@amoree-code/ocean 0.0.0-stage → 1.1.0

package/node_modules/@ocean/core/dist/domain/profiles/profile.js

@@ -0,0 +1,218 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { defaultSkillNames } from "../skills/default-skills.js";
+const cliClients = [
+    "claude",
+    "codex",
+    "gemini",
+    "antigravity",
+    "hermes",
+    "kilo",
+    "kimi",
+];
+// Completion clients reached over HTTP at a fixed endpoint (T-245 Phase 4). They return text;
+// they never spawn a process or touch the workspace.
+const apiClients = ["deepseek", "openrouter"];
+const providerSchema = z.enum([...cliClients, ...apiClients]);
+export function isApiClient(client) {
+    return apiClients.includes(client);
+}
+// A model is passed to a CLI as the argument after its model flag; a leading "-" could be
+// read as another flag.
+const modelSchema = z
+    .string()
+    .min(1)
+    .refine((model) => !model.startsWith("-"), "A model cannot start with -");
+export const transportSchema = z.enum(["cli", "openai-compatible-api"]);
+// `transport` and `temperature` stay optional (no default) so a v1 binding parses to exactly
+// the object it parsed to before schema v2, and its profile identity is unchanged.
+const clientBindingSchema = z.object({
+    enabled: z.boolean().default(true),
+    transport: transportSchema.optional(),
+    model: modelSchema.optional(),
+    temperature: z.number().min(0).max(2).optional(),
+    // A completion client that may call Ocean's bounded tools (T-245 Phase 6). Off unless set.
+    toolLoop: z.boolean().optional(),
+    profile: z.string().min(1).optional(),
+    home: z.string().min(1).optional(),
+    mode: z.string().min(1).optional(),
+    capabilities: z.array(z.string()).default([]),
+    limitations: z.array(z.string()).default([]),
+});
+const governanceSchema = z.object({
+    allowedPaths: z.array(z.string()).optional(),
+    allowedCommands: z.array(z.string()).optional(),
+    writePolicy: z.enum(["none", "workspace", "allowed-paths"]).optional(),
+    approvalRequired: z.boolean().optional(),
+    network: z.string().min(1).optional(),
+});
+// A profile name is also a filename (profiles/<name>.json) and a memory namespace
+// (memory/profiles/<name>.json), so it is restricted to characters that can never form a path.
+// Lowercase only: on a case-insensitive filesystem "Alpha" and "alpha" would share one file.
+const profileNamePattern = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+export function assertProfileName(name) {
+    // typeof first: RegExp#test coerces, so null would otherwise pass as "null".
+    if (typeof name !== "string" || !profileNamePattern.test(name))
+        throw new Error("Invalid profile name");
+    return name;
+}
+const rawProfileSchema = z.object({
+    // Absent means 1. Schema v1 stays readable for one release; v2 is what new profiles use.
+    schemaVersion: z.union([z.literal(1), z.literal(2)]).default(1),
+    name: z.string().regex(profileNamePattern, "Invalid profile name"),
+    description: z.string().default(""),
+    version: z.string().min(1).default("1.0.0"),
+    provider: providerSchema.optional(),
+    model: modelSchema.optional(),
+    role: z.string().min(1),
+    skills: z.array(z.string()).default([]),
+    allowedPaths: z.array(z.string()).default([]),
+    allowedCommands: z.array(z.string()).default([]),
+    writePolicy: z.enum(["none", "workspace", "allowed-paths"]).default("none"),
+    contextSources: z.array(z.string()).default([]),
+    clients: z.record(z.string(), clientBindingSchema).default({}),
+    defaultClient: providerSchema.optional(),
+    governance: governanceSchema.optional(),
+    memory: z
+        .object({
+        enabled: z.boolean().default(true),
+        scope: z.string().min(1).default("profile"),
+    })
+        .default({ enabled: true, scope: "profile" }),
+    verification: z
+        .object({ commands: z.array(z.string()).default([]) })
+        .default({ commands: [] }),
+    contextCompression: z.enum(["none", "ocean-bounded"]).default("none"),
+    instructions: z.string().default(""),
+});
+// Schema v2 makes explicit what v1 left to defaults: a default client, a model on every
+// enabled client, and a closed memory scope.
+function refineV2(input, context) {
+    const issue = (path, message) => context.addIssue({ code: z.ZodIssueCode.custom, path, message });
+    if (!input.defaultClient)
+        issue(["defaultClient"], "Schema v2 requires a defaultClient");
+    else if (!input.clients[input.defaultClient]?.enabled)
+        issue(["defaultClient"], "defaultClient must be an enabled client");
+    for (const [client, binding] of Object.entries(input.clients))
+        if (binding.enabled && !binding.model)
+            issue(["clients", client, "model"], "Schema v2 requires a model");
+    if (!["profile", "disabled"].includes(input.memory.scope))
+        issue(["memory", "scope"], 'Schema v2 memory.scope is "profile" or "disabled"');
+}
+export const profileSchema = rawProfileSchema
+    .superRefine((input, context) => {
+    if (input.schemaVersion === 2)
+        refineV2(input, context);
+    for (const [client, binding] of Object.entries(input.clients)) {
+        if (!providerSchema.safeParse(client).success)
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["clients", client],
+                message: `Unsupported client: ${client}`,
+            });
+        // A client's transport is fixed by what it is: a CLI cannot be called over HTTP and a
+        // completion API cannot be spawned. An API client has no provider default model.
+        const expected = isApiClient(client) ? "openai-compatible-api" : "cli";
+        if (binding.transport && binding.transport !== expected)
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["clients", client, "transport"],
+                message: `Client ${client} uses transport ${expected}`,
+            });
+        if (binding.toolLoop && !isApiClient(client))
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["clients", client, "toolLoop"],
+                message: `Client ${client} runs its own tools; toolLoop is for completion clients`,
+            });
+        if (isApiClient(client) &&
+            binding.enabled &&
+            (!binding.model || binding.model === "provider-managed"))
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["clients", client, "model"],
+                message: `Client ${client} requires a model`,
+            });
+    }
+    if (!input.provider &&
+        !input.defaultClient &&
+        !Object.entries(input.clients).some(([, binding]) => binding.enabled)) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["clients"],
+            message: "Profile must select a provider or an enabled client",
+        });
+    }
+})
+    .transform((input) => {
+    const provider = input.provider ??
+        input.defaultClient ??
+        Object.entries(input.clients).find(([, binding]) => binding.enabled)?.[0];
+    const model = input.model ?? input.clients[provider]?.model ?? "provider-managed";
+    const governance = input.governance ?? {};
+    return {
+        ...input,
+        skills: input.skills.length
+            ? input.skills
+            : defaultSkillNames(input.role),
+        provider,
+        model,
+        defaultClient: input.defaultClient ?? provider,
+        allowedPaths: governance.allowedPaths ?? input.allowedPaths,
+        allowedCommands: governance.allowedCommands ?? input.allowedCommands,
+        writePolicy: governance.writePolicy ?? input.writePolicy,
+    };
+});
+export function selectProfileClient(profile, requested) {
+    const value = requested ?? profile.defaultClient ?? profile.provider;
+    const parsed = providerSchema.safeParse(value);
+    if (!parsed.success)
+        throw new Error(`Unsupported client: ${value}`);
+    const client = parsed.data;
+    const binding = profile.clients[client];
+    if (Object.keys(profile.clients).length && !binding?.enabled)
+        throw new Error(`Client is not enabled for profile: ${client}`);
+    // The profile-level model belongs to the profile's own provider. Another client without a
+    // model of its own keeps its provider default: since the model became a CLI flag, passing
+    // e.g. a Claude model to codex would break the run.
+    return {
+        ...profile,
+        provider: client,
+        defaultClient: client,
+        model: binding?.model ??
+            (client === profile.provider ? profile.model : "provider-managed"),
+    };
+}
+// A deterministic identity for the exact configuration a profile had at the moment a
+// session was created from it: same fields (including `version`) always hash to the same
+// value, so a session can be traced back to the profile shape that produced it even after
+// the profile file on disk is later edited. Key order is fixed explicitly rather than
+// relying on object insertion order, since callers may construct a Profile in any order.
+export function profileIdentity(profile) {
+    const canonical = {
+        name: profile.name,
+        description: profile.description,
+        version: profile.version,
+        provider: profile.provider,
+        model: profile.model,
+        role: profile.role,
+        skills: profile.skills,
+        allowedPaths: profile.allowedPaths,
+        allowedCommands: profile.allowedCommands,
+        writePolicy: profile.writePolicy,
+        contextSources: profile.contextSources,
+        clients: profile.clients,
+        defaultClient: profile.defaultClient,
+        memory: profile.memory,
+        verification: profile.verification,
+        contextCompression: profile.contextCompression,
+        instructions: profile.instructions,
+        // v2-only fields are appended only for v2, so every v1 identity stays what it was and a
+        // v1 session can still be resumed after this release.
+        ...(profile.schemaVersion === 2
+            ? { schemaVersion: profile.schemaVersion }
+            : {}),
+    };
+    return createHash("sha256").update(JSON.stringify(canonical)).digest("hex");
+}
+//# sourceMappingURL=profile.js.map

package/node_modules/@ocean/core/dist/domain/profiles/runtime-config.js

@@ -0,0 +1,30 @@
+import { z } from "zod";
+import { assertProfileName } from "./profile.js";
+// bridge/config/runtime.json (T-245 Phase 5). Paths are derived from the Ocean root, never
+// configured: the settings are which profile runs when none is named, and whether a run for a
+// task may use the suggested profile instead (T-296, off unless set).
+const runtimeConfigSchema = z
+    .object({
+    schemaVersion: z.literal(1),
+    defaultProfile: z.string().refine((name) => {
+        try {
+            assertProfileName(name);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }, "Invalid profile name"),
+    autoProfile: z.boolean().optional(),
+})
+    .strict();
+export function validateRuntimeConfig(input) {
+    return runtimeConfigSchema.parse(input);
+}
+// Until runtime.json exists the historical default applies, so an install that predates the
+// file keeps working. Once it exists it is the only source; an explicit --profile wins.
+export const LEGACY_DEFAULT_PROFILE = "default";
+export function resolveProfileName(explicit, config) {
+    return explicit ?? config?.defaultProfile ?? LEGACY_DEFAULT_PROFILE;
+}
+//# sourceMappingURL=runtime-config.js.map

package/node_modules/@ocean/core/dist/domain/providers/provider-capability.js

@@ -0,0 +1,28 @@
+import { z } from "zod";
+export const providerCapabilitySchema = z.object({
+    provider: z.enum([
+        "claude",
+        "codex",
+        "gemini",
+        "antigravity",
+        "hermes",
+        "kilo",
+        "kimi",
+    ]),
+    command: z.string().min(1),
+    installed: z.boolean(),
+    headless: z.boolean(),
+    resume: z.boolean(),
+    streaming: z.boolean(),
+    structuredOutput: z.boolean(),
+    authentication: z.enum(["cli-managed", "unknown"]),
+    interactive: z.boolean().default(true),
+    interactiveContext: z
+        .enum(["verified", "partial", "not-proven"])
+        .default("not-proven"),
+    contextTransport: z.string().min(1).default("provider-specific"),
+    inputCapture: z
+        .enum(["semantic", "bounded-terminal", "none"])
+        .default("bounded-terminal"),
+});
+//# sourceMappingURL=provider-capability.js.map

package/node_modules/@ocean/core/dist/domain/providers/provider.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=provider.js.map

package/node_modules/@ocean/core/dist/domain/redaction/redaction.js

@@ -0,0 +1,86 @@
+import os from "node:os";
+// Pure secret/PII redaction. Lives in the domain layer because it is a set of
+// string transforms with no I/O — application code redacts through here instead
+// of importing the infrastructure logger.
+const MAX_PAYLOAD = 64_000;
+// Credential shapes: vendor prefixes, bearer tokens, JWTs, private keys, credentialed URLs.
+// Every pattern stays linear on hostile input (bounded runs, anchored starts): these scan
+// file contents a model asked for, and a backtracking pattern would hang the run.
+const shapePatterns = [
+    // \b: a prefix inside a word ("task-observer") is not a key.
+    /\b(?:sk-(?:ant-)?|AIza|ghp_|github_pat_|xox[baprs]-)[A-Za-z0-9_-]{8,}/gi,
+    // AWS access key ids, Stripe, npm, GitLab and the other GitHub token prefixes.
+    /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
+    /\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{16,}/g,
+    /\bnpm_[A-Za-z0-9]{36}\b/g,
+    /\bglpat-[A-Za-z0-9_-]{20,}/g,
+    /\bgh[ousr]_[A-Za-z0-9]{36,}/g,
+    /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/gi,
+    /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g,
+    /-----BEGIN (?:RSA |OPENSSH |EC )?PRIVATE KEY-----[\s\S]{0,16384}?-----END (?:RSA |OPENSSH |EC )?PRIVATE KEY-----/g,
+    // Connection strings and webhook URLs that embed a credential in the userinfo or path
+    // segment, e.g. a database connection string or a Slack incoming-webhook URL.
+    /\b[a-zA-Z][a-zA-Z0-9+.-]{0,31}:\/\/[^\s'"<>/:@]{1,256}:[^\s'"<>/@]{1,256}@[^\s'"<>]{1,256}/g,
+    /https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/]+/gi,
+];
+// Redaction also catches unquoted secret-named assignments; too broad to refuse a file on
+// (it matches `password = input.value`), right for scrubbing logs.
+const keywordAssignment = /(?:api[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|password|authorization)\s*[:=]\s*["']?[A-Za-z0-9._~+/=-]{8,}["']?/gi;
+const secretPatterns = [...shapePatterns, keywordAssignment];
+const homePath = os.homedir().replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+const privatePathPattern = new RegExp(`${homePath}(?:[/\\\\][^\\s/'"]+)*`, "g");
+// Fallback for credentials that don't match a known vendor prefix or keyword (a raw AWS
+// secret access key, an internal hex/base32 API key, a bare high-entropy token): any long
+// run of base64/hex-ish characters with entropy consistent with random data gets redacted,
+// even without a recognizable shape. This is best-effort, not a guarantee — see docs/security.md.
+const highEntropyToken = /[A-Za-z0-9+/_-]{24,}/g;
+const MIN_TOKEN_ENTROPY_BITS_PER_CHAR = 3.5;
+function shannonEntropy(value) {
+    const counts = new Map();
+    for (const char of value)
+        counts.set(char, (counts.get(char) ?? 0) + 1);
+    let entropy = 0;
+    for (const count of counts.values()) {
+        const p = count / value.length;
+        entropy -= p * Math.log2(p);
+    }
+    return entropy;
+}
+function redactHighEntropyTokens(value) {
+    return value.replace(highEntropyToken, (token) => shannonEntropy(token) >= MIN_TOKEN_ENTROPY_BITS_PER_CHAR
+        ? "[REDACTED]"
+        : token);
+}
+// Secret-named assignments, for refusing a file only (too broad for redaction): an env-style
+// line such as DB_PASS=..., or a quoted literal assigned to a secret-named key. Matched one
+// bounded line at a time with bounded runs, so a long or hostile line cannot backtrack.
+const MAX_LINE = 4_096;
+const assignedSecretPatterns = [
+    /^[ \t]{0,16}(?:(?:export|ENV|ARG)[ \t]+)?[A-Z0-9_]{0,64}(?:PASS|PASSWORD|PASSWD|PWD|SECRET|TOKEN|API_?KEY|PRIVATE_KEY)[A-Z0-9_]{0,64}[ \t]{0,8}=[ \t]{0,8}\S{6}/,
+    /(?:^|[^A-Za-z0-9_])["']?[A-Za-z0-9_]{0,64}(?:secret|token|passw(?:or)?d|pwd|api_?key)[A-Za-z0-9_]{0,64}["']?[ \t]{0,8}[:=][ \t]{0,8}["'][^"'\s]{8,256}["']/i,
+];
+function hasAssignedSecret(value) {
+    return value
+        .split("\n")
+        .some((line) => assignedSecretPatterns.some((pattern) => pattern.test(line.slice(0, MAX_LINE))));
+}
+// Whether the text holds a credential of a known shape or a secret-named literal. No entropy
+// guess and no bare keyword match: used to refuse sending a file, where a false positive on
+// ordinary code would be costly. Pattern-based, so a secret in an unknown shape gets through.
+export function containsKnownSecret(value) {
+    return (shapePatterns.some((pattern) => value.match(pattern) !== null) ||
+        hasAssignedSecret(value));
+}
+// Pattern replacement only, no length bound — for callers that need to persist a redacted
+// payload of arbitrary size (e.g. `ocean observe`'s captured command output).
+export function redactSecrets(value) {
+    let safe = value;
+    for (const pattern of secretPatterns)
+        safe = safe.replace(pattern, "[REDACTED]");
+    safe = redactHighEntropyTokens(safe);
+    return safe.replace(privatePathPattern, "[PRIVATE_PATH]");
+}
+export function redactRuntimeText(value) {
+    return redactSecrets(value).slice(0, MAX_PAYLOAD);
+}
+//# sourceMappingURL=redaction.js.map

package/node_modules/@ocean/core/dist/domain/runs/agent-tools.js

@@ -0,0 +1,92 @@
+import { z } from "zod";
+// The tools a completion client may call in a tool-loop run (T-245 Phase 6), and the pure
+// part of deciding whether one call may run. Filesystem bounds are checked again where the
+// tool executes, against real paths.
+const MAX_PATH = 1_024;
+export const MAX_WRITE_BYTES = 256 * 1024;
+const relativePath = z
+    .string()
+    .min(1)
+    .max(MAX_PATH)
+    .refine((value) => !value.includes("\0"), "path contains NUL");
+const toolArgumentSchemas = {
+    read_file: z.object({ path: relativePath }).strict(),
+    list_directory: z.object({ path: relativePath }).strict(),
+    write_file: z
+        .object({
+        path: relativePath,
+        content: z
+            .string()
+            .refine((value) => Buffer.byteLength(value) <= MAX_WRITE_BYTES, `content exceeds ${MAX_WRITE_BYTES} bytes`),
+    })
+        .strict(),
+};
+// OpenAI-compatible function specs, as sent to the provider.
+const toolSpecs = {
+    read_file: {
+        description: "Read a UTF-8 text file. path is relative to the working directory.",
+        parameters: {
+            type: "object",
+            properties: { path: { type: "string" } },
+            required: ["path"],
+            additionalProperties: false,
+        },
+    },
+    list_directory: {
+        description: "List a directory. path is relative to the working directory; use . for it.",
+        parameters: {
+            type: "object",
+            properties: { path: { type: "string" } },
+            required: ["path"],
+            additionalProperties: false,
+        },
+    },
+    write_file: {
+        description: "Create or replace a UTF-8 text file with the full new content. path is relative to the working directory.",
+        parameters: {
+            type: "object",
+            properties: { path: { type: "string" }, content: { type: "string" } },
+            required: ["path", "content"],
+            additionalProperties: false,
+        },
+    },
+};
+// Read tools always; write only when the run may write; then narrowed by the run contract.
+// There is no command tool: Ocean cannot confine what a command reads, writes or reaches.
+export function offeredTools(plan, limits) {
+    const tools = ["read_file", "list_directory"];
+    if (!plan.readOnly)
+        tools.push("write_file");
+    return tools.filter((tool) => !limits?.denied.includes(tool) &&
+        (!limits?.allowed.length || limits.allowed.includes(tool)));
+}
+export function toolDefinitions(plan, limits) {
+    return offeredTools(plan, limits).map((name) => ({
+        type: "function",
+        function: { name, ...toolSpecs[name] },
+    }));
+}
+// A call the model asked for is untrusted input: anything not offered to this run or
+// malformed is denied before execution.
+export function decideToolCall(plan, call, limits) {
+    if (!(call.name in toolArgumentSchemas))
+        return { ok: false, reason: `unknown tool: ${call.name}` };
+    const name = call.name;
+    if (!offeredTools(plan, limits).includes(name))
+        return { ok: false, reason: `tool not allowed in this run: ${name}` };
+    let input;
+    try {
+        input = JSON.parse(call.arguments || "{}");
+    }
+    catch {
+        return { ok: false, reason: "arguments are not valid JSON" };
+    }
+    const parsed = toolArgumentSchemas[name].safeParse(input);
+    if (!parsed.success)
+        return {
+            ok: false,
+            reason: `invalid arguments: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "(root)"} ${issue.message}`).join("; ")}`,
+        };
+    return { ok: true, name, args: parsed.data };
+}
+//# sourceMappingURL=agent-tools.js.map

package/node_modules/@ocean/core/dist/domain/runs/execution-plan.js

@@ -0,0 +1,71 @@
+import { createHash } from "node:crypto";
+import { isApiClient, profileIdentity, } from "../profiles/profile.js";
+function deepFreeze(value) {
+    if (value && typeof value === "object") {
+        for (const child of Object.values(value))
+            deepFreeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+// One definition, used by the plan and by the caller that decides whether writes are granted.
+export function usesToolLoop(profile) {
+    const binding = profile.clients[profile.provider];
+    return (isApiClient(profile.provider) &&
+        binding?.transport !== "cli" &&
+        binding?.toolLoop === true);
+}
+// `profile` is the result of selectProfileClient: its provider is the selected client.
+export function buildExecutionPlan(profile, options) {
+    const client = profile.provider;
+    const binding = profile.clients[client];
+    const transport = binding?.transport ??
+        (isApiClient(client) ? "openai-compatible-api" : "cli");
+    if (!options.supportedTransports.includes(transport))
+        throw new Error(`Unsupported transport for client ${client}: ${transport}`);
+    const memoryNamespace = profile.memory.enabled && profile.memory.scope !== "disabled"
+        ? profile.name
+        : null;
+    return deepFreeze({
+        profileName: profile.name,
+        profileIdentity: profileIdentity(profile),
+        client,
+        transport,
+        provider: client,
+        model: profile.model,
+        ...(binding?.temperature === undefined
+            ? {}
+            : { temperature: binding.temperature }),
+        toolLoop: usesToolLoop(profile),
+        memoryNamespace,
+        cwd: options.cwd,
+        readOnly: profile.writePolicy === "none" || !options.writeAllowed,
+        allowedPaths: [...profile.allowedPaths],
+        allowedCommands: [...profile.allowedCommands],
+        childEnv: {
+            OCEAN_CURRENT_PROFILE: profile.name,
+            OCEAN_TARGET_PROVIDER: client,
+            OCEAN_TARGET_MODEL: profile.model,
+            OCEAN_MEMORY_SCOPE: memoryNamespace ?? "disabled",
+        },
+    });
+}
+function canonical(value) {
+    if (Array.isArray(value))
+        return value.map(canonical);
+    if (value && typeof value === "object")
+        return Object.fromEntries(Object.keys(value)
+            .sort()
+            .map((key) => [
+            key,
+            canonical(value[key]),
+        ]));
+    return value;
+}
+// Keys are sorted recursively, so the identity depends only on the plan's values.
+export function executionPlanIdentity(plan) {
+    return createHash("sha256")
+        .update(JSON.stringify(canonical(plan)))
+        .digest("hex");
+}
+//# sourceMappingURL=execution-plan.js.map

package/node_modules/@ocean/core/dist/domain/runs/run-contract.js

@@ -0,0 +1,38 @@
+import { z } from "zod";
+const runContractSchema = z
+    .object({
+    runId: z.string().min(1),
+    sessionId: z.string().min(1),
+    profile: z.string().min(1),
+    workingDirectory: z.string().min(1),
+    allowedTools: z.array(z.string().min(1)).default([]),
+    deniedTools: z.array(z.string().min(1)).default([]),
+    stopConditions: z.array(z.string().min(1)).min(1),
+    approval: z.object({ required: z.boolean(), approved: z.boolean() }),
+    budget: z.object({
+        timeoutMs: z.number().int().positive(),
+        maxAttempts: z.number().int().positive(),
+        maxOutputBytes: z.number().int().positive(),
+    }),
+})
+    .superRefine((contract, context) => {
+    const overlap = contract.allowedTools.filter((tool) => contract.deniedTools.includes(tool));
+    if (overlap.length)
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["deniedTools"],
+            message: `Tool is both allowed and denied: ${overlap[0]}`,
+        });
+    if (contract.approval.required && contract.approval.approved === false)
+        return;
+});
+export function validateRunContract(input) {
+    return runContractSchema.parse(input);
+}
+export function assertRunCanStart(contract, attempt = 1) {
+    if (contract.approval.required && !contract.approval.approved)
+        throw new Error("Run approval required");
+    if (attempt > contract.budget.maxAttempts)
+        throw new Error(`Run attempt limit exceeded: ${attempt}`);
+}
+//# sourceMappingURL=run-contract.js.map

package/node_modules/@ocean/core/dist/domain/sessions/entry-contract.js

@@ -0,0 +1,31 @@
+import { z } from "zod";
+const sessionEntryPointSchema = z.enum([
+    "ocean-run",
+    "terminal-shim",
+    "interactive-managed",
+    "desktop-wrapper",
+]);
+const sessionControlLevelSchema = z.enum([
+    "full-head",
+    "managed-partial",
+    "observed",
+    "bypass",
+]);
+const sessionInputCaptureSchema = z.enum([
+    "semantic",
+    "bounded-terminal",
+    "none",
+]);
+const sessionEntryContractSchema = z.object({
+    entryPoint: sessionEntryPointSchema,
+    controlLevel: sessionControlLevelSchema,
+    inputCapture: sessionInputCaptureSchema,
+    contextTransport: z.string().min(1),
+    policyEnforcement: z.string().min(1),
+    promotion: z.literal("explicit-review"),
+    resume: z.string().min(1),
+});
+export function validateSessionEntryContract(contract) {
+    return sessionEntryContractSchema.parse(contract);
+}
+//# sourceMappingURL=entry-contract.js.map