wicked-crew 0.16.11 → 0.16.13

package/dist/api/beneath.js

@@ -0,0 +1,214 @@
+/**
+ * OPEN BENEATH A ROOT, FOLLOWING NO LINK BELOW IT (crew#1274; DES-CHAT-ARTIFACTS-001 §5.3 containment).
+ *
+ * The chat's per-turn block reads and writes under directories a run or a seat can change: a run's evidence root, the
+ * chat's scratch root (the seat's own working directory), and a project's docs root. Checking a path (`realpath`,
+ * `lstat`) and then opening it is a race: `O_NOFOLLOW` covers only the last component, so an ancestor directory
+ * swapped for a link between the check and the open sends the open outside the root. Node has no `openat`, so this
+ * module opens with the platform's own guarantee instead of a check:
+ *
+ *  - macOS: `O_NOFOLLOW_ANY` (Darwin ≥ 20): the open fails with ELOOP if ANY component of the path is a link. The
+ *    root is passed as its real path (no link in it by construction), so the guarantee covers exactly the components
+ *    below it.
+ *  - Linux: a descriptor walk: the root is opened as a directory, then each component is opened through the magic
+ *    link `/proc/self/fd/<dir>/<name>` with `O_NOFOLLOW` — the kernel resolves the magic link to the directory the
+ *    descriptor holds (never a path re-read), so this is `openat(dir, name, O_NOFOLLOW)`.
+ *  - Anywhere else (Windows): refused, with the reason. A brief or a copy is then simply not made there.
+ *
+ * The root itself is trusted: its ancestors belong to the daemon, and a run or a seat cannot rename the root (it can
+ * write only inside it). Every component below it is checked on every open, by the kernel.
+ *
+ * Listing a directory is by IDENTITY, never by a path that could be re-resolved: the directory is first opened beneath
+ * the root, then listed through what that descriptor holds — on Linux `/proc/self/fd/<n>`, on macOS
+ * `/.vol/<dev>/<ino>` (the volume file system's by-identity name; `/dev/fd/<n>` cannot be listed there). A folder
+ * swapped for a link after it was opened still lists as the folder that was opened; a file system without `/.vol`
+ * refuses the listing.
+ */
+import { closeSync, constants as fsConstants, existsSync, fstatSync, mkdirSync, openSync, opendirSync, readSync, writeSync } from 'node:fs';
+import { join } from 'node:path';
+/** `O_NOFOLLOW_ANY` from Darwin's `<sys/fcntl.h>`: Node does not export it, and passes open flags through. */
+const DARWIN_O_NOFOLLOW_ANY = 0x20000000;
+let modeHeld = null;
+/** How this platform opens beneath a root. */
+export function beneathMode() {
+    if (beneathTestHooks.mode !== undefined)
+        return beneathTestHooks.mode;
+    modeHeld ??= process.platform === 'darwin' ? 'darwin' : process.platform === 'linux' && existsSync('/proc/self/fd') ? 'procfd' : 'unsupported';
+    return modeHeld;
+}
+/** Test seams: called with the absolute path just before an open beneath a root (with its flags), and just before a
+ *  directory opened beneath a root is listed. */
+export const beneathTestHooks = {};
+export class BeneathError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+/** The components of a path relative to a root: no empty, `.`, `..`, absolute or NUL-bearing part. (`/` is the only
+ *  separator on the platforms this opens on: a backslash is an ordinary character in a POSIX name.) */
+function partsOf(rel) {
+    const parts = rel.split('/');
+    if (rel === '' || parts.some((p) => p === '' || p === '.' || p === '..' || p.includes('\0'))) {
+        throw new BeneathError('EINVAL', `not a path beneath a root: ${JSON.stringify(rel)}`);
+    }
+    return parts;
+}
+/**
+ * Open `rel` beneath the real directory `root`, following no link at or below it. Throws the open's own error (its
+ * `code`: ELOOP for a link anywhere below the root, ENOENT, ENOTDIR, EEXIST…) or a {@link BeneathError}.
+ */
+export function openBeneath(root, rel, opts = {}) {
+    const parts = partsOf(rel);
+    const base = opts.flags ?? fsConstants.O_RDONLY;
+    const abs = join(root, ...parts);
+    beneathTestHooks.beforeOpen?.(abs, base);
+    const mode = beneathMode();
+    // Darwin refuses O_NOFOLLOW together with O_NOFOLLOW_ANY (EINVAL); the latter covers the last component too.
+    if (mode === 'darwin')
+        return openSync(abs, base | DARWIN_O_NOFOLLOW_ANY, opts.mode);
+    const leafFlags = base | (fsConstants.O_NOFOLLOW ?? 0);
+    if (mode === 'procfd') {
+        let dir = openSync(root, fsConstants.O_RDONLY | fsConstants.O_DIRECTORY);
+        try {
+            for (const p of parts.slice(0, -1)) {
+                let next;
+                try {
+                    next = openSync(`/proc/self/fd/${dir}/${p}`, fsConstants.O_RDONLY | fsConstants.O_DIRECTORY | (fsConstants.O_NOFOLLOW ?? 0));
+                }
+                catch (err) {
+                    // Linux answers a link here with ENOTDIR (O_DIRECTORY is checked first) or ELOOP: either way the folder on
+                    // the way is not a real folder, and it is said the way macOS says it.
+                    const code = err.code;
+                    if (code === 'ENOTDIR' || code === 'ELOOP')
+                        throw new BeneathError('ELOOP', `${p} is not a real folder (a link is never followed)`);
+                    throw err;
+                }
+                closeSync(dir);
+                dir = next;
+            }
+            return openSync(`/proc/self/fd/${dir}/${parts.at(-1)}`, leafFlags, opts.mode);
+        }
+        finally {
+            closeSync(dir);
+        }
+    }
+    throw new BeneathError('ENOTSUP', 'this platform cannot open a file without following links in its folders');
+}
+/** Read the regular file `rel` beneath `root`, at most `max` bytes (over = refused, never cut), non-blocking (a FIFO
+ *  is refused, not waited on). Returns the bytes and the file's stats from the same descriptor. */
+export function readBeneath(root, rel, max) {
+    const fd = openBeneath(root, rel, { flags: fsConstants.O_RDONLY | (fsConstants.O_NONBLOCK ?? 0) });
+    try {
+        const st = fstatSync(fd);
+        if (!st.isFile())
+            throw new BeneathError('EFTYPE', 'not a regular file');
+        if (st.size > max)
+            throw new BeneathError('EFBIG', `over ${max} bytes`);
+        const buf = Buffer.alloc(st.size);
+        let off = 0;
+        while (off < st.size) {
+            const n = readSync(fd, buf, off, st.size - off, off);
+            if (n === 0)
+                break;
+            off += n;
+        }
+        return { data: buf.subarray(0, off), st };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** What `rel` beneath `root` is (a regular file, a directory, something else), by its own descriptor; `null` if absent. */
+export function statBeneath(root, rel) {
+    let fd;
+    try {
+        fd = openBeneath(root, rel, { flags: fsConstants.O_RDONLY | (fsConstants.O_NONBLOCK ?? 0) });
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+    try {
+        return fstatSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Create the file `rel` beneath `root` exclusively (never through a link, never over an existing entry) with `data`. */
+export function createBeneath(root, rel, data, mode) {
+    const fd = openBeneath(root, rel, { flags: fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, mode });
+    try {
+        let off = 0;
+        while (off < data.length)
+            off += writeSync(fd, data, off, data.length - off);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/**
+ * Make the directory `name` directly beneath `root` (one component: the root's own entry) and prove it is a real
+ * directory, not a link, by opening it beneath the root.
+ */
+export function mkdirBeneath(root, name, mode = 0o700) {
+    partsOf(name);
+    if (name.includes('/'))
+        throw new BeneathError('EINVAL', 'one folder at a time');
+    try {
+        mkdirSync(join(root, name), { recursive: false, mode });
+    }
+    catch (err) {
+        if (err.code !== 'EEXIST')
+            throw err;
+    }
+    const st = statBeneath(root, name);
+    if (st === null || !st.isDirectory())
+        throw new BeneathError('ENOTDIR', `${name} is not a real folder`);
+}
+/**
+ * The names in the directory `rel` beneath `root` (`''` = the root itself, trusted), at most `max`, listed by the
+ * identity of the directory opened beneath the root (see the module doc). `null` when it cannot be listed.
+ */
+export function listBeneath(root, rel, max) {
+    let target = root;
+    let fd = null;
+    try {
+        if (rel !== '') {
+            fd = openBeneath(root, rel, { flags: fsConstants.O_RDONLY | fsConstants.O_DIRECTORY });
+            const st = fstatSync(fd);
+            if (!st.isDirectory())
+                return null;
+            beneathTestHooks.beforeList?.(join(root, ...partsOf(rel)));
+            // By identity: what the descriptor holds, whatever the path names now.
+            target = beneathMode() === 'procfd' ? `/proc/self/fd/${fd}` : `/.vol/${st.dev}/${st.ino}`;
+        }
+        const names = [];
+        let more = false;
+        const handle = opendirSync(target);
+        try {
+            for (let e = handle.readSync(); e !== null; e = handle.readSync()) {
+                if (names.length >= max) {
+                    more = true;
+                    break;
+                }
+                names.push(e.name);
+            }
+        }
+        finally {
+            handle.closeSync();
+        }
+        return { names, more };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== null)
+            closeSync(fd);
+    }
+}
+//# sourceMappingURL=beneath.js.map

package/dist/api/beneath.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"beneath.js","sourceRoot":"","sources":["../../src/api/beneath.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,SAAS,EAAE,SAAS,IAAI,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAc,MAAM,SAAS,CAAC;AACxJ,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,8GAA8G;AAC9G,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAIzC,IAAI,QAAQ,GAAuB,IAAI,CAAC;AACxC,8CAA8C;AAC9C,MAAM,UAAU,WAAW;IACzB,IAAI,gBAAgB,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;IACtE,QAAQ,KAAK,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC;IAC/I,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;iDACiD;AACjD,MAAM,CAAC,MAAM,gBAAgB,GAA0H,EAAE,CAAC;AAE1J,MAAM,OAAO,YAAa,SAAQ,KAAK;IAChB;IAArB,YAAqB,IAAY,EAAE,OAAe;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,SAAI,GAAJ,IAAI,CAAQ;IAEjC,CAAC;CACF;AAED;uGACuG;AACvG,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,8BAA8B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,GAAW,EAAE,OAA2B,EAAE;IAClF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,QAAQ,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC;IACjC,gBAAgB,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,6GAA6G;IAC7G,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,GAAG,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;IACvD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QACzE,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC,IAAI,IAAY,CAAC;gBACjB,IAAI,CAAC;oBACH,IAAI,GAAG,QAAQ,CAAC,iBAAiB,GAAG,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,WAAW,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC/H,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,2GAA2G;oBAC3G,sEAAsE;oBACtE,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;oBACjD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO;wBAAE,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,kDAAkD,CAAC,CAAC;oBACpI,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,SAAS,CAAC,GAAG,CAAC,CAAC;gBACf,GAAG,GAAG,IAAI,CAAC;YACb,CAAC;YACD,OAAO,QAAQ,CAAC,iBAAiB,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACjF,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,YAAY,CAAC,SAAS,EAAE,yEAAyE,CAAC,CAAC;AAC/G,CAAC;AAED;mGACmG;AACnG,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,GAAW,EAAE,GAAW;IAChE,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IACnG,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;QACzE,IAAI,EAAE,CAAC,IAAI,GAAG,GAAG;YAAE,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM;YACnB,GAAG,IAAI,CAAC,CAAC;QACX,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC;IAC5C,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,2HAA2H;AAC3H,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,GAAW;IACnD,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,yHAAyH;AACzH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,GAAW,EAAE,IAAY,EAAE,IAAY;IACjF,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACpH,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM;YAAE,GAAG,IAAI,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IAC/E,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY,EAAE,IAAI,GAAG,KAAK;IACnE,OAAO,CAAC,IAAI,CAAC,CAAC;IACd,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IACjF,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,SAAS,EAAE,GAAG,IAAI,uBAAuB,CAAC,CAAC;AAC1G,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,GAAW,EAAE,GAAW;IAChE,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,EAAE,GAAkB,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACf,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;YACvF,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;gBAAE,OAAO,IAAI,CAAC;YACnC,gBAAgB,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3D,uEAAuE;YACvE,MAAM,GAAG,WAAW,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC;QAC5F,CAAC;QACD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAClE,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;oBACxB,IAAI,GAAG,IAAI,CAAC;oBACZ,MAAM;gBACR,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;AACH,CAAC"}

package/dist/api/capture.d.ts

@@ -61,6 +61,7 @@ export declare const CaptureSchema: z.ZodObject<{
     /** wicked-core#850 — the explicit reduced-assurance opt-in, forwarded to `POST /runs` only when `true`. */
     reducedAssurance: z.ZodOptional<z.ZodBoolean>;
 }, "strict", z.ZodTypeAny, {
+    notes?: string | undefined;
     reducedAssurance?: boolean | undefined;
     files?: ({
         name: string;
@@ -70,8 +71,8 @@ export declare const CaptureSchema: z.ZodObject<{
         mediaType: string;
         dataBase64: string;
     })[] | undefined;
-    notes?: string | undefined;
 }, {
+    notes?: string | undefined;
     reducedAssurance?: boolean | undefined;
     files?: ({
         name: string;
@@ -81,7 +82,6 @@ export declare const CaptureSchema: z.ZodObject<{
         mediaType: string;
         dataBase64: string;
     })[] | undefined;
-    notes?: string | undefined;
 }>;
 /** `POST /proposals/:id/approve` body — present only for an accept WITH an edit. */
 export declare const ApproveEditSchema: z.ZodObject<{

package/dist/api/chat-citations.d.ts

@@ -19,10 +19,31 @@
  * | kind     | citation                          | check |
  * |----------|-----------------------------------|-------|
  * | `path`   | `crew/src/api/routes.ts`          | the file exists under a read root |
- * | `line`   | `routes.ts:2264`, `x.ts:80-90`    | the file exists AND has that many lines; when a symbol is named right before the ref, that the symbol is ON that line — otherwise the line it IS on, as a CORRECTION |
+ * | `line`   | `routes.ts:2264`, `x.ts:80-90`    | the file exists AND has that many lines (a range: through its LAST line); when a symbol is named right before the ref, that the symbol is ON that line (in that range) — otherwise the line it IS on, as a CORRECTION |
  * | `symbol` | `execute_wrapped.rs:build_worker_command` | the file exists AND contains the symbol |
  * | `sha`    | `6d77153`, 7–40 hex               | `git rev-parse --verify --quiet <sha>^{commit}` in the repo the text names, else in any read root |
  *
+ * # Where a cited path is looked for (crew#1211)
+ *
+ * Seats cite paths relative to whatever they were reading, not always to the repo root: on the J3
+ * sweep Claude wrote "Paths are under `wicked-crew/packages/crew/src/`" and then cited
+ * `core/types.ts:232`, and all 7 such citations were struck through as UNVERIFIED although every
+ * one was right. A cited path is looked for, in order:
+ *  1. from a repo root, with or without the repo-name prefix (`wicked-crew/x/y.ts`, `x/y.ts`);
+ *  2. under a directory the reply itself declares (a backticked `a/b/` or `repo/a/b` token);
+ *  3. as the TAIL of a tracked file (`core/types.ts` → `packages/crew/src/core/types.ts`), by whole
+ *     path segments. A repo name spelled in full confines it to that repo; a declared directory
+ *     confines a slashed path to it (found only elsewhere ⇒ `unchecked`).
+ * Several matches at any step ⇒ the one under a declared directory; still several ⇒ `unchecked`
+ * ("the citation does not say which"). Root order is never a tie-break. A repo that could not be
+ * listed makes a tail match `unchecked`: the unlisted repo may hold another.
+ *
+ * The daemon has no record of the files a chat seat opened (`toolInvoked` carries tool names
+ * only), so the reply's own directories stand in for "the files the worker read".
+ *
+ * `unverified` means "there is no such thing in this chat's scope". A citation that names a real
+ * file the pass cannot pin to ONE place is `unchecked`, never `unverified`: it is not wrong.
+ *
  * # Why a false positive is worse than a miss
  *
  * Prose looks like a path (`e.g`, `something.this`) and words look like SHAs. Flagging prose
@@ -129,6 +150,8 @@ export interface RawCitation {
     path?: string;
     /** The first line of a `line` citation. */
     line?: number;
+    /** The last line of a `line` citation's range (`x.ts:80-90` → 90). */
+    lineEnd?: number;
     /** The symbol of a `symbol` citation, or the one the sentence named before a `line` citation. */
     symbol?: string;
     /** The repo a `sha` citation's sentence named, when it named one. */
@@ -165,6 +188,7 @@ export interface ChatCitationsResult {
     unchecked: number;
     items: ChatCitationItem[];
 }
+export declare function declaredDirectories(text: string): string[];
 /**
  * Verify every citation in a reply, bounded. Never throws: a broken root, an unreadable file or a
  * git that is not there is a verdict (`unverified` / `unchecked`), not an error.

package/dist/api/chat-citations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chat-citations.d.ts","sourceRoot":"","sources":["../../src/api/chat-citations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAOH,mGAAmG;AACnG,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,yFAAyF;IACzF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,yCAAyC;AACzC,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAE3E;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,WAAW,GAAG,YAAY,GAAG,WAAW,CAAC;AAEvF,wFAAwF;AACxF,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,eAAe,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mFAAmF;AACnF,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,QAAS,CAAC;AASxC;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEzD,gGAAgG;AAChG,MAAM,WAAW,gBAAgB;IAC/B,+CAA+C;IAC/C,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,qFAAqF;IACrF,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;IACxC,yFAAyF;IACzF,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IACrD,8EAA8E;IAC9E,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjE,GAAG,IAAI,MAAM,CAAC;CACf;AAED,6DAA6D;AAC7D,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,gBAAgB,CAAC;IACvB,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,sGAAsG;AACtG,eAAO,MAAM,gBAAgB,uCAAkC,CAAC;AAChE,eAAO,MAAM,kBAAkB,8BAA8B,CAAC;AAI9D,0DAA0D;AAC1D,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAO3D;AAkCD,6FAA6F;AAC7F,wBAAgB,WAAW,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,EAAE,CASxD;AAgBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,YAAY,EAAE,GAAG,WAAW,EAAE,CAyC5F;AAID,8DAA8D;AAC9D,wBAAgB,gBAAgB,IAAI,gBAAgB,CAiDnD;AAED,MAAM,WAAW,aAAa;IAC5B,0HAA0H;IAC1H,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,gBAAgB,EAAE,CAAC;CAC3B;AAyDD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,IAAI,GAAE,gBAAqC,EAC3C,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,mBAAmB,CAAC,CA+O9B;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,EAC9E,MAAM,EAAE,mBAAmB,GAC1B,kBAAkB,GAAG,IAAI,CAc3B"}
+{"version":3,"file":"chat-citations.d.ts","sourceRoot":"","sources":["../../src/api/chat-citations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAOH,mGAAmG;AACnG,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,yFAAyF;IACzF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,yCAAyC;AACzC,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAE3E;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,WAAW,GAAG,YAAY,GAAG,WAAW,CAAC;AAEvF,wFAAwF;AACxF,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,eAAe,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mFAAmF;AACnF,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,QAAS,CAAC;AASxC;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEzD,gGAAgG;AAChG,MAAM,WAAW,gBAAgB;IAC/B,+CAA+C;IAC/C,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,qFAAqF;IACrF,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;IACxC,yFAAyF;IACzF,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IACrD,8EAA8E;IAC9E,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjE,GAAG,IAAI,MAAM,CAAC;CACf;AAED,6DAA6D;AAC7D,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,gBAAgB,CAAC;IACvB,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iGAAiG;IACjG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,sGAAsG;AACtG,eAAO,MAAM,gBAAgB,uCAAkC,CAAC;AAChE,eAAO,MAAM,kBAAkB,8BAA8B,CAAC;AAI9D,0DAA0D;AAC1D,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAO3D;AAkCD,6FAA6F;AAC7F,wBAAgB,WAAW,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,EAAE,CASxD;AAgBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,YAAY,EAAE,GAAG,WAAW,EAAE,CAkD5F;AAID,8DAA8D;AAC9D,wBAAgB,gBAAgB,IAAI,gBAAgB,CAoDnD;AAED,MAAM,WAAW,aAAa;IAC5B,0HAA0H;IAC1H,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,gBAAgB,EAAE,CAAC;CAC3B;AAqCD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAQ1D;AAiCD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,IAAI,GAAE,gBAAqC,EAC3C,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,mBAAmB,CAAC,CA2T9B;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,EAC9E,MAAM,EAAE,mBAAmB,GAC1B,kBAAkB,GAAG,IAAI,CAc3B"}