syncpoint-ai 0.1.0

package/dist/server/application/file-io.js

@@ -0,0 +1,98 @@
+/**
+ * File I/O utilities — path security, atomic writes, resource hashing.
+ * Extracted from write-permit-service.ts.
+ */
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { ForbiddenError, normalizeResourcePath } from "../../kernel/index.js";
+import { getSyncpointDir } from "../db.js";
+// ── Path resolution ──────────────────────────────────
+export function resolveRootDir() {
+    const envRoot = process.env.SYNCPOINT_PROJECT_ROOT;
+    if (envRoot)
+        return canonicalRoot(envRoot);
+    return canonicalRoot(path.dirname(getSyncpointDir()));
+}
+export function canonicalRoot(root) {
+    const resolved = path.resolve(root);
+    try {
+        return fs.realpathSync.native(resolved);
+    }
+    catch {
+        return resolved;
+    }
+}
+export function resolveNativeLocator(root, locator) {
+    const native = path.resolve(locator);
+    if (path.isAbsolute(native))
+        return native;
+    return path.resolve(root, locator);
+}
+export function normalizeFileLocator(locator, root) {
+    return normalizeResourcePath(locator, { projectRoot: root });
+}
+// ── Path containment ─────────────────────────────────
+export function isInsideOrSame(root, target) {
+    const relative = path.relative(root, target);
+    return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}
+/**
+ * Resolve a resource locator to a filesystem path, with containment checks.
+ * Throws ForbiddenError if the resolved path escapes the guarded root.
+ */
+export function safeResolve(root, locator) {
+    const target = resolveNativeLocator(root, locator);
+    if (!isInsideOrSame(root, target)) {
+        throw new ForbiddenError("filesystem_write", `Refusing to write outside guarded root: ${locator}`);
+    }
+    const realTarget = realpathForContainmentCheck(target);
+    if (!isInsideOrSame(root, realTarget)) {
+        throw new ForbiddenError("filesystem_write", `Refusing to follow path outside guarded root: ${locator}`);
+    }
+    return target;
+}
+export function realpathForContainmentCheck(target) {
+    if (fs.existsSync(target))
+        return fs.realpathSync.native(target);
+    let existingParent = path.dirname(target);
+    while (!fs.existsSync(existingParent)) {
+        const next = path.dirname(existingParent);
+        if (next === existingParent)
+            return target;
+        existingParent = next;
+    }
+    const realParent = fs.realpathSync.native(existingParent);
+    return path.resolve(realParent, path.relative(existingParent, target));
+}
+// ── Atomic write ─────────────────────────────────────
+/**
+ * Write file atomically: write to temp file, then rename into place.
+ * Uses .syncpoint-tmp-{pid}-{ts} naming to avoid collisions.
+ */
+export function atomicWriteFile(target, content) {
+    const tmp = `${target}.syncpoint-tmp-${process.pid}-${Date.now()}`;
+    fs.writeFileSync(tmp, content);
+    fs.renameSync(tmp, target);
+}
+// ── Resource hashing ─────────────────────────────────
+export function readResourceHash(root, resource) {
+    if (resource.type !== "file")
+        return { exists: false };
+    const file = safeResolve(root, resource.locator);
+    if (!fs.existsSync(file))
+        return { exists: false };
+    const stat = fs.statSync(file);
+    if (!stat.isFile())
+        return { exists: false };
+    const hash = createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+    return { exists: true, sha256: hash };
+}
+export function resolveBaseHashes(resources, root) {
+    return resources.map(resource => ({ resource, ...readResourceHash(root, resource) }));
+}
+// ── Resource comparison ──────────────────────────────
+export function sameResource(a, b) {
+    return a.type === b.type && a.locator === b.locator;
+}
+//# sourceMappingURL=file-io.js.map

package/dist/server/application/file-io.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-io.js","sourceRoot":"","sources":["../../../_build/src/server/application/file-io.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9E,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAE3C,wDAAwD;AAExD,MAAM,UAAU,cAAc;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACnD,IAAI,OAAO;QAAE,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,OAAe;IAChE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,IAAY;IAChE,OAAO,qBAAqB,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,wDAAwD;AAExD,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,MAAc;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,OAAe;IACvD,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,cAAc,CAAC,kBAAkB,EAAE,2CAA2C,OAAO,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,UAAU,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,cAAc,CAAC,kBAAkB,EAAE,iDAAiD,OAAO,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACxD,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjE,IAAI,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,MAAM,CAAC;QAC3C,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,wDAAwD;AAExD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,OAAe;IAC7D,MAAM,GAAG,GAAG,GAAG,MAAM,kBAAkB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACnE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/B,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,wDAAwD;AAExD,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,QAAqB;IAClE,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAwB,EAAE,IAAY;IACtE,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,wDAAwD;AAExD,MAAM,UAAU,YAAY,CAAC,CAAc,EAAE,CAAc;IACzD,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC;AACtD,CAAC"}

package/dist/server/application/file-permission-guard.d.ts

@@ -0,0 +1,50 @@
+export interface FilePermissionGuardState {
+    sessionId: string;
+    projectRoot: string;
+    lockedFiles: Map<string, {
+        originalMode: number;
+        originalReadOnly: boolean;
+        lockedAt: string;
+        lockedBy: string;
+    }>;
+}
+export declare function __clearFilePermissionGuardsForTest(): void;
+export declare function recoverGuardState(projectRoot: string): {
+    recovered: string[];
+    errors: string[];
+};
+export declare function lockClaimedFiles(input: {
+    guardSessionId: string;
+    projectRoot: string;
+    taskId: string;
+    sessionId?: string;
+}): {
+    locked: string[];
+    skipped: string[];
+    errors: string[];
+};
+export declare function unlockClaimedFiles(guardSessionId: string): {
+    unlocked: string[];
+    errors: string[];
+};
+/**
+ * Emergency unlock: restore all locked files across all guards.
+ */
+export declare function unlockAllGuards(projectRoot?: string): {
+    unlocked: string[];
+    errors: string[];
+};
+export declare function temporarilyUnlockForWrite(projectRoot: string, locators: string[]): {
+    restore: () => void;
+};
+export declare function isGuardActive(guardSessionId: string): boolean;
+export declare function getActiveGuardForRoot(projectRoot: string): FilePermissionGuardState | undefined;
+export declare function refreshGuardLocks(input: {
+    guardSessionId: string;
+    taskId: string;
+    sessionId?: string;
+}): {
+    newLocks: string[];
+    errors: string[];
+};
+//# sourceMappingURL=file-permission-guard.d.ts.map

package/dist/server/application/file-permission-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-permission-guard.d.ts","sourceRoot":"","sources":["../../../_build/src/server/application/file-permission-guard.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnH;AAsBD,wBAAgB,kCAAkC,IAAI,IAAI,CAEzD;AA4ED,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAoBhG;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG;IAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAmD5D;AAED,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAoBnG;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CA8B9F;AAED,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAAE,GACjB;IAAE,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,CA8BzB;AAED,wBAAgB,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CAK/F;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAqC3C"}

package/dist/server/application/file-permission-guard.js

@@ -0,0 +1,350 @@
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { logEvent } from "../repositories/_shared.js";
+import { EventType } from "../../kernel/index.js";
+import { rcList } from "./resource-claim-service.js";
+const GUARD_STATE_VERSION = 1;
+const GUARD_STATE_DIR = ".syncpoint";
+const GUARD_STATE_FILE = "guard_state.json";
+const activeGuards = new Map();
+const isWindows = os.platform() === "win32";
+export function __clearFilePermissionGuardsForTest() {
+    activeGuards.clear();
+}
+// ── Platform-aware file locking ─────────────────────
+function setReadOnly(filePath) {
+    try {
+        const stat = fs.statSync(filePath);
+        if (!stat.isFile())
+            return null;
+        const originalMode = stat.mode;
+        const originalReadOnly = isWindows ? isWindowsReadOnly(filePath) : false;
+        if (isWindows) {
+            setWindowsReadOnly(filePath);
+        }
+        else {
+            const readOnlyMode = makeReadOnly(originalMode);
+            if (originalMode !== readOnlyMode)
+                fs.chmodSync(filePath, readOnlyMode);
+        }
+        return { originalMode, originalReadOnly };
+    }
+    catch {
+        return null;
+    }
+}
+function restoreWritable(filePath, originalMode, originalReadOnly) {
+    try {
+        if (!fs.existsSync(filePath))
+            return;
+        if (isWindows) {
+            if (!originalReadOnly)
+                clearWindowsReadOnly(filePath);
+        }
+        else {
+            fs.chmodSync(filePath, originalMode);
+        }
+    }
+    catch { /* best-effort */ }
+}
+function isWindowsReadOnly(filePath) {
+    try {
+        return (fs.statSync(filePath).mode & 0o200) === 0;
+    }
+    catch {
+        return false;
+    }
+}
+function setWindowsReadOnly(filePath) {
+    try {
+        const { execSync } = require("node:child_process");
+        execSync(`attrib +R "${filePath}"`, { windowsHide: true });
+    }
+    catch {
+        try {
+            fs.chmodSync(filePath, fs.statSync(filePath).mode & ~0o222);
+        }
+        catch { /* no-op */ }
+    }
+}
+function clearWindowsReadOnly(filePath) {
+    try {
+        const { execSync } = require("node:child_process");
+        execSync(`attrib -R "${filePath}"`, { windowsHide: true });
+    }
+    catch {
+        try {
+            fs.chmodSync(filePath, fs.statSync(filePath).mode | 0o200);
+        }
+        catch { /* no-op */ }
+    }
+}
+// ── Guard state persistence ──────────────────────────
+function getGuardStatePath(projectRoot) {
+    return path.join(projectRoot, GUARD_STATE_DIR, GUARD_STATE_FILE);
+}
+function persistGuardState(projectRoot) {
+    const statePath = getGuardStatePath(projectRoot);
+    try {
+        const stateDir = path.dirname(statePath);
+        if (!fs.existsSync(stateDir))
+            fs.mkdirSync(stateDir, { recursive: true });
+        const fileState = { version: GUARD_STATE_VERSION, guards: {} };
+        for (const [sessionId, guard] of activeGuards) {
+            if (guard.projectRoot !== projectRoot)
+                continue;
+            fileState.guards[sessionId] = {
+                projectRoot: guard.projectRoot,
+                lockedFiles: Array.from(guard.lockedFiles.entries()).map(([locator, info]) => ({
+                    locator, originalMode: info.originalMode, originalReadOnly: info.originalReadOnly,
+                    lockedAt: info.lockedAt, lockedBy: info.lockedBy,
+                })),
+            };
+        }
+        fs.writeFileSync(statePath, JSON.stringify(fileState, null, 2), "utf-8");
+    }
+    catch { /* best-effort */ }
+}
+export function recoverGuardState(projectRoot) {
+    const statePath = getGuardStatePath(projectRoot);
+    const recovered = [];
+    const errors = [];
+    try {
+        if (!fs.existsSync(statePath))
+            return { recovered, errors };
+        const state = JSON.parse(fs.readFileSync(statePath, "utf-8"));
+        if (state.version !== GUARD_STATE_VERSION) {
+            errors.push(`Guard state version ${state.version} not supported`);
+            return { recovered, errors };
+        }
+        for (const [_sid, gd] of Object.entries(state.guards)) {
+            for (const entry of gd.lockedFiles) {
+                const fp = path.resolve(gd.projectRoot, entry.locator);
+                try {
+                    if (fs.existsSync(fp)) {
+                        restoreWritable(fp, entry.originalMode, entry.originalReadOnly);
+                        recovered.push(entry.locator);
+                    }
+                }
+                catch (e) {
+                    errors.push(`${entry.locator}: ${e instanceof Error ? e.message : String(e)}`);
+                }
+            }
+        }
+        fs.unlinkSync(statePath);
+    }
+    catch (e) {
+        errors.push(`Failed to read guard state: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    return { recovered, errors };
+}
+export function lockClaimedFiles(input) {
+    const claims = rcList({
+        sessionId: input.sessionId,
+        resourceType: "file",
+        status: "ACTIVE",
+    });
+    const locators = collectFileLocators(claims);
+    const locked = [];
+    const skipped = [];
+    const errors = [];
+    const lockedFiles = new Map();
+    const nowTs = new Date().toISOString();
+    for (const locator of locators) {
+        const filePath = path.resolve(input.projectRoot, locator);
+        try {
+            if (!fs.existsSync(filePath)) {
+                skipped.push(locator);
+                continue;
+            }
+            const result = setReadOnly(filePath);
+            if (result) {
+                lockedFiles.set(locator, {
+                    originalMode: result.originalMode,
+                    originalReadOnly: result.originalReadOnly,
+                    lockedAt: nowTs,
+                    lockedBy: input.guardSessionId,
+                });
+                locked.push(locator);
+            }
+            else {
+                skipped.push(locator);
+            }
+        }
+        catch (error) {
+            errors.push(`${locator}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    activeGuards.set(input.guardSessionId, {
+        sessionId: input.guardSessionId,
+        projectRoot: input.projectRoot,
+        lockedFiles,
+    });
+    persistGuardState(input.projectRoot);
+    logEvent(EventType.SYNC_GATE_CREATED, "file_permission_guard", input.guardSessionId, JSON.stringify({ locked, skipped, errors, taskId: input.taskId }));
+    return { locked, skipped, errors };
+}
+export function unlockClaimedFiles(guardSessionId) {
+    const guard = activeGuards.get(guardSessionId);
+    if (!guard)
+        return { unlocked: [], errors: [] };
+    const unlocked = [];
+    const errors = [];
+    for (const [locator, info] of guard.lockedFiles) {
+        const filePath = path.resolve(guard.projectRoot, locator);
+        try {
+            restoreWritable(filePath, info.originalMode, info.originalReadOnly);
+            unlocked.push(locator);
+        }
+        catch (error) {
+            errors.push(`${locator}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    activeGuards.delete(guardSessionId);
+    persistGuardState(guard.projectRoot);
+    return { unlocked, errors };
+}
+/**
+ * Emergency unlock: restore all locked files across all guards.
+ */
+export function unlockAllGuards(projectRoot) {
+    const unlocked = [];
+    const errors = [];
+    const guardsToProcess = projectRoot
+        ? [...activeGuards.values()].filter(g => g.projectRoot === projectRoot)
+        : [...activeGuards.values()];
+    for (const guard of guardsToProcess) {
+        for (const [locator, info] of guard.lockedFiles) {
+            const filePath = path.resolve(guard.projectRoot, locator);
+            try {
+                restoreWritable(filePath, info.originalMode, info.originalReadOnly);
+                unlocked.push(locator);
+            }
+            catch (error) {
+                errors.push(`${locator}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        activeGuards.delete(guard.sessionId);
+        persistGuardState(guard.projectRoot);
+    }
+    // Also recover from persisted state if projectRoot specified
+    if (projectRoot) {
+        const recovery = recoverGuardState(projectRoot);
+        unlocked.push(...recovery.recovered);
+        errors.push(...recovery.errors);
+    }
+    return { unlocked, errors };
+}
+export function temporarilyUnlockForWrite(projectRoot, locators) {
+    const saved = [];
+    for (const locator of locators) {
+        const filePath = path.resolve(projectRoot, locator);
+        try {
+            if (!fs.existsSync(filePath))
+                continue;
+            const stat = fs.statSync(filePath);
+            if (!isWritable(stat.mode)) {
+                const wasReadOnly = isWindows ? isWindowsReadOnly(filePath) : false;
+                if (isWindows) {
+                    clearWindowsReadOnly(filePath);
+                }
+                else {
+                    fs.chmodSync(filePath, makeWritable(stat.mode));
+                }
+                saved.push({ filePath, mode: stat.mode, wasReadOnly });
+            }
+        }
+        catch {
+            // If we can't check/unlock, writeApply will fail with EACCES — that's the correct behavior
+        }
+    }
+    return {
+        restore() {
+            for (const { filePath, mode, wasReadOnly } of saved) {
+                try {
+                    if (!fs.existsSync(filePath))
+                        continue;
+                    if (isWindows) {
+                        if (wasReadOnly)
+                            setWindowsReadOnly(filePath);
+                    }
+                    else {
+                        fs.chmodSync(filePath, mode);
+                    }
+                }
+                catch { /* best-effort */ }
+            }
+        },
+    };
+}
+export function isGuardActive(guardSessionId) {
+    return activeGuards.has(guardSessionId);
+}
+export function getActiveGuardForRoot(projectRoot) {
+    for (const guard of activeGuards.values()) {
+        if (guard.projectRoot === projectRoot)
+            return guard;
+    }
+    return undefined;
+}
+export function refreshGuardLocks(input) {
+    const guard = activeGuards.get(input.guardSessionId);
+    if (!guard)
+        return { newLocks: [], errors: [] };
+    const claims = rcList({
+        sessionId: input.sessionId,
+        resourceType: "file",
+        status: "ACTIVE",
+    });
+    const locators = collectFileLocators(claims);
+    const newLocks = [];
+    const errors = [];
+    const nowTs = new Date().toISOString();
+    for (const locator of locators) {
+        if (guard.lockedFiles.has(locator))
+            continue;
+        const filePath = path.resolve(guard.projectRoot, locator);
+        try {
+            if (!fs.existsSync(filePath))
+                continue;
+            const result = setReadOnly(filePath);
+            if (result) {
+                guard.lockedFiles.set(locator, {
+                    originalMode: result.originalMode,
+                    originalReadOnly: result.originalReadOnly,
+                    lockedAt: nowTs,
+                    lockedBy: input.guardSessionId,
+                });
+                newLocks.push(locator);
+            }
+        }
+        catch (error) {
+            errors.push(`${locator}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    persistGuardState(guard.projectRoot);
+    return { newLocks, errors };
+}
+function collectFileLocators(claims) {
+    const locators = new Set();
+    for (const claim of claims) {
+        for (const resource of claim.resources) {
+            if (resource.type === "file")
+                locators.add(resource.locator);
+        }
+    }
+    return locators;
+}
+function makeReadOnly(mode) {
+    // Remove write bits: owner (0o200), group (0o020), others (0o002)
+    return mode & ~0o222;
+}
+function makeWritable(mode) {
+    // Add owner write bit
+    return mode | 0o200;
+}
+function isWritable(mode) {
+    return (mode & 0o200) !== 0;
+}
+//# sourceMappingURL=file-permission-guard.js.map

package/dist/server/application/file-permission-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-permission-guard.js","sourceRoot":"","sources":["../../../_build/src/server/application/file-permission-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AAqBrD,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,eAAe,GAAG,YAAY,CAAC;AACrC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAE5C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAoC,CAAC;AACjE,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC;AAE5C,MAAM,UAAU,kCAAkC;IAChD,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,uDAAuD;AAEvD,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC;QAC/B,MAAM,gBAAgB,GAAG,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACzE,IAAI,SAAS,EAAE,CAAC;YACd,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;YAChD,IAAI,YAAY,KAAK,YAAY;gBAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,YAAoB,EAAE,gBAAyB;IACxF,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO;QACrC,IAAI,SAAS,EAAE,CAAC;YAAC,IAAI,CAAC,gBAAgB;gBAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;aACpE,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACpF,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAwC,CAAC;QAC1F,QAAQ,CAAC,cAAc,QAAQ,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAwC,CAAC;QAC1F,QAAQ,CAAC,cAAc,QAAQ,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,wDAAwD;AAExD,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAmB,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC/E,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;YAC9C,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW;gBAAE,SAAS;YAChD,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG;gBAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC7E,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;oBACjF,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACjD,CAAC,CAAC;aACJ,CAAC;QACJ,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,SAAS,GAAa,EAAE,CAAC;IAAC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5D,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAmB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9E,IAAI,KAAK,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;YAClE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC/B,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACtD,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACnC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBACvD,IAAI,CAAC;oBAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;wBAAC,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;wBAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBAAC,CAAC;gBAAC,CAAC;gBAClI,OAAO,CAAC,EAAE,CAAC;oBAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;YAC/F,CAAC;QACH,CAAC;QACD,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IACzG,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAKhC;IACC,MAAM,MAAM,GAAG,MAAM,CAAC;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,MAAM;QACpB,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAmG,CAAC;IAC/H,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEvC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAClE,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,MAAM,EAAE,CAAC;gBACX,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE;oBACvB,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;oBACzC,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,KAAK,CAAC,cAAc;iBAC/B,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE;QACrC,SAAS,EAAE,KAAK,CAAC,cAAc;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW;KACZ,CAAC,CAAC;IAEH,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAErC,QAAQ,CACN,SAAS,CAAC,iBAAiB,EAC3B,uBAAuB,EACvB,KAAK,CAAC,cAAc,EACpB,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAClE,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,cAAsB;IACvD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAEhD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACpE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACpC,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,WAAoB;IAClD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,eAAe,GAAG,WAAW;QACjC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC;QACvE,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC;gBACH,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;gBACpE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;QACD,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrC,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAED,6DAA6D;IAC7D,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAChD,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,WAAmB,EACnB,QAAkB;IAElB,MAAM,KAAK,GAAoE,EAAE,CAAC;IAElF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACvC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBACpE,IAAI,SAAS,EAAE,CAAC;oBAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;gBAAC,CAAC;qBAC7C,CAAC;oBAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAC,CAAC;gBACzD,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2FAA2F;QAC7F,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO;YACL,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,KAAK,EAAE,CAAC;gBACpD,IAAI,CAAC;oBACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;wBAAE,SAAS;oBACvC,IAAI,SAAS,EAAE,CAAC;wBAAC,IAAI,WAAW;4BAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;oBAAC,CAAC;yBAC5D,CAAC;wBAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;oBAAC,CAAC;gBACxC,CAAC;gBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,cAAsB;IAClD,OAAO,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW;YAAE,OAAO,KAAK,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAIjC;IACC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAEhD,MAAM,MAAM,GAAG,MAAM,CAAC;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,MAAM;QACpB,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEvC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACvC,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,MAAM,EAAE,CAAC;gBACX,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE;oBAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;oBACzC,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,KAAK,CAAC,cAAc;iBAC/B,CAAC,CAAC;gBACH,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAuB;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACvC,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM;gBAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,kEAAkE;IAClE,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC;AACvB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,sBAAsB;IACtB,OAAO,IAAI,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC"}

package/dist/server/application/guard-session-service.d.ts

@@ -0,0 +1,48 @@
+export type GuardMode = "observe" | "stage" | "strict" | "readonly";
+export type GuardSessionStatus = "active" | "expired" | "revoked";
+export type GuardProxyAdapter = "winfsp" | "fuse" | "macfuse" | "manual";
+export interface GuardCreateSessionInput {
+    actorId: string;
+    taskId: string;
+    sessionId?: string;
+    mode?: GuardMode;
+    mountPath?: string;
+    adapter?: GuardProxyAdapter;
+    ttlSeconds?: number;
+}
+export interface GuardSession {
+    id: string;
+    actorId: string;
+    taskId: string;
+    sessionId: string;
+    projectRoot: string;
+    mountPath: string;
+    mode: GuardMode;
+    adapter: GuardProxyAdapter;
+    token: string;
+    status: GuardSessionStatus;
+    createdAt: string;
+    expiresAt: string;
+}
+export interface GuardStatusResult {
+    projectRoot: string;
+    enforcementLevel: "controlled" | "editor_guard" | "workspace_proxy";
+    proxyAvailable: boolean;
+    proxyAdapters: Array<{
+        adapter: GuardProxyAdapter;
+        available: boolean;
+        reason: string;
+    }>;
+    activeSessions: Array<Omit<GuardSession, "token">>;
+}
+export interface GuardValidateTokenResult {
+    valid: boolean;
+    session?: Omit<GuardSession, "token">;
+    reason?: string;
+}
+export declare function __clearGuardSessionsForTest(): void;
+export declare function guardStatus(): GuardStatusResult;
+export declare function guardCreateSession(input: GuardCreateSessionInput): GuardSession;
+export declare function guardValidateToken(token: string): GuardValidateTokenResult;
+export declare function guardRevokeSession(sessionId: string): Omit<GuardSession, "token">;
+//# sourceMappingURL=guard-session-service.d.ts.map

package/dist/server/application/guard-session-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-session-service.d.ts","sourceRoot":"","sources":["../../../_build/src/server/application/guard-session-service.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;AACpE,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAClE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEzE,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,kBAAkB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,YAAY,GAAG,cAAc,GAAG,iBAAiB,CAAC;IACpE,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,iBAAiB,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzF,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AASD,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED,wBAAgB,WAAW,IAAI,iBAAiB,CAgB/C;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,YAAY,CAkC/E;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,wBAAwB,CAO1E;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAMjF"}