@caupulican/pi-adaptative 0.81.39 → 0.81.41

package/dist/core/risk-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-classifier.d.ts","sourceRoot":"","sources":["../../src/core/risk-classifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiB,cAAc,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAEjH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,QAAQ,CAAC;AAiFtD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAyFtE;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAE3E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CA+E9E","sourcesContent":["import type { OperationRisk, RiskAssessment, RiskAssessmentInput, RouteDecision } from \"./autonomy/contracts.ts\";\n\nexport type ModelRouterIntent = \"research\" | \"modify\";\n\nconst EXPLICIT_MODIFY_REQUEST_RE =\n\t/^(?:can you|could you|please|pls|go ahead and|let'?s|i need you to|we need to|you should)\\s+.*\\b(add|apply|build|change|commit|create|delete|edit|fix|generate|implement|install|modify|patch|remove|rename|replace|run|test|update|write|publish|release|push|deploy|tag|reset|clean|rewrite)\\b/i;\nconst READ_ONLY_QUESTION_RE =\n\t/^(?:(?:can you|could you|please|pls|go ahead and|let'?s|i need you to|we need to|you should)\\s+)?(?:how|what|why|when|where|which|who|explain|summarize|compare|describe|list|show|search|find|view|read|locate)\\b/i;\nconst RELEASE_PUBLISH_RE = /\\b(publish|release|push|deploy|tag)\\b/i;\nconst SECURITY_AUTH_RE = /\\b(auth|token|credential|credentials|secret|api[-_]key)\\b/i;\nconst DESTRUCTIVE_RE = /\\b(delete|reset|rm\\s+-rf|clean)\\b/i;\nconst SELF_MOD_MUTATE_RE =\n\t/\\b(modify|change|write|update|edit|delete|add|remove|set)\\s+.*\\b(skills|prompts|settings|tools|behavior)\\b|self[-_]modification/i;\nconst ARCHITECTURE_MUTATE_RE = /\\b(rewrite|redesign|change|modify|rearchitect)\\s+.*\\b(architecture|architect)\\b/i;\nconst PLANNING_CORE_RE = /\\b(plan|planning|roadmap|strategy)\\b/i;\nconst PLANNING_DESIGN_WORD_RE = /\\b(design|architect\\w*|structure|approach)\\b/i;\nconst PLANNING_PROSPECTIVE_RE =\n\t/\\b(how (?:should|would|do we|can we)|what(?:'s| is) the (?:best|cleanest|right)|propose|draft|come up with|figure out|decide (?:on|how))\\b/i;\nconst REFACTOR_RE = /\\b(refactor|refactoring)\\b/i;\nconst TEST_VALIDATION_RE = /\\b(test|testing|validation|lint|vitest|jest|run)\\b/i;\nconst IMPLEMENT_RE = /\\b(implement|fix|apply|change|update|create|write|generate|modify|edit|patch|add)\\b/i;\nconst DESTRUCTIVE_CMD_RE =\n\t/\\b(rm(\\s+-r|\\s+-f|\\s+-rf|\\s+-fr)?|mv|cp|chmod|chown|install)\\b|>\\s*\\/dev\\/(sda|hda|vda)|\\b(dd\\s+if=)/i;\nconst GIT_MUTATE_CMD_RE = /\\bgit\\s+(commit|push|reset|clean|stash|rebase)\\b/i;\nconst PKG_MUTATE_CMD_RE = /\\b(npm|pnpm|yarn|bun)\\s+(install|i|update|up|publish|run|remove|rm|uninstall)\\b/i;\nconst RELEASE_DEPLOY_CMD_RE = /\\b(release|deploy)\\b/i;\nconst PYTHON_HIGH_IMPACT_RE =\n\t/\\b(?:shutil\\.(?:rmtree|move|copy|copy2|copytree)|os\\.(?:remove|unlink|rmdir|removedirs|system)|subprocess\\.(?:run|call|check_call|check_output|Popen)|Path\\([^)]*\\)\\.(?:unlink|rmdir))\\b/i;\nconst REDIRECTION_RE = /[<>]/;\n\ninterface RiskSignal {\n\trisk: OperationRisk;\n\tkind: \"release\" | \"security\" | \"destructive\" | \"self-modification\" | \"architecture\";\n\treason: string;\n}\n\nfunction isPlanningPrompt(text: string): boolean {\n\treturn PLANNING_CORE_RE.test(text) || (PLANNING_DESIGN_WORD_RE.test(text) && PLANNING_PROSPECTIVE_RE.test(text));\n}\n\nfunction highRiskSignal(text: string): RiskSignal | undefined {\n\tif (RELEASE_PUBLISH_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"release\",\n\t\t\treason: \"Operation mentions releasing, publishing, or deploying\",\n\t\t};\n\t}\n\tif (SECURITY_AUTH_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"security\",\n\t\t\treason: \"Operation mentions authentication or credentials\",\n\t\t};\n\t}\n\tif (DESTRUCTIVE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"destructive\",\n\t\t\treason: \"Operation involves deleting, resetting, or cleaning\",\n\t\t};\n\t}\n\tif (SELF_MOD_MUTATE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"self-modification\",\n\t\t\treason: \"Operation modifies settings, tools, skills, or prompts\",\n\t\t};\n\t}\n\tif (ARCHITECTURE_MUTATE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"high-impact\",\n\t\t\tkind: \"architecture\",\n\t\t\treason: \"Operation mentions rewriting or rearchitecting core parts\",\n\t\t};\n\t}\n\treturn undefined;\n}\n\nfunction stripSingleQuotes(command: string): string {\n\treturn command.replace(/'[^']*'/g, \"''\");\n}\n\nexport function classifyModelRouterRoute(prompt: string): RouteDecision {\n\tconst text = prompt.trim();\n\tif (!text) {\n\t\treturn {\n\t\t\ttier: \"cheap\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.1,\n\t\t\treasonCode: \"empty_prompt\",\n\t\t\treasons: [\"Empty or whitespace prompt\"],\n\t\t};\n\t}\n\tif (READ_ONLY_QUESTION_RE.test(text) && !EXPLICIT_MODIFY_REQUEST_RE.test(text)) {\n\t\tif (isPlanningPrompt(text)) {\n\t\t\treturn {\n\t\t\t\ttier: \"medium\",\n\t\t\t\trisk: \"read-only\",\n\t\t\t\tconfidence: 0.75,\n\t\t\t\treasonCode: \"planning_min_medium\",\n\t\t\t\treasons: [\"Planning/design prompts never route cheap by default; a judge may deem them trivial\"],\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\ttier: \"cheap\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.9,\n\t\t\treasonCode: \"read_only_question\",\n\t\t\treasons: [\"Prompt asks a question or requests an explanation, search, or lookup\"],\n\t\t};\n\t}\n\tconst highRisk = highRiskSignal(text);\n\tif (highRisk) {\n\t\tconst reasonCode: Record<RiskSignal[\"kind\"], string> = {\n\t\t\trelease: \"release_or_publish\",\n\t\t\tsecurity: \"security_or_auth\",\n\t\t\tdestructive: \"destructive_or_git_history\",\n\t\t\t\"self-modification\": \"settings_or_self_modification\",\n\t\t\tarchitecture: \"architecture_or_ambiguous\",\n\t\t};\n\t\treturn {\n\t\t\ttier: \"expensive\",\n\t\t\trisk: highRisk.kind === \"security\" ? \"high-impact\" : highRisk.risk,\n\t\t\tconfidence: highRisk.kind === \"security\" ? 0.95 : highRisk.kind === \"destructive\" ? 0.85 : 0.9,\n\t\t\treasonCode: reasonCode[highRisk.kind],\n\t\t\treasons: [highRisk.reason],\n\t\t};\n\t}\n\tif (isPlanningPrompt(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.75,\n\t\t\treasonCode: \"planning_min_medium\",\n\t\t\treasons: [\"Planning/design prompts never route cheap by default; a judge may deem them trivial\"],\n\t\t};\n\t}\n\tif (REFACTOR_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.8,\n\t\t\treasonCode: \"mechanical_refactor\",\n\t\t\treasons: [\"Prompt mentions refactoring code structure\"],\n\t\t};\n\t}\n\tif (TEST_VALIDATION_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.8,\n\t\t\treasonCode: \"test_or_validation\",\n\t\t\treasons: [\"Prompt mentions testing, validation, or linting\"],\n\t\t};\n\t}\n\tif (IMPLEMENT_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.85,\n\t\t\treasonCode: \"normal_implementation\",\n\t\t\treasons: [\"Prompt mentions implementing, updating, creating, or modifying code\"],\n\t\t};\n\t}\n\treturn {\n\t\ttier: \"cheap\",\n\t\trisk: \"read-only\",\n\t\tconfidence: 0.5,\n\t\treasonCode: \"default_read_only\",\n\t\treasons: [\"No explicit implementation, destructive, or release patterns detected\"],\n\t};\n}\n\nexport function classifyModelRouterIntent(prompt: string): ModelRouterIntent {\n\treturn classifyModelRouterRoute(prompt).tier === \"cheap\" ? \"research\" : \"modify\";\n}\n\nexport function assessOperationRisk(input: RiskAssessmentInput): RiskAssessment {\n\tconst operation = input.operation.trim();\n\tconst command = input.command?.trim() ?? \"\";\n\tconst cleanCommand = stripSingleQuotes(command);\n\tconst fullText = `${operation} ${command}`.trim();\n\tconst cleanFullText = `${operation} ${cleanCommand}`.trim();\n\tif (!fullText) {\n\t\treturn {\n\t\t\trisk: \"read-only\",\n\t\t\treasonCode: \"empty_operation\",\n\t\t\treasons: [\"Empty operation\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tif (input.toolName === \"secret_store\") {\n\t\treturn {\n\t\t\trisk: \"scoped-write\",\n\t\t\treasonCode: \"native_owner_secret_flow\",\n\t\t\treasons: [\"Native secret-store mutations require model-blind owner input and in-tool confirmation\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tif (READ_ONLY_QUESTION_RE.test(operation) && !EXPLICIT_MODIFY_REQUEST_RE.test(operation)) {\n\t\treturn {\n\t\t\trisk: \"read-only\",\n\t\t\treasonCode: \"read_only_operation\",\n\t\t\treasons: [\"Operation is explicitly read-only (list/show/read/search)\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tconst highRisk = highRiskSignal(cleanFullText);\n\tif (highRisk) {\n\t\tconst reasonCode: Record<RiskSignal[\"kind\"], string> = {\n\t\t\trelease: \"release_publish_operation\",\n\t\t\tsecurity: \"security_auth_operation\",\n\t\t\tdestructive: \"destructive_operation\",\n\t\t\t\"self-modification\": \"self_modification_operation\",\n\t\t\tarchitecture: \"architecture_mutation_operation\",\n\t\t};\n\t\treturn {\n\t\t\trisk: highRisk.risk,\n\t\t\treasonCode: reasonCode[highRisk.kind],\n\t\t\treasons: [highRisk.reason],\n\t\t\trequiresApproval: highRisk.risk === \"approval-required\",\n\t\t};\n\t}\n\tif (\n\t\tcommand &&\n\t\t(DESTRUCTIVE_CMD_RE.test(cleanCommand) ||\n\t\t\tGIT_MUTATE_CMD_RE.test(cleanCommand) ||\n\t\t\tPKG_MUTATE_CMD_RE.test(cleanCommand) ||\n\t\t\tRELEASE_DEPLOY_CMD_RE.test(cleanCommand) ||\n\t\t\tPYTHON_HIGH_IMPACT_RE.test(cleanCommand) ||\n\t\t\tREDIRECTION_RE.test(cleanCommand))\n\t) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\treasonCode: \"mutating_command\",\n\t\t\treasons: [\"Command executes a destructive, mutating, or publish operation\"],\n\t\t\trequiresApproval: true,\n\t\t};\n\t}\n\tif (\n\t\tinput.toolName &&\n\t\t![\"read_file\", \"search_web\", \"list_dir\", \"grep_search\", \"view_file\", \"memory\"].includes(input.toolName)\n\t) {\n\t\treturn {\n\t\t\trisk: \"scoped-write\",\n\t\t\treasonCode: \"generic_mutation\",\n\t\t\treasons: [\"Generic mutating operation or command\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\treturn {\n\t\trisk: \"read-only\",\n\t\treasonCode: \"default_read_only\",\n\t\treasons: [\"No mutating or high-risk patterns detected\"],\n\t\trequiresApproval: false,\n\t};\n}\n"]}

package/dist/core/risk-classifier.js

@@ -0,0 +1,233 @@
+const EXPLICIT_MODIFY_REQUEST_RE = /^(?:can you|could you|please|pls|go ahead and|let'?s|i need you to|we need to|you should)\s+.*\b(add|apply|build|change|commit|create|delete|edit|fix|generate|implement|install|modify|patch|remove|rename|replace|run|test|update|write|publish|release|push|deploy|tag|reset|clean|rewrite)\b/i;
+const READ_ONLY_QUESTION_RE = /^(?:(?:can you|could you|please|pls|go ahead and|let'?s|i need you to|we need to|you should)\s+)?(?:how|what|why|when|where|which|who|explain|summarize|compare|describe|list|show|search|find|view|read|locate)\b/i;
+const RELEASE_PUBLISH_RE = /\b(publish|release|push|deploy|tag)\b/i;
+const SECURITY_AUTH_RE = /\b(auth|token|credential|credentials|secret|api[-_]key)\b/i;
+const DESTRUCTIVE_RE = /\b(delete|reset|rm\s+-rf|clean)\b/i;
+const SELF_MOD_MUTATE_RE = /\b(modify|change|write|update|edit|delete|add|remove|set)\s+.*\b(skills|prompts|settings|tools|behavior)\b|self[-_]modification/i;
+const ARCHITECTURE_MUTATE_RE = /\b(rewrite|redesign|change|modify|rearchitect)\s+.*\b(architecture|architect)\b/i;
+const PLANNING_CORE_RE = /\b(plan|planning|roadmap|strategy)\b/i;
+const PLANNING_DESIGN_WORD_RE = /\b(design|architect\w*|structure|approach)\b/i;
+const PLANNING_PROSPECTIVE_RE = /\b(how (?:should|would|do we|can we)|what(?:'s| is) the (?:best|cleanest|right)|propose|draft|come up with|figure out|decide (?:on|how))\b/i;
+const REFACTOR_RE = /\b(refactor|refactoring)\b/i;
+const TEST_VALIDATION_RE = /\b(test|testing|validation|lint|vitest|jest|run)\b/i;
+const IMPLEMENT_RE = /\b(implement|fix|apply|change|update|create|write|generate|modify|edit|patch|add)\b/i;
+const DESTRUCTIVE_CMD_RE = /\b(rm(\s+-r|\s+-f|\s+-rf|\s+-fr)?|mv|cp|chmod|chown|install)\b|>\s*\/dev\/(sda|hda|vda)|\b(dd\s+if=)/i;
+const GIT_MUTATE_CMD_RE = /\bgit\s+(commit|push|reset|clean|stash|rebase)\b/i;
+const PKG_MUTATE_CMD_RE = /\b(npm|pnpm|yarn|bun)\s+(install|i|update|up|publish|run|remove|rm|uninstall)\b/i;
+const RELEASE_DEPLOY_CMD_RE = /\b(release|deploy)\b/i;
+const PYTHON_HIGH_IMPACT_RE = /\b(?:shutil\.(?:rmtree|move|copy|copy2|copytree)|os\.(?:remove|unlink|rmdir|removedirs|system)|subprocess\.(?:run|call|check_call|check_output|Popen)|Path\([^)]*\)\.(?:unlink|rmdir))\b/i;
+const REDIRECTION_RE = /[<>]/;
+function isPlanningPrompt(text) {
+    return PLANNING_CORE_RE.test(text) || (PLANNING_DESIGN_WORD_RE.test(text) && PLANNING_PROSPECTIVE_RE.test(text));
+}
+function highRiskSignal(text) {
+    if (RELEASE_PUBLISH_RE.test(text)) {
+        return {
+            risk: "approval-required",
+            kind: "release",
+            reason: "Operation mentions releasing, publishing, or deploying",
+        };
+    }
+    if (SECURITY_AUTH_RE.test(text)) {
+        return {
+            risk: "approval-required",
+            kind: "security",
+            reason: "Operation mentions authentication or credentials",
+        };
+    }
+    if (DESTRUCTIVE_RE.test(text)) {
+        return {
+            risk: "approval-required",
+            kind: "destructive",
+            reason: "Operation involves deleting, resetting, or cleaning",
+        };
+    }
+    if (SELF_MOD_MUTATE_RE.test(text)) {
+        return {
+            risk: "approval-required",
+            kind: "self-modification",
+            reason: "Operation modifies settings, tools, skills, or prompts",
+        };
+    }
+    if (ARCHITECTURE_MUTATE_RE.test(text)) {
+        return {
+            risk: "high-impact",
+            kind: "architecture",
+            reason: "Operation mentions rewriting or rearchitecting core parts",
+        };
+    }
+    return undefined;
+}
+function stripSingleQuotes(command) {
+    return command.replace(/'[^']*'/g, "''");
+}
+export function classifyModelRouterRoute(prompt) {
+    const text = prompt.trim();
+    if (!text) {
+        return {
+            tier: "cheap",
+            risk: "read-only",
+            confidence: 0.1,
+            reasonCode: "empty_prompt",
+            reasons: ["Empty or whitespace prompt"],
+        };
+    }
+    if (READ_ONLY_QUESTION_RE.test(text) && !EXPLICIT_MODIFY_REQUEST_RE.test(text)) {
+        if (isPlanningPrompt(text)) {
+            return {
+                tier: "medium",
+                risk: "read-only",
+                confidence: 0.75,
+                reasonCode: "planning_min_medium",
+                reasons: ["Planning/design prompts never route cheap by default; a judge may deem them trivial"],
+            };
+        }
+        return {
+            tier: "cheap",
+            risk: "read-only",
+            confidence: 0.9,
+            reasonCode: "read_only_question",
+            reasons: ["Prompt asks a question or requests an explanation, search, or lookup"],
+        };
+    }
+    const highRisk = highRiskSignal(text);
+    if (highRisk) {
+        const reasonCode = {
+            release: "release_or_publish",
+            security: "security_or_auth",
+            destructive: "destructive_or_git_history",
+            "self-modification": "settings_or_self_modification",
+            architecture: "architecture_or_ambiguous",
+        };
+        return {
+            tier: "expensive",
+            risk: highRisk.kind === "security" ? "high-impact" : highRisk.risk,
+            confidence: highRisk.kind === "security" ? 0.95 : highRisk.kind === "destructive" ? 0.85 : 0.9,
+            reasonCode: reasonCode[highRisk.kind],
+            reasons: [highRisk.reason],
+        };
+    }
+    if (isPlanningPrompt(text)) {
+        return {
+            tier: "medium",
+            risk: "read-only",
+            confidence: 0.75,
+            reasonCode: "planning_min_medium",
+            reasons: ["Planning/design prompts never route cheap by default; a judge may deem them trivial"],
+        };
+    }
+    if (REFACTOR_RE.test(text)) {
+        return {
+            tier: "medium",
+            risk: "scoped-write",
+            confidence: 0.8,
+            reasonCode: "mechanical_refactor",
+            reasons: ["Prompt mentions refactoring code structure"],
+        };
+    }
+    if (TEST_VALIDATION_RE.test(text)) {
+        return {
+            tier: "medium",
+            risk: "scoped-write",
+            confidence: 0.8,
+            reasonCode: "test_or_validation",
+            reasons: ["Prompt mentions testing, validation, or linting"],
+        };
+    }
+    if (IMPLEMENT_RE.test(text)) {
+        return {
+            tier: "medium",
+            risk: "scoped-write",
+            confidence: 0.85,
+            reasonCode: "normal_implementation",
+            reasons: ["Prompt mentions implementing, updating, creating, or modifying code"],
+        };
+    }
+    return {
+        tier: "cheap",
+        risk: "read-only",
+        confidence: 0.5,
+        reasonCode: "default_read_only",
+        reasons: ["No explicit implementation, destructive, or release patterns detected"],
+    };
+}
+export function classifyModelRouterIntent(prompt) {
+    return classifyModelRouterRoute(prompt).tier === "cheap" ? "research" : "modify";
+}
+export function assessOperationRisk(input) {
+    const operation = input.operation.trim();
+    const command = input.command?.trim() ?? "";
+    const cleanCommand = stripSingleQuotes(command);
+    const fullText = `${operation} ${command}`.trim();
+    const cleanFullText = `${operation} ${cleanCommand}`.trim();
+    if (!fullText) {
+        return {
+            risk: "read-only",
+            reasonCode: "empty_operation",
+            reasons: ["Empty operation"],
+            requiresApproval: false,
+        };
+    }
+    if (input.toolName === "secret_store") {
+        return {
+            risk: "scoped-write",
+            reasonCode: "native_owner_secret_flow",
+            reasons: ["Native secret-store mutations require model-blind owner input and in-tool confirmation"],
+            requiresApproval: false,
+        };
+    }
+    if (READ_ONLY_QUESTION_RE.test(operation) && !EXPLICIT_MODIFY_REQUEST_RE.test(operation)) {
+        return {
+            risk: "read-only",
+            reasonCode: "read_only_operation",
+            reasons: ["Operation is explicitly read-only (list/show/read/search)"],
+            requiresApproval: false,
+        };
+    }
+    const highRisk = highRiskSignal(cleanFullText);
+    if (highRisk) {
+        const reasonCode = {
+            release: "release_publish_operation",
+            security: "security_auth_operation",
+            destructive: "destructive_operation",
+            "self-modification": "self_modification_operation",
+            architecture: "architecture_mutation_operation",
+        };
+        return {
+            risk: highRisk.risk,
+            reasonCode: reasonCode[highRisk.kind],
+            reasons: [highRisk.reason],
+            requiresApproval: highRisk.risk === "approval-required",
+        };
+    }
+    if (command &&
+        (DESTRUCTIVE_CMD_RE.test(cleanCommand) ||
+            GIT_MUTATE_CMD_RE.test(cleanCommand) ||
+            PKG_MUTATE_CMD_RE.test(cleanCommand) ||
+            RELEASE_DEPLOY_CMD_RE.test(cleanCommand) ||
+            PYTHON_HIGH_IMPACT_RE.test(cleanCommand) ||
+            REDIRECTION_RE.test(cleanCommand))) {
+        return {
+            risk: "approval-required",
+            reasonCode: "mutating_command",
+            reasons: ["Command executes a destructive, mutating, or publish operation"],
+            requiresApproval: true,
+        };
+    }
+    if (input.toolName &&
+        !["read_file", "search_web", "list_dir", "grep_search", "view_file", "memory"].includes(input.toolName)) {
+        return {
+            risk: "scoped-write",
+            reasonCode: "generic_mutation",
+            reasons: ["Generic mutating operation or command"],
+            requiresApproval: false,
+        };
+    }
+    return {
+        risk: "read-only",
+        reasonCode: "default_read_only",
+        reasons: ["No mutating or high-risk patterns detected"],
+        requiresApproval: false,
+    };
+}
+//# sourceMappingURL=risk-classifier.js.map

package/dist/core/risk-classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-classifier.js","sourceRoot":"","sources":["../../src/core/risk-classifier.ts"],"names":[],"mappings":"AAIA,MAAM,0BAA0B,GAC/B,mSAAmS,CAAC;AACrS,MAAM,qBAAqB,GAC1B,qNAAqN,CAAC;AACvN,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;AACpE,MAAM,gBAAgB,GAAG,4DAA4D,CAAC;AACtF,MAAM,cAAc,GAAG,oCAAoC,CAAC;AAC5D,MAAM,kBAAkB,GACvB,kIAAkI,CAAC;AACpI,MAAM,sBAAsB,GAAG,kFAAkF,CAAC;AAClH,MAAM,gBAAgB,GAAG,uCAAuC,CAAC;AACjE,MAAM,uBAAuB,GAAG,+CAA+C,CAAC;AAChF,MAAM,uBAAuB,GAC5B,6IAA6I,CAAC;AAC/I,MAAM,WAAW,GAAG,6BAA6B,CAAC;AAClD,MAAM,kBAAkB,GAAG,qDAAqD,CAAC;AACjF,MAAM,YAAY,GAAG,sFAAsF,CAAC;AAC5G,MAAM,kBAAkB,GACvB,uGAAuG,CAAC;AACzG,MAAM,iBAAiB,GAAG,mDAAmD,CAAC;AAC9E,MAAM,iBAAiB,GAAG,kFAAkF,CAAC;AAC7G,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AACtD,MAAM,qBAAqB,GAC1B,2LAA2L,CAAC;AAC7L,MAAM,cAAc,GAAG,MAAM,CAAC;AAQ9B,SAAS,gBAAgB,CAAC,IAAY,EAAW;IAChD,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAAA,CACjH;AAED,SAAS,cAAc,CAAC,IAAY,EAA0B;IAC7D,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,wDAAwD;SAChE,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,kDAAkD;SAC1D,CAAC;IACH,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,qDAAqD;SAC7D,CAAC;IACH,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,wDAAwD;SAChE,CAAC;IACH,CAAC;IACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,2DAA2D;SACnE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAU;IACnD,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAAA,CACzC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAc,EAAiB;IACvE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,cAAc;YAC1B,OAAO,EAAE,CAAC,4BAA4B,CAAC;SACvC,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACN,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,WAAW;gBACjB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,qBAAqB;gBACjC,OAAO,EAAE,CAAC,qFAAqF,CAAC;aAChG,CAAC;QACH,CAAC;QACD,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,oBAAoB;YAChC,OAAO,EAAE,CAAC,sEAAsE,CAAC;SACjF,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,UAAU,GAAuC;YACtD,OAAO,EAAE,oBAAoB;YAC7B,QAAQ,EAAE,kBAAkB;YAC5B,WAAW,EAAE,4BAA4B;YACzC,mBAAmB,EAAE,+BAA+B;YACpD,YAAY,EAAE,2BAA2B;SACzC,CAAC;QACF,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI;YAClE,UAAU,EAAE,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;YAC9F,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrC,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC1B,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,CAAC,qFAAqF,CAAC;SAChG,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,CAAC,4CAA4C,CAAC;SACvD,CAAC;IACH,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,oBAAoB;YAChC,OAAO,EAAE,CAAC,iDAAiD,CAAC;SAC5D,CAAC;IACH,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,uBAAuB;YACnC,OAAO,EAAE,CAAC,qEAAqE,CAAC;SAChF,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,mBAAmB;QAC/B,OAAO,EAAE,CAAC,uEAAuE,CAAC;KAClF,CAAC;AAAA,CACF;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAqB;IAC5E,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;AAAA,CACjF;AAED,MAAM,UAAU,mBAAmB,CAAC,KAA0B,EAAkB;IAC/E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,YAAY,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,iBAAiB;YAC7B,OAAO,EAAE,CAAC,iBAAiB,CAAC;YAC5B,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACvC,OAAO;YACN,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,0BAA0B;YACtC,OAAO,EAAE,CAAC,wFAAwF,CAAC;YACnG,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1F,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,CAAC,2DAA2D,CAAC;YACtE,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAC/C,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,UAAU,GAAuC;YACtD,OAAO,EAAE,2BAA2B;YACpC,QAAQ,EAAE,yBAAyB;YACnC,WAAW,EAAE,uBAAuB;YACpC,mBAAmB,EAAE,6BAA6B;YAClD,YAAY,EAAE,iCAAiC;SAC/C,CAAC;QACF,OAAO;YACN,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrC,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC1B,gBAAgB,EAAE,QAAQ,CAAC,IAAI,KAAK,mBAAmB;SACvD,CAAC;IACH,CAAC;IACD,IACC,OAAO;QACP,CAAC,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC;YACrC,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC;YACpC,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC;YACpC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;YACxC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;YACxC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAClC,CAAC;QACF,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,UAAU,EAAE,kBAAkB;YAC9B,OAAO,EAAE,CAAC,gEAAgE,CAAC;YAC3E,gBAAgB,EAAE,IAAI;SACtB,CAAC;IACH,CAAC;IACD,IACC,KAAK,CAAC,QAAQ;QACd,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EACtG,CAAC;QACF,OAAO;YACN,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,kBAAkB;YAC9B,OAAO,EAAE,CAAC,uCAAuC,CAAC;YAClD,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,mBAAmB;QAC/B,OAAO,EAAE,CAAC,4CAA4C,CAAC;QACvD,gBAAgB,EAAE,KAAK;KACvB,CAAC;AAAA,CACF","sourcesContent":["import type { OperationRisk, RiskAssessment, RiskAssessmentInput, RouteDecision } from \"./autonomy/contracts.ts\";\n\nexport type ModelRouterIntent = \"research\" | \"modify\";\n\nconst EXPLICIT_MODIFY_REQUEST_RE =\n\t/^(?:can you|could you|please|pls|go ahead and|let'?s|i need you to|we need to|you should)\\s+.*\\b(add|apply|build|change|commit|create|delete|edit|fix|generate|implement|install|modify|patch|remove|rename|replace|run|test|update|write|publish|release|push|deploy|tag|reset|clean|rewrite)\\b/i;\nconst READ_ONLY_QUESTION_RE =\n\t/^(?:(?:can you|could you|please|pls|go ahead and|let'?s|i need you to|we need to|you should)\\s+)?(?:how|what|why|when|where|which|who|explain|summarize|compare|describe|list|show|search|find|view|read|locate)\\b/i;\nconst RELEASE_PUBLISH_RE = /\\b(publish|release|push|deploy|tag)\\b/i;\nconst SECURITY_AUTH_RE = /\\b(auth|token|credential|credentials|secret|api[-_]key)\\b/i;\nconst DESTRUCTIVE_RE = /\\b(delete|reset|rm\\s+-rf|clean)\\b/i;\nconst SELF_MOD_MUTATE_RE =\n\t/\\b(modify|change|write|update|edit|delete|add|remove|set)\\s+.*\\b(skills|prompts|settings|tools|behavior)\\b|self[-_]modification/i;\nconst ARCHITECTURE_MUTATE_RE = /\\b(rewrite|redesign|change|modify|rearchitect)\\s+.*\\b(architecture|architect)\\b/i;\nconst PLANNING_CORE_RE = /\\b(plan|planning|roadmap|strategy)\\b/i;\nconst PLANNING_DESIGN_WORD_RE = /\\b(design|architect\\w*|structure|approach)\\b/i;\nconst PLANNING_PROSPECTIVE_RE =\n\t/\\b(how (?:should|would|do we|can we)|what(?:'s| is) the (?:best|cleanest|right)|propose|draft|come up with|figure out|decide (?:on|how))\\b/i;\nconst REFACTOR_RE = /\\b(refactor|refactoring)\\b/i;\nconst TEST_VALIDATION_RE = /\\b(test|testing|validation|lint|vitest|jest|run)\\b/i;\nconst IMPLEMENT_RE = /\\b(implement|fix|apply|change|update|create|write|generate|modify|edit|patch|add)\\b/i;\nconst DESTRUCTIVE_CMD_RE =\n\t/\\b(rm(\\s+-r|\\s+-f|\\s+-rf|\\s+-fr)?|mv|cp|chmod|chown|install)\\b|>\\s*\\/dev\\/(sda|hda|vda)|\\b(dd\\s+if=)/i;\nconst GIT_MUTATE_CMD_RE = /\\bgit\\s+(commit|push|reset|clean|stash|rebase)\\b/i;\nconst PKG_MUTATE_CMD_RE = /\\b(npm|pnpm|yarn|bun)\\s+(install|i|update|up|publish|run|remove|rm|uninstall)\\b/i;\nconst RELEASE_DEPLOY_CMD_RE = /\\b(release|deploy)\\b/i;\nconst PYTHON_HIGH_IMPACT_RE =\n\t/\\b(?:shutil\\.(?:rmtree|move|copy|copy2|copytree)|os\\.(?:remove|unlink|rmdir|removedirs|system)|subprocess\\.(?:run|call|check_call|check_output|Popen)|Path\\([^)]*\\)\\.(?:unlink|rmdir))\\b/i;\nconst REDIRECTION_RE = /[<>]/;\n\ninterface RiskSignal {\n\trisk: OperationRisk;\n\tkind: \"release\" | \"security\" | \"destructive\" | \"self-modification\" | \"architecture\";\n\treason: string;\n}\n\nfunction isPlanningPrompt(text: string): boolean {\n\treturn PLANNING_CORE_RE.test(text) || (PLANNING_DESIGN_WORD_RE.test(text) && PLANNING_PROSPECTIVE_RE.test(text));\n}\n\nfunction highRiskSignal(text: string): RiskSignal | undefined {\n\tif (RELEASE_PUBLISH_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"release\",\n\t\t\treason: \"Operation mentions releasing, publishing, or deploying\",\n\t\t};\n\t}\n\tif (SECURITY_AUTH_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"security\",\n\t\t\treason: \"Operation mentions authentication or credentials\",\n\t\t};\n\t}\n\tif (DESTRUCTIVE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"destructive\",\n\t\t\treason: \"Operation involves deleting, resetting, or cleaning\",\n\t\t};\n\t}\n\tif (SELF_MOD_MUTATE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"self-modification\",\n\t\t\treason: \"Operation modifies settings, tools, skills, or prompts\",\n\t\t};\n\t}\n\tif (ARCHITECTURE_MUTATE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"high-impact\",\n\t\t\tkind: \"architecture\",\n\t\t\treason: \"Operation mentions rewriting or rearchitecting core parts\",\n\t\t};\n\t}\n\treturn undefined;\n}\n\nfunction stripSingleQuotes(command: string): string {\n\treturn command.replace(/'[^']*'/g, \"''\");\n}\n\nexport function classifyModelRouterRoute(prompt: string): RouteDecision {\n\tconst text = prompt.trim();\n\tif (!text) {\n\t\treturn {\n\t\t\ttier: \"cheap\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.1,\n\t\t\treasonCode: \"empty_prompt\",\n\t\t\treasons: [\"Empty or whitespace prompt\"],\n\t\t};\n\t}\n\tif (READ_ONLY_QUESTION_RE.test(text) && !EXPLICIT_MODIFY_REQUEST_RE.test(text)) {\n\t\tif (isPlanningPrompt(text)) {\n\t\t\treturn {\n\t\t\t\ttier: \"medium\",\n\t\t\t\trisk: \"read-only\",\n\t\t\t\tconfidence: 0.75,\n\t\t\t\treasonCode: \"planning_min_medium\",\n\t\t\t\treasons: [\"Planning/design prompts never route cheap by default; a judge may deem them trivial\"],\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\ttier: \"cheap\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.9,\n\t\t\treasonCode: \"read_only_question\",\n\t\t\treasons: [\"Prompt asks a question or requests an explanation, search, or lookup\"],\n\t\t};\n\t}\n\tconst highRisk = highRiskSignal(text);\n\tif (highRisk) {\n\t\tconst reasonCode: Record<RiskSignal[\"kind\"], string> = {\n\t\t\trelease: \"release_or_publish\",\n\t\t\tsecurity: \"security_or_auth\",\n\t\t\tdestructive: \"destructive_or_git_history\",\n\t\t\t\"self-modification\": \"settings_or_self_modification\",\n\t\t\tarchitecture: \"architecture_or_ambiguous\",\n\t\t};\n\t\treturn {\n\t\t\ttier: \"expensive\",\n\t\t\trisk: highRisk.kind === \"security\" ? \"high-impact\" : highRisk.risk,\n\t\t\tconfidence: highRisk.kind === \"security\" ? 0.95 : highRisk.kind === \"destructive\" ? 0.85 : 0.9,\n\t\t\treasonCode: reasonCode[highRisk.kind],\n\t\t\treasons: [highRisk.reason],\n\t\t};\n\t}\n\tif (isPlanningPrompt(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.75,\n\t\t\treasonCode: \"planning_min_medium\",\n\t\t\treasons: [\"Planning/design prompts never route cheap by default; a judge may deem them trivial\"],\n\t\t};\n\t}\n\tif (REFACTOR_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.8,\n\t\t\treasonCode: \"mechanical_refactor\",\n\t\t\treasons: [\"Prompt mentions refactoring code structure\"],\n\t\t};\n\t}\n\tif (TEST_VALIDATION_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.8,\n\t\t\treasonCode: \"test_or_validation\",\n\t\t\treasons: [\"Prompt mentions testing, validation, or linting\"],\n\t\t};\n\t}\n\tif (IMPLEMENT_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.85,\n\t\t\treasonCode: \"normal_implementation\",\n\t\t\treasons: [\"Prompt mentions implementing, updating, creating, or modifying code\"],\n\t\t};\n\t}\n\treturn {\n\t\ttier: \"cheap\",\n\t\trisk: \"read-only\",\n\t\tconfidence: 0.5,\n\t\treasonCode: \"default_read_only\",\n\t\treasons: [\"No explicit implementation, destructive, or release patterns detected\"],\n\t};\n}\n\nexport function classifyModelRouterIntent(prompt: string): ModelRouterIntent {\n\treturn classifyModelRouterRoute(prompt).tier === \"cheap\" ? \"research\" : \"modify\";\n}\n\nexport function assessOperationRisk(input: RiskAssessmentInput): RiskAssessment {\n\tconst operation = input.operation.trim();\n\tconst command = input.command?.trim() ?? \"\";\n\tconst cleanCommand = stripSingleQuotes(command);\n\tconst fullText = `${operation} ${command}`.trim();\n\tconst cleanFullText = `${operation} ${cleanCommand}`.trim();\n\tif (!fullText) {\n\t\treturn {\n\t\t\trisk: \"read-only\",\n\t\t\treasonCode: \"empty_operation\",\n\t\t\treasons: [\"Empty operation\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tif (input.toolName === \"secret_store\") {\n\t\treturn {\n\t\t\trisk: \"scoped-write\",\n\t\t\treasonCode: \"native_owner_secret_flow\",\n\t\t\treasons: [\"Native secret-store mutations require model-blind owner input and in-tool confirmation\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tif (READ_ONLY_QUESTION_RE.test(operation) && !EXPLICIT_MODIFY_REQUEST_RE.test(operation)) {\n\t\treturn {\n\t\t\trisk: \"read-only\",\n\t\t\treasonCode: \"read_only_operation\",\n\t\t\treasons: [\"Operation is explicitly read-only (list/show/read/search)\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tconst highRisk = highRiskSignal(cleanFullText);\n\tif (highRisk) {\n\t\tconst reasonCode: Record<RiskSignal[\"kind\"], string> = {\n\t\t\trelease: \"release_publish_operation\",\n\t\t\tsecurity: \"security_auth_operation\",\n\t\t\tdestructive: \"destructive_operation\",\n\t\t\t\"self-modification\": \"self_modification_operation\",\n\t\t\tarchitecture: \"architecture_mutation_operation\",\n\t\t};\n\t\treturn {\n\t\t\trisk: highRisk.risk,\n\t\t\treasonCode: reasonCode[highRisk.kind],\n\t\t\treasons: [highRisk.reason],\n\t\t\trequiresApproval: highRisk.risk === \"approval-required\",\n\t\t};\n\t}\n\tif (\n\t\tcommand &&\n\t\t(DESTRUCTIVE_CMD_RE.test(cleanCommand) ||\n\t\t\tGIT_MUTATE_CMD_RE.test(cleanCommand) ||\n\t\t\tPKG_MUTATE_CMD_RE.test(cleanCommand) ||\n\t\t\tRELEASE_DEPLOY_CMD_RE.test(cleanCommand) ||\n\t\t\tPYTHON_HIGH_IMPACT_RE.test(cleanCommand) ||\n\t\t\tREDIRECTION_RE.test(cleanCommand))\n\t) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\treasonCode: \"mutating_command\",\n\t\t\treasons: [\"Command executes a destructive, mutating, or publish operation\"],\n\t\t\trequiresApproval: true,\n\t\t};\n\t}\n\tif (\n\t\tinput.toolName &&\n\t\t![\"read_file\", \"search_web\", \"list_dir\", \"grep_search\", \"view_file\", \"memory\"].includes(input.toolName)\n\t) {\n\t\treturn {\n\t\t\trisk: \"scoped-write\",\n\t\t\treasonCode: \"generic_mutation\",\n\t\t\treasons: [\"Generic mutating operation or command\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\treturn {\n\t\trisk: \"read-only\",\n\t\treasonCode: \"default_read_only\",\n\t\treasons: [\"No mutating or high-risk patterns detected\"],\n\t\trequiresApproval: false,\n\t};\n}\n"]}

package/dist/core/runtime-builder.d.ts

@@ -35,22 +35,27 @@
 import type { Agent, AgentContext, AgentMessage, AgentTool } from "@caupulican/pi-agent-core";
 import type { SessionManager } from "@caupulican/pi-agent-core/node";
 import type { Api, Model, Usage } from "@caupulican/pi-ai";
-import type { IsolatedCompletionOptions, IsolatedCompletionResult, WorkerDelegationRunOutcome } from "./agent-session.ts";
-import type { WorkerResult } from "./autonomy/contracts.ts";
+import type { IsolatedCompletionOptions, IsolatedCompletionResult, WorkerDelegationRunOutcome } from "./agent-session-contracts.ts";
+import type { WorkerClaim } from "./autonomy/contracts.ts";
 import type { LaneRecord } from "./autonomy/lane-tracker.ts";
 import type { ArtifactStore } from "./context/context-artifacts.ts";
 import type { MemoryPromptInclusionReport, MemoryRetrievalDiagnostics } from "./context/memory-diagnostics.ts";
 import type { ContextGcReport } from "./context-gc.ts";
+import type { WorkerDelegationRequest } from "./delegation/worker-delegation-request.ts";
+import type { ExtensionImportAuthority } from "./extension-import-authority.ts";
 import { type ContextUsage, type Extension, type ExtensionCommandContextActions, type ExtensionErrorListener, ExtensionRunner, type ExtensionUIContext, type ShutdownHandler, type ToolDefinition, type ToolInfo } from "./extensions/index.ts";
+import type { GoalStateRevision } from "./goals/goal-lifecycle.ts";
 import type { GoalState } from "./goals/goal-state.ts";
 import type { OpenTaskStepRef } from "./goals/goal-tool-core.ts";
 import type { MemoryManager } from "./memory/memory-manager.ts";
 import type { MemoryControllerReloadSnapshot } from "./memory-controller.ts";
 import type { LaneWorkerRefusal } from "./model-capability.ts";
 import type { ModelRegistry } from "./model-registry.ts";
+import type { OrchestrationProfile } from "./orchestration/contracts.ts";
 import type { ProfileFilterReloadSnapshot } from "./profile-filter-controller.ts";
 import type { ModelFitnessReport } from "./research/model-fitness.ts";
 import type { ResourceLoader } from "./resource-loader.ts";
+import type { SessionImageStore } from "./session-image-store.ts";
 import { type ResourceProfileFilterSettings, type SettingsManager } from "./settings-manager.ts";
 import type { TaskStepsState } from "./tasks/task-state.ts";
 /**
@@ -63,11 +68,8 @@ import type { TaskStepsState } from "./tasks/task-state.ts";
  */
 export declare function hasAnsweredToolCallOnBranch(sessionManager: SessionManager, toolCallId: string): boolean;
 /**
- * Project a task-steps snapshot down to the OPEN (non-terminal) steps the goal tool's
- * cross-visibility nudge needs. Mirrors `goal-runtime-snapshot.ts`'s `openTaskSteps` filter
- * (status not "completed"/"cancelled", `activeForm || content`) so the two read the same
- * "open" definition, narrowed to `OpenTaskStepRef`'s id+content shape. Exported (pure, no
- * `this`) so the goal tool's `getOpenTaskSteps` wiring below is directly testable.
+ * Goal-tool adapter over the canonical open-task projection. Exported (pure, no `this`) so the
+ * production `getOpenTaskSteps` wiring below remains directly testable without another filter.
  */
 export declare function deriveOpenTaskStepRefs(taskStepsState: TaskStepsState | undefined): OpenTaskStepRef[];
 export interface RuntimeBuilderDeps {
@@ -107,13 +109,17 @@ export interface RuntimeBuilderDeps {
     getToolProfileFilter(): Required<ResourceProfileFilterSettings> | undefined;
     setToolProfileFilter(filter: Required<ResourceProfileFilterSettings> | undefined): void;
     getAllowedToolNames(): Set<string> | undefined;
+    /** Immutable active orchestration profile; absent sessions never construct run_process. */
+    getOrchestrationProfile?(): OrchestrationProfile | undefined;
     getExcludedToolNames(): Set<string> | undefined;
     /** Re-derive the profile tool filter from freshly reloaded settings (reload only). */
     deriveToolProfileFilter(): Required<ResourceProfileFilterSettings>;
     /** True when a tool/command name survives the active profile's allow/block + user allow/exclude. */
     isToolOrCommandAllowedByProfile(name: string): boolean;
+    /** Import-boundary decision for an exact owner load or an automatic profile-driven load. */
+    isExtensionPathAllowed(path: string, authority: ExtensionImportAuthority, baseDir?: string): boolean;
     /** Filter the loaded extensions through the active resource profile (records inert/denied warnings host-side). */
-    filterExtensionsForRuntime(extensions: Extension[]): Extension[];
+    filterExtensionsForRuntime(extensions: Extension[], explicitLiveExtensionPaths?: ReadonlySet<string>): Extension[];
     /** Sink for the unbound-profile-tool-grant warnings surfaced in /context. */
     setUnboundToolGrantWarnings(warnings: string[]): void;
     getUnboundToolGrantWarnings(): string[];
@@ -138,6 +144,8 @@ export interface RuntimeBuilderDeps {
     notifyExtensionsChanged(): void;
     /** Session-scoped tool-output artifact store for artifact-producing tools and artifact_retrieve (gated on the profile). */
     getToolArtifactStore(): ArtifactStore;
+    /** Lazily resolve durable image storage only for a persisted/configured session. */
+    getSessionImageStore(): Pick<SessionImageStore, "retainContent"> | undefined;
     /** Live memory manager — its provider tools join the registry. */
     getMemoryManager(): MemoryManager;
     /** Memory retrieval + prompt-inclusion diagnostics for the core diagnostics tool. */
@@ -153,36 +161,32 @@ export interface RuntimeBuilderDeps {
     initializeMemory(): Promise<void>;
     /** Goal-tool state accessors. */
     getGoalStateSnapshot(): GoalState | undefined;
-    saveGoalStateSnapshot(state: GoalState): string;
+    saveGoalStateSnapshot(state: GoalState, expected?: GoalStateRevision): string;
     /** Native task-step state accessors. */
     getTaskStepsStateSnapshot(): TaskStepsState | undefined;
     saveTaskStepsStateSnapshot(state: TaskStepsState): string;
     /** Context-gc report for the core diagnostics tool. */
     getContextGcReport(messages: AgentMessage[]): ContextGcReport;
     /** Non-blocking worker-delegation starter for the delegate tool. */
-    startWorkerDelegation(request: {
-        instructions: string;
-        systemPrompt?: string;
-        memoryRead?: boolean;
-    }): {
+    startWorkerDelegation(request: WorkerDelegationRequest): {
         started: false;
         skipReason: string;
     } | {
         started: true;
         record: LaneRecord;
     };
+    getOrchestrationProfileCatalog(): Array<{
+        profileId: string;
+        role: string;
+        description: string;
+    }>;
     getWorkerLaneRecords(): LaneRecord[];
-    getWorkerResultSnapshots(): WorkerResult[];
-    /** Resolve a managed (e.g. tmux) lane dispatch's internal LaneTracker id from the extension's own
-     * caller-chosen laneId (`BackgroundLaneController.resolveManagedLaneId`) -- the goal->tmux dispatch
-     * adapter's correlation read (see `tools/tmux-dispatch.ts`). */
+    getWorkerClaimSnapshots(): WorkerClaim[];
+    /** Confirm a managed dispatch's caller-stable canonical lane id was registered durably before the
+     * goal binds it (`BackgroundLaneController.resolveManagedLaneId`). */
     resolveManagedLaneId(callerLaneId: string): string | undefined;
     /** Worker-delegation runner for SDK/test through-completion calls. */
-    runWorkerDelegationOnce(request: {
-        instructions: string;
-        systemPrompt?: string;
-        memoryRead?: boolean;
-    }): Promise<WorkerDelegationRunOutcome>;
+    runWorkerDelegationOnce(request: WorkerDelegationRequest): Promise<WorkerDelegationRunOutcome>;
     /** Model-fitness probe for the model_fitness tool. `toolCallId` is the idempotency token
      * for spawned-usage reportId — present only for the LLM tool-call path (see model-fitness.ts). */
     runModelFitness(args: {
@@ -246,10 +250,19 @@ export declare class RuntimeBuilder {
     private _toolPromptSnippets;
     private _toolPromptGuidelines;
     private _baseToolDefinitions;
+    /** Exact extensions the owner approved through the live-load API. Discovery never populates this set. */
+    private readonly _explicitLiveExtensionPaths;
     private _reloadPromise;
     private _reloadRequested;
+    private readonly _secretVault;
     private readonly deps;
     constructor(deps: RuntimeBuilderDeps);
+    /**
+     * Resolve the construction and activation policy once for a runtime generation. This is the
+     * UAC choke point: callers must consult it before invoking a tool factory, not merely before
+     * placing an already-created definition in the live registry.
+     */
+    private _createToolAccessPolicy;
     private _runContextScout;
     /** Whether a tool name is present in the live wrapped registry. */
     hasTool(name: string): boolean;
@@ -296,6 +309,7 @@ export declare class RuntimeBuilder {
      * Falls back to full reload on error.
      */
     unloadExtensionLive(extensionPath: string): Promise<void>;
+    private _unloadExtensionLive;
     /**
      * Load a single extension without full reload.
      * Loads the extension with fresh import, rebuilds the runtime,
@@ -303,6 +317,10 @@ export declare class RuntimeBuilder {
      * Falls back to full reload on error.
      */
     loadExtensionLive(extensionPath: string): Promise<void>;
+    private _loadExtensionLive;
+    private _importExtension;
+    private _assertExtensionLoadAllowed;
+    private _recoverLiveExtensionFailure;
     /**
      * Reconcile loaded extensions with the active profile.
      * Loads extensions that should be enabled but aren't, and unloads extensions that shouldn't be.