titan-agent 6.1.0-beta.2 → 6.1.0-beta.21

package/dist/agent/verification.js

@@ -0,0 +1,164 @@
+#!/usr/bin/env node
+import { readFileSync, statSync, existsSync } from "fs";
+function verifyFileWrite(path, expectedBytes, contentSample) {
+  const verifier = "fs.readback";
+  if (!existsSync(path)) {
+    return {
+      passed: false,
+      reason: `expected ${path} to exist after write \u2014 it does not`,
+      verifier,
+      confidence: 1
+    };
+  }
+  let actualBytes = 0;
+  try {
+    actualBytes = statSync(path).size;
+  } catch (e) {
+    return {
+      passed: false,
+      reason: `stat failed on ${path}: ${e.message}`,
+      verifier,
+      confidence: 1
+    };
+  }
+  if (actualBytes !== expectedBytes) {
+    return {
+      passed: false,
+      reason: `byte mismatch: wrote ${expectedBytes}, stat reports ${actualBytes}`,
+      verifier,
+      confidence: 1
+    };
+  }
+  if (contentSample && contentSample.length > 0) {
+    try {
+      const sampleSize = Math.min(contentSample.length, 256);
+      const fd = readFileSync(path, "utf-8").slice(0, sampleSize);
+      const expectedHead = contentSample.slice(0, sampleSize);
+      if (fd !== expectedHead) {
+        return {
+          passed: false,
+          reason: `head ${sampleSize}b drift after write`,
+          verifier,
+          confidence: 0.95
+        };
+      }
+    } catch (e) {
+      return {
+        passed: false,
+        reason: `readback failed: ${e.message}`,
+        verifier,
+        confidence: 1
+      };
+    }
+  }
+  return {
+    passed: true,
+    reason: `verified ${actualBytes}b on disk`,
+    verifier,
+    confidence: 1
+  };
+}
+function verifyImageDownload(buf, expectedMimeType) {
+  const verifier = "image.magic";
+  if (!buf || buf.length < 4) {
+    return {
+      passed: false,
+      reason: `image buffer too small (${buf?.length ?? 0} bytes)`,
+      verifier,
+      confidence: 1
+    };
+  }
+  const checks = {
+    "image/png": (b) => b[0] === 137 && b[1] === 80 && b[2] === 78 && b[3] === 71,
+    "image/jpeg": (b) => b[0] === 255 && b[1] === 216 && b[2] === 255,
+    "image/gif": (b) => b.slice(0, 6).toString("ascii") === "GIF87a" || b.slice(0, 6).toString("ascii") === "GIF89a",
+    "image/webp": (b) => b.slice(0, 4).toString("ascii") === "RIFF" && b.slice(8, 12).toString("ascii") === "WEBP",
+    "image/bmp": (b) => b[0] === 66 && b[1] === 77,
+    // AVIF: 'ftypavif' or 'ftypavis' at offset 4
+    "image/avif": (b) => b.length >= 12 && b.slice(4, 8).toString("ascii") === "ftyp" && (b.slice(8, 12).toString("ascii") === "avif" || b.slice(8, 12).toString("ascii") === "avis")
+  };
+  const check = checks[expectedMimeType];
+  if (!check) {
+    if (expectedMimeType === "image/svg+xml") {
+      const head = buf.slice(0, 100).toString("utf-8").trim().toLowerCase();
+      const looksLikeSvg = head.startsWith("<svg") || head.startsWith("<?xml") || head.includes("<svg");
+      return {
+        passed: looksLikeSvg,
+        reason: looksLikeSvg ? "svg-like header present" : "no <svg root tag in first 100 bytes",
+        verifier,
+        confidence: 0.7
+      };
+    }
+    return {
+      passed: true,
+      reason: `no magic check for ${expectedMimeType} \u2014 accepting on size`,
+      verifier,
+      confidence: 0.5
+    };
+  }
+  const matched = check(buf);
+  return {
+    passed: matched,
+    reason: matched ? `magic header matches ${expectedMimeType}` : `magic header MISMATCH for ${expectedMimeType} \u2014 got 0x${buf.slice(0, 4).toString("hex")}`,
+    verifier,
+    confidence: 1
+  };
+}
+const RING_CAPACITY = 256;
+const ring = [];
+const listeners = /* @__PURE__ */ new Set();
+function subscribeVerification(fn) {
+  listeners.add(fn);
+  return () => {
+    listeners.delete(fn);
+  };
+}
+function recordVerificationEvent(event) {
+  const at = event.at ?? Date.now();
+  const full = { at, kind: event.kind, result: event.result, artifactRef: event.artifactRef };
+  ring.push(full);
+  if (ring.length > RING_CAPACITY) ring.splice(0, ring.length - RING_CAPACITY);
+  for (const listener of listeners) {
+    try {
+      listener(full);
+    } catch {
+    }
+  }
+}
+function recentVerificationEvents(limit = 32) {
+  return ring.slice(-limit);
+}
+function consecutiveTrailingFailures(forKinds) {
+  let n = 0;
+  for (let i = ring.length - 1; i >= 0; i--) {
+    const e = ring[i];
+    if (forKinds && !forKinds.includes(e.kind)) continue;
+    if (e.result.passed) return n;
+    n++;
+  }
+  return n;
+}
+function clearVerificationRing() {
+  ring.length = 0;
+}
+function verificationEventsSince(sinceMs, forKinds) {
+  return ring.filter(
+    (e) => e.at >= sinceMs && (forKinds ? forKinds.includes(e.kind) : true)
+  );
+}
+function formatVerificationSuffix(v) {
+  if (v.passed) return ` [verify: ${v.reason}]`;
+  return ` [\u26A0 verify FAIL: ${v.reason}]`;
+}
+export {
+  clearVerificationRing,
+  consecutiveTrailingFailures,
+  formatVerificationSuffix,
+  recentVerificationEvents,
+  recordVerificationEvent,
+  subscribeVerification,
+  verificationEventsSince,
+  verifyFileWrite,
+  verifyImageDownload
+};
+//# sourceMappingURL=verification.js.map

package/dist/agent/verification.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/agent/verification.ts"],"sourcesContent":["/**\n * TITAN — Runtime verification primitives (v6.1.0-beta.9)\n *\n * \"Verify-before-claim\" runtime helpers used by skills that produce\n * artifacts (write_file, append_file, edit_file, download_image, …).\n * The idea: every tool call that asserts \"I did X\" must produce a\n * checkable artifact, and the agent must read that artifact back\n * before reporting completion.\n *\n * The motivating problem: benchmark-cheating in the wider agent\n * ecosystem (UC Berkeley CRDI showed that all eight major agent\n * benchmarks are exploitable via reward-hacking; one model copied\n * answers from `git log`). The defense is not to chase a benchmark\n * number — it's to make every claim independently checkable AT\n * RUNTIME, regardless of which model is driving.\n *\n * This module gives the rest of the codebase three primitives:\n *\n *   - `verifyFileWrite(path, expectedBytesWritten, contentSample?)`\n *       Reads the file back. Confirms it exists, the byte count\n *       matches the intended write, and (if a `contentSample` was\n *       given) that the first ~256 bytes round-trip correctly.\n *       Surfaces any drift as a `VerificationResult` the caller can\n *       attach to its return value.\n *\n *   - `verifyImageDownload(buf, expectedMimeType)`\n *       Sniffs the first ~12 bytes for a magic-number match\n *       against the claimed MIME type. PNG, JPEG, GIF, WebP, BMP,\n *       AVIF are recognized. SVG and unknown types pass through\n *       with `confidence < 1`. Catches the \"CDN served HTML\n *       instead of an image\" failure mode that previously slipped\n *       through silently.\n *\n *   - `recordVerificationEvent(event)` / `recentVerificationEvents()`\n *       Pushes to a bounded in-memory ring buffer that the driver\n *       loop reads to compute `consecutiveAssertionFailures`, and\n *       that the UI can subscribe to for trust-line gating.\n *\n * Failure semantics: a failed verification does NOT throw or abort\n * the write — the file is already on disk by the time we're called.\n * Instead it RETURNS a structured `VerificationResult` so the caller\n * can decide whether to surface it as a non-fatal warning or as\n * an error to the driver loop. The driver loop's\n * `consecutiveAssertionFailures` counter (added to DriverSubtaskState\n * in this same release) decides when accumulated failures escalate\n * into a subtask-fail.\n *\n * Why a separate module: tests need to import this WITHOUT pulling\n * the whole skill registry. The verifier helpers are pure functions\n * + a tiny in-memory store, so they're cheap to load in isolation.\n */\n\nimport { readFileSync, statSync, existsSync } from 'fs';\n\n/* ───────────────────────────  Types  ─────────────────────────── */\n\nexport type VerificationKind =\n    | 'file_write'\n    | 'file_append'\n    | 'file_edit'\n    | 'image_download'\n    | 'browser_fetch';\n\nexport interface VerificationResult {\n    /** Did the artifact match expectations? */\n    passed: boolean;\n    /** Short human-readable diagnostic. Goes into the tool return string. */\n    reason: string;\n    /** Stable id of the verifier that ran (for telemetry + tests). */\n    verifier: string;\n    /** 0–1. 1 = bit-exact match; lower = heuristic match. */\n    confidence: number;\n}\n\nexport interface VerificationEvent {\n    /** Wall-clock ms at the time the event was recorded. */\n    at: number;\n    /** Which artifact kind was verified. */\n    kind: VerificationKind;\n    /** Same result fields the caller attached to its return value. */\n    result: VerificationResult;\n    /** Best-effort identifier for the artifact (path / URL / hash). */\n    artifactRef: string;\n}\n\n/* ───────────────────────────  File write verification  ─────────────────────────── */\n\n/**\n * Verify a file write by reading the artifact back.\n *\n * We re-stat the path and confirm:\n *   1. The file exists.\n *   2. Its size matches `expectedBytes` exactly (utf-8 byte count).\n *   3. (Optional) the first `contentSample.length` bytes match\n *      `contentSample`. Sampling rather than full-file readback so\n *      we don't double the IO cost for large writes.\n *\n * Returns `{ passed: false }` if any check fails. Returns\n * `{ passed: true, confidence: 1 }` only if all checks succeed.\n *\n * The 200-byte sample size is a deliberate trade — large enough to\n * catch encoding drift (BOM, line-ending munging, base64 garbling)\n * but small enough that a 50 MB HTML report doesn't cost two reads.\n */\nexport function verifyFileWrite(\n    path: string,\n    expectedBytes: number,\n    contentSample?: string,\n): VerificationResult {\n    const verifier = 'fs.readback';\n    if (!existsSync(path)) {\n        return {\n            passed: false,\n            reason: `expected ${path} to exist after write — it does not`,\n            verifier,\n            confidence: 1,\n        };\n    }\n    let actualBytes = 0;\n    try {\n        actualBytes = statSync(path).size;\n    } catch (e) {\n        return {\n            passed: false,\n            reason: `stat failed on ${path}: ${(e as Error).message}`,\n            verifier,\n            confidence: 1,\n        };\n    }\n    if (actualBytes !== expectedBytes) {\n        return {\n            passed: false,\n            reason: `byte mismatch: wrote ${expectedBytes}, stat reports ${actualBytes}`,\n            verifier,\n            confidence: 1,\n        };\n    }\n    if (contentSample && contentSample.length > 0) {\n        try {\n            const sampleSize = Math.min(contentSample.length, 256);\n            const fd = readFileSync(path, 'utf-8').slice(0, sampleSize);\n            const expectedHead = contentSample.slice(0, sampleSize);\n            if (fd !== expectedHead) {\n                return {\n                    passed: false,\n                    reason: `head ${sampleSize}b drift after write`,\n                    verifier,\n                    confidence: 0.95,\n                };\n            }\n        } catch (e) {\n            return {\n                passed: false,\n                reason: `readback failed: ${(e as Error).message}`,\n                verifier,\n                confidence: 1,\n            };\n        }\n    }\n    return {\n        passed: true,\n        reason: `verified ${actualBytes}b on disk`,\n        verifier,\n        confidence: 1,\n    };\n}\n\n/* ───────────────────────────  Image download verification  ─────────────────────────── */\n\n/**\n * Sniff the first ~12 bytes of a buffer for a magic-number match\n * against the claimed MIME type. Catches the \"the CDN served an\n * HTML error page with content-type image/jpeg\" failure mode that\n * otherwise looks like a successful download until the user opens\n * the HTML report and sees broken images.\n *\n * SVG and unknown formats can't be magic-checked from 12 bytes\n * (SVG is text, AVIF varies, etc.) so they pass with\n * `confidence: 0.5` — a callable check ran, but it can't be\n * bit-exact.\n *\n * Magic-number table sourced from the file(1) signature DB and\n * the W3C Media Type registry, restricted to the formats\n * `inferMimeFromUrl()` in download_image.ts emits.\n */\nexport function verifyImageDownload(\n    buf: Buffer,\n    expectedMimeType: string,\n): VerificationResult {\n    const verifier = 'image.magic';\n    if (!buf || buf.length < 4) {\n        return {\n            passed: false,\n            reason: `image buffer too small (${buf?.length ?? 0} bytes)`,\n            verifier,\n            confidence: 1,\n        };\n    }\n    // Magic-number checks. Each entry returns true if the buffer\n    // starts with the relevant signature for `mime`.\n    const checks: Record<string, (b: Buffer) => boolean> = {\n        'image/png':  b => b[0] === 0x89 && b[1] === 0x50 && b[2] === 0x4e && b[3] === 0x47,\n        'image/jpeg': b => b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff,\n        'image/gif':  b => b.slice(0, 6).toString('ascii') === 'GIF87a' || b.slice(0, 6).toString('ascii') === 'GIF89a',\n        'image/webp': b => b.slice(0, 4).toString('ascii') === 'RIFF' && b.slice(8, 12).toString('ascii') === 'WEBP',\n        'image/bmp':  b => b[0] === 0x42 && b[1] === 0x4d,\n        // AVIF: 'ftypavif' or 'ftypavis' at offset 4\n        'image/avif': b => b.length >= 12 && b.slice(4, 8).toString('ascii') === 'ftyp' && (b.slice(8, 12).toString('ascii') === 'avif' || b.slice(8, 12).toString('ascii') === 'avis'),\n    };\n    const check = checks[expectedMimeType];\n    if (!check) {\n        // SVG (XML), unknown types — best-effort acceptance.\n        if (expectedMimeType === 'image/svg+xml') {\n            const head = buf.slice(0, 100).toString('utf-8').trim().toLowerCase();\n            const looksLikeSvg = head.startsWith('<svg') || head.startsWith('<?xml') || head.includes('<svg');\n            return {\n                passed: looksLikeSvg,\n                reason: looksLikeSvg ? 'svg-like header present' : 'no <svg root tag in first 100 bytes',\n                verifier,\n                confidence: 0.7,\n            };\n        }\n        return {\n            passed: true,\n            reason: `no magic check for ${expectedMimeType} — accepting on size`,\n            verifier,\n            confidence: 0.5,\n        };\n    }\n    const matched = check(buf);\n    return {\n        passed: matched,\n        reason: matched\n            ? `magic header matches ${expectedMimeType}`\n            : `magic header MISMATCH for ${expectedMimeType} — got 0x${buf.slice(0, 4).toString('hex')}`,\n        verifier,\n        confidence: 1,\n    };\n}\n\n/* ───────────────────────────  Event ring buffer  ─────────────────────────── */\n\n/**\n * Bounded ring buffer of recent verification events. Read by the\n * driver loop's `consecutiveAssertionFailures` calculator and by\n * any UI surface that wants to render a trust-line.\n *\n * Capped at 256 entries — plenty for a long mission's worth of\n * writes, small enough that we never hold the buffer for memory.\n */\nconst RING_CAPACITY = 256;\nconst ring: VerificationEvent[] = [];\n\n/** Live subscribers — see subscribeVerification. */\ntype VerificationListener = (event: VerificationEvent) => void;\nconst listeners = new Set<VerificationListener>();\n\n/**\n * Subscribe to live verification events. Returns an unsubscribe\n * function. Used by the gateway SSE endpoint and by any in-process\n * listener that wants real-time trust signal.\n */\nexport function subscribeVerification(fn: VerificationListener): () => void {\n    listeners.add(fn);\n    return () => { listeners.delete(fn); };\n}\n\nexport function recordVerificationEvent(event: Omit<VerificationEvent, 'at'> & { at?: number }): void {\n    const at = event.at ?? Date.now();\n    const full: VerificationEvent = { at, kind: event.kind, result: event.result, artifactRef: event.artifactRef };\n    ring.push(full);\n    if (ring.length > RING_CAPACITY) ring.splice(0, ring.length - RING_CAPACITY);\n    // beta.10 — fan-out to live subscribers (SSE stream, in-process\n    // listeners). Errors in any one subscriber are swallowed so a\n    // misbehaving listener can't break the recorder for the rest.\n    for (const listener of listeners) {\n        try { listener(full); } catch { /* never let a bad subscriber affect the recorder */ }\n    }\n}\n\nexport function recentVerificationEvents(limit = 32): VerificationEvent[] {\n    return ring.slice(-limit);\n}\n\n/**\n * Count consecutive trailing verification failures. Used by the\n * driver loop to decide whether to escalate. Walks the ring from\n * newest to oldest, stopping at the first `passed: true`.\n *\n * `forKinds` filters which artifact kinds count (defaults to all).\n * Pass e.g. `['file_write','file_edit']` if a subtask only writes\n * files and you don't want unrelated browser fetches to influence\n * its failure count.\n */\nexport function consecutiveTrailingFailures(forKinds?: VerificationKind[]): number {\n    let n = 0;\n    for (let i = ring.length - 1; i >= 0; i--) {\n        const e = ring[i];\n        if (forKinds && !forKinds.includes(e.kind)) continue;\n        if (e.result.passed) return n;\n        n++;\n    }\n    return n;\n}\n\n/** For tests. Safe to call in prod too. */\nexport function clearVerificationRing(): void {\n    ring.length = 0;\n}\n\n/**\n * Return every event whose `at >= sinceMs`, optionally filtered by\n * artifact kind. The driver loop uses this to attribute verification\n * events to the currently-running spawn (events recorded between\n * spawn-start and spawn-return belong to that spawn).\n *\n * Returns a fresh array; safe to iterate without locking. Order is\n * preserved (oldest → newest).\n */\nexport function verificationEventsSince(\n    sinceMs: number,\n    forKinds?: VerificationKind[],\n): VerificationEvent[] {\n    return ring.filter(e =>\n        e.at >= sinceMs && (forKinds ? forKinds.includes(e.kind) : true),\n    );\n}\n\n\n/**\n * Format a `VerificationResult` for inclusion in a tool's return\n * string. Returns a leading space + bracketed status so concatenation\n * stays clean: `Successfully wrote 1234b to /path [verified 1234b on disk]`.\n *\n * Failed verifications get a \"⚠\" prefix so they're visually distinct\n * when the agent reads them back, without breaking the existing\n * \"Successfully …\" return format that downstream parsers may rely on.\n */\nexport function formatVerificationSuffix(v: VerificationResult): string {\n    if (v.passed) return ` [verify: ${v.reason}]`;\n    return ` [⚠ verify FAIL: ${v.reason}]`;\n}\n"],"mappings":";AAoDA,SAAS,cAAc,UAAU,kBAAkB;AAoD5C,SAAS,gBACZ,MACA,eACA,eACkB;AAClB,QAAM,WAAW;AACjB,MAAI,CAAC,WAAW,IAAI,GAAG;AACnB,WAAO;AAAA,MACH,QAAQ;AAAA,MACR,QAAQ,YAAY,IAAI;AAAA,MACxB;AAAA,MACA,YAAY;AAAA,IAChB;AAAA,EACJ;AACA,MAAI,cAAc;AAClB,MAAI;AACA,kBAAc,SAAS,IAAI,EAAE;AAAA,EACjC,SAAS,GAAG;AACR,WAAO;AAAA,MACH,QAAQ;AAAA,MACR,QAAQ,kBAAkB,IAAI,KAAM,EAAY,OAAO;AAAA,MACvD;AAAA,MACA,YAAY;AAAA,IAChB;AAAA,EACJ;AACA,MAAI,gBAAgB,eAAe;AAC/B,WAAO;AAAA,MACH,QAAQ;AAAA,MACR,QAAQ,wBAAwB,aAAa,kBAAkB,WAAW;AAAA,MAC1E;AAAA,MACA,YAAY;AAAA,IAChB;AAAA,EACJ;AACA,MAAI,iBAAiB,cAAc,SAAS,GAAG;AAC3C,QAAI;AACA,YAAM,aAAa,KAAK,IAAI,cAAc,QAAQ,GAAG;AACrD,YAAM,KAAK,aAAa,MAAM,OAAO,EAAE,MAAM,GAAG,UAAU;AAC1D,YAAM,eAAe,cAAc,MAAM,GAAG,UAAU;AACtD,UAAI,OAAO,cAAc;AACrB,eAAO;AAAA,UACH,QAAQ;AAAA,UACR,QAAQ,QAAQ,UAAU;AAAA,UAC1B;AAAA,UACA,YAAY;AAAA,QAChB;AAAA,MACJ;AAAA,IACJ,SAAS,GAAG;AACR,aAAO;AAAA,QACH,QAAQ;AAAA,QACR,QAAQ,oBAAqB,EAAY,OAAO;AAAA,QAChD;AAAA,QACA,YAAY;AAAA,MAChB;AAAA,IACJ;AAAA,EACJ;AACA,SAAO;AAAA,IACH,QAAQ;AAAA,IACR,QAAQ,YAAY,WAAW;AAAA,IAC/B;AAAA,IACA,YAAY;AAAA,EAChB;AACJ;AAoBO,SAAS,oBACZ,KACA,kBACkB;AAClB,QAAM,WAAW;AACjB,MAAI,CAAC,OAAO,IAAI,SAAS,GAAG;AACxB,WAAO;AAAA,MACH,QAAQ;AAAA,MACR,QAAQ,2BAA2B,KAAK,UAAU,CAAC;AAAA,MACnD;AAAA,MACA,YAAY;AAAA,IAChB;AAAA,EACJ;AAGA,QAAM,SAAiD;AAAA,IACnD,aAAc,OAAK,EAAE,CAAC,MAAM,OAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM;AAAA,IAC/E,cAAc,OAAK,EAAE,CAAC,MAAM,OAAQ,EAAE,CAAC,MAAM,OAAQ,EAAE,CAAC,MAAM;AAAA,IAC9D,aAAc,OAAK,EAAE,MAAM,GAAG,CAAC,EAAE,SAAS,OAAO,MAAM,YAAY,EAAE,MAAM,GAAG,CAAC,EAAE,SAAS,OAAO,MAAM;AAAA,IACvG,cAAc,OAAK,EAAE,MAAM,GAAG,CAAC,EAAE,SAAS,OAAO,MAAM,UAAU,EAAE,MAAM,GAAG,EAAE,EAAE,SAAS,OAAO,MAAM;AAAA,IACtG,aAAc,OAAK,EAAE,CAAC,MAAM,MAAQ,EAAE,CAAC,MAAM;AAAA;AAAA,IAE7C,cAAc,OAAK,EAAE,UAAU,MAAM,EAAE,MAAM,GAAG,CAAC,EAAE,SAAS,OAAO,MAAM,WAAW,EAAE,MAAM,GAAG,EAAE,EAAE,SAAS,OAAO,MAAM,UAAU,EAAE,MAAM,GAAG,EAAE,EAAE,SAAS,OAAO,MAAM;AAAA,EAC5K;AACA,QAAM,QAAQ,OAAO,gBAAgB;AACrC,MAAI,CAAC,OAAO;AAER,QAAI,qBAAqB,iBAAiB;AACtC,YAAM,OAAO,IAAI,MAAM,GAAG,GAAG,EAAE,SAAS,OAAO,EAAE,KAAK,EAAE,YAAY;AACpE,YAAM,eAAe,KAAK,WAAW,MAAM,KAAK,KAAK,WAAW,OAAO,KAAK,KAAK,SAAS,MAAM;AAChG,aAAO;AAAA,QACH,QAAQ;AAAA,QACR,QAAQ,eAAe,4BAA4B;AAAA,QACnD;AAAA,QACA,YAAY;AAAA,MAChB;AAAA,IACJ;AACA,WAAO;AAAA,MACH,QAAQ;AAAA,MACR,QAAQ,sBAAsB,gBAAgB;AAAA,MAC9C;AAAA,MACA,YAAY;AAAA,IAChB;AAAA,EACJ;AACA,QAAM,UAAU,MAAM,GAAG;AACzB,SAAO;AAAA,IACH,QAAQ;AAAA,IACR,QAAQ,UACF,wBAAwB,gBAAgB,KACxC,6BAA6B,gBAAgB,iBAAY,IAAI,MAAM,GAAG,CAAC,EAAE,SAAS,KAAK,CAAC;AAAA,IAC9F;AAAA,IACA,YAAY;AAAA,EAChB;AACJ;AAYA,MAAM,gBAAgB;AACtB,MAAM,OAA4B,CAAC;AAInC,MAAM,YAAY,oBAAI,IAA0B;AAOzC,SAAS,sBAAsB,IAAsC;AACxE,YAAU,IAAI,EAAE;AAChB,SAAO,MAAM;AAAE,cAAU,OAAO,EAAE;AAAA,EAAG;AACzC;AAEO,SAAS,wBAAwB,OAA8D;AAClG,QAAM,KAAK,MAAM,MAAM,KAAK,IAAI;AAChC,QAAM,OAA0B,EAAE,IAAI,MAAM,MAAM,MAAM,QAAQ,MAAM,QAAQ,aAAa,MAAM,YAAY;AAC7G,OAAK,KAAK,IAAI;AACd,MAAI,KAAK,SAAS,cAAe,MAAK,OAAO,GAAG,KAAK,SAAS,aAAa;AAI3E,aAAW,YAAY,WAAW;AAC9B,QAAI;AAAE,eAAS,IAAI;AAAA,IAAG,QAAQ;AAAA,IAAuD;AAAA,EACzF;AACJ;AAEO,SAAS,yBAAyB,QAAQ,IAAyB;AACtE,SAAO,KAAK,MAAM,CAAC,KAAK;AAC5B;AAYO,SAAS,4BAA4B,UAAuC;AAC/E,MAAI,IAAI;AACR,WAAS,IAAI,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK;AACvC,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,YAAY,CAAC,SAAS,SAAS,EAAE,IAAI,EAAG;AAC5C,QAAI,EAAE,OAAO,OAAQ,QAAO;AAC5B;AAAA,EACJ;AACA,SAAO;AACX;AAGO,SAAS,wBAA8B;AAC1C,OAAK,SAAS;AAClB;AAWO,SAAS,wBACZ,SACA,UACmB;AACnB,SAAO,KAAK;AAAA,IAAO,OACf,EAAE,MAAM,YAAY,WAAW,SAAS,SAAS,EAAE,IAAI,IAAI;AAAA,EAC/D;AACJ;AAYO,SAAS,yBAAyB,GAA+B;AACpE,MAAI,EAAE,OAAQ,QAAO,aAAa,EAAE,MAAM;AAC1C,SAAO,yBAAoB,EAAE,MAAM;AACvC;","names":[]}

package/dist/agent/worktreeExecutor.js

@@ -0,0 +1,207 @@
+#!/usr/bin/env node
+import { cpSync, existsSync, mkdirSync, rmSync } from "fs";
+import { dirname, join, resolve } from "path";
+import { execFileSync } from "child_process";
+import { TITAN_HOME } from "../utils/constants.js";
+import logger from "../utils/logger.js";
+const COMPONENT = "WorktreeExecutor";
+const WORKTREES_DIR = join(TITAN_HOME, "worktrees");
+function sanitizeSpawnId(spawnId) {
+  const clean = spawnId.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 80);
+  return clean || `spawn-${Date.now()}`;
+}
+const orphanedRunsBySpawn = /* @__PURE__ */ new Map();
+const lastWorktreePathBySpawn = /* @__PURE__ */ new Map();
+function worktreePathFor(spawnId) {
+  return join(WORKTREES_DIR, sanitizeSpawnId(spawnId));
+}
+function temporaryWorktreePathFor(spawnId) {
+  return `${worktreePathFor(spawnId)}-${Date.now()}-${process.pid}`;
+}
+function runGit(args, cwd) {
+  return execFileSync("git", args, {
+    cwd,
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: 6e4
+  });
+}
+function runGitWithInput(args, cwd, input) {
+  return execFileSync("git", args, {
+    cwd,
+    input,
+    encoding: "utf-8",
+    stdio: ["pipe", "pipe", "pipe"],
+    timeout: 6e4
+  });
+}
+function applyParentDiff(worktreePath, baseCwd) {
+  const diff = runGit(["diff", "--binary", "HEAD", "--"], baseCwd);
+  if (diff.length === 0) return;
+  runGitWithInput(["apply", "--binary", "--whitespace=nowarn"], worktreePath, diff);
+}
+function copyParentUntrackedFiles(worktreePath, baseCwd) {
+  const raw = runGit(["ls-files", "--others", "--exclude-standard", "-z"], baseCwd);
+  for (const relativePath of raw.split("\0").filter(Boolean)) {
+    const source = resolve(baseCwd, relativePath);
+    const target = resolve(worktreePath, relativePath);
+    mkdirSync(dirname(target), { recursive: true });
+    cpSync(source, target, { recursive: true, force: true, dereference: false });
+  }
+}
+function syncParentState(worktreePath, baseCwd) {
+  try {
+    applyParentDiff(worktreePath, baseCwd);
+    copyParentUntrackedFiles(worktreePath, baseCwd);
+  } catch (err) {
+    cleanupWorktreePath(worktreePath, baseCwd);
+    throw new Error(`Could not mirror parent workspace state into ${worktreePath}: ${err.message}`);
+  }
+}
+function ensureWorktree(spawnId, baseCwd) {
+  mkdirSync(WORKTREES_DIR, { recursive: true });
+  const hasOrphanedRun = (orphanedRunsBySpawn.get(spawnId) ?? 0) > 0;
+  const worktreePath = hasOrphanedRun ? temporaryWorktreePathFor(spawnId) : worktreePathFor(spawnId);
+  if (existsSync(worktreePath)) {
+    rmSync(worktreePath, { recursive: true, force: true });
+  }
+  try {
+    runGit(["worktree", "prune"], baseCwd);
+    runGit(["worktree", "add", "--detach", worktreePath, "HEAD"], baseCwd);
+    syncParentState(worktreePath, baseCwd);
+    return worktreePath;
+  } catch (err) {
+    logger.warn(COMPONENT, `git worktree add failed for ${worktreePath}; falling back to local clone: ${err.message}`);
+    try {
+      rmSync(worktreePath, { recursive: true, force: true });
+    } catch {
+    }
+    try {
+      execFileSync("git", ["clone", "--local", "--no-hardlinks", baseCwd, worktreePath], {
+        encoding: "utf-8",
+        stdio: ["ignore", "pipe", "pipe"],
+        timeout: 6e4
+      });
+      runGit(["checkout", "--detach", "HEAD"], worktreePath);
+      syncParentState(worktreePath, baseCwd);
+      return worktreePath;
+    } catch (cloneErr) {
+      try {
+        rmSync(worktreePath, { recursive: true, force: true });
+      } catch {
+      }
+      throw new Error(`Could not create isolated worktree ${worktreePath}: ${cloneErr.message}`);
+    }
+  }
+}
+function cleanupWorktreePath(worktreePath, baseCwd) {
+  try {
+    runGit(["worktree", "remove", "--force", worktreePath], baseCwd);
+  } catch (err) {
+    logger.debug(COMPONENT, `git worktree remove skipped for ${worktreePath}: ${err.message}`);
+  }
+  try {
+    rmSync(worktreePath, { recursive: true, force: true });
+  } catch (err) {
+    logger.warn(COMPONENT, `Failed to remove worktree directory ${worktreePath}: ${err.message}`);
+  }
+}
+function markOrphanedRun(spawnId) {
+  orphanedRunsBySpawn.set(spawnId, (orphanedRunsBySpawn.get(spawnId) ?? 0) + 1);
+  let released = false;
+  return () => {
+    if (released) return;
+    released = true;
+    const next = (orphanedRunsBySpawn.get(spawnId) ?? 1) - 1;
+    if (next <= 0) {
+      orphanedRunsBySpawn.delete(spawnId);
+    } else {
+      orphanedRunsBySpawn.set(spawnId, next);
+    }
+  };
+}
+function listUntrackedFiles(worktreePath) {
+  try {
+    const raw = runGit(["ls-files", "--others", "--exclude-standard", "-z"], worktreePath);
+    return raw.split("\0").filter(Boolean);
+  } catch (err) {
+    logger.debug(COMPONENT, `Could not list untracked files in ${worktreePath}: ${err.message}`);
+    return [];
+  }
+}
+function diffUntrackedFile(worktreePath, relativePath) {
+  const absolutePath = resolve(worktreePath, relativePath);
+  try {
+    return execFileSync("git", ["diff", "--no-color", "--no-index", "--", "/dev/null", absolutePath], {
+      cwd: worktreePath,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 6e4
+    });
+  } catch (err) {
+    const output = err.stdout;
+    return typeof output === "string" ? output : "";
+  }
+}
+async function run(options) {
+  const baseCwd = options.baseCwd ?? process.cwd();
+  const signal = options.signal;
+  const worktreePath = ensureWorktree(options.spawnId, baseCwd);
+  const isolatedArgs = { ...options.args, cwd: worktreePath };
+  let executeSettled = false;
+  let releaseOrphanedRun;
+  let removeAbortListener;
+  try {
+    const executePromise = options.execute(isolatedArgs, { signal }).finally(() => {
+      executeSettled = true;
+      releaseOrphanedRun?.();
+    });
+    const abortPromise = signal ? new Promise((_, reject) => {
+      const onAbort = () => {
+        if (!executeSettled) {
+          releaseOrphanedRun = markOrphanedRun(options.spawnId);
+        }
+        cleanupWorktreePath(worktreePath, baseCwd);
+        reject(signal.reason instanceof Error ? signal.reason : new Error("Isolated worktree execution aborted"));
+      };
+      if (signal.aborted) {
+        onAbort();
+        return;
+      }
+      signal.addEventListener("abort", onAbort, { once: true });
+      removeAbortListener = () => signal.removeEventListener("abort", onAbort);
+    }) : void 0;
+    const result = await (abortPromise ? Promise.race([executePromise, abortPromise]) : executePromise);
+    lastWorktreePathBySpawn.set(options.spawnId, worktreePath);
+    return result;
+  } catch (err) {
+    cleanupWorktreePath(worktreePath, baseCwd);
+    throw err;
+  } finally {
+    removeAbortListener?.();
+  }
+}
+function getWorktreeDiff(spawnId) {
+  const rememberedPath = lastWorktreePathBySpawn.get(spawnId);
+  const worktreePath = rememberedPath && existsSync(rememberedPath) ? rememberedPath : worktreePathFor(spawnId);
+  if (!existsSync(worktreePath)) return "";
+  let diff = "";
+  try {
+    diff += runGit(["diff", "--no-color", "HEAD", "--"], worktreePath);
+  } catch (err) {
+    logger.warn(COMPONENT, `Could not diff tracked files in ${worktreePath}: ${err.message}`);
+  }
+  for (const relativePath of listUntrackedFiles(worktreePath)) {
+    diff += diffUntrackedFile(worktreePath, relativePath);
+  }
+  return diff;
+}
+function _worktreeRootForTests() {
+  return WORKTREES_DIR;
+}
+export {
+  _worktreeRootForTests,
+  getWorktreeDiff,
+  run
+};
+//# sourceMappingURL=worktreeExecutor.js.map

package/dist/agent/worktreeExecutor.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/agent/worktreeExecutor.ts"],"sourcesContent":["/**\n * TITAN — Worktree Executor (Phase D.5)\n *\n * WHAT: Runs destructive contract-backed tool calls inside a detached\n * git worktree under TITAN_HOME/worktrees/<spawnId>/ and exposes the\n * resulting diff for review.\n *\n * WHY: Shell-like skills need real filesystem access, but their\n * blast radius should not include the live checkout by default. A\n * per-call worktree gives destructive tools a repo-shaped sandbox\n * while preserving ordinary tool dispatch when the feature is off.\n *\n * Parent checkout state is mirrored at worktree creation time with\n * `git diff HEAD` plus non-ignored untracked files. WHY: destructive\n * verify calls must test the user's current edits, not stale HEAD.\n * TRADE-OFFS: this is a per-call snapshot, so later parent edits need\n * a new isolated run; spawn-scoped reuse would need lifecycle hooks\n * the runner does not own yet.\n *\n * TRADE-OFFS: This isolates repository writes, not arbitrary absolute\n * paths a command might touch. The runner overrides cwd, but tools\n * that deliberately ignore cwd can still act outside the worktree;\n * guardrails and approval gates remain part of the defense. If the\n * host forbids writes to .git/worktrees, we fall back to a local clone\n * so isolation still works in locked-down test runners.\n */\nimport { cpSync, existsSync, mkdirSync, rmSync } from 'fs';\nimport { dirname, join, resolve } from 'path';\nimport { execFileSync } from 'child_process';\nimport { TITAN_HOME } from '../utils/constants.js';\nimport logger from '../utils/logger.js';\n\nconst COMPONENT = 'WorktreeExecutor';\nconst WORKTREES_DIR = join(TITAN_HOME, 'worktrees');\n\nexport interface WorktreeRunOptions {\n    spawnId: string;\n    args: Record<string, unknown>;\n    execute: (args: Record<string, unknown>, context?: { signal?: AbortSignal }) => Promise<string>;\n    baseCwd?: string;\n    signal?: AbortSignal;\n}\n\nfunction sanitizeSpawnId(spawnId: string): string {\n    const clean = spawnId.replace(/[^a-zA-Z0-9_-]/g, '').slice(0, 80);\n    return clean || `spawn-${Date.now()}`;\n}\n\nconst orphanedRunsBySpawn = new Map<string, number>();\nconst lastWorktreePathBySpawn = new Map<string, string>();\n\nfunction worktreePathFor(spawnId: string): string {\n    return join(WORKTREES_DIR, sanitizeSpawnId(spawnId));\n}\n\nfunction temporaryWorktreePathFor(spawnId: string): string {\n    return `${worktreePathFor(spawnId)}-${Date.now()}-${process.pid}`;\n}\n\nfunction runGit(args: string[], cwd: string): string {\n    return execFileSync('git', args, {\n        cwd,\n        encoding: 'utf-8',\n        stdio: ['ignore', 'pipe', 'pipe'],\n        timeout: 60_000,\n    });\n}\n\nfunction runGitWithInput(args: string[], cwd: string, input: string): string {\n    return execFileSync('git', args, {\n        cwd,\n        input,\n        encoding: 'utf-8',\n        stdio: ['pipe', 'pipe', 'pipe'],\n        timeout: 60_000,\n    });\n}\n\nfunction applyParentDiff(worktreePath: string, baseCwd: string): void {\n    const diff = runGit(['diff', '--binary', 'HEAD', '--'], baseCwd);\n    if (diff.length === 0) return;\n    runGitWithInput(['apply', '--binary', '--whitespace=nowarn'], worktreePath, diff);\n}\n\nfunction copyParentUntrackedFiles(worktreePath: string, baseCwd: string): void {\n    const raw = runGit(['ls-files', '--others', '--exclude-standard', '-z'], baseCwd);\n    for (const relativePath of raw.split('\\0').filter(Boolean)) {\n        const source = resolve(baseCwd, relativePath);\n        const target = resolve(worktreePath, relativePath);\n        mkdirSync(dirname(target), { recursive: true });\n        cpSync(source, target, { recursive: true, force: true, dereference: false });\n    }\n}\n\nfunction syncParentState(worktreePath: string, baseCwd: string): void {\n    try {\n        applyParentDiff(worktreePath, baseCwd);\n        copyParentUntrackedFiles(worktreePath, baseCwd);\n    } catch (err) {\n        cleanupWorktreePath(worktreePath, baseCwd);\n        throw new Error(`Could not mirror parent workspace state into ${worktreePath}: ${(err as Error).message}`);\n    }\n}\n\nfunction ensureWorktree(spawnId: string, baseCwd: string): string {\n    mkdirSync(WORKTREES_DIR, { recursive: true });\n    const hasOrphanedRun = (orphanedRunsBySpawn.get(spawnId) ?? 0) > 0;\n    const worktreePath = hasOrphanedRun ? temporaryWorktreePathFor(spawnId) : worktreePathFor(spawnId);\n    if (existsSync(worktreePath)) {\n        rmSync(worktreePath, { recursive: true, force: true });\n    }\n    try {\n        runGit(['worktree', 'prune'], baseCwd);\n        runGit(['worktree', 'add', '--detach', worktreePath, 'HEAD'], baseCwd);\n        syncParentState(worktreePath, baseCwd);\n        return worktreePath;\n    } catch (err) {\n        logger.warn(COMPONENT, `git worktree add failed for ${worktreePath}; falling back to local clone: ${(err as Error).message}`);\n        try { rmSync(worktreePath, { recursive: true, force: true }); } catch { /* best-effort */ }\n        try {\n            execFileSync('git', ['clone', '--local', '--no-hardlinks', baseCwd, worktreePath], {\n                encoding: 'utf-8',\n                stdio: ['ignore', 'pipe', 'pipe'],\n                timeout: 60_000,\n            });\n            runGit(['checkout', '--detach', 'HEAD'], worktreePath);\n            syncParentState(worktreePath, baseCwd);\n            return worktreePath;\n        } catch (cloneErr) {\n            try { rmSync(worktreePath, { recursive: true, force: true }); } catch { /* best-effort */ }\n            throw new Error(`Could not create isolated worktree ${worktreePath}: ${(cloneErr as Error).message}`);\n        }\n    }\n}\n\nfunction cleanupWorktreePath(worktreePath: string, baseCwd: string): void {\n    try {\n        runGit(['worktree', 'remove', '--force', worktreePath], baseCwd);\n    } catch (err) {\n        logger.debug(COMPONENT, `git worktree remove skipped for ${worktreePath}: ${(err as Error).message}`);\n    }\n    try {\n        rmSync(worktreePath, { recursive: true, force: true });\n    } catch (err) {\n        logger.warn(COMPONENT, `Failed to remove worktree directory ${worktreePath}: ${(err as Error).message}`);\n    }\n}\n\nfunction markOrphanedRun(spawnId: string): () => void {\n    orphanedRunsBySpawn.set(spawnId, (orphanedRunsBySpawn.get(spawnId) ?? 0) + 1);\n    let released = false;\n    return () => {\n        if (released) return;\n        released = true;\n        const next = (orphanedRunsBySpawn.get(spawnId) ?? 1) - 1;\n        if (next <= 0) {\n            orphanedRunsBySpawn.delete(spawnId);\n        } else {\n            orphanedRunsBySpawn.set(spawnId, next);\n        }\n    };\n}\n\nfunction listUntrackedFiles(worktreePath: string): string[] {\n    try {\n        const raw = runGit(['ls-files', '--others', '--exclude-standard', '-z'], worktreePath);\n        return raw.split('\\0').filter(Boolean);\n    } catch (err) {\n        logger.debug(COMPONENT, `Could not list untracked files in ${worktreePath}: ${(err as Error).message}`);\n        return [];\n    }\n}\n\nfunction diffUntrackedFile(worktreePath: string, relativePath: string): string {\n    const absolutePath = resolve(worktreePath, relativePath);\n    try {\n        return execFileSync('git', ['diff', '--no-color', '--no-index', '--', '/dev/null', absolutePath], {\n            cwd: worktreePath,\n            encoding: 'utf-8',\n            stdio: ['ignore', 'pipe', 'pipe'],\n            timeout: 60_000,\n        });\n    } catch (err) {\n        const output = (err as { stdout?: string }).stdout;\n        return typeof output === 'string' ? output : '';\n    }\n}\n\n/**\n * Run a destructive tool with cwd pinned to an isolated git worktree.\n * Throws through the original execute() error after removing the\n * worktree directory so aborted spawns do not accumulate.\n */\nexport async function run(options: WorktreeRunOptions): Promise<string> {\n    const baseCwd = options.baseCwd ?? process.cwd();\n    const signal = options.signal;\n    const worktreePath = ensureWorktree(options.spawnId, baseCwd);\n    const isolatedArgs = { ...options.args, cwd: worktreePath };\n    let executeSettled = false;\n    let releaseOrphanedRun: (() => void) | undefined;\n    let removeAbortListener: (() => void) | undefined;\n\n    try {\n        const executePromise = options.execute(isolatedArgs, { signal })\n            .finally(() => {\n                executeSettled = true;\n                releaseOrphanedRun?.();\n            });\n\n        const abortPromise = signal\n            ? new Promise<string>((_, reject) => {\n                const onAbort = () => {\n                    if (!executeSettled) {\n                        releaseOrphanedRun = markOrphanedRun(options.spawnId);\n                    }\n                    cleanupWorktreePath(worktreePath, baseCwd);\n                    reject(signal.reason instanceof Error\n                        ? signal.reason\n                        : new Error('Isolated worktree execution aborted'));\n                };\n                if (signal.aborted) {\n                    onAbort();\n                    return;\n                }\n                signal.addEventListener('abort', onAbort, { once: true });\n                removeAbortListener = () => signal.removeEventListener('abort', onAbort);\n            })\n            : undefined;\n\n        const result = await (abortPromise\n            ? Promise.race([executePromise, abortPromise])\n            : executePromise);\n        lastWorktreePathBySpawn.set(options.spawnId, worktreePath);\n        return result;\n    } catch (err) {\n        cleanupWorktreePath(worktreePath, baseCwd);\n        throw err;\n    } finally {\n        removeAbortListener?.();\n    }\n}\n\n/**\n * Return a unified diff of the isolated worktree against its base\n * HEAD. Includes untracked files so newly-created artifacts are\n * visible to reviewers.\n */\nexport function getWorktreeDiff(spawnId: string): string {\n    const rememberedPath = lastWorktreePathBySpawn.get(spawnId);\n    const worktreePath = rememberedPath && existsSync(rememberedPath)\n        ? rememberedPath\n        : worktreePathFor(spawnId);\n    if (!existsSync(worktreePath)) return '';\n\n    let diff = '';\n    try {\n        diff += runGit(['diff', '--no-color', 'HEAD', '--'], worktreePath);\n    } catch (err) {\n        logger.warn(COMPONENT, `Could not diff tracked files in ${worktreePath}: ${(err as Error).message}`);\n    }\n\n    for (const relativePath of listUntrackedFiles(worktreePath)) {\n        diff += diffUntrackedFile(worktreePath, relativePath);\n    }\n\n    return diff;\n}\n\n/** Test-only: expose the deterministic root used by Phase D.5. */\nexport function _worktreeRootForTests(): string {\n    return WORKTREES_DIR;\n}\n"],"mappings":";AA0BA,SAAS,QAAQ,YAAY,WAAW,cAAc;AACtD,SAAS,SAAS,MAAM,eAAe;AACvC,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAC3B,OAAO,YAAY;AAEnB,MAAM,YAAY;AAClB,MAAM,gBAAgB,KAAK,YAAY,WAAW;AAUlD,SAAS,gBAAgB,SAAyB;AAC9C,QAAM,QAAQ,QAAQ,QAAQ,mBAAmB,EAAE,EAAE,MAAM,GAAG,EAAE;AAChE,SAAO,SAAS,SAAS,KAAK,IAAI,CAAC;AACvC;AAEA,MAAM,sBAAsB,oBAAI,IAAoB;AACpD,MAAM,0BAA0B,oBAAI,IAAoB;AAExD,SAAS,gBAAgB,SAAyB;AAC9C,SAAO,KAAK,eAAe,gBAAgB,OAAO,CAAC;AACvD;AAEA,SAAS,yBAAyB,SAAyB;AACvD,SAAO,GAAG,gBAAgB,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,QAAQ,GAAG;AACnE;AAEA,SAAS,OAAO,MAAgB,KAAqB;AACjD,SAAO,aAAa,OAAO,MAAM;AAAA,IAC7B;AAAA,IACA,UAAU;AAAA,IACV,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAChC,SAAS;AAAA,EACb,CAAC;AACL;AAEA,SAAS,gBAAgB,MAAgB,KAAa,OAAuB;AACzE,SAAO,aAAa,OAAO,MAAM;AAAA,IAC7B;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,IAC9B,SAAS;AAAA,EACb,CAAC;AACL;AAEA,SAAS,gBAAgB,cAAsB,SAAuB;AAClE,QAAM,OAAO,OAAO,CAAC,QAAQ,YAAY,QAAQ,IAAI,GAAG,OAAO;AAC/D,MAAI,KAAK,WAAW,EAAG;AACvB,kBAAgB,CAAC,SAAS,YAAY,qBAAqB,GAAG,cAAc,IAAI;AACpF;AAEA,SAAS,yBAAyB,cAAsB,SAAuB;AAC3E,QAAM,MAAM,OAAO,CAAC,YAAY,YAAY,sBAAsB,IAAI,GAAG,OAAO;AAChF,aAAW,gBAAgB,IAAI,MAAM,IAAI,EAAE,OAAO,OAAO,GAAG;AACxD,UAAM,SAAS,QAAQ,SAAS,YAAY;AAC5C,UAAM,SAAS,QAAQ,cAAc,YAAY;AACjD,cAAU,QAAQ,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;AAC9C,WAAO,QAAQ,QAAQ,EAAE,WAAW,MAAM,OAAO,MAAM,aAAa,MAAM,CAAC;AAAA,EAC/E;AACJ;AAEA,SAAS,gBAAgB,cAAsB,SAAuB;AAClE,MAAI;AACA,oBAAgB,cAAc,OAAO;AACrC,6BAAyB,cAAc,OAAO;AAAA,EAClD,SAAS,KAAK;AACV,wBAAoB,cAAc,OAAO;AACzC,UAAM,IAAI,MAAM,gDAAgD,YAAY,KAAM,IAAc,OAAO,EAAE;AAAA,EAC7G;AACJ;AAEA,SAAS,eAAe,SAAiB,SAAyB;AAC9D,YAAU,eAAe,EAAE,WAAW,KAAK,CAAC;AAC5C,QAAM,kBAAkB,oBAAoB,IAAI,OAAO,KAAK,KAAK;AACjE,QAAM,eAAe,iBAAiB,yBAAyB,OAAO,IAAI,gBAAgB,OAAO;AACjG,MAAI,WAAW,YAAY,GAAG;AAC1B,WAAO,cAAc,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACzD;AACA,MAAI;AACA,WAAO,CAAC,YAAY,OAAO,GAAG,OAAO;AACrC,WAAO,CAAC,YAAY,OAAO,YAAY,cAAc,MAAM,GAAG,OAAO;AACrE,oBAAgB,cAAc,OAAO;AACrC,WAAO;AAAA,EACX,SAAS,KAAK;AACV,WAAO,KAAK,WAAW,+BAA+B,YAAY,kCAAmC,IAAc,OAAO,EAAE;AAC5H,QAAI;AAAE,aAAO,cAAc,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,IAAG,QAAQ;AAAA,IAAoB;AAC1F,QAAI;AACA,mBAAa,OAAO,CAAC,SAAS,WAAW,kBAAkB,SAAS,YAAY,GAAG;AAAA,QAC/E,UAAU;AAAA,QACV,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,QAChC,SAAS;AAAA,MACb,CAAC;AACD,aAAO,CAAC,YAAY,YAAY,MAAM,GAAG,YAAY;AACrD,sBAAgB,cAAc,OAAO;AACrC,aAAO;AAAA,IACX,SAAS,UAAU;AACf,UAAI;AAAE,eAAO,cAAc,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,MAAG,QAAQ;AAAA,MAAoB;AAC1F,YAAM,IAAI,MAAM,sCAAsC,YAAY,KAAM,SAAmB,OAAO,EAAE;AAAA,IACxG;AAAA,EACJ;AACJ;AAEA,SAAS,oBAAoB,cAAsB,SAAuB;AACtE,MAAI;AACA,WAAO,CAAC,YAAY,UAAU,WAAW,YAAY,GAAG,OAAO;AAAA,EACnE,SAAS,KAAK;AACV,WAAO,MAAM,WAAW,mCAAmC,YAAY,KAAM,IAAc,OAAO,EAAE;AAAA,EACxG;AACA,MAAI;AACA,WAAO,cAAc,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACzD,SAAS,KAAK;AACV,WAAO,KAAK,WAAW,uCAAuC,YAAY,KAAM,IAAc,OAAO,EAAE;AAAA,EAC3G;AACJ;AAEA,SAAS,gBAAgB,SAA6B;AAClD,sBAAoB,IAAI,UAAU,oBAAoB,IAAI,OAAO,KAAK,KAAK,CAAC;AAC5E,MAAI,WAAW;AACf,SAAO,MAAM;AACT,QAAI,SAAU;AACd,eAAW;AACX,UAAM,QAAQ,oBAAoB,IAAI,OAAO,KAAK,KAAK;AACvD,QAAI,QAAQ,GAAG;AACX,0BAAoB,OAAO,OAAO;AAAA,IACtC,OAAO;AACH,0BAAoB,IAAI,SAAS,IAAI;AAAA,IACzC;AAAA,EACJ;AACJ;AAEA,SAAS,mBAAmB,cAAgC;AACxD,MAAI;AACA,UAAM,MAAM,OAAO,CAAC,YAAY,YAAY,sBAAsB,IAAI,GAAG,YAAY;AACrF,WAAO,IAAI,MAAM,IAAI,EAAE,OAAO,OAAO;AAAA,EACzC,SAAS,KAAK;AACV,WAAO,MAAM,WAAW,qCAAqC,YAAY,KAAM,IAAc,OAAO,EAAE;AACtG,WAAO,CAAC;AAAA,EACZ;AACJ;AAEA,SAAS,kBAAkB,cAAsB,cAA8B;AAC3E,QAAM,eAAe,QAAQ,cAAc,YAAY;AACvD,MAAI;AACA,WAAO,aAAa,OAAO,CAAC,QAAQ,cAAc,cAAc,MAAM,aAAa,YAAY,GAAG;AAAA,MAC9F,KAAK;AAAA,MACL,UAAU;AAAA,MACV,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,MAChC,SAAS;AAAA,IACb,CAAC;AAAA,EACL,SAAS,KAAK;AACV,UAAM,SAAU,IAA4B;AAC5C,WAAO,OAAO,WAAW,WAAW,SAAS;AAAA,EACjD;AACJ;AAOA,eAAsB,IAAI,SAA8C;AACpE,QAAM,UAAU,QAAQ,WAAW,QAAQ,IAAI;AAC/C,QAAM,SAAS,QAAQ;AACvB,QAAM,eAAe,eAAe,QAAQ,SAAS,OAAO;AAC5D,QAAM,eAAe,EAAE,GAAG,QAAQ,MAAM,KAAK,aAAa;AAC1D,MAAI,iBAAiB;AACrB,MAAI;AACJ,MAAI;AAEJ,MAAI;AACA,UAAM,iBAAiB,QAAQ,QAAQ,cAAc,EAAE,OAAO,CAAC,EAC1D,QAAQ,MAAM;AACX,uBAAiB;AACjB,2BAAqB;AAAA,IACzB,CAAC;AAEL,UAAM,eAAe,SACf,IAAI,QAAgB,CAAC,GAAG,WAAW;AACjC,YAAM,UAAU,MAAM;AAClB,YAAI,CAAC,gBAAgB;AACjB,+BAAqB,gBAAgB,QAAQ,OAAO;AAAA,QACxD;AACA,4BAAoB,cAAc,OAAO;AACzC,eAAO,OAAO,kBAAkB,QAC1B,OAAO,SACP,IAAI,MAAM,qCAAqC,CAAC;AAAA,MAC1D;AACA,UAAI,OAAO,SAAS;AAChB,gBAAQ;AACR;AAAA,MACJ;AACA,aAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,4BAAsB,MAAM,OAAO,oBAAoB,SAAS,OAAO;AAAA,IAC3E,CAAC,IACC;AAEN,UAAM,SAAS,OAAO,eAChB,QAAQ,KAAK,CAAC,gBAAgB,YAAY,CAAC,IAC3C;AACN,4BAAwB,IAAI,QAAQ,SAAS,YAAY;AACzD,WAAO;AAAA,EACX,SAAS,KAAK;AACV,wBAAoB,cAAc,OAAO;AACzC,UAAM;AAAA,EACV,UAAE;AACE,0BAAsB;AAAA,EAC1B;AACJ;AAOO,SAAS,gBAAgB,SAAyB;AACrD,QAAM,iBAAiB,wBAAwB,IAAI,OAAO;AAC1D,QAAM,eAAe,kBAAkB,WAAW,cAAc,IAC1D,iBACA,gBAAgB,OAAO;AAC7B,MAAI,CAAC,WAAW,YAAY,EAAG,QAAO;AAEtC,MAAI,OAAO;AACX,MAAI;AACA,YAAQ,OAAO,CAAC,QAAQ,cAAc,QAAQ,IAAI,GAAG,YAAY;AAAA,EACrE,SAAS,KAAK;AACV,WAAO,KAAK,WAAW,mCAAmC,YAAY,KAAM,IAAc,OAAO,EAAE;AAAA,EACvG;AAEA,aAAW,gBAAgB,mBAAmB,YAAY,GAAG;AACzD,YAAQ,kBAAkB,cAAc,YAAY;AAAA,EACxD;AAEA,SAAO;AACX;AAGO,SAAS,wBAAgC;AAC5C,SAAO;AACX;","names":[]}

package/dist/config/schema.js

@@ -91,6 +91,13 @@ const SecurityConfigSchema = z.object({
   maxMemoryMB: z.number().default(2048),
   maxSubprocesses: z.number().default(10),
   maxDiskWriteMB: z.number().default(1024),
+  /**
+   * Phase D.5: opt-in worktree isolation for contract-declared
+   * destructive tools. Default false preserves legacy cwd behavior;
+   * enabling it routes those calls into ~/.titan/worktrees/<spawnId>
+   * so risky filesystem effects are reviewable before landing.
+   */
+  useWorktreeIsolation: z.boolean().default(false),
   vault: z.object({
     enabled: z.boolean().default(false),
     path: z.string().optional()
@@ -108,7 +115,27 @@ const SecurityConfigSchema = z.object({
   }).default({}),
   /** v5.0: Pre-execution command scanner for dangerous patterns */
   preExecScan: z.enum(["off", "warn", "block"]).default("warn"),
-  preExecScanAllow: z.array(z.string()).default([])
+  preExecScanAllow: z.array(z.string()).default([]),
+  /**
+   * beta.17 (Phase D.4) — auto-mode classifier policy. Reads by
+   * `src/agent/autoModeClassifier.ts` to decide whether contract-
+   * declared risk levels short-circuit the approval gate, or every
+   * call still requires explicit approval.
+   *
+   * Modes:
+   *   - 'standard'   — (default) safe→auto, moderate→notify, high→gate
+   *   - 'paranoid'   — every call gates regardless of risk
+   *   - 'permissive' — moderate promotes to auto; high still gates
+   *   - 'yolo'       — everything auto, including high. Sandbox-only.
+   *                    Logs a loud warning the first time it activates.
+   *
+   * User-configured `requiresApproval()` is ALWAYS checked first;
+   * a tool on the explicit approval list still gates even under
+   * 'permissive' or 'yolo'. Codex P1 #1.
+   */
+  autoMode: z.object({
+    policy: z.enum(["standard", "paranoid", "permissive", "yolo"]).default("standard")
+  }).default({})
 });
 const GatewayConfigSchema = z.object({
   host: z.string().default(DEFAULT_GATEWAY_HOST),