@askexenow/exe-os 0.9.276 → 0.9.277

package/dist/crm-webhook-WN3STFME.js

@@ -0,0 +1,10 @@
+import {
+  createCRMWebhookHandler,
+  parseTwentyWebhook
+} from "./chunk-Y3JP4PL5.js";
+import "./chunk-HINWHX63.js";
+import "./chunk-MLKGABMK.js";
+export {
+  createCRMWebhookHandler,
+  parseTwentyWebhook
+};

package/dist/cto-delegation-gate-5I5NJKNG.js

@@ -0,0 +1,206 @@
+import {
+  sessionScopeFilter
+} from "./chunk-PR4XTDPM.js";
+import "./chunk-XFYZ77DP.js";
+import "./chunk-5CHYEKMH.js";
+import "./chunk-4JERP7NT.js";
+import "./chunk-XEFJKWV2.js";
+import "./chunk-MVW62NIZ.js";
+import "./chunk-OYNKIAVW.js";
+import "./chunk-CX6GL3ZJ.js";
+import "./chunk-3IR6XFGW.js";
+import "./chunk-H3YWMLS4.js";
+import "./chunk-NGP6LSV2.js";
+import "./chunk-X4HA7IYX.js";
+import "./chunk-CVYC6DUW.js";
+import "./chunk-OPU3NYOO.js";
+import "./chunk-GJV3WDWM.js";
+import "./chunk-MP2AFCGL.js";
+import "./chunk-PAPQOO4S.js";
+import "./chunk-HYZV25LY.js";
+import {
+  getClient,
+  getEmployeeByRole,
+  loadEmployeesSync
+} from "./chunk-IATEXT4R.js";
+import "./chunk-2I23RPSI.js";
+import "./chunk-AEP5ZASD.js";
+import "./chunk-FXU7JOXK.js";
+import "./chunk-WREI3KQR.js";
+import "./chunk-DOHKUD26.js";
+import "./chunk-LYH5HE24.js";
+import "./chunk-MLKGABMK.js";
+
+// src/lib/cto-delegation-gate.ts
+import os from "os";
+import path from "path";
+import { existsSync, readFileSync, statSync } from "fs";
+var GATED_ROLE = "CTO";
+function resolveGatedAgent() {
+  try {
+    const employees = loadEmployeesSync();
+    const cto = getEmployeeByRole(employees, GATED_ROLE);
+    return cto?.name ?? "";
+  } catch {
+    return "";
+  }
+}
+var GATED_AGENT = resolveGatedAgent();
+function getGatedAgent() {
+  return resolveGatedAgent() || GATED_AGENT;
+}
+var BLOCKED_PATH_PREFIXES = [
+  "src/",
+  "tests/",
+  "scripts/",
+  "bin/",
+  ".github/workflows/",
+  ".claude/skills/"
+];
+var BLOCKED_FILENAMES = [
+  "package.json",
+  "tsconfig.json",
+  "docker-compose.yml"
+];
+var BLOCKED_DOCKERFILE_PREFIX = "Dockerfile";
+var BLOCKED_EXTENSIONS = [
+  ".ts",
+  ".js",
+  ".tsx",
+  ".jsx",
+  ".rs",
+  ".py",
+  ".go",
+  ".sh",
+  ".yaml",
+  ".yml",
+  ".prisma",
+  ".sql"
+];
+var EXEMPT_MD_DIR_PREFIXES = [
+  ".planning/",
+  "exe/output/",
+  "exe/",
+  "docs/"
+];
+var RECENT_DISPATCH_WINDOW_MS = 5 * 60 * 1e3;
+var SCRATCHPAD_MAX_AGE_MS = 10 * 60 * 1e3;
+var SCRATCHPAD_ESCAPE_PATTERN = /^(?:ENGINEER|TOM)-CAPABLE:\s*NO\s*—\s*reason:\s*\S+/m;
+function toWorkspaceRelative(filePath, cwd = process.cwd()) {
+  const normalized = path.normalize(filePath);
+  if (normalized.startsWith(cwd + path.sep)) {
+    return normalized.slice(cwd.length + 1);
+  }
+  if (path.isAbsolute(normalized)) {
+    return path.basename(normalized);
+  }
+  return normalized;
+}
+function isDockerfile(basename) {
+  return basename === BLOCKED_DOCKERFILE_PREFIX || basename.startsWith(`${BLOCKED_DOCKERFILE_PREFIX}.`);
+}
+function classifyPath(filePath, cwd) {
+  const rel = toWorkspaceRelative(filePath, cwd);
+  const basename = path.basename(rel);
+  const ext = path.extname(rel).toLowerCase();
+  if (ext === ".md") {
+    for (const prefix of EXEMPT_MD_DIR_PREFIXES) {
+      if (rel.startsWith(prefix)) return "exempt";
+    }
+    if (!BLOCKED_PATH_PREFIXES.some((p) => rel.startsWith(p))) {
+      return "exempt";
+    }
+  }
+  if (BLOCKED_FILENAMES.includes(basename)) return "code";
+  if (isDockerfile(basename)) return "code";
+  if (BLOCKED_EXTENSIONS.includes(ext)) return "code";
+  if (BLOCKED_PATH_PREFIXES.some((p) => rel.startsWith(p))) return "code";
+  return "exempt";
+}
+async function hasRecentEngineerDispatch(now = Date.now()) {
+  try {
+    const client = getClient();
+    const engineers = loadEmployeesSync().filter(
+      (e) => e.role.toLowerCase() === "principal engineer"
+    );
+    const engineerNames = engineers.map((e) => e.name);
+    const gatedAgent = getGatedAgent();
+    if (!gatedAgent) return false;
+    if (engineerNames.length === 0) return false;
+    const placeholders = engineerNames.map(() => "?").join(",");
+    const ydScope = sessionScopeFilter();
+    const result = await client.execute({
+      sql: `SELECT MAX(created_at) AS last_dispatch
+            FROM tasks
+            WHERE assigned_by = ? AND assigned_to IN (${placeholders})${ydScope.sql}`,
+      args: [gatedAgent, ...engineerNames, ...ydScope.args]
+    });
+    const raw = result.rows[0]?.last_dispatch;
+    if (raw === null || raw === void 0) return false;
+    const parsed = Date.parse(String(raw));
+    if (Number.isNaN(parsed)) return false;
+    return now - parsed <= RECENT_DISPATCH_WINDOW_MS;
+  } catch {
+    return false;
+  }
+}
+function scratchpadPath(sessionId, homeDir = os.homedir()) {
+  return path.join(
+    homeDir,
+    ".exe-os",
+    "session-cache",
+    `cto-scratchpad-${sessionId}.txt`
+  );
+}
+function hasValidScratchpadEscape(sessionId, now = Date.now(), homeDir = os.homedir()) {
+  const paths = [scratchpadPath(sessionId, homeDir)];
+  for (const filePath of paths) {
+    if (!existsSync(filePath)) continue;
+    try {
+      const stat = statSync(filePath);
+      if (now - stat.mtimeMs > SCRATCHPAD_MAX_AGE_MS) continue;
+      const body = readFileSync(filePath, "utf-8");
+      if (SCRATCHPAD_ESCAPE_PATTERN.test(body)) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+var GATE_BLOCK_MESSAGE = [
+  "ACTION BLOCKED by CTO delegation gate. Your Write/Edit was DENIED \u2014 it did NOT execute.",
+  "This edit looks implementable by an engineer. You MUST either:",
+  "  1. Dispatch create_task to an engineer, OR",
+  "  2. Add ENGINEER-CAPABLE: NO with explicit reason to proceed yourself.",
+  "Do NOT report this action as successful. It was blocked. No file was changed.",
+  "If you are a sub-agent, report this FAILURE to your parent agent."
+].join("\n");
+async function evaluateDelegationGate(opts) {
+  const gatedAgent = getGatedAgent();
+  if (!gatedAgent || opts.agentId !== gatedAgent) {
+    return { outcome: "allow", reason: "agent_not_gated" };
+  }
+  if (!/^(Write|Edit)$/.test(opts.toolName)) {
+    return { outcome: "allow", reason: "tool_not_gated" };
+  }
+  if (classifyPath(opts.filePath, opts.cwd) === "exempt") {
+    return { outcome: "allow", reason: "exempt_path" };
+  }
+  if (await hasRecentEngineerDispatch(opts.now)) {
+    return { outcome: "allow", reason: "recent_engineer_dispatch" };
+  }
+  if (hasValidScratchpadEscape(opts.sessionId, opts.now, opts.homeDir)) {
+    return { outcome: "allow", reason: "scratchpad_escape" };
+  }
+  return { outcome: "block", reason: "no_delegation_no_escape" };
+}
+export {
+  GATED_AGENT,
+  GATED_ROLE,
+  GATE_BLOCK_MESSAGE,
+  classifyPath,
+  evaluateDelegationGate,
+  getGatedAgent,
+  hasRecentEngineerDispatch,
+  hasValidScratchpadEscape,
+  scratchpadPath
+};

package/dist/cto-delegation-gate-CZRM46V3.js

@@ -0,0 +1,206 @@
+import {
+  sessionScopeFilter
+} from "./chunk-V6IH2YVS.js";
+import "./chunk-YHVZVCGR.js";
+import "./chunk-4FVVJ7ME.js";
+import "./chunk-4JERP7NT.js";
+import "./chunk-YR5OIJRL.js";
+import "./chunk-MVW62NIZ.js";
+import "./chunk-OYNKIAVW.js";
+import "./chunk-SSTLTIF3.js";
+import "./chunk-ZGWAADSD.js";
+import "./chunk-YFPZUT6G.js";
+import "./chunk-NGP6LSV2.js";
+import "./chunk-QPP6RTSO.js";
+import "./chunk-CVYC6DUW.js";
+import "./chunk-OPU3NYOO.js";
+import "./chunk-GJV3WDWM.js";
+import "./chunk-MP2AFCGL.js";
+import "./chunk-QRYYBFXG.js";
+import "./chunk-HYZV25LY.js";
+import {
+  getClient,
+  getEmployeeByRole,
+  loadEmployeesSync
+} from "./chunk-L7T4JRTJ.js";
+import "./chunk-2I23RPSI.js";
+import "./chunk-DS32WI6J.js";
+import "./chunk-FXU7JOXK.js";
+import "./chunk-WJMFNT4M.js";
+import "./chunk-LAAB5EOU.js";
+import "./chunk-LYH5HE24.js";
+import "./chunk-SIAA4J6H.js";
+
+// src/lib/cto-delegation-gate.ts
+import os from "os";
+import path from "path";
+import { existsSync, readFileSync, statSync } from "fs";
+var GATED_ROLE = "CTO";
+function resolveGatedAgent() {
+  try {
+    const employees = loadEmployeesSync();
+    const cto = getEmployeeByRole(employees, GATED_ROLE);
+    return cto?.name ?? "";
+  } catch {
+    return "";
+  }
+}
+var GATED_AGENT = resolveGatedAgent();
+function getGatedAgent() {
+  return resolveGatedAgent() || GATED_AGENT;
+}
+var BLOCKED_PATH_PREFIXES = [
+  "src/",
+  "tests/",
+  "scripts/",
+  "bin/",
+  ".github/workflows/",
+  ".claude/skills/"
+];
+var BLOCKED_FILENAMES = [
+  "package.json",
+  "tsconfig.json",
+  "docker-compose.yml"
+];
+var BLOCKED_DOCKERFILE_PREFIX = "Dockerfile";
+var BLOCKED_EXTENSIONS = [
+  ".ts",
+  ".js",
+  ".tsx",
+  ".jsx",
+  ".rs",
+  ".py",
+  ".go",
+  ".sh",
+  ".yaml",
+  ".yml",
+  ".prisma",
+  ".sql"
+];
+var EXEMPT_MD_DIR_PREFIXES = [
+  ".planning/",
+  "exe/output/",
+  "exe/",
+  "docs/"
+];
+var RECENT_DISPATCH_WINDOW_MS = 5 * 60 * 1e3;
+var SCRATCHPAD_MAX_AGE_MS = 10 * 60 * 1e3;
+var SCRATCHPAD_ESCAPE_PATTERN = /^(?:ENGINEER|TOM)-CAPABLE:\s*NO\s*—\s*reason:\s*\S+/m;
+function toWorkspaceRelative(filePath, cwd = process.cwd()) {
+  const normalized = path.normalize(filePath);
+  if (normalized.startsWith(cwd + path.sep)) {
+    return normalized.slice(cwd.length + 1);
+  }
+  if (path.isAbsolute(normalized)) {
+    return path.basename(normalized);
+  }
+  return normalized;
+}
+function isDockerfile(basename) {
+  return basename === BLOCKED_DOCKERFILE_PREFIX || basename.startsWith(`${BLOCKED_DOCKERFILE_PREFIX}.`);
+}
+function classifyPath(filePath, cwd) {
+  const rel = toWorkspaceRelative(filePath, cwd);
+  const basename = path.basename(rel);
+  const ext = path.extname(rel).toLowerCase();
+  if (ext === ".md") {
+    for (const prefix of EXEMPT_MD_DIR_PREFIXES) {
+      if (rel.startsWith(prefix)) return "exempt";
+    }
+    if (!BLOCKED_PATH_PREFIXES.some((p) => rel.startsWith(p))) {
+      return "exempt";
+    }
+  }
+  if (BLOCKED_FILENAMES.includes(basename)) return "code";
+  if (isDockerfile(basename)) return "code";
+  if (BLOCKED_EXTENSIONS.includes(ext)) return "code";
+  if (BLOCKED_PATH_PREFIXES.some((p) => rel.startsWith(p))) return "code";
+  return "exempt";
+}
+async function hasRecentEngineerDispatch(now = Date.now()) {
+  try {
+    const client = getClient();
+    const engineers = loadEmployeesSync().filter(
+      (e) => e.role.toLowerCase() === "principal engineer"
+    );
+    const engineerNames = engineers.map((e) => e.name);
+    const gatedAgent = getGatedAgent();
+    if (!gatedAgent) return false;
+    if (engineerNames.length === 0) return false;
+    const placeholders = engineerNames.map(() => "?").join(",");
+    const ydScope = sessionScopeFilter();
+    const result = await client.execute({
+      sql: `SELECT MAX(created_at) AS last_dispatch
+            FROM tasks
+            WHERE assigned_by = ? AND assigned_to IN (${placeholders})${ydScope.sql}`,
+      args: [gatedAgent, ...engineerNames, ...ydScope.args]
+    });
+    const raw = result.rows[0]?.last_dispatch;
+    if (raw === null || raw === void 0) return false;
+    const parsed = Date.parse(String(raw));
+    if (Number.isNaN(parsed)) return false;
+    return now - parsed <= RECENT_DISPATCH_WINDOW_MS;
+  } catch {
+    return false;
+  }
+}
+function scratchpadPath(sessionId, homeDir = os.homedir()) {
+  return path.join(
+    homeDir,
+    ".exe-os",
+    "session-cache",
+    `cto-scratchpad-${sessionId}.txt`
+  );
+}
+function hasValidScratchpadEscape(sessionId, now = Date.now(), homeDir = os.homedir()) {
+  const paths = [scratchpadPath(sessionId, homeDir)];
+  for (const filePath of paths) {
+    if (!existsSync(filePath)) continue;
+    try {
+      const stat = statSync(filePath);
+      if (now - stat.mtimeMs > SCRATCHPAD_MAX_AGE_MS) continue;
+      const body = readFileSync(filePath, "utf-8");
+      if (SCRATCHPAD_ESCAPE_PATTERN.test(body)) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+var GATE_BLOCK_MESSAGE = [
+  "ACTION BLOCKED by CTO delegation gate. Your Write/Edit was DENIED \u2014 it did NOT execute.",
+  "This edit looks implementable by an engineer. You MUST either:",
+  "  1. Dispatch create_task to an engineer, OR",
+  "  2. Add ENGINEER-CAPABLE: NO with explicit reason to proceed yourself.",
+  "Do NOT report this action as successful. It was blocked. No file was changed.",
+  "If you are a sub-agent, report this FAILURE to your parent agent."
+].join("\n");
+async function evaluateDelegationGate(opts) {
+  const gatedAgent = getGatedAgent();
+  if (!gatedAgent || opts.agentId !== gatedAgent) {
+    return { outcome: "allow", reason: "agent_not_gated" };
+  }
+  if (!/^(Write|Edit)$/.test(opts.toolName)) {
+    return { outcome: "allow", reason: "tool_not_gated" };
+  }
+  if (classifyPath(opts.filePath, opts.cwd) === "exempt") {
+    return { outcome: "allow", reason: "exempt_path" };
+  }
+  if (await hasRecentEngineerDispatch(opts.now)) {
+    return { outcome: "allow", reason: "recent_engineer_dispatch" };
+  }
+  if (hasValidScratchpadEscape(opts.sessionId, opts.now, opts.homeDir)) {
+    return { outcome: "allow", reason: "scratchpad_escape" };
+  }
+  return { outcome: "block", reason: "no_delegation_no_escape" };
+}
+export {
+  GATED_AGENT,
+  GATED_ROLE,
+  GATE_BLOCK_MESSAGE,
+  classifyPath,
+  evaluateDelegationGate,
+  getGatedAgent,
+  hasRecentEngineerDispatch,
+  hasValidScratchpadEscape,
+  scratchpadPath
+};

package/dist/cto-delegation-gate-GVXGK5PB.js

@@ -0,0 +1,278 @@
+import {
+  sessionScopeFilter
+} from "./chunk-PPLG2EIO.js";
+import "./chunk-GC7SNA6V.js";
+import "./chunk-4FVVJ7ME.js";
+import "./chunk-4JERP7NT.js";
+import "./chunk-RKTH342D.js";
+import "./chunk-MVW62NIZ.js";
+import "./chunk-OYNKIAVW.js";
+import "./chunk-SSTLTIF3.js";
+import "./chunk-FZD2J4CZ.js";
+import "./chunk-MX7DHYSC.js";
+import "./chunk-NGP6LSV2.js";
+import "./chunk-KFVD6XWS.js";
+import "./chunk-CVYC6DUW.js";
+import "./chunk-OPU3NYOO.js";
+import "./chunk-GJV3WDWM.js";
+import "./chunk-MP2AFCGL.js";
+import "./chunk-4H4HKOE4.js";
+import "./chunk-HYZV25LY.js";
+import {
+  getClient,
+  getEmployeeByRole,
+  loadEmployeesSync
+} from "./chunk-JLNXT57O.js";
+import "./chunk-2I23RPSI.js";
+import "./chunk-ZDNYW3AR.js";
+import "./chunk-FXU7JOXK.js";
+import "./chunk-WJMFNT4M.js";
+import "./chunk-LAAB5EOU.js";
+import "./chunk-LYH5HE24.js";
+import "./chunk-SIAA4J6H.js";
+
+// src/lib/cto-delegation-gate.ts
+import os from "os";
+import path from "path";
+import { existsSync, readFileSync, statSync } from "fs";
+var GATED_ROLE = "CTO";
+function resolveGatedAgent() {
+  try {
+    const employees = loadEmployeesSync();
+    const cto = getEmployeeByRole(employees, GATED_ROLE);
+    return cto?.name ?? "";
+  } catch {
+    return "";
+  }
+}
+var GATED_AGENT = resolveGatedAgent();
+function getGatedAgent() {
+  return resolveGatedAgent() || GATED_AGENT;
+}
+var BLOCKED_PATH_PREFIXES = [
+  "src/",
+  "tests/",
+  "scripts/",
+  "bin/",
+  ".github/workflows/",
+  ".claude/skills/"
+];
+var BLOCKED_FILENAMES = [
+  "package.json",
+  "tsconfig.json",
+  "docker-compose.yml"
+];
+var BLOCKED_DOCKERFILE_PREFIX = "Dockerfile";
+var BLOCKED_EXTENSIONS = [
+  ".ts",
+  ".js",
+  ".tsx",
+  ".jsx",
+  ".rs",
+  ".py",
+  ".go",
+  ".sh",
+  ".yaml",
+  ".yml",
+  ".prisma",
+  ".sql"
+];
+var EXEMPT_MD_DIR_PREFIXES = [
+  ".planning/",
+  "exe/output/",
+  "exe/",
+  "docs/"
+];
+var RECENT_DISPATCH_WINDOW_MS = 5 * 60 * 1e3;
+var SCRATCHPAD_MAX_AGE_MS = 10 * 60 * 1e3;
+var SCRATCHPAD_ESCAPE_PATTERN = /^(?:ENGINEER|TOM)-CAPABLE:\s*NO\s*—\s*reason:\s*\S+/m;
+function toWorkspaceRelative(filePath, cwd = process.cwd()) {
+  const normalized = path.normalize(filePath);
+  if (normalized.startsWith(cwd + path.sep)) {
+    return normalized.slice(cwd.length + 1);
+  }
+  if (path.isAbsolute(normalized)) {
+    return path.basename(normalized);
+  }
+  return normalized;
+}
+function isDockerfile(basename) {
+  return basename === BLOCKED_DOCKERFILE_PREFIX || basename.startsWith(`${BLOCKED_DOCKERFILE_PREFIX}.`);
+}
+function classifyPath(filePath, cwd) {
+  const rel = toWorkspaceRelative(filePath, cwd);
+  const basename = path.basename(rel);
+  const ext = path.extname(rel).toLowerCase();
+  if (ext === ".md") {
+    for (const prefix of EXEMPT_MD_DIR_PREFIXES) {
+      if (rel.startsWith(prefix)) return "exempt";
+    }
+    if (!BLOCKED_PATH_PREFIXES.some((p) => rel.startsWith(p))) {
+      return "exempt";
+    }
+  }
+  if (BLOCKED_FILENAMES.includes(basename)) return "code";
+  if (isDockerfile(basename)) return "code";
+  if (BLOCKED_EXTENSIONS.includes(ext)) return "code";
+  if (BLOCKED_PATH_PREFIXES.some((p) => rel.startsWith(p))) return "code";
+  return "exempt";
+}
+function buildPathTokens(filePath) {
+  const GENERIC_SEGMENTS = /* @__PURE__ */ new Set([
+    "src",
+    "app",
+    "api",
+    "lib",
+    "bin",
+    "tests",
+    "test",
+    "scripts",
+    "dist",
+    "build",
+    "out",
+    "pages",
+    "routes",
+    "components",
+    "utils",
+    "helpers",
+    "types",
+    "models"
+  ]);
+  const normalized = path.normalize(filePath).replace(/\\/g, "/");
+  const segments = normalized.split("/").filter(Boolean);
+  const tokens = /* @__PURE__ */ new Set();
+  const basename = segments[segments.length - 1] ?? "";
+  if (basename) tokens.add(basename);
+  const parentDir = segments[segments.length - 2];
+  if (parentDir && parentDir.length >= 5 && !GENERIC_SEGMENTS.has(parentDir)) {
+    tokens.add(parentDir);
+    tokens.add(`${parentDir}/${basename}`);
+  }
+  for (let depth = 2; depth <= Math.min(4, segments.length); depth++) {
+    const suffix = segments.slice(segments.length - depth).join("/");
+    const leadSegment = segments[segments.length - depth] ?? "";
+    if (GENERIC_SEGMENTS.has(leadSegment)) continue;
+    tokens.add(suffix);
+  }
+  return [...tokens].filter((t) => t.length > 0);
+}
+async function isFileInTaskSpec(filePath, agentId) {
+  try {
+    const client = getClient();
+    const scope = sessionScopeFilter();
+    const result = await client.execute({
+      sql: `SELECT title, context FROM tasks
+            WHERE assigned_to = ? AND status = 'in_progress'${scope.sql}`,
+      args: [agentId, ...scope.args]
+    });
+    if (result.rows.length === 0) return false;
+    const tokens = buildPathTokens(filePath);
+    if (tokens.length === 0) return false;
+    for (const row of result.rows) {
+      const haystack = [
+        String(row.title ?? ""),
+        String(row.context ?? "")
+      ].join(" ").toLowerCase();
+      for (const token of tokens) {
+        if (haystack.includes(token.toLowerCase())) {
+          return true;
+        }
+      }
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+async function hasRecentEngineerDispatch(now = Date.now()) {
+  try {
+    const client = getClient();
+    const engineers = loadEmployeesSync().filter(
+      (e) => e.role.toLowerCase() === "principal engineer"
+    );
+    const engineerNames = engineers.map((e) => e.name);
+    const gatedAgent = getGatedAgent();
+    if (!gatedAgent) return false;
+    if (engineerNames.length === 0) return false;
+    const placeholders = engineerNames.map(() => "?").join(",");
+    const ydScope = sessionScopeFilter();
+    const result = await client.execute({
+      sql: `SELECT MAX(created_at) AS last_dispatch
+            FROM tasks
+            WHERE assigned_by = ? AND assigned_to IN (${placeholders})${ydScope.sql}`,
+      args: [gatedAgent, ...engineerNames, ...ydScope.args]
+    });
+    const raw = result.rows[0]?.last_dispatch;
+    if (raw === null || raw === void 0) return false;
+    const parsed = Date.parse(String(raw));
+    if (Number.isNaN(parsed)) return false;
+    return now - parsed <= RECENT_DISPATCH_WINDOW_MS;
+  } catch {
+    return false;
+  }
+}
+function scratchpadPath(sessionId, homeDir = os.homedir()) {
+  return path.join(
+    homeDir,
+    ".exe-os",
+    "session-cache",
+    `cto-scratchpad-${sessionId}.txt`
+  );
+}
+function hasValidScratchpadEscape(sessionId, now = Date.now(), homeDir = os.homedir()) {
+  const paths = [scratchpadPath(sessionId, homeDir)];
+  for (const filePath of paths) {
+    if (!existsSync(filePath)) continue;
+    try {
+      const stat = statSync(filePath);
+      if (now - stat.mtimeMs > SCRATCHPAD_MAX_AGE_MS) continue;
+      const body = readFileSync(filePath, "utf-8");
+      if (SCRATCHPAD_ESCAPE_PATTERN.test(body)) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+var GATE_BLOCK_MESSAGE = [
+  "ACTION BLOCKED by CTO delegation gate. Your Write/Edit was DENIED \u2014 it did NOT execute.",
+  "This edit looks implementable by an engineer. You MUST either:",
+  "  1. Dispatch create_task to an engineer, OR",
+  "  2. Add ENGINEER-CAPABLE: NO with explicit reason to proceed yourself.",
+  "Do NOT report this action as successful. It was blocked. No file was changed.",
+  "If you are a sub-agent, report this FAILURE to your parent agent."
+].join("\n");
+async function evaluateDelegationGate(opts) {
+  const gatedAgent = getGatedAgent();
+  if (!gatedAgent || opts.agentId !== gatedAgent) {
+    return { outcome: "allow", reason: "agent_not_gated" };
+  }
+  if (!/^(Write|Edit)$/.test(opts.toolName)) {
+    return { outcome: "allow", reason: "tool_not_gated" };
+  }
+  if (classifyPath(opts.filePath, opts.cwd) === "exempt") {
+    return { outcome: "allow", reason: "exempt_path" };
+  }
+  if (await isFileInTaskSpec(opts.filePath, opts.agentId)) {
+    return { outcome: "allow", reason: "task_spec_authorized" };
+  }
+  if (await hasRecentEngineerDispatch(opts.now)) {
+    return { outcome: "allow", reason: "recent_engineer_dispatch" };
+  }
+  if (hasValidScratchpadEscape(opts.sessionId, opts.now, opts.homeDir)) {
+    return { outcome: "allow", reason: "scratchpad_escape" };
+  }
+  return { outcome: "block", reason: "no_delegation_no_escape" };
+}
+export {
+  GATED_AGENT,
+  GATED_ROLE,
+  GATE_BLOCK_MESSAGE,
+  buildPathTokens,
+  classifyPath,
+  evaluateDelegationGate,
+  getGatedAgent,
+  hasRecentEngineerDispatch,
+  hasValidScratchpadEscape,
+  isFileInTaskSpec,
+  scratchpadPath
+};