vgxness 1.20.4 → 1.20.6

package/dist/runs/run-snapshot-export-service.js

@@ -1,31 +1 @@
-import { redactJsonValue } from '../export/redaction.js';
-import { runSnapshotPackageKind } from './schema.js';
-export class RunSnapshotExportService {
-    runs;
-    constructor(runs) {
-        this.runs = runs;
-    }
-    exportSnapshot(input) {
-        const details = this.runs.getRun(input.runId);
-        if (!details.ok)
-            return details;
-        if (details.value.project !== input.project) {
-            return validationFailure(`Run project mismatch: expected ${input.project}, got ${details.value.project}`);
-        }
-        const redactedRun = redactJsonValue(details.value);
-        return {
-            ok: true,
-            value: {
-                kind: runSnapshotPackageKind,
-                version: 1,
-                exportedAt: new Date().toISOString(),
-                project: input.project,
-                runId: input.runId,
-                run: redactedRun,
-            },
-        };
-    }
-}
-function validationFailure(message) {
-    return { ok: false, error: { code: 'validation_failed', message } };
-}
+export * from '../application/runs/run-snapshot-export-service.js';

package/dist/runs/sandbox-process-execution.js

@@ -1,240 +1 @@
-import { spawn, spawnSync } from 'node:child_process';
-import { isAbsolute, sep } from 'node:path';
-import { canonicalizeExistingPath, isPathInside, isProviderConfigPath } from '../permissions/path-boundaries.js';
-const defaultTimeoutMs = 10_000;
-const defaultOutputLimitBytes = 64 * 1024;
-const allowedEnvKey = /^[A-Z_][A-Z0-9_]*$/u;
-const shellMetaCharacters = /[\s;&|<>$`\\]/u;
-export function buildSandboxExecutionPlan(request) {
-    const workspaceRoot = realpathOrUndefined(request.workspaceRoot);
-    if (workspaceRoot === undefined)
-        return rejected('workspace-root-not-found', `Workspace root does not exist: ${request.workspaceRoot}`);
-    const cwd = realpathOrUndefined(request.cwd ?? request.workspaceRoot);
-    if (cwd === undefined)
-        return rejected('cwd-not-found', `Process cwd does not exist: ${request.cwd ?? request.workspaceRoot}`, workspaceRoot);
-    const externalCwd = externalCwdAuthorization({ cwd, workspaceRoot, request });
-    if (!externalCwd.ok)
-        return rejected(externalCwd.code, externalCwd.message, workspaceRoot, cwd, externalCwd.approvedExternalRoot, request.externalAuthorization);
-    if (isProviderConfigPathForAnyRoot(cwd, workspaceRoot, externalCwd.approvedExternalRoot))
-        return rejected('provider-config-cwd-rejected', `Process cwd targets provider/OpenCode config: ${request.cwd ?? request.workspaceRoot}`, workspaceRoot, cwd, externalCwd.approvedExternalRoot, request.externalAuthorization);
-    if (request.command.length === 0)
-        return rejected('empty-command', 'Process command is required.', workspaceRoot, cwd);
-    if (isAbsolute(request.command) || request.command.includes(sep) || shellMetaCharacters.test(request.command)) {
-        return rejected('shell-or-path-command-rejected', 'Command must be a single allowlisted executable name; shell strings and paths are rejected.', workspaceRoot, cwd);
-    }
-    if (!request.allowedCommands.includes(request.command)) {
-        return rejected('command-not-allowlisted', `Command is not allowlisted: ${request.command}`, workspaceRoot, cwd);
-    }
-    const argv = request.args ?? [];
-    if (!argv.every((arg) => typeof arg === 'string'))
-        return rejected('invalid-argv', 'Arguments must be an argv array of strings.', workspaceRoot, cwd);
-    const targetPaths = request.targetPaths ?? [];
-    if (!targetPaths.every((targetPath) => typeof targetPath === 'string'))
-        return rejected('invalid-target-paths', 'Target paths must be an array of strings.', workspaceRoot, cwd);
-    const providerConfigTargetPath = targetPaths.find((targetPath) => isProviderConfigPathForAnyRoot(targetPath, workspaceRoot, cwd, externalCwd.approvedExternalRoot));
-    if (providerConfigTargetPath !== undefined)
-        return rejected('provider-config-target-path-rejected', `Process plan target path targets provider/OpenCode config: ${providerConfigTargetPath}`, workspaceRoot, cwd, externalCwd.approvedExternalRoot, request.externalAuthorization);
-    const env = request.env ?? {};
-    const envKeys = Object.keys(env).sort();
-    const invalidEnvKey = envKeys.find((key) => !allowedEnvKey.test(key));
-    if (invalidEnvKey !== undefined)
-        return rejected('invalid-env-key', `Environment key is not in the limited allow shape: ${invalidEnvKey}`, workspaceRoot, cwd);
-    const timeoutMs = request.timeoutMs ?? defaultTimeoutMs;
-    if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 60_000)
-        return rejected('invalid-timeout', 'Timeout must be an integer between 1 and 60000 ms.', workspaceRoot, cwd);
-    const outputLimitBytes = request.outputLimitBytes ?? defaultOutputLimitBytes;
-    if (!Number.isInteger(outputLimitBytes) || outputLimitBytes < 1 || outputLimitBytes > 1024 * 1024)
-        return rejected('invalid-output-limit', 'Output limit must be an integer between 1 byte and 1 MiB.', workspaceRoot, cwd);
-    const evidence = acceptedEvidence(workspaceRoot, cwd, externalCwd.approvedExternalRoot, request.externalAuthorization, [
-        'workspace-root-realpath-resolved',
-        externalCwd.approvedExternalRoot === undefined ? 'cwd-realpath-inside-workspace' : 'cwd-realpath-inside-approved-external-root',
-        'command-is-executable-name-not-shell-string',
-        'command-allowlisted',
-        'argv-array-only',
-        'limited-env-keys-validated',
-        'timeout-configured',
-        'output-cap-configured',
-        'provider-config-paths-not-targeted-by-process-plan',
-    ]);
-    return {
-        ok: true,
-        value: {
-            strategy: 'bounded-process',
-            executable: true,
-            request: { workspaceRoot, cwd, command: request.command, argv, envKeys, timeoutMs, outputLimitBytes },
-            evidence,
-        },
-    };
-}
-export async function executeSandboxedProcess(request) {
-    const plan = buildSandboxExecutionPlan(request);
-    if (!plan.ok)
-        return plan;
-    const { command, argv, cwd, timeoutMs, outputLimitBytes } = plan.value.request;
-    const env = limitedEnv(request.env ?? {});
-    return await new Promise((resolvePromise) => {
-        const child = spawn(command, argv, { cwd, env, shell: false, stdio: ['ignore', 'pipe', 'pipe'] });
-        let stdout = '';
-        let stderr = '';
-        let outputBytes = 0;
-        let outputTruncated = false;
-        let timedOut = false;
-        const timer = setTimeout(() => {
-            timedOut = true;
-            child.kill('SIGTERM');
-        }, timeoutMs);
-        const append = (chunk, target) => {
-            if (outputBytes >= outputLimitBytes) {
-                outputTruncated = true;
-                return;
-            }
-            const remaining = outputLimitBytes - outputBytes;
-            const slice = chunk.subarray(0, Math.max(0, remaining));
-            outputBytes += slice.byteLength;
-            if (slice.byteLength < chunk.byteLength)
-                outputTruncated = true;
-            if (target === 'stdout')
-                stdout += slice.toString('utf8');
-            else
-                stderr += slice.toString('utf8');
-        };
-        child.stdout?.on('data', (chunk) => append(chunk, 'stdout'));
-        child.stderr?.on('data', (chunk) => append(chunk, 'stderr'));
-        child.on('error', (error) => {
-            clearTimeout(timer);
-            resolvePromise({ ok: false, error: { code: 'process-launch-failed', message: error.message, evidence: plan.value.evidence } });
-        });
-        child.on('close', (exitCode, signal) => {
-            clearTimeout(timer);
-            resolvePromise({ ok: true, value: { exitCode, signal, stdout, stderr, timedOut, outputTruncated, evidence: plan.value.evidence } });
-        });
-    });
-}
-export function executeSandboxedProcessSync(request) {
-    const plan = buildSandboxExecutionPlan(request);
-    if (!plan.ok)
-        return plan;
-    const { command, argv, cwd, timeoutMs, outputLimitBytes } = plan.value.request;
-    const executed = spawnSync(command, argv, {
-        cwd,
-        env: limitedEnv(request.env ?? {}),
-        shell: false,
-        stdio: ['ignore', 'pipe', 'pipe'],
-        timeout: timeoutMs,
-        encoding: 'buffer',
-        maxBuffer: outputLimitBytes,
-    });
-    if (executed.error?.message.includes('maxBuffer')) {
-        // Keep the bounded-process contract explicit: output beyond maxBuffer is truncated.
-    }
-    else if (executed.error !== undefined && !isTimeoutError(executed.error)) {
-        return { ok: false, error: { code: 'process-launch-failed', message: executed.error.message, evidence: plan.value.evidence } };
-    }
-    const stdout = bufferToLimitedString(executed.stdout, outputLimitBytes);
-    const remaining = Math.max(0, outputLimitBytes - Buffer.byteLength(stdout));
-    const stderr = bufferToLimitedString(executed.stderr, remaining);
-    const outputTruncated = Buffer.byteLength(stdout) + Buffer.byteLength(stderr) >= outputLimitBytes || (executed.error?.message.includes('maxBuffer') ?? false);
-    return {
-        ok: true,
-        value: {
-            exitCode: executed.status,
-            signal: executed.signal,
-            stdout,
-            stderr,
-            timedOut: isTimeoutError(executed.error),
-            outputTruncated,
-            evidence: plan.value.evidence,
-        },
-    };
-}
-function isTimeoutError(error) {
-    return error?.code === 'ETIMEDOUT';
-}
-function bufferToLimitedString(buffer, limit) {
-    if (buffer === null || buffer === undefined || limit <= 0)
-        return '';
-    const source = typeof buffer === 'string' ? Buffer.from(buffer) : buffer;
-    return source.subarray(0, limit).toString('utf8');
-}
-function acceptedEvidence(workspaceRoot, cwd, approvedExternalRoot, externalAuthorization, checks) {
-    return {
-        strategy: 'bounded-process',
-        enforceable: true,
-        createsSandbox: false,
-        createsWorktree: false,
-        filesystemIsolation: false,
-        networkIsolation: false,
-        shellDisabled: true,
-        argvArrayOnly: true,
-        providerConfigWritesBlocked: true,
-        workspaceRoot,
-        cwd,
-        externalCwdAuthorized: approvedExternalRoot !== undefined,
-        ...(approvedExternalRoot === undefined ? {} : { approvedExternalRoot }),
-        ...(externalAuthorization === undefined || approvedExternalRoot === undefined ? {} : { externalAuthorization }),
-        capabilities: {
-            sandboxEnforceable: false,
-            processExecutionEnforceable: true,
-            workspaceBoundaryEnforced: true,
-            providerConfigWritesBlocked: true,
-            shellDisabled: true,
-            argvArrayOnly: true,
-            limitedEnvironment: true,
-            timeoutEnforced: true,
-            outputCapEnforced: true,
-            createsSandbox: false,
-            createsWorktree: false,
-            filesystemIsolation: false,
-            networkIsolation: false,
-        },
-        limitations: [
-            'bounded-process does not create an OS-level sandbox',
-            'bounded-process does not create or manage a git worktree',
-            'bounded-process enforces local process launch constraints only; it is not an OS-level filesystem sandbox',
-            'bounded-process does not prove network isolation',
-        ],
-        validation: { accepted: true, checks },
-    };
-}
-function rejected(code, message, workspaceRoot, cwd, approvedExternalRoot, externalAuthorization) {
-    const evidence = workspaceRoot === undefined || cwd === undefined
-        ? undefined
-        : { ...acceptedEvidence(workspaceRoot, cwd, approvedExternalRoot, externalAuthorization, []), enforceable: false, validation: { accepted: false, checks: [code] } };
-    return { ok: false, error: { code, message, ...(evidence === undefined ? {} : { evidence }) } };
-}
-function externalCwdAuthorization(input) {
-    if (isInside(input.cwd, input.workspaceRoot))
-        return { ok: true };
-    if (input.request.externalAuthorization === undefined) {
-        return { ok: false, code: 'cwd-escapes-workspace', message: `Process cwd escapes workspace boundary: ${input.request.cwd ?? input.request.workspaceRoot}` };
-    }
-    const roots = input.request.approvedExternalRoots ?? [];
-    for (const root of roots) {
-        const canonicalRoot = realpathOrUndefined(root);
-        if (canonicalRoot !== undefined && isInside(input.cwd, canonicalRoot))
-            return { ok: true, approvedExternalRoot: canonicalRoot };
-    }
-    return {
-        ok: false,
-        code: 'cwd-not-approved-external-root',
-        message: `Process cwd is outside the workspace and not inside an approved external root: ${input.request.cwd ?? input.request.workspaceRoot}`,
-    };
-}
-function isProviderConfigPathForAnyRoot(path, workspaceRoot, ...additionalRoots) {
-    if (isProviderConfigPath(path, workspaceRoot))
-        return true;
-    return additionalRoots.some((root) => root !== undefined && isProviderConfigPath(path, root));
-}
-function realpathOrUndefined(path) {
-    return canonicalizeExistingPath(path);
-}
-function isInside(path, workspaceRoot) {
-    return isPathInside(path, workspaceRoot);
-}
-function limitedEnv(input) {
-    const env = { PATH: process.env.PATH ?? '' };
-    for (const [key, value] of Object.entries(input))
-        if (value !== undefined)
-            env[key] = value;
-    return env;
-}
+export * from '../application/runs/sandbox-process-execution.js';

package/dist/runs/sandbox-worktree-planning.js

@@ -1,59 +1 @@
-import { sep } from 'node:path';
-import { resolveWorkspaceContainedPath } from '../permissions/policy-evaluator.js';
-const uncheckedGitBoundary = {
-    status: 'uncertain',
-    reason: 'git boundary validation was not reached',
-};
-export function planWorktreeSandbox(input) {
-    const contained = resolveWorkspaceContainedPath(input.workspaceRoot, input.targetPath);
-    if (!contained.ok)
-        return rejected(input.workspaceRoot, uncheckedGitBoundary, 'sandbox_boundary', contained.reason);
-    const configPath = providerConfigPath(contained.targetPath, contained.workspaceRoot);
-    if (configPath !== undefined) {
-        return rejected(contained.workspaceRoot, uncheckedGitBoundary, 'provider_config_write', `Provider config target is prohibited: ${configPath}`);
-    }
-    const gitBoundary = input.gitBoundaryInspector({ workspaceRoot: contained.workspaceRoot, targetPath: contained.targetPath });
-    if (gitBoundary.status !== 'compatible')
-        return rejected(contained.workspaceRoot, gitBoundary, 'git_boundary', gitBoundary.reason);
-    return {
-        strategy: 'worktree',
-        decision: 'accepted',
-        workspaceRoot: contained.workspaceRoot,
-        targetPath: contained.targetPath,
-        gitBoundary,
-        providerConfigMutation: false,
-        createsWorktree: false,
-        executesProvider: false,
-        audit: {
-            workspaceRoot: contained.workspaceRoot,
-            strategy: 'worktree',
-            decision: 'accepted',
-            validationSummary: gitBoundary.reason,
-        },
-    };
-}
-function rejected(workspaceRoot, gitBoundary, reason, validationSummary) {
-    return {
-        strategy: 'worktree',
-        decision: 'rejected',
-        workspaceRoot,
-        gitBoundary,
-        providerConfigMutation: false,
-        createsWorktree: false,
-        executesProvider: false,
-        reason,
-        audit: {
-            workspaceRoot,
-            strategy: 'worktree',
-            decision: 'rejected',
-            validationSummary,
-        },
-    };
-}
-function providerConfigPath(targetPath, workspaceRoot) {
-    const relative = targetPath.slice(workspaceRoot.length).split(sep).filter(Boolean);
-    const firstSegment = relative[0];
-    if (firstSegment === '.opencode' || firstSegment === '.claude')
-        return firstSegment;
-    return undefined;
-}
+export * from '../application/runs/sandbox-worktree-planning.js';

package/dist/runs/schema.js

@@ -1,5 +1 @@
-export const TERMINAL_RUN_STATUSES = ['completed', 'failed', 'blocked', 'cancelled'];
-export function isTerminalRunStatus(status) {
-    return TERMINAL_RUN_STATUSES.includes(status);
-}
-export const runSnapshotPackageKind = 'vgxness.run-snapshot-package';
+export * from '../domain/runs/schema.js';

package/dist/runs/task-scoped-command-grant-service.js

@@ -1,216 +1 @@
-import { matchTaskScopedCommandGrant } from '../permissions/task-scoped-command-grant-matcher.js';
-import { validateTaskScopedCommandGrantCreationInput } from '../permissions/task-scoped-command-grant-validation.js';
-import { commandAllowlistIds } from '../workflows/command-allowlist-adapter.js';
-import { TaskScopedCommandGrantRepository } from './repositories/task-scoped-command-grants.js';
-import { RunRepository } from './repositories/runs.js';
-import { isTerminalRunStatus } from './schema.js';
-const grantableCategories = new Set(['shell', 'test-run', 'git']);
-export class TaskScopedCommandGrantService {
-    runs;
-    grants;
-    constructor(database) {
-        this.runs = new RunRepository(database);
-        this.grants = new TaskScopedCommandGrantRepository(database);
-    }
-    create(input) {
-        const run = this.runs.getById(input.runId);
-        if (!run.ok)
-            return run;
-        if (isTerminalRunStatus(run.value.status))
-            return validationFailure(`Cannot create task-scoped command grants for terminal run status: ${run.value.status}`);
-        if (input.agentId !== run.value.selectedAgentId)
-            return validationFailure('Grant agentId must match the run selected agent');
-        const validated = validateTaskScopedCommandGrantCreationInput(input, { knownAllowlistIds: commandAllowlistIds(), now: input.createdAt === undefined ? new Date() : new Date(input.createdAt) });
-        if (!validated.ok)
-            return validated;
-        const createInput = validated.value;
-        return this.grants.create(createInput);
-    }
-    list(filters = {}) {
-        return this.grants.list(filters);
-    }
-    get(id) {
-        return this.grants.get(id);
-    }
-    revoke(input) {
-        return this.grants.revoke(input);
-    }
-    previewMatch(input) {
-        return this.evaluateMatch(input, false);
-    }
-    tryAuthorizeAsk(input) {
-        if (input.baseDecision.decision !== 'ask')
-            return { ok: true, value: { authorized: false, evaluation: emptyEvaluation(false, ['base-decision-not-ask']) } };
-        const preview = this.evaluateMatch({
-            runId: input.run.id,
-            agentId: input.request.agentId ?? input.request.agent?.id ?? input.run.selectedAgentId,
-            category: input.request.category,
-            operation: input.request.operation,
-            ...(input.request.taskFingerprint === undefined ? {} : { taskFingerprint: input.request.taskFingerprint }),
-            ...(input.request.commandId === undefined ? {} : { commandId: input.request.commandId }),
-            ...(input.request.workspaceRoot === undefined ? {} : { workspaceRoot: input.request.workspaceRoot }),
-            ...(input.request.cwd === undefined ? {} : { cwd: input.request.cwd }),
-            ...taskGrantTargetPaths(input.request),
-            ...(input.request.destructive === undefined ? {} : { destructive: input.request.destructive }),
-            ...(input.request.privileged === undefined ? {} : { privileged: input.request.privileged }),
-            ...(input.request.ambiguous === undefined ? {} : { ambiguous: input.request.ambiguous }),
-            ...(input.now === undefined ? {} : { now: input.now }),
-        }, true);
-        if (!preview.ok)
-            return preview;
-        if (preview.value.selectedGrantId === undefined)
-            return { ok: true, value: { authorized: false, evaluation: preview.value } };
-        const before = this.grants.get(preview.value.selectedGrantId);
-        if (!before.ok)
-            return before;
-        const consumeInput = {
-            grantId: preview.value.selectedGrantId,
-            now: (input.now ?? new Date()).toISOString(),
-            ...(preview.value.commandId === undefined ? {} : { commandId: preview.value.commandId }),
-            ...(preview.value.canonicalCwd === undefined ? {} : { canonicalCwd: preview.value.canonicalCwd }),
-            ...(preview.value.matchedExternalRoot === undefined ? {} : { matchedExternalRoot: preview.value.matchedExternalRoot }),
-        };
-        const consumed = this.grants.consumeUse(consumeInput);
-        if (!consumed.ok) {
-            return {
-                ok: true,
-                value: {
-                    authorized: false,
-                    evaluation: { ...preview.value, matched: false, missReasons: [...new Set([...preview.value.missReasons, 'concurrent-consume-lost'])].sort() },
-                },
-            };
-        }
-        const evaluation = {
-            ...preview.value,
-            matched: true,
-            useCountBefore: before.value.usedCount,
-            useCountAfter: consumed.value.usedCount,
-        };
-        const event = this.runs.appendEvent({
-            runId: input.run.id,
-            kind: 'evidence',
-            title: 'Task-scoped command grant authorized preflight ask',
-            payload: grantEvaluationPayload(evaluation),
-            relatedType: 'task-scoped-command-grant',
-            relatedId: consumed.value.id,
-        });
-        if (!event.ok)
-            return { ok: false, error: event.error };
-        const decision = {
-            ...input.baseDecision,
-            decision: 'allow',
-            reason: 'task_scoped_grant',
-            message: `Task-scoped grant ${consumed.value.id} authorizes this bounded external command preflight.`,
-            auditEvidence: [...(input.baseDecision.auditEvidence ?? []), `taskScopedGrant:${consumed.value.id}`, ...(evaluation.commandId === undefined ? [] : [`commandAllowlistId:${evaluation.commandId}`])],
-        };
-        return { ok: true, value: { authorized: true, decision, grant: consumed.value, evaluation, event: event.value } };
-    }
-    evaluateMatch(input, requireEligibleAskMetadata) {
-        const missing = requiredMissReasons(input);
-        if (missing.length > 0)
-            return { ok: true, value: emptyEvaluation(true, missing) };
-        if (!grantableCategories.has(input.category))
-            return { ok: true, value: emptyEvaluation(true, ['unsupported-category']) };
-        if (requireEligibleAskMetadata && (input.destructive === true || input.privileged === true || input.ambiguous === true)) {
-            return { ok: true, value: emptyEvaluation(true, ['hard-risk-override']) };
-        }
-        const run = this.runs.getById(input.runId);
-        if (!run.ok)
-            return run;
-        if (input.agentId !== run.value.selectedAgentId)
-            return { ok: true, value: emptyEvaluation(true, ['agent-mismatch']) };
-        const agentId = input.agentId;
-        const taskFingerprint = input.taskFingerprint;
-        const cwd = input.cwd;
-        const workspaceRoot = input.workspaceRoot;
-        if (agentId === undefined || taskFingerprint === undefined || cwd === undefined || workspaceRoot === undefined) {
-            return { ok: true, value: emptyEvaluation(true, requiredMissReasons(input)) };
-        }
-        const candidates = this.grants.list({ runId: input.runId, agentId, status: 'active' });
-        if (!candidates.ok)
-            return candidates;
-        const matched = matchTaskScopedCommandGrant({
-            request: {
-                runId: input.runId,
-                agentId,
-                taskFingerprint,
-                category: input.category,
-                operation: input.operation,
-                ...(input.commandId === undefined ? {} : { commandId: input.commandId }),
-                cwd,
-                ...(input.targetPaths === undefined ? {} : { targetPaths: input.targetPaths }),
-                ...(input.destructive === undefined ? {} : { destructive: input.destructive }),
-                ...(input.privileged === undefined ? {} : { privileged: input.privileged }),
-                ...(input.ambiguous === undefined ? {} : { ambiguous: input.ambiguous }),
-            },
-            candidates: candidates.value,
-            knownAllowlistIds: commandAllowlistIds(),
-            now: input.now ?? new Date(),
-            workspaceRoot,
-        });
-        return { ok: true, value: evaluationFromMatch(matched) };
-    }
-}
-export function grantEvaluationPayload(evaluation) {
-    return {
-        evaluated: evaluation.evaluated,
-        matched: evaluation.matched,
-        selectedGrantId: evaluation.selectedGrantId ?? null,
-        matchedGrantIds: evaluation.matchedGrantIds,
-        missReasons: evaluation.missReasons,
-        commandId: evaluation.commandId ?? null,
-        canonicalCwd: evaluation.canonicalCwd ?? null,
-        matchedExternalRoot: evaluation.matchedExternalRoot ?? null,
-        useCountBefore: evaluation.useCountBefore ?? null,
-        useCountAfter: evaluation.useCountAfter ?? null,
-        candidates: evaluation.candidates,
-    };
-}
-function evaluationFromMatch(match) {
-    return {
-        evaluated: true,
-        matched: match.selectedGrantId !== undefined,
-        ...(match.selectedGrantId === undefined ? {} : { selectedGrantId: match.selectedGrantId }),
-        matchedGrantIds: match.matchedGrantIds,
-        missReasons: match.missReasons,
-        ...(match.canonicalCwd === undefined ? {} : { canonicalCwd: match.canonicalCwd }),
-        ...(match.matchedExternalRoot === undefined ? {} : { matchedExternalRoot: match.matchedExternalRoot }),
-        ...(match.commandId === undefined ? {} : { commandId: match.commandId }),
-        candidates: match.candidates.map((candidate) => ({
-            grantId: candidate.grantId,
-            matched: candidate.matched,
-            selected: candidate.selected,
-            missReasons: candidate.missReasons,
-            commandId: candidate.commandId ?? null,
-            canonicalCwd: candidate.canonicalCwd ?? null,
-            matchedExternalRoot: candidate.matchedExternalRoot ?? null,
-        })),
-    };
-}
-function emptyEvaluation(evaluated, missReasons) {
-    return { evaluated, matched: false, matchedGrantIds: [], missReasons, candidates: [] };
-}
-function requiredMissReasons(input) {
-    const reasons = [];
-    if (input.runId.trim().length === 0)
-        reasons.push('missing-run-id');
-    if (input.agentId === undefined || input.agentId.trim().length === 0)
-        reasons.push('missing-agent-id');
-    if (input.taskFingerprint === undefined || input.taskFingerprint.trim().length === 0)
-        reasons.push('missing-task-fingerprint');
-    if (input.workspaceRoot === undefined || input.workspaceRoot.trim().length === 0)
-        reasons.push('missing-workspace-root');
-    if (input.cwd === undefined || input.cwd.trim().length === 0)
-        reasons.push('missing-cwd');
-    return reasons;
-}
-function taskGrantTargetPaths(request) {
-    if (request.targetPaths !== undefined)
-        return { targetPaths: request.targetPaths };
-    if (request.targetPath !== undefined)
-        return { targetPaths: [request.targetPath] };
-    return {};
-}
-function validationFailure(message) {
-    return { ok: false, error: { code: 'validation_failed', message } };
-}
+export * from '../application/runs/task-scoped-command-grant-service.js';