type BoundaryAllowedType = "file" | "directory";

/** Caller-provided path safety requirements for one fs bridge operation. */

export type PathSafetyOptions = {

type PathSafetyOptions = {

action: string;

aliasPolicy?: PathAliasPolicy;

requireWritable?: boolean;

return input;

}

export function isWindowsDriveAbsolutePath(raw: string): boolean {

function isWindowsDriveAbsolutePath(raw: string): boolean {

return /^[A-Za-z]:[\\/]/.test(stripWindowsNamespacePrefix(raw.trim()));

}

expiresAt: number;

};

export type NoVncObserverTokenPayload = {

type NoVncObserverTokenPayload = {

noVncPort: number;

password?: string;

};

return path.join(rootDir, ...MATERIALIZED_SANDBOX_SKILLS_WORKSPACE_PARTS);

}

export function resolveMaterializedSandboxSkillsRoot(rootDir: string): string {

return path.join(resolveMaterializedSandboxSkillsWorkspaceDir(rootDir), "skills");

}

/** Returns true when a skill mount source exists inside the canonical mount root. */

export function isExistingWorkspaceSkillMountSource(params: {

rootDir: string;