@aitne/daemon 0.1.7 → 0.1.8

package/dist/observers/poll-guard.js

@@ -0,0 +1,89 @@
+import { createLogger } from "../logging.js";
+import { raceWithAbort } from "../core/abort-utils.js";
+export { raceWithAbort };
+const logger = createLogger("poll-guard");
+/**
+ * Shared overlap+timeout guard for observer pollers.
+ *
+ * Combines the two patterns that several existing pollers already do
+ * inline — `mail-poller`'s `inFlight` flag (overlap prevention) and a
+ * per-tick wall-clock cap that the audit found missing on
+ * `CalendarPoller`, `NotionPoller`, and `ImminentEventScheduler`.
+ *
+ * Contract: callers MUST honor the AbortSignal in long-running work.
+ * For SDK calls that don't natively support `signal`, wrap them with
+ * {@link raceWithAbort} — the underlying call leaks (continues in the
+ * background until it naturally completes or the transport times out),
+ * but the poller's promise resolves so `inFlight` can reset and the
+ * next tick is unblocked.
+ *
+ * What this does NOT do:
+ *  - Kill the in-flight work directly (PollGuard is signal-only).
+ *  - Reset `inFlight` if `fn` ignores both the signal and never resolves.
+ *    That failure mode is a poller bug — surface it loudly via the
+ *    timeout warning rather than silently allowing concurrent ticks
+ *    that could race on shared DB state.
+ */
+export class PollGuard {
+    name;
+    tickTimeoutMs;
+    inFlight = false;
+    currentAborter = null;
+    skipCount = 0;
+    constructor(options) {
+        this.name = options.name;
+        this.tickTimeoutMs = options.tickTimeoutMs ?? 0;
+    }
+    /**
+     * Run `fn` once with overlap protection. Returns `true` if `fn` ran
+     * (regardless of whether it threw), `false` if a previous tick was
+     * still in flight and this call was skipped.
+     *
+     * Errors from `fn` are re-thrown to the caller — the guard does not
+     * swallow them. Callers wrap their own `try/catch` for logging policy.
+     */
+    async run(fn) {
+        if (this.inFlight) {
+            this.skipCount += 1;
+            logger.debug({ name: this.name, skipCount: this.skipCount }, "Skipping tick — previous run still in flight");
+            return false;
+        }
+        if (this.skipCount > 0) {
+            logger.warn({ name: this.name, skipped: this.skipCount }, "Resumed after skipping ticks");
+            this.skipCount = 0;
+        }
+        this.inFlight = true;
+        const aborter = new AbortController();
+        this.currentAborter = aborter;
+        let timer;
+        if (this.tickTimeoutMs > 0) {
+            timer = setTimeout(() => {
+                logger.warn({ name: this.name, tickTimeoutMs: this.tickTimeoutMs }, "Poll tick exceeded wall-clock — aborting");
+                aborter.abort(new Error(`poll_tick_timeout:${this.name}:${this.tickTimeoutMs}ms`));
+            }, this.tickTimeoutMs);
+            timer.unref?.();
+        }
+        try {
+            await fn(aborter.signal);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+            this.currentAborter = null;
+            this.inFlight = false;
+        }
+        return true;
+    }
+    /**
+     * Cancel any in-flight tick. Safe to call from `observer.stop()` even
+     * when no tick is running.
+     */
+    abortInFlight(reason) {
+        this.currentAborter?.abort(reason);
+    }
+    /** Test seam. */
+    isInFlight() {
+        return this.inFlight;
+    }
+}
+//# sourceMappingURL=poll-guard.js.map

package/dist/observers/poll-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"poll-guard.js","sourceRoot":"","sources":["../../src/observers/poll-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;AAiB1C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,SAAS;IACH,IAAI,CAAS;IACb,aAAa,CAAS;IAC/B,QAAQ,GAAG,KAAK,CAAC;IACjB,cAAc,GAA2B,IAAI,CAAC;IAC9C,SAAS,GAAG,CAAC,CAAC;IAEtB,YAAY,OAAyB;QACnC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,CAAC,EAA0C;QAClD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,CACV,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAC9C,8CAA8C,CAC/C,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,EAC5C,8BAA8B,CAC/B,CAAC;YACF,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;QAC9B,IAAI,KAAgD,CAAC;QACrD,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;YAC3B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,EACtD,0CAA0C,CAC3C,CAAC;gBACF,OAAO,CAAC,KAAK,CACX,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,CACpE,CAAC;YACJ,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACvB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,MAAgB;QAC5B,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,iBAAiB;IACjB,UAAU;QACR,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF"}

package/dist/safety/absolute-block-audit.d.ts

@@ -10,6 +10,21 @@ import type { AbsoluteBlockMatch } from "./always-disallowed.js";
  * the SDK-level `disallowedTools` / TOML deny-rule rejection; this row
  * is observability only. If the DB is transiently unavailable, a warning
  * logs and the hook still returns the block decision to the caller.
+ *
+ * Two semantic call sites, discriminated via the `result` parameter:
+ *
+ *   - `result: 'failed'` (default) — the Claude SDK PreToolUse hook
+ *     authoritatively rejected the call. The audit row truthfully reports
+ *     a denied invocation. `trigger='absolute_block_layer'`.
+ *
+ *   - `result: 'partial'` — a CLI backend (Codex, Gemini) observed a
+ *     `tool_use`-shaped stream event whose input matches an absolute-block
+ *     pattern. The actual rejection (or not) happens inside the subprocess
+ *     sandbox / admin policy, where the daemon cannot directly observe
+ *     the outcome. `trigger='absolute_block_stream_observation'` so an
+ *     audit-log filter can keep the two streams cleanly separated.
+ *     `detail.observation: 'stream'` mirrors the trigger discrimination
+ *     for consumers that prefer the JSON detail field.
  */
 export declare function recordAbsoluteBlockAudit(params: {
     db: Database.Database | undefined;
@@ -18,5 +33,7 @@ export declare function recordAbsoluteBlockAudit(params: {
     match: AbsoluteBlockMatch;
     toolName: string;
     sessionId?: number | null;
+    /** Audit row outcome — see the function docstring. */
+    result?: "failed" | "partial";
 }): void;
 //# sourceMappingURL=absolute-block-audit.d.ts.map

package/dist/safety/absolute-block-audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"absolute-block-audit.d.ts","sourceRoot":"","sources":["../../src/safety/absolute-block-audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAExE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAIjE;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,SAAS,CAAC;IAClC,OAAO,EAAE,SAAS,CAAC;IACnB,IAAI,EAAE,uBAAuB,CAAC;IAC9B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,GAAG,IAAI,CAqBP"}
+{"version":3,"file":"absolute-block-audit.d.ts","sourceRoot":"","sources":["../../src/safety/absolute-block-audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAExE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAIjE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,SAAS,CAAC;IAClC,OAAO,EAAE,SAAS,CAAC;IACnB,IAAI,EAAE,uBAAuB,CAAC;IAC9B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sDAAsD;IACtD,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC/B,GAAG,IAAI,CAgCP"}

package/dist/safety/absolute-block-audit.js

@@ -9,11 +9,34 @@ const logger = createLogger("absolute-block-audit");
  * the SDK-level `disallowedTools` / TOML deny-rule rejection; this row
  * is observability only. If the DB is transiently unavailable, a warning
  * logs and the hook still returns the block decision to the caller.
+ *
+ * Two semantic call sites, discriminated via the `result` parameter:
+ *
+ *   - `result: 'failed'` (default) — the Claude SDK PreToolUse hook
+ *     authoritatively rejected the call. The audit row truthfully reports
+ *     a denied invocation. `trigger='absolute_block_layer'`.
+ *
+ *   - `result: 'partial'` — a CLI backend (Codex, Gemini) observed a
+ *     `tool_use`-shaped stream event whose input matches an absolute-block
+ *     pattern. The actual rejection (or not) happens inside the subprocess
+ *     sandbox / admin policy, where the daemon cannot directly observe
+ *     the outcome. `trigger='absolute_block_stream_observation'` so an
+ *     audit-log filter can keep the two streams cleanly separated.
+ *     `detail.observation: 'stream'` mirrors the trigger discrimination
+ *     for consumers that prefer the JSON detail field.
  */
 export function recordAbsoluteBlockAudit(params) {
-    const { db, backend, mode, match, toolName, sessionId } = params;
+    const { db, backend, mode, match, toolName, sessionId, result } = params;
     if (!db)
         return;
+    const effectiveResult = result ?? "failed";
+    // Trigger is derived from `result` so the (action_type, trigger, result)
+    // triple is internally consistent: a reader that filters on any one of
+    // those three columns sees the same partition between authoritative
+    // PreToolUse rejections and CLI stream observations.
+    const trigger = effectiveResult === "partial"
+        ? "absolute_block_stream_observation"
+        : "absolute_block_layer";
     try {
         const detail = JSON.stringify({
             category: match.category,
@@ -21,9 +44,12 @@ export function recordAbsoluteBlockAudit(params) {
             redacted: match.redacted,
             mode,
             sessionId: sessionId ?? null,
+            ...(effectiveResult === "partial"
+                ? { observation: "stream" }
+                : {}),
         });
         db.prepare(`INSERT INTO agent_actions (action_type, trigger, result, detail, backend)
-         VALUES (?, ?, ?, ?, ?)`).run("blocked_absolute", "absolute_block_layer", "failed", detail, backend);
+         VALUES (?, ?, ?, ?, ?)`).run("blocked_absolute", trigger, effectiveResult, detail, backend);
     }
     catch (err) {
         logger.warn({ err, backend, category: match.category }, "failed to record blocked_absolute audit row");

package/dist/safety/absolute-block-audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"absolute-block-audit.js","sourceRoot":"","sources":["../../src/safety/absolute-block-audit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,MAAM,MAAM,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAOxC;IACC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IACjE,IAAI,CAAC,EAAE;QAAE,OAAO;IAChB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI;YACJ,SAAS,EAAE,SAAS,IAAI,IAAI;SAC7B,CAAC,CAAC;QACH,EAAE,CAAC,OAAO,CACR;gCAC0B,CAC3B,CAAC,GAAG,CAAC,kBAAkB,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAC1C,6CAA6C,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"absolute-block-audit.js","sourceRoot":"","sources":["../../src/safety/absolute-block-audit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,MAAM,MAAM,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,wBAAwB,CAAC,MASxC;IACC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACzE,IAAI,CAAC,EAAE;QAAE,OAAO;IAChB,MAAM,eAAe,GAAG,MAAM,IAAI,QAAQ,CAAC;IAC3C,yEAAyE;IACzE,uEAAuE;IACvE,oEAAoE;IACpE,qDAAqD;IACrD,MAAM,OAAO,GAAG,eAAe,KAAK,SAAS;QAC3C,CAAC,CAAC,mCAAmC;QACrC,CAAC,CAAC,sBAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI;YACJ,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,GAAG,CAAC,eAAe,KAAK,SAAS;gBAC/B,CAAC,CAAC,EAAE,WAAW,EAAE,QAAiB,EAAE;gBACpC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,EAAE,CAAC,OAAO,CACR;gCAC0B,CAC3B,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAC1C,6CAA6C,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/safety/agent-write-tracker.d.ts

@@ -31,12 +31,53 @@
 export declare class AgentWriteTracker {
     private readonly ttlMs;
     private readonly recentWrites;
-    constructor(ttlMs?: number);
+    /**
+     * Parallel commit-tracking map keyed by `<repoPath>::<sha-lower>`. Used by
+     * `GitWatcher` to flip observations of agent-originated commits from
+     * `actor='user'` / `'unknown'` to `actor='agent'` so the hourly_check
+     * pending-floor does not count the daemon's own commits as user
+     * activity (C1).
+     */
+    private readonly recentCommits;
+    private readonly commitTtlMs;
+    constructor(ttlMs?: number, opts?: {
+        commitTtlMs?: number;
+    });
     markWriting(absolutePath: string, content?: string | null, opts?: {
         ttlMs?: number;
     }): void;
+    /**
+     * Remove a mark for `absolutePath`, regardless of mode (content-hash or
+     * path-only). Used by writers that mark **before** the visible-write
+     * boundary (C2 fix — `markWriting` must precede `writeFileAtomically` /
+     * `writeFileSync` so FS-watch consumers see a populated tracker the
+     * moment the rename/write completes). If the write throws, the caller
+     * rolls the mark back via `unmark` so a stale mark cannot suppress a
+     * later legitimate user edit. Idempotent — `Map.delete` on an unknown
+     * key is a no-op, so callers can `unmark` unconditionally in a catch.
+     */
+    unmark(absolutePath: string): void;
     isMarked(absolutePath: string, content: string | null | undefined): boolean;
     cleanup(now?: number): void;
     private hashContent;
+    /**
+     * Register a git SHA the daemon just committed in `repoPath`. The next
+     * `GitWatcher` observation of that SHA is flipped from `actor='user'` /
+     * `'unknown'` to `actor='agent'` via `isAgentCommit`, which keeps the
+     * hourly_check pending-floor from counting the daemon's own commits as
+     * user activity (the loop bug described in C1).
+     *
+     * Production callers pass the full 40-char SHA from `git rev-parse HEAD`.
+     * The minimum-length guard (≥7 hex chars) prevents accidental cross-repo
+     * collisions when tests feed abbreviated hashes. Malformed input is a
+     * silent no-op rather than an error — this is best-effort attribution,
+     * never a correctness gate.
+     */
+    markAgentCommit(repoPath: string, sha: string, opts?: {
+        ttlMs?: number;
+    }): void;
+    isAgentCommit(repoPath: string, sha: string): boolean;
+    private commitKey;
+    private cleanupCommits;
 }
 //# sourceMappingURL=agent-write-tracker.d.ts.map

package/dist/safety/agent-write-tracker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-write-tracker.d.ts","sourceRoot":"","sources":["../../src/safety/agent-write-tracker.ts"],"names":[],"mappings":"AAiBA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,iBAAiB;IAGhB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFlC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAkC;gBAElC,KAAK,SAAS;IAE3C,WAAW,CACT,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,EACvB,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACxB,IAAI;IAWP,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAsB3E,OAAO,CAAC,GAAG,SAAa,GAAG,IAAI;IAQ/B,OAAO,CAAC,WAAW;CAGpB"}
+{"version":3,"file":"agent-write-tracker.d.ts","sourceRoot":"","sources":["../../src/safety/agent-write-tracker.ts"],"names":[],"mappings":"AA+BA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,iBAAiB;IAa1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAZxB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAkC;IAC/D;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAmC;IACjE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAGlB,KAAK,SAAS,EAC/B,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;IAKjC,WAAW,CACT,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,EACvB,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACxB,IAAI;IAWP;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAIlC,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAsB3E,OAAO,CAAC,GAAG,SAAa,GAAG,IAAI;IAQ/B,OAAO,CAAC,WAAW;IAMnB;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAa/E,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO;IAYrD,OAAO,CAAC,SAAS;IAOjB,OAAO,CAAC,cAAc;CAKvB"}

package/dist/safety/agent-write-tracker.js

@@ -1,6 +1,14 @@
 import { createHash } from "node:crypto";
 import { createLogger } from "../logging.js";
 const logger = createLogger("agent-write-tracker");
+const SHA_PATTERN = /^[0-9a-f]{7,40}$/i;
+/**
+ * Commit-tracking TTL default. Outlives the 5-min `GitWatcher` poll
+ * default at `git-watcher.ts` so a commit made just after a poll cycle
+ * still wins attribution at the next cycle. Constructor lets tests
+ * override.
+ */
+const DEFAULT_COMMIT_TTL_MS = 15 * 60_000;
 /**
  * AgentWriteTracker — short-lived, in-memory record of paths the agent is
  * currently writing via the daemon API. Observers consult it to classify
@@ -34,8 +42,18 @@ const logger = createLogger("agent-write-tracker");
 export class AgentWriteTracker {
     ttlMs;
     recentWrites = new Map();
-    constructor(ttlMs = 30_000) {
+    /**
+     * Parallel commit-tracking map keyed by `<repoPath>::<sha-lower>`. Used by
+     * `GitWatcher` to flip observations of agent-originated commits from
+     * `actor='user'` / `'unknown'` to `actor='agent'` so the hourly_check
+     * pending-floor does not count the daemon's own commits as user
+     * activity (C1).
+     */
+    recentCommits = new Map();
+    commitTtlMs;
+    constructor(ttlMs = 30_000, opts) {
         this.ttlMs = ttlMs;
+        this.commitTtlMs = opts?.commitTtlMs ?? DEFAULT_COMMIT_TTL_MS;
     }
     markWriting(absolutePath, content, opts) {
         const mode = typeof content === "string" ? "content-hash" : "path-only";
@@ -47,6 +65,19 @@ export class AgentWriteTracker {
         logger.debug({ path: absolutePath, mode, ttlMs }, "Write marked for agent attribution");
         this.cleanup();
     }
+    /**
+     * Remove a mark for `absolutePath`, regardless of mode (content-hash or
+     * path-only). Used by writers that mark **before** the visible-write
+     * boundary (C2 fix — `markWriting` must precede `writeFileAtomically` /
+     * `writeFileSync` so FS-watch consumers see a populated tracker the
+     * moment the rename/write completes). If the write throws, the caller
+     * rolls the mark back via `unmark` so a stale mark cannot suppress a
+     * later legitimate user edit. Idempotent — `Map.delete` on an unknown
+     * key is a no-op, so callers can `unmark` unconditionally in a catch.
+     */
+    unmark(absolutePath) {
+        this.recentWrites.delete(absolutePath);
+    }
     isMarked(absolutePath, content) {
         const entry = this.recentWrites.get(absolutePath);
         if (!entry) {
@@ -78,5 +109,54 @@ export class AgentWriteTracker {
     hashContent(content) {
         return createHash("sha256").update(content).digest("hex");
     }
+    // ── Commit attribution (C1) ──────────────────────────────────────────
+    /**
+     * Register a git SHA the daemon just committed in `repoPath`. The next
+     * `GitWatcher` observation of that SHA is flipped from `actor='user'` /
+     * `'unknown'` to `actor='agent'` via `isAgentCommit`, which keeps the
+     * hourly_check pending-floor from counting the daemon's own commits as
+     * user activity (the loop bug described in C1).
+     *
+     * Production callers pass the full 40-char SHA from `git rev-parse HEAD`.
+     * The minimum-length guard (≥7 hex chars) prevents accidental cross-repo
+     * collisions when tests feed abbreviated hashes. Malformed input is a
+     * silent no-op rather than an error — this is best-effort attribution,
+     * never a correctness gate.
+     */
+    markAgentCommit(repoPath, sha, opts) {
+        if (!SHA_PATTERN.test(sha))
+            return;
+        const ttlMs = opts?.ttlMs ?? this.commitTtlMs;
+        this.recentCommits.set(this.commitKey(repoPath, sha), {
+            expiresAt: Date.now() + ttlMs,
+        });
+        logger.debug({ repoPath, sha: sha.slice(0, 8), ttlMs }, "Agent commit marked for attribution");
+        this.cleanupCommits();
+    }
+    isAgentCommit(repoPath, sha) {
+        if (!sha)
+            return false;
+        const key = this.commitKey(repoPath, sha);
+        const entry = this.recentCommits.get(key);
+        if (!entry)
+            return false;
+        if (Date.now() > entry.expiresAt) {
+            this.recentCommits.delete(key);
+            return false;
+        }
+        return true;
+    }
+    commitKey(repoPath, sha) {
+        // Normalise: trailing slash and case differences should hit the same
+        // bucket. `realpathSync` (symlink resolution) is intentionally out of
+        // scope — audit follow-up H12 covers it.
+        return `${repoPath.replace(/\/+$/, "")}::${sha.toLowerCase()}`;
+    }
+    cleanupCommits(now = Date.now()) {
+        for (const [key, entry] of this.recentCommits.entries()) {
+            if (entry.expiresAt <= now)
+                this.recentCommits.delete(key);
+        }
+    }
 }
 //# sourceMappingURL=agent-write-tracker.js.map

package/dist/safety/agent-write-tracker.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-write-tracker.js","sourceRoot":"","sources":["../../src/safety/agent-write-tracker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,MAAM,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAC;AAcnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,OAAO,iBAAiB;IAGC;IAFZ,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE/D,YAA6B,QAAQ,MAAM;QAAd,UAAK,GAAL,KAAK,CAAS;IAAG,CAAC;IAE/C,WAAW,CACT,YAAoB,EACpB,OAAuB,EACvB,IAAyB;QAEzB,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC;QACxE,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;QACxC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE;YAClC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC7B,WAAW,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;SAC5E,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,oCAAoC,CAAC,CAAC;QACxF,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,QAAQ,CAAC,YAAoB,EAAE,OAAkC;QAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,sEAAsE;QACtE,wDAAwD;QACxD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,mEAAmE;QACnE,8CAA8C;QAC9C,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACtB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC3B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,OAAe;QACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;CACF"}
+{"version":3,"file":"agent-write-tracker.js","sourceRoot":"","sources":["../../src/safety/agent-write-tracker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,MAAM,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAC;AAkBnD,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,EAAE,GAAG,MAAM,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,OAAO,iBAAiB;IAaT;IAZF,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/D;;;;;;OAMG;IACc,aAAa,GAAG,IAAI,GAAG,EAAwB,CAAC;IAChD,WAAW,CAAS;IAErC,YACmB,QAAQ,MAAM,EAC/B,IAA+B;QADd,UAAK,GAAL,KAAK,CAAS;QAG/B,IAAI,CAAC,WAAW,GAAG,IAAI,EAAE,WAAW,IAAI,qBAAqB,CAAC;IAChE,CAAC;IAED,WAAW,CACT,YAAoB,EACpB,OAAuB,EACvB,IAAyB;QAEzB,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC;QACxE,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;QACxC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE;YAClC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC7B,WAAW,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;SAC5E,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,oCAAoC,CAAC,CAAC;QACxF,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAoB;QACzB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACzC,CAAC;IAED,QAAQ,CAAC,YAAoB,EAAE,OAAkC;QAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,sEAAsE;QACtE,wDAAwD;QACxD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,mEAAmE;QACnE,8CAA8C;QAC9C,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACtB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC3B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,OAAe;QACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED,wEAAwE;IAExE;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,QAAgB,EAAE,GAAW,EAAE,IAAyB;QACtE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO;QACnC,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC;QAC9C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE;YACpD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC9B,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CACV,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EACzC,qCAAqC,CACtC,CAAC;QACF,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;IAED,aAAa,CAAC,QAAgB,EAAE,GAAW;QACzC,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,SAAS,CAAC,QAAgB,EAAE,GAAW;QAC7C,qEAAqE;QACrE,sEAAsE;QACtE,yCAAyC;QACzC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;IACjE,CAAC;IAEO,cAAc,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;CACF"}

package/dist/safety/always-disallowed.d.ts

@@ -128,4 +128,38 @@ export declare function classifyAbsoluteBlock(toolName: string, rawArg: string |
  * `docs/design/appendices/cost-reduction-structural.md` §A "Privacy".
  */
 export declare function looksLikeSecretPath(raw: string): boolean;
+/**
+ * docs/design/appendices/opencode-backend.md §5.8 — render `ALWAYS_DISALLOWED_TOOLS`
+ * into an OpenCode-flavoured `permission` block.
+ *
+ * Translation rules (V5-corrected):
+ *   - `Bash(<glob>)` → `permission.bash[<glob>] = "deny"`.
+ *   - `Read(<glob>)` → synthesise `permission.bash[<reader> <glob>] = "deny"`
+ *     for each entry in `SECRET_READ_BASH_COMMANDS`. The `read` permission
+ *     key does not exist in opencode 1.14.50 (V5); per-session sessions
+ *     that should have zero read capability set `tools: { read: false }`
+ *     instead — the per-session translator handles that branch.
+ *   - `Edit(<glob>)` / `Write(<glob>)` → **skipped**. opencode's `edit`
+ *     permission is whole-tool (V5), so emitting `edit: "deny"` would
+ *     lock every edit, including the agent's legitimate workdir writes.
+ *     Coverage falls through to bash-glob denies for canonical write
+ *     idioms (`tee`, `cp`, `mv`, `echo > …`) — but those are an
+ *     **accepted gap** in opencode's absolute-block layer, mirroring
+ *     Codex's allow-mode gap (docs/design/09-safety-cost.md §6).
+ *   - Bare tool names like `CronCreate` / `RemoteTrigger` — these are
+ *     Claude-SDK-specific server-side tools that don't exist on
+ *     OpenCode's surface. Silently skipped (not warned) so future SDK
+ *     additions don't pollute opencode's startup logs.
+ *
+ * Always merged into the per-session permission JSON at the config-
+ * builder layer; absolute-block entries take precedence over user-
+ * configured allow/deny (deny order is `request_overrides ⊕ absolute_block`,
+ * with absolute winning).
+ */
+export declare function buildOpencodeAbsoluteBlockPermission(): {
+    permission: {
+        bash: Record<string, "deny">;
+    };
+    warnings: string[];
+};
 //# sourceMappingURL=always-disallowed.d.ts.map

package/dist/safety/always-disallowed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"always-disallowed.d.ts","sourceRoot":"","sources":["../../src/safety/always-disallowed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,smEAyK1B,CAAC;AAEX;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAC7B,kBAAkB,GAClB,sBAAsB,GACtB,eAAe,GACf,YAAY,GACZ,aAAa,GACb,cAAc,CAAC;AAEnB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,qBAAqB,CAAC;IAChC,sFAAsF;IACtF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAqBrD;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAK1D;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,kBAAkB,GAAG,IAAI,CAgH3B;AAUD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAkBxD"}
+{"version":3,"file":"always-disallowed.d.ts","sourceRoot":"","sources":["../../src/safety/always-disallowed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,smEAuL1B,CAAC;AAEX;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAC7B,kBAAkB,GAClB,sBAAsB,GACtB,eAAe,GACf,YAAY,GACZ,aAAa,GACb,cAAc,CAAC;AAEnB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,qBAAqB,CAAC;IAChC,sFAAsF;IACtF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAwBrD;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAK1D;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,kBAAkB,GAAG,IAAI,CA0H3B;AAUD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAkBxD;AAuCD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,oCAAoC,IAAI;IACtD,UAAU,EAAE;QACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC9B,CAAC;IACF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAyBA"}

package/dist/safety/always-disallowed.js

@@ -117,6 +117,20 @@ export const ALWAYS_DISALLOWED_TOOLS = [
     // Blocks `curl <url> | sh`, `wget <url> | bash`, `bash <(curl ...)`, etc.
     // Plain `curl http://localhost:<port>/...` is NOT blocked — skills rely
     // on it as the daemon-API chokepoint.
+    //
+    // Multi-pipe forms — `curl URL | tee file | sh`, `curl URL | cat | bash`,
+    // `wget URL | gzip -d | sh` — relied entirely on the Claude SDK glob
+    // wildcard accepting `|` mid-pattern (it does for minimatch-style `*`).
+    // For Claude both modes the **`classifyAbsoluteBlock` regex below is
+    // authoritative** via the PreToolUse hook (claude-tool-collection.ts:1153
+    // returns `decision: "block"`), and the regex was rewritten in 2026-05
+    // to span intermediate `|` segments — so the SDK glob list does not
+    // need additional `Bash(curl *| *sh*)`-style entries (and adding them
+    // would break Gemini's `commandPrefix` translator, which strips only the
+    // trailing `\s*\*$` and treats every other `*` as a literal asterisk).
+    // Gemini strict mode is independently covered by the explicit
+    // `\\bcurl\\b.*(;|\\|\\||&&|\\||\\$\\(|\x60)` chaining-operator deny
+    // rule in `gemini-cli-core.ts`.
     "Bash(curl * | sh*)",
     "Bash(curl * | bash*)",
     "Bash(wget * | sh*)",
@@ -271,6 +285,9 @@ export function stripBashHeredocs(cmd) {
     const declRe = /<<-?\s*(?:'([^']+)'|"([^"]+)"|(\w+))/g;
     let dm;
     while ((dm = declRe.exec(cmd)) !== null) {
+        // The regex requires one of groups 1–3 to capture, so `dm[3] ?? ""` is
+        // defensively unreachable — covered branch picks dm[1] | dm[2] | dm[3].
+        /* c8 ignore next */
         const delim = dm[1] ?? dm[2] ?? dm[3] ?? "";
         if (delim)
             heredocs.push({ delim, allowIndent: dm[0].startsWith("<<-") });
@@ -334,13 +351,23 @@ export function classifyAbsoluteBlock(toolName, rawArg) {
         }
         // Pipe-to-shell and indirect-eval RCE.
         //
-        // Coverage (kept in sync with the `ALWAYS_DISALLOWED_TOOLS` entries
-        // in this file — the SDK list is the authoritative block layer; the
-        // patterns below are observability and must categorize anything the
-        // SDK rejects):
+        // For Claude this regex is the **authoritative block** layer — it runs
+        // ahead of the SDK glob list via the PreToolUse hook
+        // (claude-tool-collection.ts:1153) and returns `decision: "block"`. The
+        // glob list is best-effort defense in depth for backends that lack a
+        // hook surface (Codex/Opencode allow modes; Gemini's allow mode); on
+        // Claude any miss here would let the call through regardless of glob
+        // coverage. Audit categorization is a side benefit, not the goal.
+        //
+        // Coverage:
         //
-        //   1. `curl … | sh` / `wget … | bash` and any chain ending in
-        //      pipe-to-(sh|bash).
+        //   1. `curl … | sh` / `wget … | bash`, and any multi-pipe chain
+        //      ending in pipe-to-(sh|bash). The `[^\n]*?` is **lazy** and
+        //      permits `|` in the middle so `curl X | tee Y | sh` and
+        //      `curl X | cat | bash` are caught — the prior `[^|]*` rule
+        //      stopped at the first `|` and allowed those bypasses. `\n` is
+        //      still excluded so the rule does not span logical lines of a
+        //      multi-line Bash invocation (the second line stands on its own).
         //   2. `bash <(…)` / `sh <(…)` — process substitution into a shell.
         //      `\s*` (not `\s+`) so the no-space forms `bash<(…)` and
         //      `sh<(…)`, which are valid bash, are also caught.
@@ -368,7 +395,7 @@ export function classifyAbsoluteBlock(toolName, rawArg) {
         // existing `cmdStart` anchor used by the `rm` rule (declared above), so
         // `eval`/`source` only triggers when invoked as a command at start-of-line
         // or after a shell separator.
-        if (/\b(?:curl|wget)\b[^|]*\|\s*(?:sh|bash)\b/.test(scan)
+        if (/\b(?:curl|wget)\b[^\n]*?\|\s*(?:sh|bash)\b/.test(scan)
             || /\b(?:bash|sh)\s*<\(/.test(scan)
             || /<\(\s*(?:curl|wget)\b/.test(scan)
             || new RegExp(`${cmdStart}(?:eval|source)\\b\\s+\\S`).test(scan)
@@ -440,4 +467,84 @@ function redactPath(raw) {
     return tail.length > 0 ? `.../${tail}` : "<unknown>";
     /* c8 ignore stop */
 }
+/**
+ * Common file-reader commands an agent might use to exfiltrate a secret
+ * file via Bash. Each one becomes a `bash` pattern-map deny prefixed
+ * with the file path glob from the corresponding `Read(<glob>)` entry —
+ * defense in depth on top of the `tools: { read: false }` hard-disable
+ * the per-session permission translator emits.
+ *
+ * Kept narrow: the absolute-block layer is meant to catch canonical
+ * exfiltration idioms, not every theoretical shell trick. A motivated
+ * attacker can bypass with `dd if=…`, `awk '{print}' …`, or by piping
+ * through an unusual interpreter — those gaps are documented in
+ * `docs/design/09-safety-cost.md` §6 alongside the Codex allow-mode gap.
+ */
+const SECRET_READ_BASH_COMMANDS = [
+    "cat",
+    "less",
+    "more",
+    "head",
+    "tail",
+    "strings",
+    "xxd",
+    "od",
+    "hexdump",
+];
+/**
+ * docs/design/appendices/opencode-backend.md §5.8 — render `ALWAYS_DISALLOWED_TOOLS`
+ * into an OpenCode-flavoured `permission` block.
+ *
+ * Translation rules (V5-corrected):
+ *   - `Bash(<glob>)` → `permission.bash[<glob>] = "deny"`.
+ *   - `Read(<glob>)` → synthesise `permission.bash[<reader> <glob>] = "deny"`
+ *     for each entry in `SECRET_READ_BASH_COMMANDS`. The `read` permission
+ *     key does not exist in opencode 1.14.50 (V5); per-session sessions
+ *     that should have zero read capability set `tools: { read: false }`
+ *     instead — the per-session translator handles that branch.
+ *   - `Edit(<glob>)` / `Write(<glob>)` → **skipped**. opencode's `edit`
+ *     permission is whole-tool (V5), so emitting `edit: "deny"` would
+ *     lock every edit, including the agent's legitimate workdir writes.
+ *     Coverage falls through to bash-glob denies for canonical write
+ *     idioms (`tee`, `cp`, `mv`, `echo > …`) — but those are an
+ *     **accepted gap** in opencode's absolute-block layer, mirroring
+ *     Codex's allow-mode gap (docs/design/09-safety-cost.md §6).
+ *   - Bare tool names like `CronCreate` / `RemoteTrigger` — these are
+ *     Claude-SDK-specific server-side tools that don't exist on
+ *     OpenCode's surface. Silently skipped (not warned) so future SDK
+ *     additions don't pollute opencode's startup logs.
+ *
+ * Always merged into the per-session permission JSON at the config-
+ * builder layer; absolute-block entries take precedence over user-
+ * configured allow/deny (deny order is `request_overrides ⊕ absolute_block`,
+ * with absolute winning).
+ */
+export function buildOpencodeAbsoluteBlockPermission() {
+    const bash = {};
+    for (const entry of ALWAYS_DISALLOWED_TOOLS) {
+        if (entry.startsWith("Bash(") && entry.endsWith(")")) {
+            const pattern = entry.slice("Bash(".length, -1);
+            if (pattern.length > 0)
+                bash[pattern] = "deny";
+            continue;
+        }
+        if (entry.startsWith("Read(") && entry.endsWith(")")) {
+            const pathGlob = entry.slice("Read(".length, -1);
+            // ALWAYS_DISALLOWED_TOOLS never contains `Read()` (empty glob); guard
+            // is defensive in case a future entry is malformed.
+            /* c8 ignore next */
+            if (pathGlob.length === 0)
+                continue;
+            for (const reader of SECRET_READ_BASH_COMMANDS) {
+                bash[`${reader} ${pathGlob}`] = "deny";
+            }
+            continue;
+        }
+        // Edit(…), Write(…), bare tool names — see function docstring.
+    }
+    return {
+        permission: { bash },
+        warnings: [],
+    };
+}
 //# sourceMappingURL=always-disallowed.js.map

package/dist/safety/always-disallowed.js.map

@@ -1 +1 @@
-{"version":3,"file":"always-disallowed.js","sourceRoot":"","sources":["../../src/safety/always-disallowed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,yBAAyB;IACzB,qEAAqE;IACrE,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,kEAAkE;IAClE,EAAE;IACF,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,oEAAoE;IACpE,+CAA+C;IAC/C,EAAE;IACF,wDAAwD;IACxD,mEAAmE;IACnE,uEAAuE;IACvE,kEAAkE;IAClE,wEAAwE;IACxE,2EAA2E;IAC3E,sEAAsE;IACtE,2BAA2B;IAC3B,qEAAqE;IACrE,qDAAqD;IACrD,EAAE;IACF,sEAAsE;IACtE,8BAA8B;IAC9B,oEAAoE;IACpE,6DAA6D;IAC7D,8DAA8D;IAC9D,qEAAqE;IACrE,qEAAqE;IACrE,0CAA0C;IAC1C,sEAAsE;IACtE,uEAAuE;IACvE,kDAAkD;IAClD,gBAAgB;IAChB,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,yEAAyE;IACzE,uEAAuE;IACvE,oCAAoC;IACpC,eAAe;IACf,eAAe;IACf,eAAe;IACf,eAAe;IACf,eAAe;IACf,qDAAqD;IACrD,eAAe;IACf,4DAA4D;IAC5D,eAAe;IACf,0CAA0C;IAC1C,eAAe;IACf,0CAA0C;IAC1C,eAAe;IACf,wCAAwC;IACxC,eAAe;IACf,+DAA+D;IAC/D,cAAc;IACd,eAAe;IACf,eAAe;IACf,eAAe;IACf,eAAe;IACf,eAAe;IACf,6EAA6E;IAC7E,yEAAyE;IACzE,qEAAqE;IACrE,gEAAgE;IAChE,uBAAuB;IACvB,+BAA+B;IAC/B,+BAA+B;IAE/B,6BAA6B;IAC7B,cAAc;IACd,cAAc;IACd,YAAY;IAEZ,4CAA4C;IAC5C,0EAA0E;IAC1E,wEAAwE;IACxE,sCAAsC;IACtC,oBAAoB;IACpB,sBAAsB;IACtB,oBAAoB;IACpB,sBAAsB;IACtB,kBAAkB;IAClB,gBAAgB;IAChB,4DAA4D;IAC5D,wEAAwE;IACxE,iEAAiE;IACjE,mEAAmE;IACnE,kEAAkE;IAClE,cAAc;IACd,YAAY;IACZ,8DAA8D;IAC9D,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,2DAA2D;IAC3D,cAAc;IACd,gBAAgB;IAEhB,wCAAwC;IACxC,kBAAkB,EAAE,qBAAqB;IACzC,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,iCAAiC;IAEnD,0BAA0B;IAC1B,YAAY;IACZ,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,eAAe;IACf,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,iBAAiB;IACjB,2BAA2B;IAC3B,8BAA8B;IAC9B,gBAAgB;IAChB,8BAA8B;IAC9B,kCAAkC;IAElC,uCAAuC;IACvC,sEAAsE;IACtE,uEAAuE;IACvE,8DAA8D;IAC9D,oCAAoC;IACpC,0CAA0C;IAC1C,oCAAoC;IAEpC,2BAA2B;IAC3B,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,oCAAoC;IACpC,aAAa,EAAE,YAAY;IAC3B,eAAe,EAAE,cAAc;IAC/B,gBAAgB,EAAE,eAAe;IACjC,kBAAkB,EAAE,iBAAiB;IACrC,gBAAgB,EAAE,eAAe;IACjC,oBAAoB,EAAE,mBAAmB;IACzC,kBAAkB,EAAE,iBAAiB;IACrC,oBAAoB,EAAE,mBAAmB;IACzC,kBAAkB,EAAE,iBAAiB;IACrC,4BAA4B,EAAE,2BAA2B;IACzD,+BAA+B,EAAE,8BAA8B;IAC/D,iBAAiB,EAAE,gBAAgB;IACnC,+BAA+B,EAAE,8BAA8B;IAC/D,mCAAmC,EAAE,kCAAkC;IACvE,qCAAqC,EAAE,oCAAoC;IAC3E,2CAA2C,EAAE,0CAA0C;IACvF,qCAAqC,EAAE,oCAAoC;IAE3E,iDAAiD;IACjD,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,gEAAgE;IAChE,0EAA0E;IAC1E,0EAA0E;IAC1E,iEAAiE;IACjE,2EAA2E;IAC3E,+CAA+C;IAC/C,YAAY,EAAE,UAAU,EAAE,YAAY;IACtC,eAAe,EAAE,kBAAkB;CAC3B,CAAC;AA0BX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,sEAAsE;IACtE,iEAAiE;IACjE,sEAAsE;IACtE,4DAA4D;IAC5D,MAAM,QAAQ,GAAmD,EAAE,CAAC;IACpE,MAAM,MAAM,GAAG,uCAAuC,CAAC;IACvD,IAAI,EAA0B,CAAC;IAC/B,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,KAAK;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,QAAQ,GAAG,GAAG,CAAC;IACnB,KAAK,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,mBAAmB,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,WAAW,CACtE,CAAC;QACF,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,iEAAiE;IACjE,qEAAqE;IACrE,gEAAgE;IAChE,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,MAA0B;IAE1B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAE1B,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,kEAAkE;QAClE,8DAA8D;QAC9D,gEAAgE;QAChE,iEAAiE;QACjE,2DAA2D;QAC3D,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QACzC,oEAAoE;QACpE,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,mEAAmE;QACnE,oEAAoE;QACpE,8DAA8D;QAC9D,EAAE;QACF,YAAY;QACZ,kEAAkE;QAClE,iEAAiE;QACjE,oDAAoD;QACpD,6CAA6C;QAC7C,yDAAyD;QACzD,6DAA6D;QAC7D,kEAAkE;QAClE,8DAA8D;QAC9D,6CAA6C;QAC7C,EAAE;QACF,gEAAgE;QAChE,kEAAkE;QAClE,6DAA6D;QAC7D,kEAAkE;QAClE,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,sBAAsB,CAAC;QACxC,IACE,IAAI,MAAM,CAAC,GAAG,QAAQ,kDAAkD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;eACjF,IAAI,MAAM,CAAC,GAAG,QAAQ,qCAAqC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAC1E,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzE,CAAC;QACD,uCAAuC;QACvC,EAAE;QACF,oEAAoE;QACpE,oEAAoE;QACpE,oEAAoE;QACpE,gBAAgB;QAChB,EAAE;QACF,+DAA+D;QAC/D,0BAA0B;QAC1B,oEAAoE;QACpE,8DAA8D;QAC9D,wDAAwD;QACxD,qEAAqE;QACrE,4DAA4D;QAC5D,kEAAkE;QAClE,gEAAgE;QAChE,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,kEAAkE;QAClE,qEAAqE;QACrE,iEAAiE;QACjE,gEAAgE;QAChE,iEAAiE;QACjE,2DAA2D;QAC3D,mEAAmE;QACnE,oEAAoE;QACpE,yDAAyD;QACzD,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,wEAAwE;QACxE,2EAA2E;QAC3E,8BAA8B;QAC9B,IACE,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC;eAClD,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;eAChC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;eAClC,IAAI,MAAM,CAAC,GAAG,QAAQ,2BAA2B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;eAC7D,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC;eACrD,gHAAgH,CAAC,IAAI,CAAC,IAAI,CAAC,EAC9H,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAChE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QAChD,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACvC;gEAC4D;IAC5D,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrB,oBAAoB;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAa;QACzB,qBAAqB;QACrB,yCAAyC;QACzC,aAAa;QACb,eAAe;QACf,aAAa;QACb,wBAAwB;QACxB,2BAA2B;QAC3B,UAAU;QACV,0BAA0B;QAC1B,gCAAgC;QAChC,0DAA0D;KAC3D,CAAC;IACF,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,+DAA+D;IAC/D,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B;;yBAEqB;IACrB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IACrD,oBAAoB;AACtB,CAAC"}
+{"version":3,"file":"always-disallowed.js","sourceRoot":"","sources":["../../src/safety/always-disallowed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,yBAAyB;IACzB,qEAAqE;IACrE,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,kEAAkE;IAClE,EAAE;IACF,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,oEAAoE;IACpE,+CAA+C;IAC/C,EAAE;IACF,wDAAwD;IACxD,mEAAmE;IACnE,uEAAuE;IACvE,kEAAkE;IAClE,wEAAwE;IACxE,2EAA2E;IAC3E,sEAAsE;IACtE,2BAA2B;IAC3B,qEAAqE;IACrE,qDAAqD;IACrD,EAAE;IACF,sEAAsE;IACtE,8BAA8B;IAC9B,oEAAoE;IACpE,6DAA6D;IAC7D,8DAA8D;IAC9D,qEAAqE;IACrE,qEAAqE;IACrE,0CAA0C;IAC1C,sEAAsE;IACtE,uEAAuE;IACvE,kDAAkD;IAClD,gBAAgB;IAChB,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,yEAAyE;IACzE,uEAAuE;IACvE,oCAAoC;IACpC,eAAe;IACf,eAAe;IACf,eAAe;IACf,eAAe;IACf,eAAe;IACf,qDAAqD;IACrD,eAAe;IACf,4DAA4D;IAC5D,eAAe;IACf,0CAA0C;IAC1C,eAAe;IACf,0CAA0C;IAC1C,eAAe;IACf,wCAAwC;IACxC,eAAe;IACf,+DAA+D;IAC/D,cAAc;IACd,eAAe;IACf,eAAe;IACf,eAAe;IACf,eAAe;IACf,eAAe;IACf,6EAA6E;IAC7E,yEAAyE;IACzE,qEAAqE;IACrE,gEAAgE;IAChE,uBAAuB;IACvB,+BAA+B;IAC/B,+BAA+B;IAE/B,6BAA6B;IAC7B,cAAc;IACd,cAAc;IACd,YAAY;IAEZ,4CAA4C;IAC5C,0EAA0E;IAC1E,wEAAwE;IACxE,sCAAsC;IACtC,EAAE;IACF,0EAA0E;IAC1E,qEAAqE;IACrE,wEAAwE;IACxE,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,yEAAyE;IACzE,uEAAuE;IACvE,8DAA8D;IAC9D,qEAAqE;IACrE,gCAAgC;IAChC,oBAAoB;IACpB,sBAAsB;IACtB,oBAAoB;IACpB,sBAAsB;IACtB,kBAAkB;IAClB,gBAAgB;IAChB,4DAA4D;IAC5D,wEAAwE;IACxE,iEAAiE;IACjE,mEAAmE;IACnE,kEAAkE;IAClE,cAAc;IACd,YAAY;IACZ,8DAA8D;IAC9D,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,2DAA2D;IAC3D,cAAc;IACd,gBAAgB;IAEhB,wCAAwC;IACxC,kBAAkB,EAAE,qBAAqB;IACzC,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,iCAAiC;IAEnD,0BAA0B;IAC1B,YAAY;IACZ,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,eAAe;IACf,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,iBAAiB;IACjB,2BAA2B;IAC3B,8BAA8B;IAC9B,gBAAgB;IAChB,8BAA8B;IAC9B,kCAAkC;IAElC,uCAAuC;IACvC,sEAAsE;IACtE,uEAAuE;IACvE,8DAA8D;IAC9D,oCAAoC;IACpC,0CAA0C;IAC1C,oCAAoC;IAEpC,2BAA2B;IAC3B,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,oCAAoC;IACpC,aAAa,EAAE,YAAY;IAC3B,eAAe,EAAE,cAAc;IAC/B,gBAAgB,EAAE,eAAe;IACjC,kBAAkB,EAAE,iBAAiB;IACrC,gBAAgB,EAAE,eAAe;IACjC,oBAAoB,EAAE,mBAAmB;IACzC,kBAAkB,EAAE,iBAAiB;IACrC,oBAAoB,EAAE,mBAAmB;IACzC,kBAAkB,EAAE,iBAAiB;IACrC,4BAA4B,EAAE,2BAA2B;IACzD,+BAA+B,EAAE,8BAA8B;IAC/D,iBAAiB,EAAE,gBAAgB;IACnC,+BAA+B,EAAE,8BAA8B;IAC/D,mCAAmC,EAAE,kCAAkC;IACvE,qCAAqC,EAAE,oCAAoC;IAC3E,2CAA2C,EAAE,0CAA0C;IACvF,qCAAqC,EAAE,oCAAoC;IAE3E,iDAAiD;IACjD,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,gEAAgE;IAChE,0EAA0E;IAC1E,0EAA0E;IAC1E,iEAAiE;IACjE,2EAA2E;IAC3E,+CAA+C;IAC/C,YAAY,EAAE,UAAU,EAAE,YAAY;IACtC,eAAe,EAAE,kBAAkB;CAC3B,CAAC;AA0BX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,sEAAsE;IACtE,iEAAiE;IACjE,sEAAsE;IACtE,4DAA4D;IAC5D,MAAM,QAAQ,GAAmD,EAAE,CAAC;IACpE,MAAM,MAAM,GAAG,uCAAuC,CAAC;IACvD,IAAI,EAA0B,CAAC;IAC/B,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,uEAAuE;QACvE,wEAAwE;QACxE,oBAAoB;QACpB,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,KAAK;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,QAAQ,GAAG,GAAG,CAAC;IACnB,KAAK,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,mBAAmB,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,WAAW,CACtE,CAAC;QACF,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,iEAAiE;IACjE,qEAAqE;IACrE,gEAAgE;IAChE,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,MAA0B;IAE1B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAE1B,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,kEAAkE;QAClE,8DAA8D;QAC9D,gEAAgE;QAChE,iEAAiE;QACjE,2DAA2D;QAC3D,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QACzC,oEAAoE;QACpE,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,mEAAmE;QACnE,oEAAoE;QACpE,8DAA8D;QAC9D,EAAE;QACF,YAAY;QACZ,kEAAkE;QAClE,iEAAiE;QACjE,oDAAoD;QACpD,6CAA6C;QAC7C,yDAAyD;QACzD,6DAA6D;QAC7D,kEAAkE;QAClE,8DAA8D;QAC9D,6CAA6C;QAC7C,EAAE;QACF,gEAAgE;QAChE,kEAAkE;QAClE,6DAA6D;QAC7D,kEAAkE;QAClE,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,sBAAsB,CAAC;QACxC,IACE,IAAI,MAAM,CAAC,GAAG,QAAQ,kDAAkD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;eACjF,IAAI,MAAM,CAAC,GAAG,QAAQ,qCAAqC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAC1E,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzE,CAAC;QACD,uCAAuC;QACvC,EAAE;QACF,uEAAuE;QACvE,qDAAqD;QACrD,wEAAwE;QACxE,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,kEAAkE;QAClE,EAAE;QACF,YAAY;QACZ,EAAE;QACF,iEAAiE;QACjE,kEAAkE;QAClE,8DAA8D;QAC9D,iEAAiE;QACjE,oEAAoE;QACpE,mEAAmE;QACnE,uEAAuE;QACvE,oEAAoE;QACpE,8DAA8D;QAC9D,wDAAwD;QACxD,qEAAqE;QACrE,4DAA4D;QAC5D,kEAAkE;QAClE,gEAAgE;QAChE,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,kEAAkE;QAClE,qEAAqE;QACrE,iEAAiE;QACjE,gEAAgE;QAChE,iEAAiE;QACjE,2DAA2D;QAC3D,mEAAmE;QACnE,oEAAoE;QACpE,yDAAyD;QACzD,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,wEAAwE;QACxE,2EAA2E;QAC3E,8BAA8B;QAC9B,IACE,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC;eACpD,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;eAChC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;eAClC,IAAI,MAAM,CAAC,GAAG,QAAQ,2BAA2B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;eAC7D,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC;eACrD,gHAAgH,CAAC,IAAI,CAAC,IAAI,CAAC,EAC9H,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAChE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QAChD,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACvC;gEAC4D;IAC5D,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrB,oBAAoB;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAa;QACzB,qBAAqB;QACrB,yCAAyC;QACzC,aAAa;QACb,eAAe;QACf,aAAa;QACb,wBAAwB;QACxB,2BAA2B;QAC3B,UAAU;QACV,0BAA0B;QAC1B,gCAAgC;QAChC,0DAA0D;KAC3D,CAAC;IACF,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,+DAA+D;IAC/D,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B;;yBAEqB;IACrB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IACrD,oBAAoB;AACtB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,yBAAyB,GAAG;IAChC,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,KAAK;IACL,IAAI;IACJ,SAAS;CACD,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,oCAAoC;IAMlD,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,uBAAuB,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;YAChD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;YACjD,sEAAsE;YACtE,oDAAoD;YACpD,oBAAoB;YACpB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACpC,KAAK,MAAM,MAAM,IAAI,yBAAyB,EAAE,CAAC;gBAC/C,IAAI,CAAC,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC;YACzC,CAAC;YACD,SAAS;QACX,CAAC;QACD,+DAA+D;IACjE,CAAC;IACD,OAAO;QACL,UAAU,EAAE,EAAE,IAAI,EAAE;QACpB,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC"}