@cleocode/core 2026.6.13 → 2026.6.14

package/dist/orchestration/spawn.js

@@ -47,6 +47,42 @@ import { enforceThinAgent, } from './thin-agent.js';
 // ============================================================================
 // Internal helpers
 // ============================================================================
+/**
+ * Restrict a `baseline` list to only the entries also present in `allowlist`
+ * (set intersection, baseline order preserved, deduped). This is the core
+ * T1947 enforcement primitive: the allowlist can only REMOVE entries from the
+ * baseline, never add — an allowlist entry absent from the baseline is ignored.
+ *
+ * When `allowlist` is `undefined`, the baseline passes through unchanged (a
+ * node that declares no allowlist is unaffected — additive).
+ *
+ * @param baseline  - The Tier-0/1/2 baseline list (skills or tools).
+ * @param allowlist - The node's per-step allowlist, or `undefined` for no restriction.
+ * @returns `{ effective, removed }` — the intersected list plus the baseline
+ *          entries that were dropped (empty when no allowlist was applied).
+ * @task T1947
+ */
+function applyAllowlist(baseline, allowlist) {
+    if (allowlist === undefined) {
+        return { effective: baseline, removed: [], applied: false };
+    }
+    const allow = new Set(allowlist);
+    const effective = [];
+    const removed = [];
+    const seen = new Set();
+    for (const entry of baseline) {
+        if (seen.has(entry))
+            continue;
+        seen.add(entry);
+        if (allow.has(entry)) {
+            effective.push(entry);
+        }
+        else {
+            removed.push(entry);
+        }
+    }
+    return { effective, removed, applied: true };
+}
 /**
  * Map an `orchLevel` (0/1/2) to the canonical {@link AgentSpawnCapability}.
  *
@@ -192,6 +228,9 @@ export async function composeSpawnPayload(db, task, options = {}) {
     //     does not (yet) emit one, so legacy call sites remain unchanged.
     const thinAgentMode = options.thinAgentEnforcement ?? 'strict';
     let thinAgentMeta;
+    // Tool baseline after the thin-agent guard (post-strip in `'strip'` mode).
+    // `undefined` when the caller supplied no tool list at all.
+    let toolBaseline;
     if (options.tools !== undefined) {
         const thinAgentResult = enforceThinAgent(role, options.tools, thinAgentMode);
         if (!thinAgentResult.ok) {
@@ -202,6 +241,30 @@ export async function composeSpawnPayload(db, task, options = {}) {
             stripped: thinAgentResult.stripped,
             bypassed: thinAgentResult.bypassed,
         };
+        toolBaseline = thinAgentResult.tools;
+    }
+    // 6b-bis. Per-step skill/tool allowlist enforcement (T1947 · M4).
+    //
+    //   The Tier-0/1/2 selection above (role → tier) determines the BASELINE skill
+    //   set (`resolvedAgent.skills`) and — when the caller supplied one — the tool
+    //   baseline (post thin-agent guard). A cantbook node's `allowed_skills` /
+    //   `allowed_tools` then FURTHER RESTRICTS that baseline via set intersection:
+    //   the allowlist can only REMOVE entries, never add one (AC2/AC3/AC4). When a
+    //   node declares no allowlist the baseline passes through unchanged (additive).
+    const skillResult = applyAllowlist(resolvedAgent.skills, options.allowedSkills);
+    const effectiveSkills = skillResult.effective;
+    const toolResult = toolBaseline !== undefined
+        ? applyAllowlist(toolBaseline, options.allowedTools)
+        : { effective: undefined, removed: [], applied: false };
+    const effectiveTools = toolResult.effective;
+    let allowlistMeta;
+    if (skillResult.applied || toolResult.applied) {
+        allowlistMeta = {
+            removedSkills: skillResult.removed,
+            removedTools: toolResult.removed,
+            skillsEmptiedByAllowlist: skillResult.applied && effectiveSkills.length === 0,
+            toolsEmptiedByAllowlist: toolResult.applied && (effectiveTools?.length ?? 0) === 0,
+        };
     }
     // 6c. PSYCHE-MEMORY wiring (T1260 E3 — M4 injection primitive).
     //     Build the retrieval bundle for tier-1/2 prompts when a sessionId is
@@ -347,6 +410,9 @@ export async function composeSpawnPayload(db, task, options = {}) {
     if (thinAgentMeta !== undefined) {
         meta.thinAgent = thinAgentMeta;
     }
+    if (allowlistMeta !== undefined) {
+        meta.allowlist = allowlistMeta;
+    }
     return {
         taskId: task.id,
         agentId: resolvedAgent.agentId,
@@ -357,6 +423,8 @@ export async function composeSpawnPayload(db, task, options = {}) {
         atomicity,
         prompt: promptResult.prompt,
         ...(retrievalBundle !== undefined ? { retrievalBundle } : {}),
+        effectiveSkills,
+        ...(effectiveTools !== undefined ? { effectiveTools } : {}),
         meta,
     };
 }

package/dist/orchestration/spawn.js.map

@@ -1 +1 @@
-{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../../src/orchestration/spawn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAwB,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAE1B,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,EAAoB,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,gBAAgB,EAEhB,4BAA4B,GAI7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,gBAAgB,GAGjB,MAAM,iBAAiB,CAAC;AAsSzB,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,SAAiB;IACxC,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,cAAc,CAAC;IAC3C,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACnC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CAAC,IAA0B;IACpD,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,CAAC,CAAC;IACtC,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAgB,EAChB,IAAU,EACV,UAAsC,EAAE;IAExC,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAEtD,0BAA0B;IAC1B,EAAE;IACF,gBAAgB;IAChB,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,qEAAqE;IACrE,6CAA6C;IAC7C,2EAA2E;IAC3E,0EAA0E;IAC1E,gFAAgF;IAChF,IAAI,YAA4B,CAAC;IACjC,IAAI,OAAe,CAAC;IACpB,MAAM,qBAAqB,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC;IAE5D,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAO,GAAG,OAAO,CAAC,OAAQ,CAAC;QAC3B,iEAAiE;QACjE,uEAAuE;QACvE,oEAAoE;QACpE,YAAY,GAAG;YACb,OAAO;YACP,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,QAAQ;YAC9B,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,4DAA4D;YACpE,YAAY,EAAE,OAAO,KAAK,0BAA0B;SACrD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;QAC/B,IAAI,YAAY,CAAC,UAAU,GAAG,yBAAyB,EAAE,CAAC;YACxD,4CAA4C;YAC5C,OAAO,GAAG,0BAA0B,CAAC;QACvC,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,MAAM,aAAa,GAAG,YAAY,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IAEjE,sBAAsB;IACtB,0CAA0C;IAC1C,wEAAwE;IACxE,6CAA6C;IAC7C,mEAAmE;IACnE,MAAM,IAAI,GACR,OAAO,CAAC,IAAI;QACZ,CAAC,CAAC,qBAAqB,IAAI,CAAC,YAAY,CAAC,YAAY;YACnD,CAAC,CAAE,YAAY,CAAC,IAA6B;YAC7C,CAAC,CAAC,eAAe,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhD,2EAA2E;IAC3E,8DAA8D;IAC9D,IAAI,qBAAqB,EAAE,CAAC;QAC1B,YAAY,GAAG,EAAE,GAAG,YAAY,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,qDAAqD;IACrD,MAAM,IAAI,GAAc,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAEjE,4DAA4D;IAC5D,MAAM,UAAU,GAAG,kBAAkB,CAAC;QACpC,QAAQ,EAAE,OAAO,CAAC,WAAW;QAC7B,WAAW;KACZ,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC;IAEpC,sEAAsE;IACtE,sEAAsE;IACtE,iDAAiD;IACjD,4DAA4D;IAC5D,uEAAuE;IACvE,0EAA0E;IAC1E,MAAM,SAAS,GAAoB,OAAO,CAAC,kBAAkB;QAC3D,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;QACnB,CAAC,CAAC,cAAc,CAAC;YACb,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,IAAI;YACJ,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACxC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAC3D;YACD,aAAa,EAAE,IAAI,CAAC,KAAK;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;IAEP,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,aAAa,GAA6B,OAAO,CAAC,oBAAoB,IAAI,QAAQ,CAAC;IACzF,IAAI,aAAoD,CAAC;IACzD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,eAAe,GAAoB,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAC9F,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAC/B,aAAa,CAAC,OAAO,EACrB,IAAI,EACJ,8BAA8B,eAAe,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAC5E,CAAC;QACJ,CAAC;QACD,aAAa,GAAG;YACd,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,eAAe,CAAC,QAAQ;YAClC,QAAQ,EAAE,eAAe,CAAC,QAAQ;SACnC,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,0EAA0E;IAC1E,iFAAiF;IACjF,gFAAgF;IAChF,IAAI,eAA0E,CAAC;IAC/E,IAAI,IAAI,IAAI,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YAC9E,eAAe,GAAG,MAAM,oBAAoB,CAC1C;gBACE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,QAAQ;gBAClC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE;aAChD,EACD,WAAW,CACZ,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,qEAAqE;IACrE,IAAI,oBAAmD,CAAC;IACxD,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CACvE,wBAAwB,CACzB,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5E,MAAM,QAAQ,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,oBAAoB,GAAG,QAAQ,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E,gFAAgF;IAChF,IAAI,cAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAEzE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,iGAAiG;YACjG,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;gBAC9B,YAAY;gBACZ,eAAe;gBACf,iBAAiB;gBACjB,kBAAkB;gBAClB,WAAW;gBACX,UAAU;aACX,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAwB,EAAE,CAAC;YAEzC,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;gBAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;gBACvD,MAAM,MAAM,GAAG,QAAQ,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvE,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,IAAI,4BAA4B,CAAC;gBAEnE,IAAI,WAA+B,CAAC;gBACpC,IAAI,MAAM,IAAI,UAAU,EAAE,CAAC;oBACzB,IAAI,CAAC;wBACH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;wBAC/D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;4BACnB,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;wBAChD,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,4CAA4C;oBAC9C,CAAC;gBACH,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC;YAED,cAAc,GAAG,QAAQ,CAAC;QAC5B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;IAC1E,CAAC;IAED,kDAAkD;IAClD,2EAA2E;IAC3E,4DAA4D;IAC5D,IAAI,gBAAoC,CAAC;IACzC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACd,IAAI,CAAC;YACH,gBAAgB,GAAG,4BAA4B,CAC7C,MAAM,2BAA2B,CAAC,WAAW,CAAC,CAC/C,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,uDAAuD;QACzD,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,iCAAiC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,oBAAoB,GAAG,OAAO,CAAC,cAAc,IAAI,WAAW,KAAK,aAAa,CAAC;IACrF,MAAM,YAAY,GAAG,gBAAgB,CAAC;QACpC,IAAI;QACJ,QAAQ;QACR,IAAI;QACJ,WAAW;QACX,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACpC,WAAW;QACX,sBAAsB,EAAE,CAAC,oBAAoB;QAC7C,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,gBAAgB;QAChB,eAAe;QACf,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,cAAc;QACd,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC;IAEH,uEAAuE;IACvE,wEAAwE;IACxE,wEAAwE;IACxE,cAAc;IACd,MAAM,cAAc,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9E,MAAM,IAAI,GAAqB;QAC7B,UAAU,EAAE,aAAa,CAAC,IAAI;QAC9B,eAAe,EAAE,cAAc;QAC/B,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM;QACvC,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,eAAe,EAAE,OAAO;QACxB,QAAQ,EAAE;YACR,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,IAAI,EAAE,YAAY,CAAC,IAA0C;YAC7D,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,YAAY,EAAE,YAAY,CAAC,YAAY;YACvC,GAAG,CAAC,YAAY,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjF;KACF,CAAC;IACF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,aAAa,CAAC;IACjC,CAAC;IAED,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,OAAO,EAAE,aAAa,CAAC,OAAO;QAC9B,IAAI;QACJ,IAAI;QACJ,WAAW;QACX,aAAa;QACb,SAAS;QACT,MAAM,EAAE,YAAY,CAAC,MAAM;QAC3B,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,IAAI;KACL,CAAC;AACJ,CAAC"}
+{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../../src/orchestration/spawn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAwB,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAE1B,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,EAAoB,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,gBAAgB,EAEhB,4BAA4B,GAI7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,gBAAgB,GAGjB,MAAM,iBAAiB,CAAC;AAgYzB,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;;;;;;;;;;;;;GAcG;AACH,SAAS,cAAc,CACrB,QAA2B,EAC3B,SAAwC;IAExC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC9B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,SAAiB;IACxC,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,cAAc,CAAC;IAC3C,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACnC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CAAC,IAA0B;IACpD,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,CAAC,CAAC;IACtC,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAgB,EAChB,IAAU,EACV,UAAsC,EAAE;IAExC,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAEtD,0BAA0B;IAC1B,EAAE;IACF,gBAAgB;IAChB,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,qEAAqE;IACrE,6CAA6C;IAC7C,2EAA2E;IAC3E,0EAA0E;IAC1E,gFAAgF;IAChF,IAAI,YAA4B,CAAC;IACjC,IAAI,OAAe,CAAC;IACpB,MAAM,qBAAqB,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC;IAE5D,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAO,GAAG,OAAO,CAAC,OAAQ,CAAC;QAC3B,iEAAiE;QACjE,uEAAuE;QACvE,oEAAoE;QACpE,YAAY,GAAG;YACb,OAAO;YACP,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,QAAQ;YAC9B,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,4DAA4D;YACpE,YAAY,EAAE,OAAO,KAAK,0BAA0B;SACrD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;QAC/B,IAAI,YAAY,CAAC,UAAU,GAAG,yBAAyB,EAAE,CAAC;YACxD,4CAA4C;YAC5C,OAAO,GAAG,0BAA0B,CAAC;QACvC,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,MAAM,aAAa,GAAG,YAAY,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IAEjE,sBAAsB;IACtB,0CAA0C;IAC1C,wEAAwE;IACxE,6CAA6C;IAC7C,mEAAmE;IACnE,MAAM,IAAI,GACR,OAAO,CAAC,IAAI;QACZ,CAAC,CAAC,qBAAqB,IAAI,CAAC,YAAY,CAAC,YAAY;YACnD,CAAC,CAAE,YAAY,CAAC,IAA6B;YAC7C,CAAC,CAAC,eAAe,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhD,2EAA2E;IAC3E,8DAA8D;IAC9D,IAAI,qBAAqB,EAAE,CAAC;QAC1B,YAAY,GAAG,EAAE,GAAG,YAAY,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,qDAAqD;IACrD,MAAM,IAAI,GAAc,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAEjE,4DAA4D;IAC5D,MAAM,UAAU,GAAG,kBAAkB,CAAC;QACpC,QAAQ,EAAE,OAAO,CAAC,WAAW;QAC7B,WAAW;KACZ,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC;IAEpC,sEAAsE;IACtE,sEAAsE;IACtE,iDAAiD;IACjD,4DAA4D;IAC5D,uEAAuE;IACvE,0EAA0E;IAC1E,MAAM,SAAS,GAAoB,OAAO,CAAC,kBAAkB;QAC3D,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;QACnB,CAAC,CAAC,cAAc,CAAC;YACb,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,IAAI;YACJ,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACxC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAC3D;YACD,aAAa,EAAE,IAAI,CAAC,KAAK;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;IAEP,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,aAAa,GAA6B,OAAO,CAAC,oBAAoB,IAAI,QAAQ,CAAC;IACzF,IAAI,aAAoD,CAAC;IACzD,2EAA2E;IAC3E,4DAA4D;IAC5D,IAAI,YAA2C,CAAC;IAChD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,eAAe,GAAoB,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAC9F,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAC/B,aAAa,CAAC,OAAO,EACrB,IAAI,EACJ,8BAA8B,eAAe,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAC5E,CAAC;QACJ,CAAC;QACD,aAAa,GAAG;YACd,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,eAAe,CAAC,QAAQ;YAClC,QAAQ,EAAE,eAAe,CAAC,QAAQ;SACnC,CAAC;QACF,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC;IACvC,CAAC;IAED,kEAAkE;IAClE,EAAE;IACF,+EAA+E;IAC/E,+EAA+E;IAC/E,2EAA2E;IAC3E,+EAA+E;IAC/E,+EAA+E;IAC/E,iFAAiF;IACjF,MAAM,WAAW,GAAG,cAAc,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAChF,MAAM,eAAe,GAAG,WAAW,CAAC,SAAS,CAAC;IAC9C,MAAM,UAAU,GACd,YAAY,KAAK,SAAS;QACxB,CAAC,CAAC,cAAc,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC;QACpD,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5D,MAAM,cAAc,GAAG,UAAU,CAAC,SAAS,CAAC;IAE5C,IAAI,aAAoD,CAAC;IACzD,IAAI,WAAW,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QAC9C,aAAa,GAAG;YACd,aAAa,EAAE,WAAW,CAAC,OAAO;YAClC,YAAY,EAAE,UAAU,CAAC,OAAO;YAChC,wBAAwB,EAAE,WAAW,CAAC,OAAO,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;YAC7E,uBAAuB,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC;SACnF,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,0EAA0E;IAC1E,iFAAiF;IACjF,gFAAgF;IAChF,IAAI,eAA0E,CAAC;IAC/E,IAAI,IAAI,IAAI,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YAC9E,eAAe,GAAG,MAAM,oBAAoB,CAC1C;gBACE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,QAAQ;gBAClC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE;aAChD,EACD,WAAW,CACZ,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,qEAAqE;IACrE,IAAI,oBAAmD,CAAC;IACxD,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CACvE,wBAAwB,CACzB,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5E,MAAM,QAAQ,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,oBAAoB,GAAG,QAAQ,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E,gFAAgF;IAChF,IAAI,cAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAEzE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,iGAAiG;YACjG,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;gBAC9B,YAAY;gBACZ,eAAe;gBACf,iBAAiB;gBACjB,kBAAkB;gBAClB,WAAW;gBACX,UAAU;aACX,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAwB,EAAE,CAAC;YAEzC,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;gBAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;gBACvD,MAAM,MAAM,GAAG,QAAQ,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvE,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,IAAI,4BAA4B,CAAC;gBAEnE,IAAI,WAA+B,CAAC;gBACpC,IAAI,MAAM,IAAI,UAAU,EAAE,CAAC;oBACzB,IAAI,CAAC;wBACH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;wBAC/D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;4BACnB,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;wBAChD,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,4CAA4C;oBAC9C,CAAC;gBACH,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC;YAED,cAAc,GAAG,QAAQ,CAAC;QAC5B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;IAC1E,CAAC;IAED,kDAAkD;IAClD,2EAA2E;IAC3E,4DAA4D;IAC5D,IAAI,gBAAoC,CAAC;IACzC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACd,IAAI,CAAC;YACH,gBAAgB,GAAG,4BAA4B,CAC7C,MAAM,2BAA2B,CAAC,WAAW,CAAC,CAC/C,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,uDAAuD;QACzD,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,iCAAiC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,oBAAoB,GAAG,OAAO,CAAC,cAAc,IAAI,WAAW,KAAK,aAAa,CAAC;IACrF,MAAM,YAAY,GAAG,gBAAgB,CAAC;QACpC,IAAI;QACJ,QAAQ;QACR,IAAI;QACJ,WAAW;QACX,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACpC,WAAW;QACX,sBAAsB,EAAE,CAAC,oBAAoB;QAC7C,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,gBAAgB;QAChB,eAAe;QACf,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,cAAc;QACd,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC;IAEH,uEAAuE;IACvE,wEAAwE;IACxE,wEAAwE;IACxE,cAAc;IACd,MAAM,cAAc,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9E,MAAM,IAAI,GAAqB;QAC7B,UAAU,EAAE,aAAa,CAAC,IAAI;QAC9B,eAAe,EAAE,cAAc;QAC/B,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM;QACvC,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,eAAe,EAAE,OAAO;QACxB,QAAQ,EAAE;YACR,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,IAAI,EAAE,YAAY,CAAC,IAA0C;YAC7D,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,YAAY,EAAE,YAAY,CAAC,YAAY;YACvC,GAAG,CAAC,YAAY,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjF;KACF,CAAC;IACF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,aAAa,CAAC;IACjC,CAAC;IACD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,aAAa,CAAC;IACjC,CAAC;IAED,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,OAAO,EAAE,aAAa,CAAC,OAAO;QAC9B,IAAI;QACJ,IAAI;QACJ,WAAW;QACX,aAAa;QACb,SAAS;QACT,MAAM,EAAE,YAAY,CAAC,MAAM;QAC3B,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,eAAe;QACf,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,IAAI;KACL,CAAC;AACJ,CAAC"}

package/dist/playbooks/cantbook-profile.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Cantbook stage LLM-profile resolution (T11759 · M4 cantbook done-gate).
+ *
+ * A `.cantbook` agentic stage can pin its LLM via `profile:` (a named
+ * `llm.profiles` entry), or the inline `model:` / `provider:` escape hatch
+ * ({@link PlaybookAgenticNode}). This module is the single seam the two
+ * production cantbook dispatchers (`buildDefaultDispatcher` in `playbook.ts` and
+ * `buildGoDispatcher` in `go-ivtr-runner.ts`) call to turn that declaration into
+ * a RESOLUTION through the E9 chokepoint.
+ *
+ * ## Gate-13 compliance (no transport construction here)
+ *
+ * This helper ONLY calls {@link resolveLLMForSystem} — the single E9 resolution
+ * chokepoint. It NEVER constructs a transport, an AI-SDK client, or reads a
+ * credential off the wire; the returned {@link ResolvedLLMForSystem} carries the
+ * provider/model/sealed-credential METADATA only. The Pi runner / model-runner
+ * downstream is the sole place a client is built. Passing a resolution hint (the
+ * profile + the cantbook system key) is exactly the Gate-13-allowed seam.
+ *
+ * ## How the cantbook node keys the resolver
+ *
+ * The node identity is encoded as the OPEN-axis system-of-use key
+ * `cantbook:<playbook>#<nodeId>` (via {@link formatSystemKey}), and threaded as
+ * `resolveLLMForSystem`'s `systemKey` option so it drives the
+ * `llm.systems[key]` granular-override tier + audit identity. The flat `system`
+ * argument stays the resolvable `'task-executor'` background label (the same one
+ * the Pi runner uses), and the node's `profile:` flows through `opts.profile` as
+ * the highest-priority pin. When the node declares neither `profile` nor
+ * `model`/`provider`, callers should skip this helper — the resolution is
+ * unchanged.
+ *
+ * @module playbooks/cantbook-profile
+ * @task T11759
+ * @epic T10403
+ */
+import { type ResolvedLLMForSystem } from '../llm/system-resolver.js';
+/** The per-stage LLM pin a `.cantbook` agentic node may declare (T11759). */
+export interface CantbookProfilePin {
+    /** Named `llm.profiles` profile to pin (highest priority when resolvable). */
+    readonly profile?: string;
+    /** Inline model id escape hatch (resolution hint only — no transport built). */
+    readonly model?: string;
+    /** Inline provider transport escape hatch (resolution hint only). */
+    readonly provider?: string;
+}
+/** Inputs to {@link resolveCantbookNodeProfile}. */
+export interface ResolveCantbookNodeProfileInput {
+    /** The playbook (`.cantbook`) name — the first segment of the node identity. */
+    readonly playbookName: string;
+    /** The agentic node id — the second segment of the node identity. */
+    readonly nodeId: string;
+    /** The node's declared LLM pin (`profile` / `model` / `provider`). */
+    readonly pin: CantbookProfilePin;
+    /** Project root for config + credential resolution (defaults to cwd inside E9). */
+    readonly projectRoot?: string;
+}
+/**
+ * Build the canonical OPEN-axis system-of-use key for a cantbook node
+ * (`cantbook:<playbook>#<nodeId>`).
+ *
+ * Exported so the dispatchers + tests assert the exact key the resolver is
+ * threaded with WITHOUT re-implementing the encoding.
+ *
+ * @param playbookName - The `.cantbook` name.
+ * @param nodeId - The agentic node id.
+ * @returns The encoded `cantbook:<playbook>#<nodeId>` key.
+ * @task T11759
+ */
+export declare function cantbookNodeSystemKey(playbookName: string, nodeId: string): string;
+/**
+ * `true` when a node's pin actually declares an LLM override (so the dispatcher
+ * should resolve via {@link resolveCantbookNodeProfile}); `false` when it is the
+ * empty/unset pin and the default resolution path applies unchanged.
+ *
+ * @param pin - The node's declared pin (may be all-undefined).
+ * @returns Whether any of `profile` / `model` / `provider` is set.
+ * @task T11759
+ */
+export declare function hasCantbookProfilePin(pin: CantbookProfilePin): boolean;
+/**
+ * Resolve a cantbook stage's pinned LLM through the E9 chokepoint
+ * ({@link resolveLLMForSystem}).
+ *
+ * Threads the node identity as the `cantbook:<playbook>#<nodeId>` system key and
+ * the node's `profile:` as the highest-priority pin. Inline `model:` / `provider:`
+ * are NOT consumed by the resolver tiers directly (those are not config keys) —
+ * they ride back on the returned envelope as the caller-supplied hint so the
+ * dispatcher can surface them to the spawn / model-runner boundary. This function
+ * NEVER constructs a transport (Gate-13): it only resolves metadata.
+ *
+ * @param input - Playbook name + node id + the declared pin + project root.
+ * @returns The {@link ResolvedLLMForSystem} envelope (metadata only; never throws).
+ * @task T11759
+ */
+export declare function resolveCantbookNodeProfile(input: ResolveCantbookNodeProfileInput): Promise<ResolvedLLMForSystem>;
+//# sourceMappingURL=cantbook-profile.d.ts.map

package/dist/playbooks/cantbook-profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cantbook-profile.d.ts","sourceRoot":"","sources":["../../src/playbooks/cantbook-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAIH,OAAO,EAAE,KAAK,oBAAoB,EAAuB,MAAM,2BAA2B,CAAC;AAS3F,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,oDAAoD;AACpD,MAAM,WAAW,+BAA+B;IAC9C,gFAAgF;IAChF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,mFAAmF;IACnF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAEtE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,+BAA+B,GACrC,OAAO,CAAC,oBAAoB,CAAC,CAQ/B"}

package/dist/playbooks/cantbook-profile.js

@@ -0,0 +1,97 @@
+/**
+ * Cantbook stage LLM-profile resolution (T11759 · M4 cantbook done-gate).
+ *
+ * A `.cantbook` agentic stage can pin its LLM via `profile:` (a named
+ * `llm.profiles` entry), or the inline `model:` / `provider:` escape hatch
+ * ({@link PlaybookAgenticNode}). This module is the single seam the two
+ * production cantbook dispatchers (`buildDefaultDispatcher` in `playbook.ts` and
+ * `buildGoDispatcher` in `go-ivtr-runner.ts`) call to turn that declaration into
+ * a RESOLUTION through the E9 chokepoint.
+ *
+ * ## Gate-13 compliance (no transport construction here)
+ *
+ * This helper ONLY calls {@link resolveLLMForSystem} — the single E9 resolution
+ * chokepoint. It NEVER constructs a transport, an AI-SDK client, or reads a
+ * credential off the wire; the returned {@link ResolvedLLMForSystem} carries the
+ * provider/model/sealed-credential METADATA only. The Pi runner / model-runner
+ * downstream is the sole place a client is built. Passing a resolution hint (the
+ * profile + the cantbook system key) is exactly the Gate-13-allowed seam.
+ *
+ * ## How the cantbook node keys the resolver
+ *
+ * The node identity is encoded as the OPEN-axis system-of-use key
+ * `cantbook:<playbook>#<nodeId>` (via {@link formatSystemKey}), and threaded as
+ * `resolveLLMForSystem`'s `systemKey` option so it drives the
+ * `llm.systems[key]` granular-override tier + audit identity. The flat `system`
+ * argument stays the resolvable `'task-executor'` background label (the same one
+ * the Pi runner uses), and the node's `profile:` flows through `opts.profile` as
+ * the highest-priority pin. When the node declares neither `profile` nor
+ * `model`/`provider`, callers should skip this helper — the resolution is
+ * unchanged.
+ *
+ * @module playbooks/cantbook-profile
+ * @task T11759
+ * @epic T10403
+ */
+import { formatSystemKey } from '../llm/system-key.js';
+import { resolveLLMForSystem } from '../llm/system-resolver.js';
+/**
+ * The flat background {@link SystemOfUseLabel} a cantbook stage resolves its LLM
+ * through. Mirrors the Pi runner's default (`'task-executor'`) so a stage with
+ * NO profile pin resolves to the same background lane the runner already uses.
+ */
+const CANTBOOK_BASE_SYSTEM = 'task-executor';
+/**
+ * Build the canonical OPEN-axis system-of-use key for a cantbook node
+ * (`cantbook:<playbook>#<nodeId>`).
+ *
+ * Exported so the dispatchers + tests assert the exact key the resolver is
+ * threaded with WITHOUT re-implementing the encoding.
+ *
+ * @param playbookName - The `.cantbook` name.
+ * @param nodeId - The agentic node id.
+ * @returns The encoded `cantbook:<playbook>#<nodeId>` key.
+ * @task T11759
+ */
+export function cantbookNodeSystemKey(playbookName, nodeId) {
+    return formatSystemKey({ kind: 'cantbook-node', id: `${playbookName}#${nodeId}` });
+}
+/**
+ * `true` when a node's pin actually declares an LLM override (so the dispatcher
+ * should resolve via {@link resolveCantbookNodeProfile}); `false` when it is the
+ * empty/unset pin and the default resolution path applies unchanged.
+ *
+ * @param pin - The node's declared pin (may be all-undefined).
+ * @returns Whether any of `profile` / `model` / `provider` is set.
+ * @task T11759
+ */
+export function hasCantbookProfilePin(pin) {
+    return pin.profile !== undefined || pin.model !== undefined || pin.provider !== undefined;
+}
+/**
+ * Resolve a cantbook stage's pinned LLM through the E9 chokepoint
+ * ({@link resolveLLMForSystem}).
+ *
+ * Threads the node identity as the `cantbook:<playbook>#<nodeId>` system key and
+ * the node's `profile:` as the highest-priority pin. Inline `model:` / `provider:`
+ * are NOT consumed by the resolver tiers directly (those are not config keys) —
+ * they ride back on the returned envelope as the caller-supplied hint so the
+ * dispatcher can surface them to the spawn / model-runner boundary. This function
+ * NEVER constructs a transport (Gate-13): it only resolves metadata.
+ *
+ * @param input - Playbook name + node id + the declared pin + project root.
+ * @returns The {@link ResolvedLLMForSystem} envelope (metadata only; never throws).
+ * @task T11759
+ */
+export async function resolveCantbookNodeProfile(input) {
+    const systemKey = cantbookNodeSystemKey(input.playbookName, input.nodeId);
+    const opts = { systemKey };
+    if (input.projectRoot !== undefined)
+        opts.projectRoot = input.projectRoot;
+    if (input.pin.profile !== undefined)
+        opts.profile = input.pin.profile;
+    // `resolveLLMForSystem` is the single E9 chokepoint — it owns config tiers,
+    // CredentialPool binding, and the sealed-handle. No client is built here.
+    return resolveLLMForSystem(CANTBOOK_BASE_SYSTEM, opts);
+}
+//# sourceMappingURL=cantbook-profile.js.map

package/dist/playbooks/cantbook-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cantbook-profile.js","sourceRoot":"","sources":["../../src/playbooks/cantbook-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAA6B,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAE3F;;;;GAIG;AACH,MAAM,oBAAoB,GAAqB,eAAe,CAAC;AAwB/D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB,EAAE,MAAc;IACxE,OAAO,eAAe,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,YAAY,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAuB;IAC3D,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC;AAC5F,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAsC;IAEtC,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,IAAI,GAA+B,EAAE,SAAS,EAAE,CAAC;IACvD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IAC1E,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;IACtE,4EAA4E;IAC5E,0EAA0E;IAC1E,OAAO,mBAAmB,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;AACzD,CAAC"}

package/dist/playbooks/guarded-deterministic-runner.d.ts

@@ -0,0 +1,153 @@
+/**
+ * Guarded deterministic-node runner — routes EVERY `deterministic` (shell/tool)
+ * dispatch in `executePlaybook` through the `guard.ts` deny-first chokepoint
+ * (T11802 · M4 cantbook done-gate).
+ *
+ * ## The gap this closes (AC1)
+ *
+ * The playbook runtime (`@cleocode/playbooks/runtime`) executes `deterministic`
+ * nodes through an INJECTED `DeterministicRunner`. When no runner is injected it
+ * degrades to `AgentDispatcher.dispatch` with a synthetic `deterministic:<cmd>`
+ * agent id — a path that NEVER touches the `guard.ts` shell denylist. So a
+ * `.cantbook` shell step could spawn a subprocess that bypasses the single
+ * policy point.
+ *
+ * This factory builds the CANONICAL production `DeterministicRunner`: every
+ * command is funnelled through the injected {@link GuardedToolSurface}'s
+ * `executeShell` — the SAME deny-first command policy + env-scrub chokepoint
+ * (`createToolGuard`) that in-process skill nodes already use (T11477). There is
+ * NO second subprocess code path: shell steps and skill→tool calls share ONE
+ * guard. The runtime stays a pure state machine (it imports no `child_process`);
+ * the guard owns the spawn (AC1).
+ *
+ * ## Deny semantics (AC3)
+ *
+ * The guard's `executeShell` checks the command basename against the policy
+ * denylist BEFORE any process is spawned. In `mode: 'enforce'` a denied command
+ * rejects with {@link GuardDeniedError} (`E_TOOL_GUARD_DENIED`); this runner
+ * catches that rejection and maps it to a contract-clean
+ * `{ status: 'failure', error }` envelope so the runtime's retry / escalation
+ * semantics stay intact (the runtime contract is non-throwing). In `mode: 'warn'`
+ * the guard logs-and-proceeds — the denylist is advisory — so a guarded runner
+ * built for enforcement MUST be constructed from an `enforce`-mode guard.
+ *
+ * ## Why a factory over a guard (DIP)
+ *
+ * The runner depends on the abstract {@link GuardedToolSurface} (the contract
+ * shape of `createToolGuard()`), NOT on the concrete guard — so the policy point
+ * is injected, exactly mirroring {@link createSkillNodeExecutor}. `core` builds
+ * the guard once (`createToolGuard({ allowedRoots, deniedCommands, mode })`) and
+ * hands the same surface to BOTH the skill executor and this deterministic
+ * runner.
+ *
+ * @epic T11391
+ * @task T11802
+ * @saga T11387
+ * @see ../tools/guard.ts — the deny-first chokepoint
+ * @see ./skill-node-executor.ts — the sibling in-process skill path
+ */
+import type { GuardedToolSurface } from '@cleocode/contracts/tools/skill-executor';
+/**
+ * Canonical deny-list of destructive command basenames a `.cantbook`
+ * `deterministic` node may NOT run (T11802 · AC3). This is the SSoT the
+ * production dispatcher hands to `createToolGuard({ deniedCommands })` so the
+ * SAME chokepoint that guards in-process skill→tool calls also rejects a
+ * dangerous shell step. Matched against the command's last path segment by the
+ * guard, so `/bin/rm` and `rm` are both denied.
+ *
+ * Intentionally conservative — destructive disk / process / system operations a
+ * planning playbook should never invoke. Extend deliberately; every addition is
+ * a policy decision.
+ */
+export declare const DEFAULT_DETERMINISTIC_DENIED_COMMANDS: readonly string[];
+/**
+ * Minimal projection of the playbook runtime's `DeterministicRunInput` that the
+ * guarded runner consumes. Declared structurally so `@cleocode/core` does NOT
+ * import `@cleocode/playbooks` (preserves the directed layering
+ * `contracts → core → playbooks`). The runtime's input is structurally
+ * assignable to this shape.
+ */
+export interface GuardedDeterministicInput {
+    /** Playbook run identifier (FK into `playbook_runs.run_id`). */
+    readonly runId: string;
+    /** Node identifier within the run graph. */
+    readonly nodeId: string;
+    /** Executable to run (NOT a shell string — args are passed separately). */
+    readonly command: string;
+    /** Arguments passed to {@link GuardedDeterministicInput.command}. */
+    readonly args: readonly string[];
+    /** Working directory. Defaults to `process.cwd()` in the shell primitive. */
+    readonly cwd?: string;
+    /** Extra environment variables merged (and scrubbed) over the child env. */
+    readonly env?: Readonly<Record<string, string>>;
+    /** Hard timeout in milliseconds; the process is killed when exceeded. */
+    readonly timeout_ms?: number;
+}
+/**
+ * Terminal output of a guarded deterministic execution. Structurally identical
+ * to the runtime's `DeterministicRunResult` so this runner is assignable to the
+ * runtime's `DeterministicRunner` interface without a wrapper.
+ */
+export interface GuardedDeterministicResult {
+    status: 'success' | 'failure';
+    /** Key-value pairs merged into the run context on success. */
+    output: Record<string, unknown>;
+    /** Human-readable failure reason on `status === 'failure'`. */
+    error?: string;
+}
+/**
+ * Structural match for the playbook runtime's `DeterministicRunner` interface.
+ * Re-declared here (not imported) for the same directed-layering reason as
+ * {@link GuardedDeterministicInput}.
+ */
+export interface GuardedDeterministicRunner {
+    run(input: GuardedDeterministicInput): Promise<GuardedDeterministicResult>;
+}
+/**
+ * Options accepted by {@link createGuardedDeterministicRunner}.
+ *
+ * @task T11802
+ */
+export interface GuardedDeterministicRunnerOptions {
+    /**
+     * The deny-first guarded tool surface every deterministic command is routed
+     * through. Typically the SAME `createToolGuard({ allowedRoots, deniedCommands,
+     * mode })` result handed to the in-process skill executor — so shell steps and
+     * skill→tool calls share ONE policy point. Injected (DIP) — the runner never
+     * constructs its own guard.
+     */
+    readonly tools: GuardedToolSurface;
+}
+/**
+ * Build a {@link GuardedDeterministicRunner} that routes EVERY `deterministic`
+ * node command through the injected guard's `executeShell` (T11802 · AC1).
+ *
+ * Inject the result as `deterministicRunner` when calling `executePlaybook`:
+ *
+ * @example
+ * ```ts
+ * import { createToolGuard } from '@cleocode/core/internal';
+ *
+ * const tools = createToolGuard({
+ *   allowedRoots: [projectRoot],
+ *   deniedCommands: ['rm', 'shutdown', 'mkfs'],
+ *   mode: 'enforce',
+ * });
+ * await executePlaybook({
+ *   db, playbook, playbookHash, initialContext, dispatcher,
+ *   deterministicRunner: createGuardedDeterministicRunner({ tools }),
+ * });
+ * // A `deterministic` node running `rm` → guard rejects → { status: 'failure' }
+ * ```
+ *
+ * The returned runner NEVER throws — a guard `enforce`-mode rejection
+ * ({@link import('../tools/guard.js').GuardDeniedError}) is caught and mapped to
+ * a `{ status: 'failure', error }` envelope so the runtime's retry / escalation
+ * stays intact (the runtime's `DeterministicRunner` contract is non-throwing).
+ *
+ * @param opts - The injected guarded tool surface.
+ * @returns A runner assignable to the runtime's `DeterministicRunner`.
+ * @task T11802
+ */
+export declare function createGuardedDeterministicRunner(opts: GuardedDeterministicRunnerOptions): GuardedDeterministicRunner;
+//# sourceMappingURL=guarded-deterministic-runner.d.ts.map

package/dist/playbooks/guarded-deterministic-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guarded-deterministic-runner.d.ts","sourceRoot":"","sources":["../../src/playbooks/guarded-deterministic-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAEnF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,EAAE,SAAS,MAAM,EAYjE,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,yEAAyE;IACzE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,GAAG,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAC5E;AAED;;;;GAIG;AACH,MAAM,WAAW,iCAAiC;IAChD;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,iCAAiC,GACtC,0BAA0B,CAiD5B"}

package/dist/playbooks/guarded-deterministic-runner.js

@@ -0,0 +1,155 @@
+/**
+ * Guarded deterministic-node runner — routes EVERY `deterministic` (shell/tool)
+ * dispatch in `executePlaybook` through the `guard.ts` deny-first chokepoint
+ * (T11802 · M4 cantbook done-gate).
+ *
+ * ## The gap this closes (AC1)
+ *
+ * The playbook runtime (`@cleocode/playbooks/runtime`) executes `deterministic`
+ * nodes through an INJECTED `DeterministicRunner`. When no runner is injected it
+ * degrades to `AgentDispatcher.dispatch` with a synthetic `deterministic:<cmd>`
+ * agent id — a path that NEVER touches the `guard.ts` shell denylist. So a
+ * `.cantbook` shell step could spawn a subprocess that bypasses the single
+ * policy point.
+ *
+ * This factory builds the CANONICAL production `DeterministicRunner`: every
+ * command is funnelled through the injected {@link GuardedToolSurface}'s
+ * `executeShell` — the SAME deny-first command policy + env-scrub chokepoint
+ * (`createToolGuard`) that in-process skill nodes already use (T11477). There is
+ * NO second subprocess code path: shell steps and skill→tool calls share ONE
+ * guard. The runtime stays a pure state machine (it imports no `child_process`);
+ * the guard owns the spawn (AC1).
+ *
+ * ## Deny semantics (AC3)
+ *
+ * The guard's `executeShell` checks the command basename against the policy
+ * denylist BEFORE any process is spawned. In `mode: 'enforce'` a denied command
+ * rejects with {@link GuardDeniedError} (`E_TOOL_GUARD_DENIED`); this runner
+ * catches that rejection and maps it to a contract-clean
+ * `{ status: 'failure', error }` envelope so the runtime's retry / escalation
+ * semantics stay intact (the runtime contract is non-throwing). In `mode: 'warn'`
+ * the guard logs-and-proceeds — the denylist is advisory — so a guarded runner
+ * built for enforcement MUST be constructed from an `enforce`-mode guard.
+ *
+ * ## Why a factory over a guard (DIP)
+ *
+ * The runner depends on the abstract {@link GuardedToolSurface} (the contract
+ * shape of `createToolGuard()`), NOT on the concrete guard — so the policy point
+ * is injected, exactly mirroring {@link createSkillNodeExecutor}. `core` builds
+ * the guard once (`createToolGuard({ allowedRoots, deniedCommands, mode })`) and
+ * hands the same surface to BOTH the skill executor and this deterministic
+ * runner.
+ *
+ * @epic T11391
+ * @task T11802
+ * @saga T11387
+ * @see ../tools/guard.ts — the deny-first chokepoint
+ * @see ./skill-node-executor.ts — the sibling in-process skill path
+ */
+/**
+ * Canonical deny-list of destructive command basenames a `.cantbook`
+ * `deterministic` node may NOT run (T11802 · AC3). This is the SSoT the
+ * production dispatcher hands to `createToolGuard({ deniedCommands })` so the
+ * SAME chokepoint that guards in-process skill→tool calls also rejects a
+ * dangerous shell step. Matched against the command's last path segment by the
+ * guard, so `/bin/rm` and `rm` are both denied.
+ *
+ * Intentionally conservative — destructive disk / process / system operations a
+ * planning playbook should never invoke. Extend deliberately; every addition is
+ * a policy decision.
+ */
+export const DEFAULT_DETERMINISTIC_DENIED_COMMANDS = Object.freeze([
+    'rm',
+    'rmdir',
+    'shutdown',
+    'reboot',
+    'mkfs',
+    'dd',
+    'shred',
+    'fdisk',
+    'mkswap',
+    'kill',
+    'killall',
+]);
+/**
+ * Build a {@link GuardedDeterministicRunner} that routes EVERY `deterministic`
+ * node command through the injected guard's `executeShell` (T11802 · AC1).
+ *
+ * Inject the result as `deterministicRunner` when calling `executePlaybook`:
+ *
+ * @example
+ * ```ts
+ * import { createToolGuard } from '@cleocode/core/internal';
+ *
+ * const tools = createToolGuard({
+ *   allowedRoots: [projectRoot],
+ *   deniedCommands: ['rm', 'shutdown', 'mkfs'],
+ *   mode: 'enforce',
+ * });
+ * await executePlaybook({
+ *   db, playbook, playbookHash, initialContext, dispatcher,
+ *   deterministicRunner: createGuardedDeterministicRunner({ tools }),
+ * });
+ * // A `deterministic` node running `rm` → guard rejects → { status: 'failure' }
+ * ```
+ *
+ * The returned runner NEVER throws — a guard `enforce`-mode rejection
+ * ({@link import('../tools/guard.js').GuardDeniedError}) is caught and mapped to
+ * a `{ status: 'failure', error }` envelope so the runtime's retry / escalation
+ * stays intact (the runtime's `DeterministicRunner` contract is non-throwing).
+ *
+ * @param opts - The injected guarded tool surface.
+ * @returns A runner assignable to the runtime's `DeterministicRunner`.
+ * @task T11802
+ */
+export function createGuardedDeterministicRunner(opts) {
+    const { tools } = opts;
+    return {
+        async run(input) {
+            try {
+                // The guard checks the command basename against the denylist BEFORE
+                // spawning (deny → reject in enforce mode), then scrubs the child env at
+                // the chokepoint. This is the ONLY shell-spawn path for deterministic
+                // nodes — there is no bypass.
+                const result = await tools.executeShell({
+                    command: input.command,
+                    args: [...input.args],
+                    ...(input.cwd !== undefined ? { cwd: input.cwd } : {}),
+                    ...(input.env !== undefined ? { env: input.env } : {}),
+                    ...(input.timeout_ms !== undefined ? { timeoutMs: input.timeout_ms } : {}),
+                });
+                // A non-zero exit is a node failure, not a thrown error — mirror the
+                // shell primitive's "exit code is the result" contract.
+                if (result.code === 0) {
+                    return {
+                        status: 'success',
+                        output: {
+                            [`${input.nodeId}_stdout`]: result.stdout,
+                            [`${input.nodeId}_exitCode`]: result.code,
+                        },
+                    };
+                }
+                return {
+                    status: 'failure',
+                    output: {
+                        [`${input.nodeId}_stdout`]: result.stdout,
+                        [`${input.nodeId}_stderr`]: result.stderr,
+                        [`${input.nodeId}_exitCode`]: result.code,
+                    },
+                    error: `deterministic node "${input.nodeId}" command "${input.command}" exited ` +
+                        `${result.code === null ? 'on signal/timeout' : `with code ${result.code}`}`,
+                };
+            }
+            catch (err) {
+                // Guard-denied (enforce mode) or an unexpected spawn error — never let it
+                // escape; the runtime contract is non-throwing.
+                return {
+                    status: 'failure',
+                    output: {},
+                    error: err instanceof Error ? err.message : String(err),
+                };
+            }
+        },
+    };
+}
+//# sourceMappingURL=guarded-deterministic-runner.js.map