@caupulican/pi-adaptative 0.81.40 → 0.81.41

package/dist/core/risk-classifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"risk-classifier.d.ts","sourceRoot":"","sources":["../../src/core/risk-classifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiB,cAAc,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAEjH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,QAAQ,CAAC;AAiFtD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAyFtE;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAE3E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAuE9E","sourcesContent":["import type { OperationRisk, RiskAssessment, RiskAssessmentInput, RouteDecision } from \"./autonomy/contracts.ts\";\n\nexport type ModelRouterIntent = \"research\" | \"modify\";\n\nconst EXPLICIT_MODIFY_REQUEST_RE =\n\t/^(?:can you|could you|please|pls|go ahead and|let'?s|i need you to|we need to|you should)\\s+.*\\b(add|apply|build|change|commit|create|delete|edit|fix|generate|implement|install|modify|patch|remove|rename|replace|run|test|update|write|publish|release|push|deploy|tag|reset|clean|rewrite)\\b/i;\nconst READ_ONLY_QUESTION_RE =\n\t/^(?:(?:can you|could you|please|pls|go ahead and|let'?s|i need you to|we need to|you should)\\s+)?(?:how|what|why|when|where|which|who|explain|summarize|compare|describe|list|show|search|find|view|read|locate)\\b/i;\nconst RELEASE_PUBLISH_RE = /\\b(publish|release|push|deploy|tag)\\b/i;\nconst SECURITY_AUTH_RE = /\\b(auth|token|credential|credentials|secret|api[-_]key)\\b/i;\nconst DESTRUCTIVE_RE = /\\b(delete|reset|rm\\s+-rf|clean)\\b/i;\nconst SELF_MOD_MUTATE_RE =\n\t/\\b(modify|change|write|update|edit|delete|add|remove|set)\\s+.*\\b(skills|prompts|settings|tools|behavior)\\b|self[-_]modification/i;\nconst ARCHITECTURE_MUTATE_RE = /\\b(rewrite|redesign|change|modify|rearchitect)\\s+.*\\b(architecture|architect)\\b/i;\nconst PLANNING_CORE_RE = /\\b(plan|planning|roadmap|strategy)\\b/i;\nconst PLANNING_DESIGN_WORD_RE = /\\b(design|architect\\w*|structure|approach)\\b/i;\nconst PLANNING_PROSPECTIVE_RE =\n\t/\\b(how (?:should|would|do we|can we)|what(?:'s| is) the (?:best|cleanest|right)|propose|draft|come up with|figure out|decide (?:on|how))\\b/i;\nconst REFACTOR_RE = /\\b(refactor|refactoring)\\b/i;\nconst TEST_VALIDATION_RE = /\\b(test|testing|validation|lint|vitest|jest|run)\\b/i;\nconst IMPLEMENT_RE = /\\b(implement|fix|apply|change|update|create|write|generate|modify|edit|patch|add)\\b/i;\nconst DESTRUCTIVE_CMD_RE =\n\t/\\b(rm(\\s+-r|\\s+-f|\\s+-rf|\\s+-fr)?|mv|cp|chmod|chown|install)\\b|>\\s*\\/dev\\/(sda|hda|vda)|\\b(dd\\s+if=)/i;\nconst GIT_MUTATE_CMD_RE = /\\bgit\\s+(commit|push|reset|clean|stash|rebase)\\b/i;\nconst PKG_MUTATE_CMD_RE = /\\b(npm|pnpm|yarn|bun)\\s+(install|i|update|up|publish|run|remove|rm|uninstall)\\b/i;\nconst RELEASE_DEPLOY_CMD_RE = /\\b(release|deploy)\\b/i;\nconst PYTHON_HIGH_IMPACT_RE =\n\t/\\b(?:shutil\\.(?:rmtree|move|copy|copy2|copytree)|os\\.(?:remove|unlink|rmdir|removedirs|system)|subprocess\\.(?:run|call|check_call|check_output|Popen)|Path\\([^)]*\\)\\.(?:unlink|rmdir))\\b/i;\nconst REDIRECTION_RE = /[<>]/;\n\ninterface RiskSignal {\n\trisk: OperationRisk;\n\tkind: \"release\" | \"security\" | \"destructive\" | \"self-modification\" | \"architecture\";\n\treason: string;\n}\n\nfunction isPlanningPrompt(text: string): boolean {\n\treturn PLANNING_CORE_RE.test(text) || (PLANNING_DESIGN_WORD_RE.test(text) && PLANNING_PROSPECTIVE_RE.test(text));\n}\n\nfunction highRiskSignal(text: string): RiskSignal | undefined {\n\tif (RELEASE_PUBLISH_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"release\",\n\t\t\treason: \"Operation mentions releasing, publishing, or deploying\",\n\t\t};\n\t}\n\tif (SECURITY_AUTH_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"security\",\n\t\t\treason: \"Operation mentions authentication or credentials\",\n\t\t};\n\t}\n\tif (DESTRUCTIVE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"destructive\",\n\t\t\treason: \"Operation involves deleting, resetting, or cleaning\",\n\t\t};\n\t}\n\tif (SELF_MOD_MUTATE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"self-modification\",\n\t\t\treason: \"Operation modifies settings, tools, skills, or prompts\",\n\t\t};\n\t}\n\tif (ARCHITECTURE_MUTATE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"high-impact\",\n\t\t\tkind: \"architecture\",\n\t\t\treason: \"Operation mentions rewriting or rearchitecting core parts\",\n\t\t};\n\t}\n\treturn undefined;\n}\n\nfunction stripSingleQuotes(command: string): string {\n\treturn command.replace(/'[^']*'/g, \"''\");\n}\n\nexport function classifyModelRouterRoute(prompt: string): RouteDecision {\n\tconst text = prompt.trim();\n\tif (!text) {\n\t\treturn {\n\t\t\ttier: \"cheap\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.1,\n\t\t\treasonCode: \"empty_prompt\",\n\t\t\treasons: [\"Empty or whitespace prompt\"],\n\t\t};\n\t}\n\tif (READ_ONLY_QUESTION_RE.test(text) && !EXPLICIT_MODIFY_REQUEST_RE.test(text)) {\n\t\tif (isPlanningPrompt(text)) {\n\t\t\treturn {\n\t\t\t\ttier: \"medium\",\n\t\t\t\trisk: \"read-only\",\n\t\t\t\tconfidence: 0.75,\n\t\t\t\treasonCode: \"planning_min_medium\",\n\t\t\t\treasons: [\"Planning/design prompts never route cheap by default; a judge may deem them trivial\"],\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\ttier: \"cheap\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.9,\n\t\t\treasonCode: \"read_only_question\",\n\t\t\treasons: [\"Prompt asks a question or requests an explanation, search, or lookup\"],\n\t\t};\n\t}\n\tconst highRisk = highRiskSignal(text);\n\tif (highRisk) {\n\t\tconst reasonCode: Record<RiskSignal[\"kind\"], string> = {\n\t\t\trelease: \"release_or_publish\",\n\t\t\tsecurity: \"security_or_auth\",\n\t\t\tdestructive: \"destructive_or_git_history\",\n\t\t\t\"self-modification\": \"settings_or_self_modification\",\n\t\t\tarchitecture: \"architecture_or_ambiguous\",\n\t\t};\n\t\treturn {\n\t\t\ttier: \"expensive\",\n\t\t\trisk: highRisk.kind === \"security\" ? \"high-impact\" : highRisk.risk,\n\t\t\tconfidence: highRisk.kind === \"security\" ? 0.95 : highRisk.kind === \"destructive\" ? 0.85 : 0.9,\n\t\t\treasonCode: reasonCode[highRisk.kind],\n\t\t\treasons: [highRisk.reason],\n\t\t};\n\t}\n\tif (isPlanningPrompt(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.75,\n\t\t\treasonCode: \"planning_min_medium\",\n\t\t\treasons: [\"Planning/design prompts never route cheap by default; a judge may deem them trivial\"],\n\t\t};\n\t}\n\tif (REFACTOR_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.8,\n\t\t\treasonCode: \"mechanical_refactor\",\n\t\t\treasons: [\"Prompt mentions refactoring code structure\"],\n\t\t};\n\t}\n\tif (TEST_VALIDATION_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.8,\n\t\t\treasonCode: \"test_or_validation\",\n\t\t\treasons: [\"Prompt mentions testing, validation, or linting\"],\n\t\t};\n\t}\n\tif (IMPLEMENT_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.85,\n\t\t\treasonCode: \"normal_implementation\",\n\t\t\treasons: [\"Prompt mentions implementing, updating, creating, or modifying code\"],\n\t\t};\n\t}\n\treturn {\n\t\ttier: \"cheap\",\n\t\trisk: \"read-only\",\n\t\tconfidence: 0.5,\n\t\treasonCode: \"default_read_only\",\n\t\treasons: [\"No explicit implementation, destructive, or release patterns detected\"],\n\t};\n}\n\nexport function classifyModelRouterIntent(prompt: string): ModelRouterIntent {\n\treturn classifyModelRouterRoute(prompt).tier === \"cheap\" ? \"research\" : \"modify\";\n}\n\nexport function assessOperationRisk(input: RiskAssessmentInput): RiskAssessment {\n\tconst operation = input.operation.trim();\n\tconst command = input.command?.trim() ?? \"\";\n\tconst cleanCommand = stripSingleQuotes(command);\n\tconst fullText = `${operation} ${command}`.trim();\n\tconst cleanFullText = `${operation} ${cleanCommand}`.trim();\n\tif (!fullText) {\n\t\treturn {\n\t\t\trisk: \"read-only\",\n\t\t\treasonCode: \"empty_operation\",\n\t\t\treasons: [\"Empty operation\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tif (READ_ONLY_QUESTION_RE.test(operation) && !EXPLICIT_MODIFY_REQUEST_RE.test(operation)) {\n\t\treturn {\n\t\t\trisk: \"read-only\",\n\t\t\treasonCode: \"read_only_operation\",\n\t\t\treasons: [\"Operation is explicitly read-only (list/show/read/search)\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tconst highRisk = highRiskSignal(cleanFullText);\n\tif (highRisk) {\n\t\tconst reasonCode: Record<RiskSignal[\"kind\"], string> = {\n\t\t\trelease: \"release_publish_operation\",\n\t\t\tsecurity: \"security_auth_operation\",\n\t\t\tdestructive: \"destructive_operation\",\n\t\t\t\"self-modification\": \"self_modification_operation\",\n\t\t\tarchitecture: \"architecture_mutation_operation\",\n\t\t};\n\t\treturn {\n\t\t\trisk: highRisk.risk,\n\t\t\treasonCode: reasonCode[highRisk.kind],\n\t\t\treasons: [highRisk.reason],\n\t\t\trequiresApproval: highRisk.risk === \"approval-required\",\n\t\t};\n\t}\n\tif (\n\t\tcommand &&\n\t\t(DESTRUCTIVE_CMD_RE.test(cleanCommand) ||\n\t\t\tGIT_MUTATE_CMD_RE.test(cleanCommand) ||\n\t\t\tPKG_MUTATE_CMD_RE.test(cleanCommand) ||\n\t\t\tRELEASE_DEPLOY_CMD_RE.test(cleanCommand) ||\n\t\t\tPYTHON_HIGH_IMPACT_RE.test(cleanCommand) ||\n\t\t\tREDIRECTION_RE.test(cleanCommand))\n\t) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\treasonCode: \"mutating_command\",\n\t\t\treasons: [\"Command executes a destructive, mutating, or publish operation\"],\n\t\t\trequiresApproval: true,\n\t\t};\n\t}\n\tif (\n\t\tinput.toolName &&\n\t\t![\"read_file\", \"search_web\", \"list_dir\", \"grep_search\", \"view_file\", \"memory\"].includes(input.toolName)\n\t) {\n\t\treturn {\n\t\t\trisk: \"scoped-write\",\n\t\t\treasonCode: \"generic_mutation\",\n\t\t\treasons: [\"Generic mutating operation or command\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\treturn {\n\t\trisk: \"read-only\",\n\t\treasonCode: \"default_read_only\",\n\t\treasons: [\"No mutating or high-risk patterns detected\"],\n\t\trequiresApproval: false,\n\t};\n}\n"]}
+{"version":3,"file":"risk-classifier.d.ts","sourceRoot":"","sources":["../../src/core/risk-classifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiB,cAAc,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAEjH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,QAAQ,CAAC;AAiFtD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAyFtE;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAE3E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CA+E9E","sourcesContent":["import type { OperationRisk, RiskAssessment, RiskAssessmentInput, RouteDecision } from \"./autonomy/contracts.ts\";\n\nexport type ModelRouterIntent = \"research\" | \"modify\";\n\nconst EXPLICIT_MODIFY_REQUEST_RE =\n\t/^(?:can you|could you|please|pls|go ahead and|let'?s|i need you to|we need to|you should)\\s+.*\\b(add|apply|build|change|commit|create|delete|edit|fix|generate|implement|install|modify|patch|remove|rename|replace|run|test|update|write|publish|release|push|deploy|tag|reset|clean|rewrite)\\b/i;\nconst READ_ONLY_QUESTION_RE =\n\t/^(?:(?:can you|could you|please|pls|go ahead and|let'?s|i need you to|we need to|you should)\\s+)?(?:how|what|why|when|where|which|who|explain|summarize|compare|describe|list|show|search|find|view|read|locate)\\b/i;\nconst RELEASE_PUBLISH_RE = /\\b(publish|release|push|deploy|tag)\\b/i;\nconst SECURITY_AUTH_RE = /\\b(auth|token|credential|credentials|secret|api[-_]key)\\b/i;\nconst DESTRUCTIVE_RE = /\\b(delete|reset|rm\\s+-rf|clean)\\b/i;\nconst SELF_MOD_MUTATE_RE =\n\t/\\b(modify|change|write|update|edit|delete|add|remove|set)\\s+.*\\b(skills|prompts|settings|tools|behavior)\\b|self[-_]modification/i;\nconst ARCHITECTURE_MUTATE_RE = /\\b(rewrite|redesign|change|modify|rearchitect)\\s+.*\\b(architecture|architect)\\b/i;\nconst PLANNING_CORE_RE = /\\b(plan|planning|roadmap|strategy)\\b/i;\nconst PLANNING_DESIGN_WORD_RE = /\\b(design|architect\\w*|structure|approach)\\b/i;\nconst PLANNING_PROSPECTIVE_RE =\n\t/\\b(how (?:should|would|do we|can we)|what(?:'s| is) the (?:best|cleanest|right)|propose|draft|come up with|figure out|decide (?:on|how))\\b/i;\nconst REFACTOR_RE = /\\b(refactor|refactoring)\\b/i;\nconst TEST_VALIDATION_RE = /\\b(test|testing|validation|lint|vitest|jest|run)\\b/i;\nconst IMPLEMENT_RE = /\\b(implement|fix|apply|change|update|create|write|generate|modify|edit|patch|add)\\b/i;\nconst DESTRUCTIVE_CMD_RE =\n\t/\\b(rm(\\s+-r|\\s+-f|\\s+-rf|\\s+-fr)?|mv|cp|chmod|chown|install)\\b|>\\s*\\/dev\\/(sda|hda|vda)|\\b(dd\\s+if=)/i;\nconst GIT_MUTATE_CMD_RE = /\\bgit\\s+(commit|push|reset|clean|stash|rebase)\\b/i;\nconst PKG_MUTATE_CMD_RE = /\\b(npm|pnpm|yarn|bun)\\s+(install|i|update|up|publish|run|remove|rm|uninstall)\\b/i;\nconst RELEASE_DEPLOY_CMD_RE = /\\b(release|deploy)\\b/i;\nconst PYTHON_HIGH_IMPACT_RE =\n\t/\\b(?:shutil\\.(?:rmtree|move|copy|copy2|copytree)|os\\.(?:remove|unlink|rmdir|removedirs|system)|subprocess\\.(?:run|call|check_call|check_output|Popen)|Path\\([^)]*\\)\\.(?:unlink|rmdir))\\b/i;\nconst REDIRECTION_RE = /[<>]/;\n\ninterface RiskSignal {\n\trisk: OperationRisk;\n\tkind: \"release\" | \"security\" | \"destructive\" | \"self-modification\" | \"architecture\";\n\treason: string;\n}\n\nfunction isPlanningPrompt(text: string): boolean {\n\treturn PLANNING_CORE_RE.test(text) || (PLANNING_DESIGN_WORD_RE.test(text) && PLANNING_PROSPECTIVE_RE.test(text));\n}\n\nfunction highRiskSignal(text: string): RiskSignal | undefined {\n\tif (RELEASE_PUBLISH_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"release\",\n\t\t\treason: \"Operation mentions releasing, publishing, or deploying\",\n\t\t};\n\t}\n\tif (SECURITY_AUTH_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"security\",\n\t\t\treason: \"Operation mentions authentication or credentials\",\n\t\t};\n\t}\n\tif (DESTRUCTIVE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"destructive\",\n\t\t\treason: \"Operation involves deleting, resetting, or cleaning\",\n\t\t};\n\t}\n\tif (SELF_MOD_MUTATE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"self-modification\",\n\t\t\treason: \"Operation modifies settings, tools, skills, or prompts\",\n\t\t};\n\t}\n\tif (ARCHITECTURE_MUTATE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"high-impact\",\n\t\t\tkind: \"architecture\",\n\t\t\treason: \"Operation mentions rewriting or rearchitecting core parts\",\n\t\t};\n\t}\n\treturn undefined;\n}\n\nfunction stripSingleQuotes(command: string): string {\n\treturn command.replace(/'[^']*'/g, \"''\");\n}\n\nexport function classifyModelRouterRoute(prompt: string): RouteDecision {\n\tconst text = prompt.trim();\n\tif (!text) {\n\t\treturn {\n\t\t\ttier: \"cheap\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.1,\n\t\t\treasonCode: \"empty_prompt\",\n\t\t\treasons: [\"Empty or whitespace prompt\"],\n\t\t};\n\t}\n\tif (READ_ONLY_QUESTION_RE.test(text) && !EXPLICIT_MODIFY_REQUEST_RE.test(text)) {\n\t\tif (isPlanningPrompt(text)) {\n\t\t\treturn {\n\t\t\t\ttier: \"medium\",\n\t\t\t\trisk: \"read-only\",\n\t\t\t\tconfidence: 0.75,\n\t\t\t\treasonCode: \"planning_min_medium\",\n\t\t\t\treasons: [\"Planning/design prompts never route cheap by default; a judge may deem them trivial\"],\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\ttier: \"cheap\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.9,\n\t\t\treasonCode: \"read_only_question\",\n\t\t\treasons: [\"Prompt asks a question or requests an explanation, search, or lookup\"],\n\t\t};\n\t}\n\tconst highRisk = highRiskSignal(text);\n\tif (highRisk) {\n\t\tconst reasonCode: Record<RiskSignal[\"kind\"], string> = {\n\t\t\trelease: \"release_or_publish\",\n\t\t\tsecurity: \"security_or_auth\",\n\t\t\tdestructive: \"destructive_or_git_history\",\n\t\t\t\"self-modification\": \"settings_or_self_modification\",\n\t\t\tarchitecture: \"architecture_or_ambiguous\",\n\t\t};\n\t\treturn {\n\t\t\ttier: \"expensive\",\n\t\t\trisk: highRisk.kind === \"security\" ? \"high-impact\" : highRisk.risk,\n\t\t\tconfidence: highRisk.kind === \"security\" ? 0.95 : highRisk.kind === \"destructive\" ? 0.85 : 0.9,\n\t\t\treasonCode: reasonCode[highRisk.kind],\n\t\t\treasons: [highRisk.reason],\n\t\t};\n\t}\n\tif (isPlanningPrompt(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.75,\n\t\t\treasonCode: \"planning_min_medium\",\n\t\t\treasons: [\"Planning/design prompts never route cheap by default; a judge may deem them trivial\"],\n\t\t};\n\t}\n\tif (REFACTOR_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.8,\n\t\t\treasonCode: \"mechanical_refactor\",\n\t\t\treasons: [\"Prompt mentions refactoring code structure\"],\n\t\t};\n\t}\n\tif (TEST_VALIDATION_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.8,\n\t\t\treasonCode: \"test_or_validation\",\n\t\t\treasons: [\"Prompt mentions testing, validation, or linting\"],\n\t\t};\n\t}\n\tif (IMPLEMENT_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.85,\n\t\t\treasonCode: \"normal_implementation\",\n\t\t\treasons: [\"Prompt mentions implementing, updating, creating, or modifying code\"],\n\t\t};\n\t}\n\treturn {\n\t\ttier: \"cheap\",\n\t\trisk: \"read-only\",\n\t\tconfidence: 0.5,\n\t\treasonCode: \"default_read_only\",\n\t\treasons: [\"No explicit implementation, destructive, or release patterns detected\"],\n\t};\n}\n\nexport function classifyModelRouterIntent(prompt: string): ModelRouterIntent {\n\treturn classifyModelRouterRoute(prompt).tier === \"cheap\" ? \"research\" : \"modify\";\n}\n\nexport function assessOperationRisk(input: RiskAssessmentInput): RiskAssessment {\n\tconst operation = input.operation.trim();\n\tconst command = input.command?.trim() ?? \"\";\n\tconst cleanCommand = stripSingleQuotes(command);\n\tconst fullText = `${operation} ${command}`.trim();\n\tconst cleanFullText = `${operation} ${cleanCommand}`.trim();\n\tif (!fullText) {\n\t\treturn {\n\t\t\trisk: \"read-only\",\n\t\t\treasonCode: \"empty_operation\",\n\t\t\treasons: [\"Empty operation\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tif (input.toolName === \"secret_store\") {\n\t\treturn {\n\t\t\trisk: \"scoped-write\",\n\t\t\treasonCode: \"native_owner_secret_flow\",\n\t\t\treasons: [\"Native secret-store mutations require model-blind owner input and in-tool confirmation\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tif (READ_ONLY_QUESTION_RE.test(operation) && !EXPLICIT_MODIFY_REQUEST_RE.test(operation)) {\n\t\treturn {\n\t\t\trisk: \"read-only\",\n\t\t\treasonCode: \"read_only_operation\",\n\t\t\treasons: [\"Operation is explicitly read-only (list/show/read/search)\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tconst highRisk = highRiskSignal(cleanFullText);\n\tif (highRisk) {\n\t\tconst reasonCode: Record<RiskSignal[\"kind\"], string> = {\n\t\t\trelease: \"release_publish_operation\",\n\t\t\tsecurity: \"security_auth_operation\",\n\t\t\tdestructive: \"destructive_operation\",\n\t\t\t\"self-modification\": \"self_modification_operation\",\n\t\t\tarchitecture: \"architecture_mutation_operation\",\n\t\t};\n\t\treturn {\n\t\t\trisk: highRisk.risk,\n\t\t\treasonCode: reasonCode[highRisk.kind],\n\t\t\treasons: [highRisk.reason],\n\t\t\trequiresApproval: highRisk.risk === \"approval-required\",\n\t\t};\n\t}\n\tif (\n\t\tcommand &&\n\t\t(DESTRUCTIVE_CMD_RE.test(cleanCommand) ||\n\t\t\tGIT_MUTATE_CMD_RE.test(cleanCommand) ||\n\t\t\tPKG_MUTATE_CMD_RE.test(cleanCommand) ||\n\t\t\tRELEASE_DEPLOY_CMD_RE.test(cleanCommand) ||\n\t\t\tPYTHON_HIGH_IMPACT_RE.test(cleanCommand) ||\n\t\t\tREDIRECTION_RE.test(cleanCommand))\n\t) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\treasonCode: \"mutating_command\",\n\t\t\treasons: [\"Command executes a destructive, mutating, or publish operation\"],\n\t\t\trequiresApproval: true,\n\t\t};\n\t}\n\tif (\n\t\tinput.toolName &&\n\t\t![\"read_file\", \"search_web\", \"list_dir\", \"grep_search\", \"view_file\", \"memory\"].includes(input.toolName)\n\t) {\n\t\treturn {\n\t\t\trisk: \"scoped-write\",\n\t\t\treasonCode: \"generic_mutation\",\n\t\t\treasons: [\"Generic mutating operation or command\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\treturn {\n\t\trisk: \"read-only\",\n\t\treasonCode: \"default_read_only\",\n\t\treasons: [\"No mutating or high-risk patterns detected\"],\n\t\trequiresApproval: false,\n\t};\n}\n"]}

package/dist/core/risk-classifier.js

@@ -168,6 +168,14 @@ export function assessOperationRisk(input) {
             requiresApproval: false,
         };
     }
+    if (input.toolName === "secret_store") {
+        return {
+            risk: "scoped-write",
+            reasonCode: "native_owner_secret_flow",
+            reasons: ["Native secret-store mutations require model-blind owner input and in-tool confirmation"],
+            requiresApproval: false,
+        };
+    }
     if (READ_ONLY_QUESTION_RE.test(operation) && !EXPLICIT_MODIFY_REQUEST_RE.test(operation)) {
         return {
             risk: "read-only",

package/dist/core/risk-classifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"risk-classifier.js","sourceRoot":"","sources":["../../src/core/risk-classifier.ts"],"names":[],"mappings":"AAIA,MAAM,0BAA0B,GAC/B,mSAAmS,CAAC;AACrS,MAAM,qBAAqB,GAC1B,qNAAqN,CAAC;AACvN,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;AACpE,MAAM,gBAAgB,GAAG,4DAA4D,CAAC;AACtF,MAAM,cAAc,GAAG,oCAAoC,CAAC;AAC5D,MAAM,kBAAkB,GACvB,kIAAkI,CAAC;AACpI,MAAM,sBAAsB,GAAG,kFAAkF,CAAC;AAClH,MAAM,gBAAgB,GAAG,uCAAuC,CAAC;AACjE,MAAM,uBAAuB,GAAG,+CAA+C,CAAC;AAChF,MAAM,uBAAuB,GAC5B,6IAA6I,CAAC;AAC/I,MAAM,WAAW,GAAG,6BAA6B,CAAC;AAClD,MAAM,kBAAkB,GAAG,qDAAqD,CAAC;AACjF,MAAM,YAAY,GAAG,sFAAsF,CAAC;AAC5G,MAAM,kBAAkB,GACvB,uGAAuG,CAAC;AACzG,MAAM,iBAAiB,GAAG,mDAAmD,CAAC;AAC9E,MAAM,iBAAiB,GAAG,kFAAkF,CAAC;AAC7G,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AACtD,MAAM,qBAAqB,GAC1B,2LAA2L,CAAC;AAC7L,MAAM,cAAc,GAAG,MAAM,CAAC;AAQ9B,SAAS,gBAAgB,CAAC,IAAY,EAAW;IAChD,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAAA,CACjH;AAED,SAAS,cAAc,CAAC,IAAY,EAA0B;IAC7D,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,wDAAwD;SAChE,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,kDAAkD;SAC1D,CAAC;IACH,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,qDAAqD;SAC7D,CAAC;IACH,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,wDAAwD;SAChE,CAAC;IACH,CAAC;IACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,2DAA2D;SACnE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAU;IACnD,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAAA,CACzC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAc,EAAiB;IACvE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,cAAc;YAC1B,OAAO,EAAE,CAAC,4BAA4B,CAAC;SACvC,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACN,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,WAAW;gBACjB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,qBAAqB;gBACjC,OAAO,EAAE,CAAC,qFAAqF,CAAC;aAChG,CAAC;QACH,CAAC;QACD,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,oBAAoB;YAChC,OAAO,EAAE,CAAC,sEAAsE,CAAC;SACjF,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,UAAU,GAAuC;YACtD,OAAO,EAAE,oBAAoB;YAC7B,QAAQ,EAAE,kBAAkB;YAC5B,WAAW,EAAE,4BAA4B;YACzC,mBAAmB,EAAE,+BAA+B;YACpD,YAAY,EAAE,2BAA2B;SACzC,CAAC;QACF,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI;YAClE,UAAU,EAAE,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;YAC9F,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrC,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC1B,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,CAAC,qFAAqF,CAAC;SAChG,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,CAAC,4CAA4C,CAAC;SACvD,CAAC;IACH,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,oBAAoB;YAChC,OAAO,EAAE,CAAC,iDAAiD,CAAC;SAC5D,CAAC;IACH,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,uBAAuB;YACnC,OAAO,EAAE,CAAC,qEAAqE,CAAC;SAChF,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,mBAAmB;QAC/B,OAAO,EAAE,CAAC,uEAAuE,CAAC;KAClF,CAAC;AAAA,CACF;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAqB;IAC5E,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;AAAA,CACjF;AAED,MAAM,UAAU,mBAAmB,CAAC,KAA0B,EAAkB;IAC/E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,YAAY,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,iBAAiB;YAC7B,OAAO,EAAE,CAAC,iBAAiB,CAAC;YAC5B,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1F,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,CAAC,2DAA2D,CAAC;YACtE,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAC/C,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,UAAU,GAAuC;YACtD,OAAO,EAAE,2BAA2B;YACpC,QAAQ,EAAE,yBAAyB;YACnC,WAAW,EAAE,uBAAuB;YACpC,mBAAmB,EAAE,6BAA6B;YAClD,YAAY,EAAE,iCAAiC;SAC/C,CAAC;QACF,OAAO;YACN,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrC,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC1B,gBAAgB,EAAE,QAAQ,CAAC,IAAI,KAAK,mBAAmB;SACvD,CAAC;IACH,CAAC;IACD,IACC,OAAO;QACP,CAAC,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC;YACrC,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC;YACpC,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC;YACpC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;YACxC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;YACxC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAClC,CAAC;QACF,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,UAAU,EAAE,kBAAkB;YAC9B,OAAO,EAAE,CAAC,gEAAgE,CAAC;YAC3E,gBAAgB,EAAE,IAAI;SACtB,CAAC;IACH,CAAC;IACD,IACC,KAAK,CAAC,QAAQ;QACd,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EACtG,CAAC;QACF,OAAO;YACN,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,kBAAkB;YAC9B,OAAO,EAAE,CAAC,uCAAuC,CAAC;YAClD,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,mBAAmB;QAC/B,OAAO,EAAE,CAAC,4CAA4C,CAAC;QACvD,gBAAgB,EAAE,KAAK;KACvB,CAAC;AAAA,CACF","sourcesContent":["import type { OperationRisk, RiskAssessment, RiskAssessmentInput, RouteDecision } from \"./autonomy/contracts.ts\";\n\nexport type ModelRouterIntent = \"research\" | \"modify\";\n\nconst EXPLICIT_MODIFY_REQUEST_RE =\n\t/^(?:can you|could you|please|pls|go ahead and|let'?s|i need you to|we need to|you should)\\s+.*\\b(add|apply|build|change|commit|create|delete|edit|fix|generate|implement|install|modify|patch|remove|rename|replace|run|test|update|write|publish|release|push|deploy|tag|reset|clean|rewrite)\\b/i;\nconst READ_ONLY_QUESTION_RE =\n\t/^(?:(?:can you|could you|please|pls|go ahead and|let'?s|i need you to|we need to|you should)\\s+)?(?:how|what|why|when|where|which|who|explain|summarize|compare|describe|list|show|search|find|view|read|locate)\\b/i;\nconst RELEASE_PUBLISH_RE = /\\b(publish|release|push|deploy|tag)\\b/i;\nconst SECURITY_AUTH_RE = /\\b(auth|token|credential|credentials|secret|api[-_]key)\\b/i;\nconst DESTRUCTIVE_RE = /\\b(delete|reset|rm\\s+-rf|clean)\\b/i;\nconst SELF_MOD_MUTATE_RE =\n\t/\\b(modify|change|write|update|edit|delete|add|remove|set)\\s+.*\\b(skills|prompts|settings|tools|behavior)\\b|self[-_]modification/i;\nconst ARCHITECTURE_MUTATE_RE = /\\b(rewrite|redesign|change|modify|rearchitect)\\s+.*\\b(architecture|architect)\\b/i;\nconst PLANNING_CORE_RE = /\\b(plan|planning|roadmap|strategy)\\b/i;\nconst PLANNING_DESIGN_WORD_RE = /\\b(design|architect\\w*|structure|approach)\\b/i;\nconst PLANNING_PROSPECTIVE_RE =\n\t/\\b(how (?:should|would|do we|can we)|what(?:'s| is) the (?:best|cleanest|right)|propose|draft|come up with|figure out|decide (?:on|how))\\b/i;\nconst REFACTOR_RE = /\\b(refactor|refactoring)\\b/i;\nconst TEST_VALIDATION_RE = /\\b(test|testing|validation|lint|vitest|jest|run)\\b/i;\nconst IMPLEMENT_RE = /\\b(implement|fix|apply|change|update|create|write|generate|modify|edit|patch|add)\\b/i;\nconst DESTRUCTIVE_CMD_RE =\n\t/\\b(rm(\\s+-r|\\s+-f|\\s+-rf|\\s+-fr)?|mv|cp|chmod|chown|install)\\b|>\\s*\\/dev\\/(sda|hda|vda)|\\b(dd\\s+if=)/i;\nconst GIT_MUTATE_CMD_RE = /\\bgit\\s+(commit|push|reset|clean|stash|rebase)\\b/i;\nconst PKG_MUTATE_CMD_RE = /\\b(npm|pnpm|yarn|bun)\\s+(install|i|update|up|publish|run|remove|rm|uninstall)\\b/i;\nconst RELEASE_DEPLOY_CMD_RE = /\\b(release|deploy)\\b/i;\nconst PYTHON_HIGH_IMPACT_RE =\n\t/\\b(?:shutil\\.(?:rmtree|move|copy|copy2|copytree)|os\\.(?:remove|unlink|rmdir|removedirs|system)|subprocess\\.(?:run|call|check_call|check_output|Popen)|Path\\([^)]*\\)\\.(?:unlink|rmdir))\\b/i;\nconst REDIRECTION_RE = /[<>]/;\n\ninterface RiskSignal {\n\trisk: OperationRisk;\n\tkind: \"release\" | \"security\" | \"destructive\" | \"self-modification\" | \"architecture\";\n\treason: string;\n}\n\nfunction isPlanningPrompt(text: string): boolean {\n\treturn PLANNING_CORE_RE.test(text) || (PLANNING_DESIGN_WORD_RE.test(text) && PLANNING_PROSPECTIVE_RE.test(text));\n}\n\nfunction highRiskSignal(text: string): RiskSignal | undefined {\n\tif (RELEASE_PUBLISH_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"release\",\n\t\t\treason: \"Operation mentions releasing, publishing, or deploying\",\n\t\t};\n\t}\n\tif (SECURITY_AUTH_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"security\",\n\t\t\treason: \"Operation mentions authentication or credentials\",\n\t\t};\n\t}\n\tif (DESTRUCTIVE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"destructive\",\n\t\t\treason: \"Operation involves deleting, resetting, or cleaning\",\n\t\t};\n\t}\n\tif (SELF_MOD_MUTATE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"self-modification\",\n\t\t\treason: \"Operation modifies settings, tools, skills, or prompts\",\n\t\t};\n\t}\n\tif (ARCHITECTURE_MUTATE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"high-impact\",\n\t\t\tkind: \"architecture\",\n\t\t\treason: \"Operation mentions rewriting or rearchitecting core parts\",\n\t\t};\n\t}\n\treturn undefined;\n}\n\nfunction stripSingleQuotes(command: string): string {\n\treturn command.replace(/'[^']*'/g, \"''\");\n}\n\nexport function classifyModelRouterRoute(prompt: string): RouteDecision {\n\tconst text = prompt.trim();\n\tif (!text) {\n\t\treturn {\n\t\t\ttier: \"cheap\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.1,\n\t\t\treasonCode: \"empty_prompt\",\n\t\t\treasons: [\"Empty or whitespace prompt\"],\n\t\t};\n\t}\n\tif (READ_ONLY_QUESTION_RE.test(text) && !EXPLICIT_MODIFY_REQUEST_RE.test(text)) {\n\t\tif (isPlanningPrompt(text)) {\n\t\t\treturn {\n\t\t\t\ttier: \"medium\",\n\t\t\t\trisk: \"read-only\",\n\t\t\t\tconfidence: 0.75,\n\t\t\t\treasonCode: \"planning_min_medium\",\n\t\t\t\treasons: [\"Planning/design prompts never route cheap by default; a judge may deem them trivial\"],\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\ttier: \"cheap\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.9,\n\t\t\treasonCode: \"read_only_question\",\n\t\t\treasons: [\"Prompt asks a question or requests an explanation, search, or lookup\"],\n\t\t};\n\t}\n\tconst highRisk = highRiskSignal(text);\n\tif (highRisk) {\n\t\tconst reasonCode: Record<RiskSignal[\"kind\"], string> = {\n\t\t\trelease: \"release_or_publish\",\n\t\t\tsecurity: \"security_or_auth\",\n\t\t\tdestructive: \"destructive_or_git_history\",\n\t\t\t\"self-modification\": \"settings_or_self_modification\",\n\t\t\tarchitecture: \"architecture_or_ambiguous\",\n\t\t};\n\t\treturn {\n\t\t\ttier: \"expensive\",\n\t\t\trisk: highRisk.kind === \"security\" ? \"high-impact\" : highRisk.risk,\n\t\t\tconfidence: highRisk.kind === \"security\" ? 0.95 : highRisk.kind === \"destructive\" ? 0.85 : 0.9,\n\t\t\treasonCode: reasonCode[highRisk.kind],\n\t\t\treasons: [highRisk.reason],\n\t\t};\n\t}\n\tif (isPlanningPrompt(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.75,\n\t\t\treasonCode: \"planning_min_medium\",\n\t\t\treasons: [\"Planning/design prompts never route cheap by default; a judge may deem them trivial\"],\n\t\t};\n\t}\n\tif (REFACTOR_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.8,\n\t\t\treasonCode: \"mechanical_refactor\",\n\t\t\treasons: [\"Prompt mentions refactoring code structure\"],\n\t\t};\n\t}\n\tif (TEST_VALIDATION_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.8,\n\t\t\treasonCode: \"test_or_validation\",\n\t\t\treasons: [\"Prompt mentions testing, validation, or linting\"],\n\t\t};\n\t}\n\tif (IMPLEMENT_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.85,\n\t\t\treasonCode: \"normal_implementation\",\n\t\t\treasons: [\"Prompt mentions implementing, updating, creating, or modifying code\"],\n\t\t};\n\t}\n\treturn {\n\t\ttier: \"cheap\",\n\t\trisk: \"read-only\",\n\t\tconfidence: 0.5,\n\t\treasonCode: \"default_read_only\",\n\t\treasons: [\"No explicit implementation, destructive, or release patterns detected\"],\n\t};\n}\n\nexport function classifyModelRouterIntent(prompt: string): ModelRouterIntent {\n\treturn classifyModelRouterRoute(prompt).tier === \"cheap\" ? \"research\" : \"modify\";\n}\n\nexport function assessOperationRisk(input: RiskAssessmentInput): RiskAssessment {\n\tconst operation = input.operation.trim();\n\tconst command = input.command?.trim() ?? \"\";\n\tconst cleanCommand = stripSingleQuotes(command);\n\tconst fullText = `${operation} ${command}`.trim();\n\tconst cleanFullText = `${operation} ${cleanCommand}`.trim();\n\tif (!fullText) {\n\t\treturn {\n\t\t\trisk: \"read-only\",\n\t\t\treasonCode: \"empty_operation\",\n\t\t\treasons: [\"Empty operation\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tif (READ_ONLY_QUESTION_RE.test(operation) && !EXPLICIT_MODIFY_REQUEST_RE.test(operation)) {\n\t\treturn {\n\t\t\trisk: \"read-only\",\n\t\t\treasonCode: \"read_only_operation\",\n\t\t\treasons: [\"Operation is explicitly read-only (list/show/read/search)\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tconst highRisk = highRiskSignal(cleanFullText);\n\tif (highRisk) {\n\t\tconst reasonCode: Record<RiskSignal[\"kind\"], string> = {\n\t\t\trelease: \"release_publish_operation\",\n\t\t\tsecurity: \"security_auth_operation\",\n\t\t\tdestructive: \"destructive_operation\",\n\t\t\t\"self-modification\": \"self_modification_operation\",\n\t\t\tarchitecture: \"architecture_mutation_operation\",\n\t\t};\n\t\treturn {\n\t\t\trisk: highRisk.risk,\n\t\t\treasonCode: reasonCode[highRisk.kind],\n\t\t\treasons: [highRisk.reason],\n\t\t\trequiresApproval: highRisk.risk === \"approval-required\",\n\t\t};\n\t}\n\tif (\n\t\tcommand &&\n\t\t(DESTRUCTIVE_CMD_RE.test(cleanCommand) ||\n\t\t\tGIT_MUTATE_CMD_RE.test(cleanCommand) ||\n\t\t\tPKG_MUTATE_CMD_RE.test(cleanCommand) ||\n\t\t\tRELEASE_DEPLOY_CMD_RE.test(cleanCommand) ||\n\t\t\tPYTHON_HIGH_IMPACT_RE.test(cleanCommand) ||\n\t\t\tREDIRECTION_RE.test(cleanCommand))\n\t) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\treasonCode: \"mutating_command\",\n\t\t\treasons: [\"Command executes a destructive, mutating, or publish operation\"],\n\t\t\trequiresApproval: true,\n\t\t};\n\t}\n\tif (\n\t\tinput.toolName &&\n\t\t![\"read_file\", \"search_web\", \"list_dir\", \"grep_search\", \"view_file\", \"memory\"].includes(input.toolName)\n\t) {\n\t\treturn {\n\t\t\trisk: \"scoped-write\",\n\t\t\treasonCode: \"generic_mutation\",\n\t\t\treasons: [\"Generic mutating operation or command\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\treturn {\n\t\trisk: \"read-only\",\n\t\treasonCode: \"default_read_only\",\n\t\treasons: [\"No mutating or high-risk patterns detected\"],\n\t\trequiresApproval: false,\n\t};\n}\n"]}
+{"version":3,"file":"risk-classifier.js","sourceRoot":"","sources":["../../src/core/risk-classifier.ts"],"names":[],"mappings":"AAIA,MAAM,0BAA0B,GAC/B,mSAAmS,CAAC;AACrS,MAAM,qBAAqB,GAC1B,qNAAqN,CAAC;AACvN,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;AACpE,MAAM,gBAAgB,GAAG,4DAA4D,CAAC;AACtF,MAAM,cAAc,GAAG,oCAAoC,CAAC;AAC5D,MAAM,kBAAkB,GACvB,kIAAkI,CAAC;AACpI,MAAM,sBAAsB,GAAG,kFAAkF,CAAC;AAClH,MAAM,gBAAgB,GAAG,uCAAuC,CAAC;AACjE,MAAM,uBAAuB,GAAG,+CAA+C,CAAC;AAChF,MAAM,uBAAuB,GAC5B,6IAA6I,CAAC;AAC/I,MAAM,WAAW,GAAG,6BAA6B,CAAC;AAClD,MAAM,kBAAkB,GAAG,qDAAqD,CAAC;AACjF,MAAM,YAAY,GAAG,sFAAsF,CAAC;AAC5G,MAAM,kBAAkB,GACvB,uGAAuG,CAAC;AACzG,MAAM,iBAAiB,GAAG,mDAAmD,CAAC;AAC9E,MAAM,iBAAiB,GAAG,kFAAkF,CAAC;AAC7G,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AACtD,MAAM,qBAAqB,GAC1B,2LAA2L,CAAC;AAC7L,MAAM,cAAc,GAAG,MAAM,CAAC;AAQ9B,SAAS,gBAAgB,CAAC,IAAY,EAAW;IAChD,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAAA,CACjH;AAED,SAAS,cAAc,CAAC,IAAY,EAA0B;IAC7D,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,wDAAwD;SAChE,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,kDAAkD;SAC1D,CAAC;IACH,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,qDAAqD;SAC7D,CAAC;IACH,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,wDAAwD;SAChE,CAAC;IACH,CAAC;IACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,2DAA2D;SACnE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAU;IACnD,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAAA,CACzC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAc,EAAiB;IACvE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,cAAc;YAC1B,OAAO,EAAE,CAAC,4BAA4B,CAAC;SACvC,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACN,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,WAAW;gBACjB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,qBAAqB;gBACjC,OAAO,EAAE,CAAC,qFAAqF,CAAC;aAChG,CAAC;QACH,CAAC;QACD,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,oBAAoB;YAChC,OAAO,EAAE,CAAC,sEAAsE,CAAC;SACjF,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,UAAU,GAAuC;YACtD,OAAO,EAAE,oBAAoB;YAC7B,QAAQ,EAAE,kBAAkB;YAC5B,WAAW,EAAE,4BAA4B;YACzC,mBAAmB,EAAE,+BAA+B;YACpD,YAAY,EAAE,2BAA2B;SACzC,CAAC;QACF,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI;YAClE,UAAU,EAAE,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;YAC9F,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrC,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC1B,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,CAAC,qFAAqF,CAAC;SAChG,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,CAAC,4CAA4C,CAAC;SACvD,CAAC;IACH,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,oBAAoB;YAChC,OAAO,EAAE,CAAC,iDAAiD,CAAC;SAC5D,CAAC;IACH,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,uBAAuB;YACnC,OAAO,EAAE,CAAC,qEAAqE,CAAC;SAChF,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,mBAAmB;QAC/B,OAAO,EAAE,CAAC,uEAAuE,CAAC;KAClF,CAAC;AAAA,CACF;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAqB;IAC5E,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;AAAA,CACjF;AAED,MAAM,UAAU,mBAAmB,CAAC,KAA0B,EAAkB;IAC/E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,YAAY,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,iBAAiB;YAC7B,OAAO,EAAE,CAAC,iBAAiB,CAAC;YAC5B,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACvC,OAAO;YACN,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,0BAA0B;YACtC,OAAO,EAAE,CAAC,wFAAwF,CAAC;YACnG,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1F,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,CAAC,2DAA2D,CAAC;YACtE,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAC/C,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,UAAU,GAAuC;YACtD,OAAO,EAAE,2BAA2B;YACpC,QAAQ,EAAE,yBAAyB;YACnC,WAAW,EAAE,uBAAuB;YACpC,mBAAmB,EAAE,6BAA6B;YAClD,YAAY,EAAE,iCAAiC;SAC/C,CAAC;QACF,OAAO;YACN,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrC,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC1B,gBAAgB,EAAE,QAAQ,CAAC,IAAI,KAAK,mBAAmB;SACvD,CAAC;IACH,CAAC;IACD,IACC,OAAO;QACP,CAAC,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC;YACrC,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC;YACpC,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC;YACpC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;YACxC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;YACxC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAClC,CAAC;QACF,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,UAAU,EAAE,kBAAkB;YAC9B,OAAO,EAAE,CAAC,gEAAgE,CAAC;YAC3E,gBAAgB,EAAE,IAAI;SACtB,CAAC;IACH,CAAC;IACD,IACC,KAAK,CAAC,QAAQ;QACd,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EACtG,CAAC;QACF,OAAO;YACN,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,kBAAkB;YAC9B,OAAO,EAAE,CAAC,uCAAuC,CAAC;YAClD,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,mBAAmB;QAC/B,OAAO,EAAE,CAAC,4CAA4C,CAAC;QACvD,gBAAgB,EAAE,KAAK;KACvB,CAAC;AAAA,CACF","sourcesContent":["import type { OperationRisk, RiskAssessment, RiskAssessmentInput, RouteDecision } from \"./autonomy/contracts.ts\";\n\nexport type ModelRouterIntent = \"research\" | \"modify\";\n\nconst EXPLICIT_MODIFY_REQUEST_RE =\n\t/^(?:can you|could you|please|pls|go ahead and|let'?s|i need you to|we need to|you should)\\s+.*\\b(add|apply|build|change|commit|create|delete|edit|fix|generate|implement|install|modify|patch|remove|rename|replace|run|test|update|write|publish|release|push|deploy|tag|reset|clean|rewrite)\\b/i;\nconst READ_ONLY_QUESTION_RE =\n\t/^(?:(?:can you|could you|please|pls|go ahead and|let'?s|i need you to|we need to|you should)\\s+)?(?:how|what|why|when|where|which|who|explain|summarize|compare|describe|list|show|search|find|view|read|locate)\\b/i;\nconst RELEASE_PUBLISH_RE = /\\b(publish|release|push|deploy|tag)\\b/i;\nconst SECURITY_AUTH_RE = /\\b(auth|token|credential|credentials|secret|api[-_]key)\\b/i;\nconst DESTRUCTIVE_RE = /\\b(delete|reset|rm\\s+-rf|clean)\\b/i;\nconst SELF_MOD_MUTATE_RE =\n\t/\\b(modify|change|write|update|edit|delete|add|remove|set)\\s+.*\\b(skills|prompts|settings|tools|behavior)\\b|self[-_]modification/i;\nconst ARCHITECTURE_MUTATE_RE = /\\b(rewrite|redesign|change|modify|rearchitect)\\s+.*\\b(architecture|architect)\\b/i;\nconst PLANNING_CORE_RE = /\\b(plan|planning|roadmap|strategy)\\b/i;\nconst PLANNING_DESIGN_WORD_RE = /\\b(design|architect\\w*|structure|approach)\\b/i;\nconst PLANNING_PROSPECTIVE_RE =\n\t/\\b(how (?:should|would|do we|can we)|what(?:'s| is) the (?:best|cleanest|right)|propose|draft|come up with|figure out|decide (?:on|how))\\b/i;\nconst REFACTOR_RE = /\\b(refactor|refactoring)\\b/i;\nconst TEST_VALIDATION_RE = /\\b(test|testing|validation|lint|vitest|jest|run)\\b/i;\nconst IMPLEMENT_RE = /\\b(implement|fix|apply|change|update|create|write|generate|modify|edit|patch|add)\\b/i;\nconst DESTRUCTIVE_CMD_RE =\n\t/\\b(rm(\\s+-r|\\s+-f|\\s+-rf|\\s+-fr)?|mv|cp|chmod|chown|install)\\b|>\\s*\\/dev\\/(sda|hda|vda)|\\b(dd\\s+if=)/i;\nconst GIT_MUTATE_CMD_RE = /\\bgit\\s+(commit|push|reset|clean|stash|rebase)\\b/i;\nconst PKG_MUTATE_CMD_RE = /\\b(npm|pnpm|yarn|bun)\\s+(install|i|update|up|publish|run|remove|rm|uninstall)\\b/i;\nconst RELEASE_DEPLOY_CMD_RE = /\\b(release|deploy)\\b/i;\nconst PYTHON_HIGH_IMPACT_RE =\n\t/\\b(?:shutil\\.(?:rmtree|move|copy|copy2|copytree)|os\\.(?:remove|unlink|rmdir|removedirs|system)|subprocess\\.(?:run|call|check_call|check_output|Popen)|Path\\([^)]*\\)\\.(?:unlink|rmdir))\\b/i;\nconst REDIRECTION_RE = /[<>]/;\n\ninterface RiskSignal {\n\trisk: OperationRisk;\n\tkind: \"release\" | \"security\" | \"destructive\" | \"self-modification\" | \"architecture\";\n\treason: string;\n}\n\nfunction isPlanningPrompt(text: string): boolean {\n\treturn PLANNING_CORE_RE.test(text) || (PLANNING_DESIGN_WORD_RE.test(text) && PLANNING_PROSPECTIVE_RE.test(text));\n}\n\nfunction highRiskSignal(text: string): RiskSignal | undefined {\n\tif (RELEASE_PUBLISH_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"release\",\n\t\t\treason: \"Operation mentions releasing, publishing, or deploying\",\n\t\t};\n\t}\n\tif (SECURITY_AUTH_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"security\",\n\t\t\treason: \"Operation mentions authentication or credentials\",\n\t\t};\n\t}\n\tif (DESTRUCTIVE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"destructive\",\n\t\t\treason: \"Operation involves deleting, resetting, or cleaning\",\n\t\t};\n\t}\n\tif (SELF_MOD_MUTATE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"self-modification\",\n\t\t\treason: \"Operation modifies settings, tools, skills, or prompts\",\n\t\t};\n\t}\n\tif (ARCHITECTURE_MUTATE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"high-impact\",\n\t\t\tkind: \"architecture\",\n\t\t\treason: \"Operation mentions rewriting or rearchitecting core parts\",\n\t\t};\n\t}\n\treturn undefined;\n}\n\nfunction stripSingleQuotes(command: string): string {\n\treturn command.replace(/'[^']*'/g, \"''\");\n}\n\nexport function classifyModelRouterRoute(prompt: string): RouteDecision {\n\tconst text = prompt.trim();\n\tif (!text) {\n\t\treturn {\n\t\t\ttier: \"cheap\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.1,\n\t\t\treasonCode: \"empty_prompt\",\n\t\t\treasons: [\"Empty or whitespace prompt\"],\n\t\t};\n\t}\n\tif (READ_ONLY_QUESTION_RE.test(text) && !EXPLICIT_MODIFY_REQUEST_RE.test(text)) {\n\t\tif (isPlanningPrompt(text)) {\n\t\t\treturn {\n\t\t\t\ttier: \"medium\",\n\t\t\t\trisk: \"read-only\",\n\t\t\t\tconfidence: 0.75,\n\t\t\t\treasonCode: \"planning_min_medium\",\n\t\t\t\treasons: [\"Planning/design prompts never route cheap by default; a judge may deem them trivial\"],\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\ttier: \"cheap\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.9,\n\t\t\treasonCode: \"read_only_question\",\n\t\t\treasons: [\"Prompt asks a question or requests an explanation, search, or lookup\"],\n\t\t};\n\t}\n\tconst highRisk = highRiskSignal(text);\n\tif (highRisk) {\n\t\tconst reasonCode: Record<RiskSignal[\"kind\"], string> = {\n\t\t\trelease: \"release_or_publish\",\n\t\t\tsecurity: \"security_or_auth\",\n\t\t\tdestructive: \"destructive_or_git_history\",\n\t\t\t\"self-modification\": \"settings_or_self_modification\",\n\t\t\tarchitecture: \"architecture_or_ambiguous\",\n\t\t};\n\t\treturn {\n\t\t\ttier: \"expensive\",\n\t\t\trisk: highRisk.kind === \"security\" ? \"high-impact\" : highRisk.risk,\n\t\t\tconfidence: highRisk.kind === \"security\" ? 0.95 : highRisk.kind === \"destructive\" ? 0.85 : 0.9,\n\t\t\treasonCode: reasonCode[highRisk.kind],\n\t\t\treasons: [highRisk.reason],\n\t\t};\n\t}\n\tif (isPlanningPrompt(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.75,\n\t\t\treasonCode: \"planning_min_medium\",\n\t\t\treasons: [\"Planning/design prompts never route cheap by default; a judge may deem them trivial\"],\n\t\t};\n\t}\n\tif (REFACTOR_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.8,\n\t\t\treasonCode: \"mechanical_refactor\",\n\t\t\treasons: [\"Prompt mentions refactoring code structure\"],\n\t\t};\n\t}\n\tif (TEST_VALIDATION_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.8,\n\t\t\treasonCode: \"test_or_validation\",\n\t\t\treasons: [\"Prompt mentions testing, validation, or linting\"],\n\t\t};\n\t}\n\tif (IMPLEMENT_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.85,\n\t\t\treasonCode: \"normal_implementation\",\n\t\t\treasons: [\"Prompt mentions implementing, updating, creating, or modifying code\"],\n\t\t};\n\t}\n\treturn {\n\t\ttier: \"cheap\",\n\t\trisk: \"read-only\",\n\t\tconfidence: 0.5,\n\t\treasonCode: \"default_read_only\",\n\t\treasons: [\"No explicit implementation, destructive, or release patterns detected\"],\n\t};\n}\n\nexport function classifyModelRouterIntent(prompt: string): ModelRouterIntent {\n\treturn classifyModelRouterRoute(prompt).tier === \"cheap\" ? \"research\" : \"modify\";\n}\n\nexport function assessOperationRisk(input: RiskAssessmentInput): RiskAssessment {\n\tconst operation = input.operation.trim();\n\tconst command = input.command?.trim() ?? \"\";\n\tconst cleanCommand = stripSingleQuotes(command);\n\tconst fullText = `${operation} ${command}`.trim();\n\tconst cleanFullText = `${operation} ${cleanCommand}`.trim();\n\tif (!fullText) {\n\t\treturn {\n\t\t\trisk: \"read-only\",\n\t\t\treasonCode: \"empty_operation\",\n\t\t\treasons: [\"Empty operation\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tif (input.toolName === \"secret_store\") {\n\t\treturn {\n\t\t\trisk: \"scoped-write\",\n\t\t\treasonCode: \"native_owner_secret_flow\",\n\t\t\treasons: [\"Native secret-store mutations require model-blind owner input and in-tool confirmation\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tif (READ_ONLY_QUESTION_RE.test(operation) && !EXPLICIT_MODIFY_REQUEST_RE.test(operation)) {\n\t\treturn {\n\t\t\trisk: \"read-only\",\n\t\t\treasonCode: \"read_only_operation\",\n\t\t\treasons: [\"Operation is explicitly read-only (list/show/read/search)\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tconst highRisk = highRiskSignal(cleanFullText);\n\tif (highRisk) {\n\t\tconst reasonCode: Record<RiskSignal[\"kind\"], string> = {\n\t\t\trelease: \"release_publish_operation\",\n\t\t\tsecurity: \"security_auth_operation\",\n\t\t\tdestructive: \"destructive_operation\",\n\t\t\t\"self-modification\": \"self_modification_operation\",\n\t\t\tarchitecture: \"architecture_mutation_operation\",\n\t\t};\n\t\treturn {\n\t\t\trisk: highRisk.risk,\n\t\t\treasonCode: reasonCode[highRisk.kind],\n\t\t\treasons: [highRisk.reason],\n\t\t\trequiresApproval: highRisk.risk === \"approval-required\",\n\t\t};\n\t}\n\tif (\n\t\tcommand &&\n\t\t(DESTRUCTIVE_CMD_RE.test(cleanCommand) ||\n\t\t\tGIT_MUTATE_CMD_RE.test(cleanCommand) ||\n\t\t\tPKG_MUTATE_CMD_RE.test(cleanCommand) ||\n\t\t\tRELEASE_DEPLOY_CMD_RE.test(cleanCommand) ||\n\t\t\tPYTHON_HIGH_IMPACT_RE.test(cleanCommand) ||\n\t\t\tREDIRECTION_RE.test(cleanCommand))\n\t) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\treasonCode: \"mutating_command\",\n\t\t\treasons: [\"Command executes a destructive, mutating, or publish operation\"],\n\t\t\trequiresApproval: true,\n\t\t};\n\t}\n\tif (\n\t\tinput.toolName &&\n\t\t![\"read_file\", \"search_web\", \"list_dir\", \"grep_search\", \"view_file\", \"memory\"].includes(input.toolName)\n\t) {\n\t\treturn {\n\t\t\trisk: \"scoped-write\",\n\t\t\treasonCode: \"generic_mutation\",\n\t\t\treasons: [\"Generic mutating operation or command\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\treturn {\n\t\trisk: \"read-only\",\n\t\treasonCode: \"default_read_only\",\n\t\treasons: [\"No mutating or high-risk patterns detected\"],\n\t\trequiresApproval: false,\n\t};\n}\n"]}

package/dist/core/runtime-builder.d.ts

@@ -35,14 +35,16 @@
 import type { Agent, AgentContext, AgentMessage, AgentTool } from "@caupulican/pi-agent-core";
 import type { SessionManager } from "@caupulican/pi-agent-core/node";
 import type { Api, Model, Usage } from "@caupulican/pi-ai";
-import type { IsolatedCompletionOptions, IsolatedCompletionResult, WorkerDelegationRunOutcome } from "./agent-session.ts";
+import type { IsolatedCompletionOptions, IsolatedCompletionResult, WorkerDelegationRunOutcome } from "./agent-session-contracts.ts";
 import type { WorkerClaim } from "./autonomy/contracts.ts";
 import type { LaneRecord } from "./autonomy/lane-tracker.ts";
 import type { ArtifactStore } from "./context/context-artifacts.ts";
 import type { MemoryPromptInclusionReport, MemoryRetrievalDiagnostics } from "./context/memory-diagnostics.ts";
 import type { ContextGcReport } from "./context-gc.ts";
 import type { WorkerDelegationRequest } from "./delegation/worker-delegation-request.ts";
+import type { ExtensionImportAuthority } from "./extension-import-authority.ts";
 import { type ContextUsage, type Extension, type ExtensionCommandContextActions, type ExtensionErrorListener, ExtensionRunner, type ExtensionUIContext, type ShutdownHandler, type ToolDefinition, type ToolInfo } from "./extensions/index.ts";
+import type { GoalStateRevision } from "./goals/goal-lifecycle.ts";
 import type { GoalState } from "./goals/goal-state.ts";
 import type { OpenTaskStepRef } from "./goals/goal-tool-core.ts";
 import type { MemoryManager } from "./memory/memory-manager.ts";
@@ -114,8 +116,10 @@ export interface RuntimeBuilderDeps {
     deriveToolProfileFilter(): Required<ResourceProfileFilterSettings>;
     /** True when a tool/command name survives the active profile's allow/block + user allow/exclude. */
     isToolOrCommandAllowedByProfile(name: string): boolean;
+    /** Import-boundary decision for an exact owner load or an automatic profile-driven load. */
+    isExtensionPathAllowed(path: string, authority: ExtensionImportAuthority, baseDir?: string): boolean;
     /** Filter the loaded extensions through the active resource profile (records inert/denied warnings host-side). */
-    filterExtensionsForRuntime(extensions: Extension[]): Extension[];
+    filterExtensionsForRuntime(extensions: Extension[], explicitLiveExtensionPaths?: ReadonlySet<string>): Extension[];
     /** Sink for the unbound-profile-tool-grant warnings surfaced in /context. */
     setUnboundToolGrantWarnings(warnings: string[]): void;
     getUnboundToolGrantWarnings(): string[];
@@ -157,7 +161,7 @@ export interface RuntimeBuilderDeps {
     initializeMemory(): Promise<void>;
     /** Goal-tool state accessors. */
     getGoalStateSnapshot(): GoalState | undefined;
-    saveGoalStateSnapshot(state: GoalState): string;
+    saveGoalStateSnapshot(state: GoalState, expected?: GoalStateRevision): string;
     /** Native task-step state accessors. */
     getTaskStepsStateSnapshot(): TaskStepsState | undefined;
     saveTaskStepsStateSnapshot(state: TaskStepsState): string;
@@ -246,8 +250,11 @@ export declare class RuntimeBuilder {
     private _toolPromptSnippets;
     private _toolPromptGuidelines;
     private _baseToolDefinitions;
+    /** Exact extensions the owner approved through the live-load API. Discovery never populates this set. */
+    private readonly _explicitLiveExtensionPaths;
     private _reloadPromise;
     private _reloadRequested;
+    private readonly _secretVault;
     private readonly deps;
     constructor(deps: RuntimeBuilderDeps);
     /**
@@ -302,6 +309,7 @@ export declare class RuntimeBuilder {
      * Falls back to full reload on error.
      */
     unloadExtensionLive(extensionPath: string): Promise<void>;
+    private _unloadExtensionLive;
     /**
      * Load a single extension without full reload.
      * Loads the extension with fresh import, rebuilds the runtime,
@@ -309,6 +317,10 @@ export declare class RuntimeBuilder {
      * Falls back to full reload on error.
      */
     loadExtensionLive(extensionPath: string): Promise<void>;
+    private _loadExtensionLive;
+    private _importExtension;
+    private _assertExtensionLoadAllowed;
+    private _recoverLiveExtensionFailure;
     /**
      * Reconcile loaded extensions with the active profile.
      * Loads extensions that should be enabled but aren't, and unloads extensions that shouldn't be.