project-tiny-context-harness 0.11.0 → 0.12.0

package/dist/lib/long-task-windows-job-supervisor-result.js

@@ -1,152 +0,0 @@
-import { parseStrictYaml } from "./strict-codec.js";
-const RESULT_FIELDS = [
-    "AccountingSourceKind",
-    "ActiveProcessesAtResult",
-    "CompletedUnixMs",
-    "DescendantsCleaned",
-    "Error",
-    "ExitCode",
-    "KernelCpu100Ns",
-    "MonotonicClockId",
-    "MonotonicCompletedNs",
-    "MonotonicStartedNs",
-    "OutputOverflow",
-    "ProcessId",
-    "RequestId",
-    "StartedUnixMs",
-    "StderrBytes",
-    "StdoutBytes",
-    "TimedOut",
-    "TotalCpu100Ns",
-    "TotalProcesses",
-    "TotalTerminatedProcesses",
-    "UserCpu100Ns",
-    "WallClockId",
-];
-const FAILURE_FIELDS = ["Error", "RequestId"];
-export function parseWindowsJobSupervisorResult(line, requestId) {
-    const response = parseResponse(line);
-    if (sameFields(response, FAILURE_FIELDS))
-        handleFailure(response, requestId);
-    assertFields(response, RESULT_FIELDS);
-    assertResultShape(response);
-    if (response.RequestId !== requestId)
-        invalidResult("response_identity");
-    if (response.ActiveProcessesAtResult !== 0 ||
-        response.DescendantsCleaned !== true)
-        throw new Error("process_observer_descendant_process_alive");
-    return {
-        process_id: response.ProcessId,
-        exit_code: response.ExitCode,
-        timed_out: response.TimedOut,
-        output_overflow: response.OutputOverflow,
-        stdout_bytes: response.StdoutBytes,
-        stderr_bytes: response.StderrBytes,
-        started_at: new Date(response.StartedUnixMs).toISOString(),
-        completed_at: new Date(response.CompletedUnixMs).toISOString(),
-    };
-}
-function parseResponse(line) {
-    try {
-        if (!line.startsWith("{") || !line.endsWith("}"))
-            throw new Error();
-        return record(parseStrictYaml(line));
-    }
-    catch {
-        invalidResult("response_json");
-    }
-}
-function handleFailure(response, requestId) {
-    if (response.RequestId !== requestId)
-        invalidResult("response_identity");
-    if (!validDiagnostic(response.Error))
-        invalidResult("failure_shape");
-    if (response.Error.includes("descendants_alive"))
-        throw new Error("process_observer_descendant_process_alive");
-    throw new Error(`process_observer_windows_job_unavailable:${response.Error}`);
-}
-function assertResultShape(response) {
-    assertCoreResult(response);
-    assertClockResult(response);
-    assertAccountingResult(response);
-}
-function assertCoreResult(response) {
-    if (response.Error !== null ||
-        !positiveSafeInteger(response.ProcessId) ||
-        !signedInt32(response.ExitCode) ||
-        typeof response.TimedOut !== "boolean" ||
-        typeof response.OutputOverflow !== "boolean" ||
-        typeof response.DescendantsCleaned !== "boolean" ||
-        !nonnegativeSafeInteger(response.StdoutBytes) ||
-        !nonnegativeSafeInteger(response.StderrBytes) ||
-        !Number.isSafeInteger(response.StdoutBytes + response.StderrBytes))
-        invalidResult("result_shape");
-}
-function assertClockResult(response) {
-    if (!validUnixMilliseconds(response.StartedUnixMs) ||
-        !validUnixMilliseconds(response.CompletedUnixMs) ||
-        response.CompletedUnixMs < response.StartedUnixMs ||
-        !decimalString(response.MonotonicStartedNs) ||
-        !decimalString(response.MonotonicCompletedNs) ||
-        BigInt(response.MonotonicCompletedNs) <
-            BigInt(response.MonotonicStartedNs) ||
-        response.MonotonicClockId !== "windows-stopwatch-qpc-v1" ||
-        response.WallClockId !== "unix-epoch-ms-v1")
-        invalidResult("result_shape");
-}
-function assertAccountingResult(response) {
-    if (!nonnegativeSafeInteger(response.UserCpu100Ns) ||
-        !nonnegativeSafeInteger(response.KernelCpu100Ns) ||
-        !nonnegativeSafeInteger(response.TotalCpu100Ns) ||
-        response.TotalCpu100Ns !==
-            response.UserCpu100Ns + response.KernelCpu100Ns ||
-        !positiveSafeInteger(response.TotalProcesses) ||
-        !nonnegativeSafeInteger(response.ActiveProcessesAtResult) ||
-        !nonnegativeSafeInteger(response.TotalTerminatedProcesses) ||
-        response.TotalTerminatedProcesses > response.TotalProcesses ||
-        response.AccountingSourceKind !== "windows-job-object-accounting-v1")
-        invalidResult("result_shape");
-}
-function record(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        invalidResult("response_shape");
-    return value;
-}
-function sameFields(value, expected) {
-    const actual = Object.keys(value).sort();
-    const sortedExpected = [...expected].sort();
-    return (actual.length === sortedExpected.length &&
-        actual.every((field, index) => field === sortedExpected[index]));
-}
-function assertFields(value, expected) {
-    if (!sameFields(value, expected))
-        invalidResult("response_fields");
-}
-function positiveSafeInteger(value) {
-    return Number.isSafeInteger(value) && Number(value) > 0;
-}
-function nonnegativeSafeInteger(value) {
-    return Number.isSafeInteger(value) && Number(value) >= 0;
-}
-function signedInt32(value) {
-    return (Number.isSafeInteger(value) &&
-        Number(value) >= -2_147_483_648 &&
-        Number(value) <= 2_147_483_647);
-}
-function validUnixMilliseconds(value) {
-    return nonnegativeSafeInteger(value) && value <= 8_640_000_000_000_000;
-}
-function decimalString(value) {
-    return typeof value === "string" && /^[0-9]+$/u.test(value);
-}
-function validDiagnostic(value) {
-    return (typeof value === "string" &&
-        !value.includes("\u0000") &&
-        value.length > 0 &&
-        value.length <= 16_384 &&
-        !value.includes("\r") &&
-        !value.includes("\n"));
-}
-function invalidResult(detail) {
-    throw new Error(`process_observer_windows_job_result_invalid:${detail}`);
-}

package/dist/lib/long-task-windows-job-supervisor.d.ts

@@ -1,2 +0,0 @@
-import type { SpawnedCommandExecution } from "./long-task-command-process.js";
-export declare function spawnWindowsJobCommandOnce(executable: string, argv: string[], cwd: string, timeoutMs: number, environment: NodeJS.ProcessEnv, combinedOutputLimitBytes: number): Promise<SpawnedCommandExecution>;

package/dist/lib/long-task-windows-job-supervisor.js

@@ -1,126 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { lstat, mkdtemp, realpath, rm } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { assertProtectedRepositoryFile } from "./long-task-protected-files.js";
-import { runOneWindowsJobHelperRequest } from "./long-task-windows-job-supervisor-helper.js";
-import { assertFreshWindowsJobStreamTarget, createWindowsJobSupervisorRequest, parseWindowsJobSupervisorResult, readWindowsJobStream, WINDOWS_JOB_SUPERVISOR_ASSET_RELATIVE_FILES, } from "./long-task-windows-job-supervisor-protocol.js";
-const HELPER_CLOSE_GRACE_MS = 10_000;
-export async function spawnWindowsJobCommandOnce(executable, argv, cwd, timeoutMs, environment, combinedOutputLimitBytes) {
-    if (process.platform !== "win32")
-        throw new Error("process_observer_windows_job_unavailable:platform");
-    const helper = await packageSupervisorHelper();
-    const powershell = await windowsPowerShellExecutable();
-    const createdTemporaryRoot = await mkdtemp(path.join(tmpdir(), "ty-context-windows-job-"));
-    const temporaryRoot = await assertPrivateTemporaryRoot(createdTemporaryRoot);
-    let execution;
-    let failure;
-    try {
-        const stdoutPath = path.join(temporaryRoot, "stdout.bin");
-        const stderrPath = path.join(temporaryRoot, "stderr.bin");
-        await Promise.all([
-            assertFreshWindowsJobStreamTarget(stdoutPath),
-            assertFreshWindowsJobStreamTarget(stderrPath),
-        ]);
-        const request = createWindowsJobSupervisorRequest({
-            requestId: randomUUID(),
-            executable,
-            argv,
-            cwd,
-            stdoutPath,
-            stderrPath,
-            timeoutMs,
-            combinedOutputLimitBytes,
-            environment,
-        });
-        const response = await runOneWindowsJobHelperRequest(powershell, helper, JSON.stringify(request), timeoutMs + HELPER_CLOSE_GRACE_MS);
-        const result = parseWindowsJobSupervisorResult(response, request.request_id);
-        const [stdout, stderr] = await Promise.all([
-            readWindowsJobStream(stdoutPath, result.stdout_bytes, combinedOutputLimitBytes),
-            readWindowsJobStream(stderrPath, result.stderr_bytes, combinedOutputLimitBytes),
-        ]);
-        if (stdout.length + stderr.length > combinedOutputLimitBytes)
-            throw new Error("process_observer_windows_job_result_invalid:stream_limit");
-        if (result.timed_out)
-            throw new Error("command_timeout");
-        if (result.output_overflow)
-            throw new Error("command_output_limit_exceeded");
-        execution = {
-            exit_code: result.exit_code,
-            stdout,
-            stderr,
-            pid: result.process_id,
-            started_at: result.started_at,
-            completed_at: result.completed_at,
-        };
-    }
-    catch (error) {
-        failure = error;
-    }
-    try {
-        await removePrivateTemporaryRoot(temporaryRoot);
-    }
-    catch (error) {
-        failure ??= new Error(`process_observer_windows_job_unavailable:cleanup:${message(error)}`);
-    }
-    if (failure)
-        throw failure;
-    return execution;
-}
-async function packageSupervisorHelper() {
-    const packageRoot = fileURLToPath(new URL("../../", import.meta.url));
-    let helper = "";
-    try {
-        for (const relative of WINDOWS_JOB_SUPERVISOR_ASSET_RELATIVE_FILES) {
-            const file = await assertProtectedRepositoryFile(packageRoot, path.join(packageRoot, ...relative.split("/")), `windows_job_supervisor_asset:${relative}`);
-            if (relative.endsWith("/windows_job_process_supervisor.ps1"))
-                helper = file;
-        }
-    }
-    catch (error) {
-        throw new Error(`process_observer_windows_job_unavailable:assets:${message(error)}`);
-    }
-    return helper;
-}
-async function windowsPowerShellExecutable() {
-    const windowsRoot = process.env.SystemRoot ?? process.env.WINDIR;
-    if (!windowsRoot || !path.isAbsolute(windowsRoot))
-        throw new Error("process_observer_windows_job_unavailable:powershell");
-    const executable = path.join(windowsRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
-    try {
-        const status = await lstat(executable);
-        if (!status.isFile() || status.isSymbolicLink())
-            throw new Error();
-        return await realpath(executable);
-    }
-    catch {
-        throw new Error("process_observer_windows_job_unavailable:powershell");
-    }
-}
-async function assertPrivateTemporaryRoot(created) {
-    const status = await lstat(created);
-    if (!status.isDirectory() || status.isSymbolicLink())
-        throw new Error("process_observer_windows_job_unavailable:temporary_root_identity");
-    return realpath(created);
-}
-async function removePrivateTemporaryRoot(target) {
-    const status = await lstat(target);
-    if (!status.isDirectory() ||
-        status.isSymbolicLink() ||
-        normalizeHostPath(await realpath(target)) !==
-            normalizeHostPath(path.resolve(target)))
-        throw new Error("temporary_root_identity");
-    await rm(target, {
-        recursive: true,
-        force: true,
-        maxRetries: 10,
-        retryDelay: 100,
-    });
-}
-function normalizeHostPath(value) {
-    return process.platform === "win32" ? value.toLowerCase() : value;
-}
-function message(error) {
-    return error instanceof Error ? error.message : String(error);
-}

package/dist/lib/long-task-worker-selection.d.ts

@@ -1,2 +0,0 @@
-export declare const LONG_TASK_IMPLEMENTATION_AGENT = "long_task_implementation";
-export declare function selectedAgentType(toolInput: unknown): string | null;

package/dist/lib/long-task-worker-selection.js

@@ -1,7 +0,0 @@
-export const LONG_TASK_IMPLEMENTATION_AGENT = "long_task_implementation";
-export function selectedAgentType(toolInput) {
-    if (!toolInput || typeof toolInput !== "object" || Array.isArray(toolInput))
-        return null;
-    const value = toolInput.agent_type;
-    return typeof value === "string" && value.length > 0 ? value : null;
-}

package/dist/lib/long-task-workspace-manifest.d.ts

@@ -1,8 +0,0 @@
-import type { WorkspaceFingerprintV2, WorkspaceManifestV2 } from "./long-task-delivery-types.js";
-export declare function captureWorkspaceFingerprint(rootInput: string, excludedPrefixes?: string[]): Promise<WorkspaceFingerprintV2>;
-export declare function captureWorkspaceManifest(rootInput: string, workdirInput: string, _copyRoot?: string, additionalExcludedWorkdirs?: string[]): Promise<WorkspaceManifestV2>;
-export declare function changedWorkspacePaths(baseline: WorkspaceManifestV2, current: WorkspaceManifestV2): string[];
-export declare function changedWorkspacePathsFromHead(rootInput: string, workdirInput: string, additionalExcludedWorkdirs?: string[]): Promise<string[]>;
-export declare function workspaceFingerprintExcludedPrefixes(root: string, workdirs: string[]): string[];
-export declare function workspaceSnapshotExcludedPrefixes(root: string, workdirs: string[]): string[];
-export declare function workspacePathExcluded(relative: string, excluded: string[]): boolean;

package/dist/lib/long-task-workspace-manifest.js

@@ -1,173 +0,0 @@
-import { readFile, stat } from "node:fs/promises";
-import path from "node:path";
-import { gitBuffer, gitBufferInput, gitOutput, repoRelative, splitGitZero, } from "./long-task-git.js";
-import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
-export async function captureWorkspaceFingerprint(rootInput, excludedPrefixes = []) {
-    const root = path.resolve(rootInput);
-    const indexTree = await gitOutput(root, ["write-tree"]);
-    const [head, headTree, staged, unstaged, statusBytes, untracked] = await Promise.all([
-        gitOutput(root, ["rev-parse", "HEAD"]),
-        gitOutput(root, ["rev-parse", "HEAD^{tree}"]),
-        gitBuffer(root, scopedDiffArgs(["diff", "--cached", "--binary", "--no-ext-diff"], excludedPrefixes)),
-        gitBuffer(root, scopedDiffArgs(["diff", "--binary", "--no-ext-diff"], excludedPrefixes)),
-        Promise.all([
-            gitBuffer(root, scopedDiffArgs(["diff", "--cached", "--raw", "-z", "-M"], excludedPrefixes)),
-            gitBuffer(root, scopedDiffArgs(["diff", "--raw", "-z", "-M"], excludedPrefixes)),
-        ]).then((rows) => Buffer.concat(rows)),
-        untrackedIdentity(root, excludedPrefixes),
-    ]);
-    const unsigned = {
-        head,
-        head_tree: headTree,
-        index_tree: indexTree,
-        staged_diff_sha256: sha256Hex(staged),
-        unstaged_diff_sha256: sha256Hex(unstaged),
-        untracked_sha256: untracked,
-        status_sha256: sha256Hex(statusBytes),
-    };
-    return {
-        ...unsigned,
-        identity: sha256Hex(canonicalValueJson(unsigned)),
-    };
-}
-export async function captureWorkspaceManifest(rootInput, workdirInput, _copyRoot, additionalExcludedWorkdirs = []) {
-    const root = path.resolve(rootInput);
-    const workdir = path.resolve(workdirInput);
-    const workdirRelative = repoRelative(root, workdir);
-    if (!workdirRelative)
-        throw new Error("long_task_workdir_must_not_be_repository_root");
-    const excluded = workspaceFingerprintExcludedPrefixes(root, [
-        workdir,
-        ...additionalExcludedWorkdirs,
-    ]);
-    const fingerprint = await captureWorkspaceFingerprint(root, excluded);
-    const [indexBytes, modifiedBytes, untrackedBytes] = await Promise.all([
-        gitBuffer(root, ["ls-files", "--stage", "-z"]),
-        gitBuffer(root, ["diff", "--name-only", "-z"]),
-        gitBuffer(root, ["ls-files", "--others", "--exclude-standard", "-z"]),
-    ]);
-    const files = new Map();
-    for (const record of splitGitZero(indexBytes)) {
-        const tab = record.indexOf("\t");
-        if (tab < 0)
-            continue;
-        const [modeText, objectId, stage] = record.slice(0, tab).split(" ");
-        const relative = record.slice(tab + 1).replace(/\\/gu, "/");
-        if (stage !== "0" || workspacePathExcluded(relative, excluded))
-            continue;
-        files.set(relative, {
-            path: relative,
-            mode: Number.parseInt(modeText, 8),
-            size: 0,
-            sha256: `git:${objectId}`,
-        });
-    }
-    const overlays = new Set([
-        ...splitGitZero(modifiedBytes),
-        ...splitGitZero(untrackedBytes),
-    ]);
-    const overlayNames = [...overlays]
-        .map((raw) => raw.replace(/\\/gu, "/"))
-        .filter((relative) => !workspacePathExcluded(relative, excluded));
-    const overlayInfo = new Map(await Promise.all(overlayNames.map(async (relative) => [
-        relative,
-        await stat(path.join(root, ...relative.split("/")), {
-            bigint: true,
-        }).catch(() => null),
-    ])));
-    const overlayHashes = await gitObjectIds(root, overlayNames.filter((relative) => overlayInfo.get(relative)?.isFile()));
-    for (const relative of overlayNames) {
-        const absolute = path.join(root, ...relative.split("/"));
-        const info = overlayInfo.get(relative);
-        if (!info?.isFile()) {
-            files.delete(relative);
-            continue;
-        }
-        const bytes = await readFile(absolute);
-        files.set(relative, {
-            path: relative,
-            mode: gitFileMode(Number(info.mode)),
-            size: bytes.length,
-            sha256: `git:${overlayHashes.get(relative)}`,
-        });
-    }
-    return {
-        repository_root: root,
-        git_head: fingerprint.head,
-        files: [...files.values()].sort((a, b) => a.path.localeCompare(b.path)),
-        fingerprint,
-        snapshot_sha256: fingerprint.identity,
-    };
-}
-export function changedWorkspacePaths(baseline, current) {
-    const before = new Map(baseline.files.map((file) => [file.path, `${file.mode}:${file.sha256}`]));
-    const after = new Map(current.files.map((file) => [file.path, `${file.mode}:${file.sha256}`]));
-    return [...new Set([...before.keys(), ...after.keys()])]
-        .filter((file) => before.get(file) !== after.get(file))
-        .sort();
-}
-export async function changedWorkspacePathsFromHead(rootInput, workdirInput, additionalExcludedWorkdirs = []) {
-    const root = path.resolve(rootInput);
-    const workdir = path.resolve(workdirInput);
-    const excluded = workspaceFingerprintExcludedPrefixes(root, [
-        workdir,
-        ...additionalExcludedWorkdirs,
-    ]);
-    const [trackedBytes, untrackedBytes] = await Promise.all([
-        gitBuffer(root, scopedDiffArgs(["diff", "--name-only", "--no-renames", "--no-ext-diff", "-z", "HEAD"], excluded)),
-        gitBuffer(root, ["ls-files", "--others", "--exclude-standard", "-z"]),
-    ]);
-    return [
-        ...new Set([...splitGitZero(trackedBytes), ...splitGitZero(untrackedBytes)]
-            .map((raw) => raw.replace(/\\/gu, "/"))
-            .filter((relative) => !workspacePathExcluded(relative, excluded))),
-    ].sort();
-}
-export function workspaceFingerprintExcludedPrefixes(root, workdirs) {
-    return [
-        ...workspaceSnapshotExcludedPrefixes(root, workdirs),
-        "project_context",
-    ].filter(Boolean);
-}
-export function workspaceSnapshotExcludedPrefixes(root, workdirs) {
-    return [
-        ...workdirs.map((workdir) => repoRelative(root, path.resolve(workdir))),
-        "tmp/ty-context/long-task-runs",
-    ].filter(Boolean);
-}
-export function workspacePathExcluded(relative, excluded) {
-    const normalized = relative.replace(/\\/gu, "/");
-    return (normalized.split("/").includes("node_modules") ||
-        excluded.some((prefix) => normalized === prefix || normalized.startsWith(`${prefix}/`)));
-}
-async function untrackedIdentity(root, excluded) {
-    const names = splitGitZero(await gitBuffer(root, ["ls-files", "--others", "--exclude-standard", "-z"]))
-        .map((name) => name.replace(/\\/gu, "/"))
-        .filter((name) => !workspacePathExcluded(name, excluded))
-        .sort();
-    const hashes = await gitObjectIds(root, names);
-    const rows = names.map((name) => [
-        name,
-        hashes.get(name) ?? "missing",
-    ]);
-    return sha256Hex(canonicalValueJson(rows));
-}
-async function gitObjectIds(root, names) {
-    if (!names.length)
-        return new Map();
-    const output = await gitBufferInput(root, ["hash-object", "--stdin-paths"], Buffer.from(`${names.join("\n")}\n`, "utf8"));
-    const ids = output.toString("utf8").trim().split(/\r?\n/u);
-    return new Map(names.map((name, index) => [name, ids[index]]));
-}
-function scopedDiffArgs(base, excluded) {
-    return [
-        ...base,
-        "--",
-        ".",
-        ...excluded.map((prefix) => `:(exclude)${prefix}/**`),
-        ":(exclude)**/node_modules/**",
-    ];
-}
-function gitFileMode(mode) {
-    return mode & 0o111 ? 0o100755 : 0o100644;
-}

package/dist/lib/long-task-workspace-runtime-types.d.ts

@@ -1,23 +0,0 @@
-export interface WorkspaceFileV2 {
-    path: string;
-    mode: number;
-    size: number;
-    sha256: string;
-}
-export interface WorkspaceFingerprintV2 {
-    head: string;
-    head_tree: string;
-    index_tree: string;
-    staged_diff_sha256: string;
-    unstaged_diff_sha256: string;
-    untracked_sha256: string;
-    status_sha256: string;
-    identity: string;
-}
-export interface WorkspaceManifestV2 {
-    repository_root: string;
-    git_head: string;
-    files: WorkspaceFileV2[];
-    fingerprint: WorkspaceFingerprintV2;
-    snapshot_sha256: string;
-}

package/dist/lib/long-task-workspace-runtime-types.js

@@ -1 +0,0 @@
-export {};

package/dist/lib/long-task-workspace-scope.d.ts

@@ -1,39 +0,0 @@
-interface WorkspaceScopeAuthority {
-    global: {
-        technical: {
-            forbidden_paths: Array<{
-                path: string;
-            }>;
-        };
-    };
-    outcomes: Array<{
-        technical: {
-            expected_change_paths: string[];
-            allowed_support_paths: string[];
-            forbidden_paths: string[];
-        };
-    }>;
-}
-export interface WorkspaceScopeClassificationV2 {
-    protected: string[];
-    expected_change: string[];
-    allowed_support: string[];
-    forbidden: string[];
-    unclassified: string[];
-    blocking_paths: string[];
-}
-export declare function classifyWorkspaceScope(authority: WorkspaceScopeAuthority, changedPaths: string[], protectedPaths: string[]): WorkspaceScopeClassificationV2;
-export declare function protectedWorkspacePaths(input: {
-    contract_files?: Record<string, string> | null;
-    source_hashes?: Record<string, string> | null;
-    context_hashes?: Record<string, string> | null;
-    checks?: Array<{
-        verification_input_hashes: Record<string, string>;
-        protected_authority_paths?: string[];
-    }>;
-    additional_files?: string[];
-}): string[];
-export declare function firstLockManagedWorkspacePaths(repository: string, changedPaths: string[]): Promise<string[]>;
-export declare function workspaceScopeErrors(classification: WorkspaceScopeClassificationV2): string[];
-export declare function assertWorkspaceScope(classification: WorkspaceScopeClassificationV2): void;
-export {};

package/dist/lib/long-task-workspace-scope.js

@@ -1,126 +0,0 @@
-import path from "node:path";
-import { readConfig } from "./config.js";
-import { harnessConfigPath, harnessPath, harnessRoot } from "./harness-root.js";
-import { listFiles, pathExists } from "./fs.js";
-import { matchesRepoPattern, normalizeRepositoryFile, } from "./long-task-paths.js";
-import { longTaskCodexAgentProfileBootstrapPaths } from "./long-task-codex-agent-profile.js";
-import { packageAssetPath } from "./paths.js";
-import { enabledManagedSkillNames, isProfileEnabled } from "./profiles.js";
-export function classifyWorkspaceScope(authority, changedPaths, protectedPaths) {
-    const protectedSet = new Set(normalizeFiles(protectedPaths));
-    const expectedPatterns = authority.outcomes.flatMap((outcome) => outcome.technical.expected_change_paths);
-    const supportPatterns = authority.outcomes.flatMap((outcome) => outcome.technical.allowed_support_paths);
-    const forbiddenPatterns = [
-        ...authority.global.technical.forbidden_paths.map((entry) => entry.path),
-        ...authority.outcomes.flatMap((outcome) => outcome.technical.forbidden_paths),
-    ];
-    const result = {
-        protected: [],
-        expected_change: [],
-        allowed_support: [],
-        forbidden: [],
-        unclassified: [],
-        blocking_paths: [],
-    };
-    for (const file of normalizeFiles(changedPaths)) {
-        if (protectedSet.has(file))
-            result.protected.push(file);
-        else if (matchesAny(file, forbiddenPatterns))
-            result.forbidden.push(file);
-        else if (matchesAny(file, expectedPatterns))
-            result.expected_change.push(file);
-        else if (matchesAny(file, supportPatterns))
-            result.allowed_support.push(file);
-        else
-            result.unclassified.push(file);
-    }
-    result.blocking_paths = [...result.forbidden, ...result.unclassified].sort();
-    return result;
-}
-export function protectedWorkspacePaths(input) {
-    return normalizeFiles([
-        ...Object.keys(input.contract_files ?? {}),
-        ...Object.keys(input.source_hashes ?? {}),
-        ...Object.keys(input.context_hashes ?? {}),
-        ...(input.checks ?? []).flatMap((check) => [
-            ...Object.keys(check.verification_input_hashes),
-            ...(check.protected_authority_paths ?? []),
-        ]),
-        ...(input.additional_files ?? []),
-    ]);
-}
-export async function firstLockManagedWorkspacePaths(repository, changedPaths) {
-    const root = await harnessRoot(repository);
-    const config = await readConfig(repository);
-    const managedFiles = new Set([
-        await harnessConfigPath(repository),
-        ".codex/hooks.json",
-        ...(await longTaskCodexAgentProfileBootstrapPaths(repository, root, isProfileEnabled(config, "long-task"))),
-        ...(await packageManagedBootstrapFiles(root, config)),
-    ].map(normalizeManagedRoot));
-    return normalizeFiles(changedPaths).filter((file) => managedFiles.has(file));
-}
-export function workspaceScopeErrors(classification) {
-    return [
-        ...classification.forbidden.map((file) => `workspace_path_forbidden:${file}`),
-        ...classification.unclassified.map((file) => `workspace_path_unclassified:${file}`),
-    ];
-}
-export function assertWorkspaceScope(classification) {
-    const [error] = workspaceScopeErrors(classification);
-    if (error)
-        throw new Error(error);
-}
-function normalizeFiles(files) {
-    return [
-        ...new Set(files.map((file) => normalizeRepositoryFile(file))),
-    ].sort();
-}
-function matchesAny(file, patterns) {
-    return patterns.some((pattern) => matchesRepoPattern(file, pattern));
-}
-function normalizeManagedRoot(file) {
-    return normalizeRepositoryFile(file.replace(/\/+$/u, ""));
-}
-async function packageManagedBootstrapFiles(root, config) {
-    const files = [];
-    for (const managed of config.managed_files)
-        files.push(...(await managedBootstrapFiles(root, config, managed)));
-    return files;
-}
-async function managedBootstrapFiles(root, config, managed) {
-    const normalized = normalizeManagedRoot(managed.path);
-    if (managed.path === "AGENTS.md" ||
-        managed.path === "Makefile" ||
-        managed.path === ".github/workflows/harness.yml")
-        return [managed.path];
-    if (isSkillsManagedPath(normalized, root)) {
-        const files = [];
-        for (const name of enabledManagedSkillNames(config))
-            files.push(...(await assetTreeFiles(harnessPath(root, "skills", name), "skills", name)));
-        return files;
-    }
-    if (normalized === harnessPath(root, "ty-context-managed", "context_templates"))
-        return assetTreeFiles(managed.path, "context_templates");
-    if (normalized === harnessPath(root, "ty-context-managed", "templates"))
-        return assetTreeFiles(managed.path, "templates");
-    if (normalized === harnessPath(root, "ty-context-managed", "policies"))
-        return assetTreeFiles(managed.path, "policies");
-    if (normalized ===
-        harnessPath(root, "ty-context-managed", "make", "ty-context.mk"))
-        return [managed.path];
-    if (managed.path === "tools")
-        return assetTreeFiles(managed.path, "tools");
-    return [];
-}
-async function assetTreeFiles(destinationRoot, ...assetSegments) {
-    const sourceRoot = packageAssetPath(...assetSegments);
-    if (!(await pathExists(sourceRoot)))
-        return [];
-    return (await listFiles(sourceRoot)).map((file) => normalizeManagedRoot(harnessPath(destinationRoot, path.relative(sourceRoot, file).replace(/\\/gu, "/"))));
-}
-function isSkillsManagedPath(managedPath, root) {
-    return (managedPath === harnessPath(root, "skills") ||
-        managedPath === ".harness/agents/skills" ||
-        (managedPath === ".agents/skills" && root !== ".agents"));
-}