A containerised workspace's files as a FileBackend (design ยง4.33): /src/a.txt is the workspace's src/a.txt, / its root. One workspace is one tenant's: an application serving several builds one backend per tenant and picks it with FileBackend.resolved (rule 8).
'''Order.''' A mutation locks the whole workspace, files/workspace/<id> (WorkspaceLocks), as a command there does, so a batch's edits and commands apply in call order, even two paths that name one file through a link. Reads take no lock and see the workspace as it is.
'''Replay.''' The target is Verifiable (C4). Each mutation runs ReplayGuard.verifiable under ctx.effectKey("file.write" | "file.edit" | "file.delete", path): the plan reads the file once, makes every refusal, and plans a compare-and-set against the hash it read, which the runner applies atomically under its mutation lock and replaces the file atomically. So a replayed edit that landed returns its first outcome, one that did not runs again, and one whose file another writer changed is refused.
'''Bounds.''' Content and an edit's result at most maxFileBytes UTF-8 bytes, checked before they are sent; a read at most the runner's maxFileSize; listings at most the runner's maxDirectoryEntries, then limit. A listing the runner cut is truncated, its entries those the runner returned, sorted.
'''Block.''' A workspace effect stays when a Block retracts its turn (rule 5).
Listings show what the runner's default exclusions (.git, node_modules, ...) leave, and skip entries whose names are not valid paths. grep reads each file whole, as text: a file that is not UTF-8 or is over the runner's size limit is skipped and the listing marked truncated.
Replaces old with replacement in the file path: the one occurrence, or every occurrence when replaceAll. Refused when old is empty or absent, or occurs more than once and not replaceAll.
Replaces old with replacement in the file path: the one occurrence, or every occurrence when replaceAll. Refused when old is empty or absent, or occurs more than once and not replaceAll.
The files within under that accept takes, in path order, at most limit: accept is applied before the limit, so a file it refuses never takes a place (a composite passes a predicate that refuses the paths a mount shadows, and relies on this to fill its limit with visible files). search likewise.
The files within under that accept takes, in path order, at most limit: accept is applied before the limit, so a file it refuses never takes a place (a composite passes a predicate that refuses the paths a mount shadows, and relies on this to fill its limit with visible files). search likewise.
The lines matching regex of the files within under that accept takes, in path then line order. regex is the model's: match it with org.llm4s.security.RegexSafetyManager.safeFind, never a bare matcher, so a catastrophic pattern is bounded and cannot overflow the stack.
The lines matching regex of the files within under that accept takes, in path then line order. regex is the model's: match it with org.llm4s.security.RegexSafetyManager.safeFind, never a bare matcher, so a catastrophic pattern is bounded and cannot overflow the stack.
The lines matching regex in the files within under. include filters the files: a pattern with no / matches a file's name, one with a / its path relative to under (as ripgrep's --glob).
The lines matching regex in the files within under. include filters the files: a pattern with no / matches a file's name, one with a / its path relative to under (as ripgrep's --glob).