internal/

Package atomicfile provides durable, crash-safe atomic replacement of one file's contents (spec "docs/specs/long-running-command-supervision.md", "Manifests and durability": "Manifest updates use write-new, sync, and atomic replace semantics").

Package filemutation implements the shared mechanics of the two direct mutation tools, WriteFile and EditFile: single-step preparation and canonicalization, workspace containment, atomic publication, optimistic file-freshness concurrency, and permit-scoped cross-loop serialization.

Package hashcache memoizes the parse of a byte slice keyed by its SHA-256.

Package nofollow provides one small, platform-portable primitive for opening a file while refusing to traverse a symlink (POSIX) or reparse point (Windows) at the final path component.

Package prepared holds the small helpers the direct file/context tools share at the preparation boundary: reading a call's typed prepared artifact back from the context and building the direct filesystem requirements (empty grant pair — the tool enforces the approved resolved resource itself).

Package safetext converts raw process output bytes into model-safe text (spec "docs/specs/long-running-command-supervision.md", "Output capture and storage": "Model-visible text passes through safe-text normalization: invalid UTF-8 is replaced deterministically; disallowed terminal control sequences are escaped or removed; binary detection is reported; normalization is reported").

Package workspace holds the shared, security-sensitive primitives the standard tools depend on: `**`-aware glob matching, workspace path containment, and typed-nil detection for injected dependencies.