained";
-    if (outcome === "lost")
-        return "lost";
-    if (outcome === "released-unrecorded")
-        return "released-unrecorded";
-    if (outcome === "not-held")
-        return "uncontended";
-    // `released-superseded` is a clean handover as far as the ledger is concerned: the lock went back and the
-    // record is correct — it just belongs to somebody else now.
-    return reason === "timeout" ? "timeout" : "released";
-}
-/**
- * `acquired` must mean the kernel actually excluded somebody. A read lease takes no lock (R-105), and an
- * unreadable predecessor record is not proof of a crash (R-100) — so neither may be reported as one.
- */
-export function leaseAcquisitionOutcome(access, recovered) {
-    if (access === "read")
-        return "uncontended";
-    return recovered === true ? "recovered" : "acquired";
-}
-export async function acquireWorkspaceLease(input) {
-    // Before the read-lease return, so both paths are validated (R-152).
-    assertCloseBounds(input);
-    if (input.access === "read") {
-        return {
-            workspace: input.workspace,
-            access: "read",
-            ownerId: input.ownerId,
-            recovered: false,
-            attachProcess: () => { },
-            attachHerdrTab: () => { },
-            // A read lease took no kernel lock, so there is nothing to keep: `not-held` is the same answer
-            // `release()` gives, and it is the truth rather than a retention that never happened (R-152).
-            markRetained: async () => "not-held",
-            readCloseFailure: async () => null,
-            lost: new Promise(() => { }),
-            // No kernel lock was ever taken, so there is no handover to claim (R-105, release side).
-            release: async () => "not-held",
-        };
-    }
-    if (input.signal?.aborted) {
-        throw new GovernanceRefusal(refusal("WORKSPACE_WRITE_CONFLICT", `writer lease for ${input.workspace.workspaceId} was cancelled before acquisition`));
-    }
-    await mkdir(input.leaseDir, { recursive: true, mode: 0o700 });
-    const paths = leasePaths(input.leaseDir, input.workspace.root);
-    const { spawn } = await import("node:child_process");
-    const holder = spawn(input.flockCommand ?? "flock", [
-        "--exclusive", "--nonblock", "--conflict-exit-code", "73", paths.lock,
-        process.execPath, "--input-type=module", "-e", HELPER_SOURCE,
-    ], {
-        stdio: ["pipe", "pipe", "pipe"],
-        env: {
-            ...process.env,
-            PI_DADDY_LEASE_MARKER: paths.marker,
-            PI_DADDY_LEASE_CLOSE_ATTEMPTS: String(input.herdrCloseAttempts ?? 10),
-            PI_DADDY_LEASE_CLOSE_TIMEOUT_MS: String(input.herdrCloseTimeoutMs ?? 15_000),
-        },
-        // Own process group, for two reasons. It lets teardown kill `flock` AND the helper holding the lock
-        // file descriptor as one unit even before the helper has reported its pid (R-99), and it stops a
-        // stray group signal — a terminal Ctrl-C, a closed window — from releasing a live writer's lock as
-        // a side effect.
-        detached: true,
-    });
-    const timeoutMs = input.acquisitionTimeoutMs ?? 2000;
-    let ready = false;
-    let helperPid;
-    let stderr = "";
-    /**
-     * Kill the whole holder GROUP — one signal, no ordering. (The pid-by-pid fallback below is the
-     * only path that kills in sequence, and only when the group is already reaped.) `flock` does not pass `--close`, so the helper inherits
-     * the lock file descriptor and holds the lock in its own right — killing only `flock` leaves the
-     * lock HELD by an orphan, and every later acquisition then reports WORKSPACE_WRITE_CONFLICT, which
-     * is the one message an operator would use to conclude another agent is writing. Measured in
-     * `docs/probes/g35-flock-fd-inheritance` (R-99).
-     */
-    const hardKill = () => {
-        // The GROUP, so this works on the readiness-timeout path too — there `helperPid` is usually still
-        // unknown, and killing only the wrapper leaves a half-booted helper free to inherit the lock file
-        // descriptor and hold it forever. Fall back to individual pids if the group is already reaped.
-        if (holder.pid !== undefined) {
-            try {
-                process.kill(-holder.pid, "SIGKILL");
-                return;
-            }
-            catch { /* group gone */ }
-        }
-        if (Number.isInteger(helperPid)) {
-            try {
-                process.kill(helperPid, "SIGKILL");
-            }
-            catch { /* already gone */ }
-        }
-        holder.kill("SIGKILL");
-    };
-    holder.stderr?.on("data", (chunk) => { stderr += String(chunk); });
-    try {
-        await new Promise((resolveReady, rejectReady) => {
-            const timer = setTimeout(() => rejectReady(new GovernanceRefusal(refusal("WORKSPACE_LEASE_STALE", `writer lease helper did not become ready within ${timeoutMs}ms`))), timeoutMs);
-            const cleanup = () => {
-                clearTimeout(timer);
-                input.signal?.removeEventListener("abort", onAbort);
-            };
-            const onAbort = () => rejectReady(new GovernanceRefusal(refusal("WORKSPACE_WRITE_CONFLICT", `writer lease for ${input.workspace.workspaceId} was cancelled before acquisition`)));
-            input.signal?.addEventListener("abort", onAbort, { once: true });
-            holder.once("error", (error) => {
-                cleanup();
-                rejectReady(new GovernanceRefusal(refusal("WORKSPACE_LEASE_STALE", `workspace writer leases require a working flock command (${String(error)})`)));
-            });
-            holder.once("close", (code) => {
-                if (ready)
-                    return;
-                cleanup();
-                const codeName = code === 73 ? "WORKSPACE_WRITE_CONFLICT" : "WORKSPACE_LEASE_STALE";
-                rejectReady(new GovernanceRefusal(refusal(codeName, code === 73
-                    ? `workspace ${input.workspace.workspaceId} already has an active pi-daddy-governed writer`
-                    : `workspace lease helper exited before acquisition${stderr ? ` (${stderr.trim()})` : ""}`, { workspace_id: input.workspace.workspaceId, root: input.workspace.root })));
-            });
-            holder.stdout?.on("data", (chunk) => {
-                const output = String(chunk);
-                if (!output.includes(LEASE_READY) || ready)
-                    return;
-                helperPid = Number(output.match(new RegExp(`${LEASE_READY}:(\\d+)`))?.[1]);
-                ready = true;
-                cleanup();
-                resolveReady();
-            });
-        });
-    }
-    catch (error) {
-        hardKill();
-        throw error;
-    }
-    const previous = await readMetadata(paths.metadata);
-    // "malformed" is not "no prior owner": an unreadable record cannot prove a clean handover (R-100).
-    const recovered = previous === "malformed" ? "unknown" : previous?.state === "active";
-    const token = randomUUID();
-    const metadata = {
-        version: 1,
-        state: "active",
-        token,
-        owner_id: input.ownerId,
-        workspace_id: input.workspace.workspaceId,
-        root: input.workspace.root,
-        pid: Number.isInteger(helperPid) ? helperPid : (holder.pid ?? process.pid),
-        acquired_at: new Date().toISOString(),
-    };
-    try {
-        await atomicMetadata(paths.metadata, metadata);
-    }
-    catch (error) {
-        holder.stdin?.end();
-        throw new GovernanceRefusal(refusal("WORKSPACE_LEASE_STALE", `acquired the kernel writer lock but could not record its owner (${String(error)})`, { workspace_id: input.workspace.workspaceId, root: input.workspace.root }));
-    }
-    // TWO variables, deliberately. `releasing` goes up the instant release begins, because the handshake
-    // below closes the helper on purpose — and if `lost` could still fire during it, an intentional release
-    // would report itself as a lost lease. `settled` memoizes the ANSWER, so a second call cannot invent a
-    // clean handover. Collapsing these into one flag set at the end broke every check-runner test.
-    let releasing = false;
-    let settled;
-    let lose;
-    const lost = new Promise((resolveLost) => { lose = resolveLost; });
-    const lostError = () => new Error(`workspace writer lease helper exited for ${input.workspace.workspaceId}`);
-    holder.once("close", () => { if (!releasing)
-        lose(lostError()); });
-    if (holder.exitCode !== null || holder.signalCode !== null)
-        queueMicrotask(() => lose(lostError()));
-    const attach = (value) => {
-        if (releasing || holder.exitCode !== null || holder.signalCode !== null || !holder.stdin?.writable) {
-            throw new GovernanceRefusal(refusal("WORKSPACE_LEASE_STALE", `writer lease for ${input.workspace.workspaceId} was lost before child attachment`));
-        }
-        holder.stdin.write(`${JSON.stringify(value)}\n`);
-    };
-    return {
-        workspace: input.workspace,
-        access: "write",
-        ownerId: input.ownerId,
-        recovered,
-        attachProcess(pid) { attach({ process_pid: pid }); },
-        attachHerdrTab(tabId) { attach({ herdr_tab: tabId }); },
-        lost,
-        async markRetained(reason = "retained") {
-            // Deliberately does NOT touch the kernel lock or the helper: the pane may still be live. It only
-            // stops the record from looking like a crash.
-            //
-            // **Both guards below exist because the CALLER ledgers whatever this returns (R-152).**
-            //
-            // Already settled: `release()` checked `settled` and this did not, so a completed handover could be
-            // rewritten into `retained:…` and the memoized answer flipped with it — the mirror of the defect R-146
-            // fixed, reachable by the `try { … } finally { await lease.release() }` shape this API invites.
-            if (settled)
-                return settled;
-            // Already dead: the helper is gone and the kernel lock with it, so the fact is `lost`. Recording a
-            // retention here tells an operator a pane may still be live and tells the next owner nothing crashed —
-            // precisely the two facts R-103's outcome union was added to keep apart.
-            if (holder.exitCode !== null || holder.signalCode !== null)
-                return (settled = "lost");
-            const current = await readMetadata(paths.metadata);
-            let recorded = false;
-            if (current !== "malformed" && current?.token === token) {
-                recorded = await atomicMetadata(paths.metadata, {
-                    ...metadata, state: "released", released_at: new Date().toISOString(), release_reason: `retained:${reason}`,
-                }).then(() => true, () => false);
-            }
-            /**
-             * **It must, however, let THIS process exit (R-146).** Leaving the helper alone is the decision;
-             * leaving the parent's three pipes and the child handle referenced was an accident, and it meant a
-             * retained lease wedged its own process forever — measured `exit=124` against `exit=0` for the same
-             * sequence ending in `release()`.
-             *
-             * **Which hosts it actually wedged, corrected after review.** `process.exit()` runs `exit` handlers and
-             * ignores pending handles, so this only bites a host that lets the loop drain: pi's **print** mode sets
-             * `process.exitCode` and returns (`dist/main.js`), and a library consumer — an ADR-0034 external
-             * controller calling this package directly — does the same. pi's interactive and rpc modes call
-             * `process.exit()` explicitly (`dist/modes/interactive/interactive-mode.js:3148`), so there the process
-             * still leaves and `pane-reaper`'s `process.once("exit")` sweep still runs. An earlier version of this
-             * comment claimed the sweep was lost generally and cited `src/cli.ts`, which has one subcommand
-             * (`init`) and can neither hold a lease nor open a pane.
-             *
-             * Unref rather than close, because the lock must outlive this call: when the parent does exit, the
-             * helper sees EOF and runs the path it was written for — bounded `herdr tab close` attempts, a marker
-             * file, then release anyway (R-102: an unreleasable lock strands a worktree with no in-product
-             * recovery, which is strictly worse than a recorded failure to close). Narrowed to this path on
-             * purpose: at spawn it would remove the accidental guarantee that a process cannot exit while a lease
-             * is still ACTIVE, which is a different decision and not this fix.
-             */
-            /**
-             * **Terminal (R-146).** `releasing` stops a late `holder.close` being reported as a lost lease, and
-             * `settled` stops a later `release()` running the clean handshake — which it did: measured, it returned
-             * `released`, overwrote `retained:herdr-close-failed` with `completed`, and sent `{release:true}` so the
-             * helper exited `clean` and never attempted the close. The pane retention exists to protect was
-             * abandoned silently, and the ledger asserted a clean handover for a lease kept *because* a pane would
-             * not close. No in-tree caller does this — but `WorkspaceLease` is a public export and
-             * `try { … } finally { await lease.release() }` is the obvious shape for the external controllers this
-             * whole fix is for.
-             */
-            releasing = true;
-            // **Settle only if the record was actually written.** An unwritable lease directory used to leave the
-            // record `state: "active"` while the ledger said `retained`, so the next owner reported a phantom
-            // `recovered: true` — and making retention terminal removed the later `release()` that would still have
-            // written the handover. Unsettled, that repair is available again; the residue is stated in R-152
-            // rather than implied, because nothing here can write a record to a directory that refuses writes.
-            if (recorded)
-                settled = "retained";
-            holder.unref();
-            unrefStream(holder.stdout);
-            unrefStream(holder.stderr);
-            return "retained";
-        },
-        async readCloseFailure() {
-            try {
-                return JSON.parse(await readFile(paths.marker, "utf8"));
-            }
-            catch {
-                return null;
-            }
-        },
-        async release(reason = "completed") {
-            // Memoized, not a boolean. A second call used to answer "released" whatever the first returned, so a
-            // retry — or a `finally` after an explicit release — read a clean handover that never happened.
-            if (settled)
-                return settled;
-            releasing = true;
-            // Already gone: this owner never released anything, and saying so is the caller's business to
-            // record. Throwing here discarded completed work and masked the real error (R-99).
-            if (holder.exitCode !== null || holder.signalCode !== null)
-                return (settled = "lost");
-            // Default FALSE: "recorded" must mean this owner actually wrote its own handover. Anything else —
-            // an unreadable record, or a successor's token in place of ours — means the lock goes back but the
-            // record does not say so, and the NEXT owner will report a recovery that never happened unless the
-            // caller ledgers it (R-100). Only the current token may mark the handover, so a stale lease object
-            // can never overwrite a live successor.
-            // Three outcomes, because they call for three different responses: we wrote our handover; a
-            // successor already owns the record and we correctly left it alone; or the record is unreadable or
-            // unwritable and somebody has to be told.
-            let how = "released-unrecorded";
-            const current = await readMetadata(paths.metadata);
-            if (current !== "malformed" && current?.token === token) {
-                try {
-                    await atomicMetadata(paths.metadata, {
-                        ...metadata,
-                        state: "released",
-                        released_at: new Date().toISOString(),
-                        release_reason: reason,
-                    });
-                    how = "released";
-                }
-                catch {
-                    how = "released-unrecorded";
-                }
-            }
-            else if (current !== "malformed" && current !== null) {
-                // A live successor's record. Declining to overwrite it is the token guard working, not a fault.
-                how = "released-superseded";
-            }
-            holder.stdin?.write(`${JSON.stringify({ release: true })}\n`);
-            holder.stdin?.end();
-            if (holder.exitCode === null && holder.signalCode === null) {
-                await Promise.race([once(holder, "close"), new Promise((resolveWait) => setTimeout(resolveWait, 1000))]);
-            }
-            // The helper holds the lock fd in its own right, so the wrapper alone is not enough (R-99).
-            if (holder.exitCode === null && holder.signalCode === null)
-                hardKill();
-            return (settled = how);
-        },
-    };
-}
-//# sourceMappingURL=workspace-lease.js.map

package/dist/workspace-lease.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"workspace-lease.js","sourceRoot":"","sources":["../src/workspace-lease.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,cAAc,EACd,UAAU,EACV,YAAY,GAIb,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAE3D,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE/F,MAAM,CAAC,MAAM,uBAAuB,GAAG,+BAA+B,CAAC;AAEvE,MAAM,UAAU,wBAAwB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC3E,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5E,OAAO,GAAG,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC;AACxF,CAAC;AAGD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAyC,EACzC,MAAc;IAEd,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IAC9C,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACtC,IAAI,OAAO,KAAK,qBAAqB;QAAE,OAAO,qBAAqB,CAAC;IACpE,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,aAAa,CAAC;IACjD,0GAA0G;IAC1G,4DAA4D;IAC5D,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAwB,EACxB,SAA8B;IAE9B,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC;IAC5C,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAgB3C;IACC,qEAAqE;IACrE,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK;YAChB,aAAa,EAAE,GAAG,EAAE,GAAE,CAAC;YACvB,cAAc,EAAE,GAAG,EAAE,GAAE,CAAC;YACxB,+FAA+F;YAC/F,8FAA8F;YAC9F,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,UAAmB;YAC7C,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;YAClC,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;YAC3B,yFAAyF;YACzF,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,UAAU;SAChC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC1B,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,0BAA0B,EAAE,oBAAoB,KAAK,CAAC,SAAS,CAAC,WAAW,mCAAmC,CAAC,CAAC,CAAC;IACvJ,CAAC;IAED,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,IAAI,OAAO,EAAE;QAClD,aAAa,EAAE,YAAY,EAAE,sBAAsB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;QACrE,OAAO,CAAC,QAAQ,EAAE,qBAAqB,EAAE,IAAI,EAAE,aAAa;KAC7D,EAAE;QACD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAC/B,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,qBAAqB,EAAE,KAAK,CAAC,MAAM;YACnC,6BAA6B,EAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;YACrE,+BAA+B,EAAE,MAAM,CAAC,KAAK,CAAC,mBAAmB,IAAI,MAAM,CAAC;SAC7E;QACD,oGAAoG;QACpG,iGAAiG;QACjG,mGAAmG;QACnG,iBAAiB;QACjB,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,KAAK,CAAC,oBAAoB,IAAI,IAAI,CAAC;IACrD,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,SAA6B,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB;;;;;;;OAOG;IACH,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,kGAAkG;QAClG,kGAAkG;QAClG,+FAA+F;QAC/F,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,SAAU,EAAE,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC,CAAC;IACF,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE;YACpD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,iBAAiB,CAAC,OAAO,CACtE,uBAAuB,EAAE,mDAAmD,SAAS,IAAI,CAC1F,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAChB,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACtD,CAAC,CAAC;YACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAC7D,0BAA0B,EAAE,oBAAoB,KAAK,CAAC,SAAS,CAAC,WAAW,mCAAmC,CAC/G,CAAC,CAAC,CAAC;YACJ,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC7B,OAAO,EAAE,CAAC;gBACV,WAAW,CAAC,IAAI,iBAAiB,CAAC,OAAO,CACvC,uBAAuB,EAAE,4DAA4D,MAAM,CAAC,KAAK,CAAC,GAAG,CACtG,CAAC,CAAC,CAAC;YACN,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC5B,IAAI,KAAK;oBAAE,OAAO;gBAClB,OAAO,EAAE,CAAC;gBACV,MAAM,QAAQ,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,uBAAuB,CAAC;gBACpF,WAAW,CAAC,IAAI,iBAAiB,CAAC,OAAO,CACvC,QAAQ,EACR,IAAI,KAAK,EAAE;oBACT,CAAC,CAAC,aAAa,KAAK,CAAC,SAAS,CAAC,WAAW,iDAAiD;oBAC3F,CAAC,CAAC,mDAAmD,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAC5F,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAC1E,CAAC,CAAC,CAAC;YACN,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBAClC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK;oBAAE,OAAO;gBACnD,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3E,KAAK,GAAG,IAAI,CAAC;gBACb,OAAO,EAAE,CAAC;gBACV,YAAY,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,EAAE,CAAC;QACX,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpD,mGAAmG;IACnG,MAAM,SAAS,GAAwB,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,KAAK,QAAQ,CAAC;IAC3G,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAkB;QAC9B,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,QAAQ;QACf,KAAK;QACL,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW;QACzC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI;QAC1B,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QAC3E,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,uBAAuB,EAAE,mEAAmE,MAAM,CAAC,KAAK,CAAC,GAAG,EAC5G,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAC1E,CAAC,CAAC;IACL,CAAC;IAED,qGAAqG;IACrG,wGAAwG;IACxG,uGAAuG;IACvG,+FAA+F;IAC/F,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,OAAwC,CAAC;IAC7C,IAAI,IAA6B,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAQ,CAAC,WAAW,EAAE,EAAE,GAAG,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,4CAA4C,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7G,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;QAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;QAAE,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACpG,MAAM,MAAM,GAAG,CAAC,KAAsD,EAAE,EAAE;QACxE,IAAI,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;YACnG,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,uBAAuB,EAAE,oBAAoB,KAAK,CAAC,SAAS,CAAC,WAAW,mCAAmC,CAC5G,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC,CAAC;IACF,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS;QACT,aAAa,CAAC,GAAG,IAAI,MAAM,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,cAAc,CAAC,KAAK,IAAI,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI;QACJ,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,UAAU;YACpC,iGAAiG;YACjG,8CAA8C;YAC9C,EAAE;YACF,wFAAwF;YACxF,EAAE;YACF,oGAAoG;YACpG,uGAAuG;YACvG,gGAAgG;YAChG,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;YAC5B,mGAAmG;YACnG,uGAAuG;YACvG,yEAAyE;YACzE,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;gBAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC;YACtF,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,EAAE,KAAK,KAAK,KAAK,EAAE,CAAC;gBACxD,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE;oBAC9C,GAAG,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,cAAc,EAAE,YAAY,MAAM,EAAE;iBAC5G,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YACD;;;;;;;;;;;;;;;;;;;;;eAqBG;YACH;;;;;;;;;eASG;YACH,SAAS,GAAG,IAAI,CAAC;YACjB,sGAAsG;YACtG,kGAAkG;YAClG,wGAAwG;YACxG,kGAAkG;YAClG,mGAAmG;YACnG,IAAI,QAAQ;gBAAE,OAAO,GAAG,UAAU,CAAC;YACnC,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,KAAK,CAAC,gBAAgB;YACpB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAA2C,CAAC;YACpG,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,WAAW;YAChC,qGAAqG;YACrG,gGAAgG;YAChG,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;YAC5B,SAAS,GAAG,IAAI,CAAC;YACjB,8FAA8F;YAC9F,mFAAmF;YACnF,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;gBAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC;YAEtF,kGAAkG;YAClG,mGAAmG;YACnG,mGAAmG;YACnG,mGAAmG;YACnG,wCAAwC;YACxC,4FAA4F;YAC5F,mGAAmG;YACnG,0CAA0C;YAC1C,IAAI,GAAG,GAAwB,qBAAqB,CAAC;YACrD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,EAAE,KAAK,KAAK,KAAK,EAAE,CAAC;gBACxD,IAAI,CAAC;oBACH,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE;wBACnC,GAAG,QAAQ;wBACX,KAAK,EAAE,UAAU;wBACjB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACrC,cAAc,EAAE,MAAM;qBACvB,CAAC,CAAC;oBACH,GAAG,GAAG,UAAU,CAAC;gBACnB,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,GAAG,qBAAqB,CAAC;gBAC9B,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACvD,gGAAgG;gBAChG,GAAG,GAAG,qBAAqB,CAAC;YAC9B,CAAC;YAED,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC9D,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;YACpB,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBAC3D,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3G,CAAC;YACD,4FAA4F;YAC5F,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;gBAAE,QAAQ,EAAE,CAAC;YACvE,OAAO,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/workspace.d.ts

@@ -1,57 +0,0 @@
-export declare const ENV_WORKSPACE_REGISTRY = "PI_GRANTS_WORKSPACE_REGISTRY";
-export type WorkspaceAccess = "read" | "write";
-export interface WorkspaceRegistryFile {
-    version: 1;
-    workspaces: Record<string, {
-        path: string;
-    }>;
-    /**
-     * Where this was loaded from, carried so a refusal can NAME it.
-     *
-     * `docs/SPEC.md` claimed an unregistered id is refused "with `WORKSPACE_NOT_REGISTERED`, which names the
-     * file", and `catalog.ts` justified exempting the whole namespace from the unknown check on the strength of
-     * that — *"a second, weaker check here can only turn that precise refusal into a misleading one"*. The
-     * refusal named no file: the registry object had no idea where it came from. Carried on the object rather
-     * than passed per call so a caller cannot forget it. Optional because a hand-built literal (tests,
-     * `workspaceEntries` fixtures) has no source.
-     */
-    source?: string;
-}
-export interface ValidatedWorkspace {
-    workspaceId: string;
-    /** Canonical Git worktree root and the child's validated initial CWD. Not a sandbox. */
-    root: string;
-    gitCommonDir: string;
-}
-export declare function loadWorkspaceRegistry(path: string): Promise<WorkspaceRegistryFile>;
-/**
- * The registered workspace ids, for `planInit` to scaffold and `/grants` to list. `[]` when there is no registry or it is broken.
- *
- * Fails SOFT, and only because nothing here is an authority: this decides which ids appear as COMMENTS in a
- * generated file. `loadWorkspaceRegistry` throws a GovernanceRefusal naming the file, and that refusal is
- * the operator's signal at the point of use, where routing genuinely depends on it. Swallowing it there
- * would be unsafe; swallowing it here costs a suggestion. Same argument as `buildCatalog`'s.
- *
- * Lives here rather than in `init.ts` because it reads the filesystem, and `planInit` — the centrepiece of
- * that module — documents itself as "Pure: no filesystem". It is a registry concern; this is where the
- * registry lives. Moved when `init.ts` crossed the 400-line ceiling, which this project splits for rather
- * than raising (`delegate.ts` at 413, `grants.ts` at 398).
- */
-export declare function registeredWorkspaceIds(registryPath?: string | undefined): Promise<string[]>;
-export declare function resolveWorkspace(registry: WorkspaceRegistryFile, workspaceId: string): Promise<ValidatedWorkspace>;
-/**
- * Canonicalize and validate the initial workspace against Git's registered worktree list.
- * This prevents accidental misrouting. It does not constrain any path a child accesses after spawn.
- */
-export declare function validateRegisteredWorkspace(input: {
-    workspaceId: string;
-    registeredRoot: string;
-    suppliedRoot?: string;
-}): Promise<ValidatedWorkspace>;
-/**
- * The governed-writer lease lives in `./workspace-lease.ts` and is re-exported here so that
- * "the workspace module" remains one import for callers. Split only to stay under the 400-line
- * module ceiling this project enforces mechanically.
- */
-export { ENV_WORKSPACE_LEASE_DIR, acquireWorkspaceLease, defaultWorkspaceLeaseDir, leaseAcquisitionOutcome, leaseReleaseLedgerOutcome, type LeaseReleaseOutcome, type WorkspaceLease, } from "./workspace-lease.ts";
-//# sourceMappingURL=workspace.d.ts.map

package/dist/workspace.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,sBAAsB,iCAAiC,CAAC;AAGrE,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAsBD,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA+IxF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAAC,YAAY,qBAAsC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOlH;AAED,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAaxH;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAyC9B;AAED;;;;GAIG;AACH,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,cAAc,GACpB,MAAM,sBAAsB,CAAC"}

package/dist/workspace.js

@@ -1,216 +0,0 @@
-import { createHash, randomUUID } from "node:crypto";
-import { execFile } from "node:child_process";
-import { once } from "node:events";
-import { mkdir, open, readFile, realpath, rename, stat, writeFile } from "node:fs/promises";
-import { constants } from "node:fs";
-import { homedir } from "node:os";
-import { isAbsolute, join } from "node:path";
-import { promisify } from "node:util";
-import { GovernanceRefusal, refusal } from "./refusals.js";
-import { isSafeWorkspaceId, workspaceCapability } from "./capabilities.js";
-const execFileAsync = promisify(execFile);
-export const ENV_WORKSPACE_REGISTRY = "PI_GRANTS_WORKSPACE_REGISTRY";
-/**
- * How long a registry read may take before it is a refusal rather than a wait.
- *
- * **R-79's defect class, and this reader reintroduced it.** That entry records a probe that hung forever on
- * a FIFO with "no timeout anywhere in the path". This function used a bare `readFile`, which was survivable
- * while it ran only at spawn time — and stopped being survivable when 0.19.0 began reading the registry from
- * `buildCatalog` and `registeredWorkspaceIds`, both awaited inside `session_start`. Measured on `52135ca`:
- * `PI_GRANTS_WORKSPACE_REGISTRY` pointing at a FIFO blocked session start indefinitely, so the session never
- * reached the `holding [...]` line, the executor probe, or any control after it — and `delegate` awaits the
- * same promise, so delegation hung too. A blocking special file, an unresponsive network mount or a hostile
- * `mkfifo` all reach it.
- *
- * Two seconds because this is an operator-authored local JSON file: any legitimate one is a single-digit
- * millisecond read (measured: 8ms), so the bound is three orders of magnitude of headroom and still bounded.
- */
-const REGISTRY_READ_TIMEOUT_MS = 2_000;
-/** A registry is an operator-authored JSON file; anything approaching this is not one. */
-const REGISTRY_MAX_BYTES = 1 << 20;
-export async function loadWorkspaceRegistry(path) {
-    // **One handle, opened non-blocking, and every check made against THAT handle.** Three defects made this
-    // the shape rather than `stat`-then-`readFile`:
-    //
-    //  - `AbortSignal.timeout` cannot rescue a FIFO: a signal is observed between chunks, while a FIFO blocks
-    //    inside `open(2)` before any read begins. `O_NONBLOCK` makes the open itself return instead (measured:
-    //    1ms), which is what actually bounds this path. R-79's defect class, and R-136's.
-    //  - `stat` by name followed by `readFile` by name is a TOCTOU: swapping a regular file for a FIFO between
-    //    the two hung the loader indefinitely, and the attacker is any process at the same uid — precisely the
-    //    actor the mode check below cannot exclude. Measured, 5 of 6 iterations completing in ~1ms and the
-    //    sixth never returning. `fstat` on a held descriptor has no name to re-resolve.
-    //  - a second reader (the ADR-0035 registry pin, since reverted to its own PR) reimplemented the guards and
-    //    got them wrong. One reader is why that cannot happen again.
-    let handle;
-    try {
-        handle = await open(path, constants.O_RDONLY | constants.O_NONBLOCK);
-    }
-    catch (error) {
-        throw new GovernanceRefusal(refusal("WORKSPACE_NOT_REGISTERED", `workspace registry ${path} could not be opened (${String(error)})`, { registry_path: path }));
-    }
-    let raw;
-    try {
-        const info = await handle.stat();
-        if (!info.isFile()) {
-            throw new GovernanceRefusal(refusal("WORKSPACE_NOT_REGISTERED", `workspace registry ${path} is not a regular file — refusing to read it. A FIFO, device or socket ` +
-                `at ${ENV_WORKSPACE_REGISTRY} would block session start rather than fail, because opening one ` +
-                `waits for a writer that may never come.`, { registry_path: path }));
-        }
-        if (info.size > REGISTRY_MAX_BYTES) {
-            throw new GovernanceRefusal(refusal("WORKSPACE_NOT_REGISTERED", `workspace registry ${path} is ${info.size} bytes, over the ${REGISTRY_MAX_BYTES} limit — refusing ` +
-                `rather than reading it into memory at session start.`, { registry_path: path }));
-        }
-        // **Ownership and mode are NOT checked here, and that is a scope decision (R-137, ADR-0036).** A
-        // previous revision refused a registry not owned by this user or writable by others. Those guards are
-        // about *tamper resistance*, which is a different question from the one ADR-0035 raised, and they went in
-        // mid-review without an ADR — where they promptly acquired a false claim ("nobody ELSE may rewrite it":
-        // it inspects the file and never its parent directory, and `rename(2)` needs only directory write) and a
-        // false-positive refusal of `0664`, which `umask 002` produces for every file an operator creates.
-        //
-        // What IS checked above is what ADR-0035 made this reader's problem: it began reading the registry at
-        // SESSION START, so the read must be bounded and must not block. Integrity is R-137, open and measured.
-        // The deadline is checked BETWEEN chunks, which is all `AbortSignal.timeout` ever did on the previous
-        // implementation — review measured 74 of 200 one-MiB reads completing in full with `signal.aborted`
-        // already true, because a signal is never observed *inside* a libuv read request. An explicit check makes
-        // the bound as real as it can be in-process, and its limit is the same one honestly stated below: a
-        // stalled `open` or a single wedged read cannot be interrupted from here.
-        const deadline = Date.now() + REGISTRY_READ_TIMEOUT_MS;
-        const buffer = Buffer.allocUnsafe(REGISTRY_MAX_BYTES + 1);
-        let filled = 0;
-        while (filled < buffer.length) {
-            if (Date.now() > deadline) {
-                throw new GovernanceRefusal(refusal("WORKSPACE_NOT_REGISTERED", `workspace registry ${path} did not finish reading within ${REGISTRY_READ_TIMEOUT_MS}ms — ` +
-                    `refusing rather than waiting, because session start awaits this read.`, { registry_path: path }));
-            }
-            const { bytesRead } = await handle.read(buffer, filled, buffer.length - filled, filled);
-            if (bytesRead === 0)
-                break;
-            filled += bytesRead;
-        }
-        if (filled > REGISTRY_MAX_BYTES) {
-            throw new GovernanceRefusal(refusal("WORKSPACE_NOT_REGISTERED", `workspace registry ${path} exceeded the ${REGISTRY_MAX_BYTES} limit while being read — it grew ` +
-                `after its size was checked. Refusing rather than allocating it.`, { registry_path: path }));
-        }
-        raw = buffer.subarray(0, filled).toString("utf8");
-    }
-    catch (error) {
-        if (error instanceof GovernanceRefusal)
-            throw error;
-        const timedOut = error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError");
-        throw new GovernanceRefusal(refusal("WORKSPACE_NOT_REGISTERED", timedOut
-            ? `workspace registry ${path} did not return within ${REGISTRY_READ_TIMEOUT_MS}ms — refusing rather ` +
-                `than waiting, because session start awaits this read.`
-            : `workspace registry ${path} could not be read (${String(error)})`, { registry_path: path }));
-    }
-    finally {
-        await handle.close().catch(() => { });
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch (error) {
-        throw new GovernanceRefusal(refusal("WORKSPACE_NOT_REGISTERED", `workspace registry ${path} is not valid JSON (${String(error)})`, { registry_path: path }));
-    }
-    const file = parsed;
-    if (file?.version !== 1 || !file.workspaces || typeof file.workspaces !== "object" || Array.isArray(file.workspaces)) {
-        throw new GovernanceRefusal(refusal("WORKSPACE_NOT_REGISTERED", `workspace registry ${path} must contain {version:1, workspaces:{id:{path}}}`, { registry_path: path }));
-    }
-    for (const [id, value] of Object.entries(file.workspaces)) {
-        if (!id || !value || typeof value.path !== "string" || !isAbsolute(value.path)) {
-            throw new GovernanceRefusal(refusal("WORKSPACE_NOT_REGISTERED", `workspace registry entry ${JSON.stringify(id)} must name an absolute path`, { registry_path: path, workspace_id: id }));
-        }
-        // ADR-0035 made a registry id the tail of a CAPABILITY id (`workspace:<id>`), so this file is an input
-        // to the grant grammar and has to obey it — the STRICT one. This shipped with the loose
-        // `isWellFormedCapability` blocklist, and review measured what that let through: an id of `*` minted
-        // `WORKSPACE_WILDCARD` (an operator naming one worktree held routing over all of them), an id with a
-        // space became two capabilities because `ceilingForDefinition` splits on `[\s,]+`, and quote/`$()` ids
-        // reached a generated file whose own instructions say to paste them into `PI_GRANTS_GRANT`. See
-        // `isSafeCapability`, which is now the one grammar for both channels into that file.
-        if (!isSafeWorkspaceId(id)) {
-            throw new GovernanceRefusal(refusal("GRANT_ID_MALFORMED", `workspace registry id ${JSON.stringify(id)} cannot be used: since ADR-0035 an id becomes the ` +
-                `capability ${JSON.stringify(workspaceCapability(id))}, and an id must match ` +
-                `[A-Za-z0-9][A-Za-z0-9._/-]* — slashes and dots are fine (a worktree named after its branch ` +
-                `works), but not spaces, quotes, commas, wildcards, shell metacharacters or non-ASCII, each of ` +
-                `which either splits into several capabilities or reaches a file you are told to source. ` +
-                `Rename it in ${path}.`, { registry_path: path, workspace_id: id }));
-        }
-    }
-    return { version: 1, workspaces: structuredClone(file.workspaces), source: path };
-}
-/**
- * The registered workspace ids, for `planInit` to scaffold and `/grants` to list. `[]` when there is no registry or it is broken.
- *
- * Fails SOFT, and only because nothing here is an authority: this decides which ids appear as COMMENTS in a
- * generated file. `loadWorkspaceRegistry` throws a GovernanceRefusal naming the file, and that refusal is
- * the operator's signal at the point of use, where routing genuinely depends on it. Swallowing it there
- * would be unsafe; swallowing it here costs a suggestion. Same argument as `buildCatalog`'s.
- *
- * Lives here rather than in `init.ts` because it reads the filesystem, and `planInit` — the centrepiece of
- * that module — documents itself as "Pure: no filesystem". It is a registry concern; this is where the
- * registry lives. Moved when `init.ts` crossed the 400-line ceiling, which this project splits for rather
- * than raising (`delegate.ts` at 413, `grants.ts` at 398).
- */
-export async function registeredWorkspaceIds(registryPath = process.env[ENV_WORKSPACE_REGISTRY]) {
-    if (!registryPath)
-        return [];
-    try {
-        return Object.keys((await loadWorkspaceRegistry(registryPath)).workspaces).sort();
-    }
-    catch {
-        return [];
-    }
-}
-export async function resolveWorkspace(registry, workspaceId) {
-    const registered = Object.hasOwn(registry.workspaces, workspaceId) ? registry.workspaces[workspaceId] : undefined;
-    const known = Object.keys(registry.workspaces).sort();
-    if (!registered) {
-        throw new GovernanceRefusal(refusal("WORKSPACE_NOT_REGISTERED", `workspace ${JSON.stringify(workspaceId)} is not present in the operator-owned registry` +
-            (registry.source ? ` ${registry.source}` : "") +
-            (known.length > 0 ? ` — it lists: ${known.join(", ")}` : " — it lists nothing"), { workspace_id: workspaceId, ...(registry.source ? { registry_path: registry.source } : {}) }));
-    }
-    return validateRegisteredWorkspace({ workspaceId, registeredRoot: registered.path });
-}
-/**
- * Canonicalize and validate the initial workspace against Git's registered worktree list.
- * This prevents accidental misrouting. It does not constrain any path a child accesses after spawn.
- */
-export async function validateRegisteredWorkspace(input) {
-    let registered;
-    let supplied;
-    try {
-        registered = await realpath(input.registeredRoot);
-        supplied = await realpath(input.suppliedRoot ?? input.registeredRoot);
-        if (!(await stat(registered)).isDirectory())
-            throw new Error("registered root is not a directory");
-    }
-    catch (error) {
-        throw new GovernanceRefusal(refusal("WORKSPACE_NOT_REGISTERED", `workspace ${input.workspaceId} root could not be canonicalized (${String(error)})`, { workspace_id: input.workspaceId }));
-    }
-    if (registered !== supplied) {
-        throw new GovernanceRefusal(refusal("WORKSPACE_NOT_REGISTERED", `workspace ${input.workspaceId} resolved to ${supplied}, not its registered worktree ${registered}`, { workspace_id: input.workspaceId, supplied_root: supplied, registered_root: registered }));
-    }
-    try {
-        const top = (await execFileAsync("git", ["-C", registered, "rev-parse", "--show-toplevel"], { encoding: "utf8" })).stdout.trim();
-        const canonicalTop = await realpath(top);
-        if (canonicalTop !== registered)
-            throw new Error(`path is inside worktree ${canonicalTop}, not its root`);
-        const commonRaw = (await execFileAsync("git", ["-C", registered, "rev-parse", "--path-format=absolute", "--git-common-dir"], { encoding: "utf8" })).stdout.trim();
-        const gitCommonDir = await realpath(commonRaw);
-        const list = (await execFileAsync("git", ["-C", registered, "worktree", "list", "--porcelain"], { encoding: "utf8" })).stdout;
-        const registeredWorktrees = await Promise.all(list.split("\n").filter((line) => line.startsWith("worktree ")).map((line) => realpath(line.slice(9))));
-        if (!registeredWorktrees.includes(registered))
-            throw new Error("Git does not list this path as a worktree");
-        return { workspaceId: input.workspaceId, root: registered, gitCommonDir };
-    }
-    catch (error) {
-        throw new GovernanceRefusal(refusal("WORKSPACE_NOT_REGISTERED", `workspace ${input.workspaceId} is not the registered Git worktree it claims to be (${String(error)})`, { workspace_id: input.workspaceId, registered_root: registered }));
-    }
-}
-/**
- * The governed-writer lease lives in `./workspace-lease.ts` and is re-exported here so that
- * "the workspace module" remains one import for callers. Split only to stay under the 400-line
- * module ceiling this project enforces mechanically.
- */
-export { ENV_WORKSPACE_LEASE_DIR, acquireWorkspaceLease, defaultWorkspaceLeaseDir, leaseAcquisitionOutcome, leaseReleaseLedgerOutcome, } from "./workspace-lease.js";
-//# sourceMappingURL=workspace.js.map