@cleocode/git-shim 2026.5.16 → 2026.5.17

package/dist/__tests__/isolation-boundary.test.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Tests for the T1761 isolation boundary check in the git-shim.
+ *
+ * Verifies:
+ * - `isCwdInsideWorktree` correctly identifies in/out-of-boundary paths.
+ * - `evaluateIsolationBoundary` fires ONLY for:
+ *     - CLEO_AGENT_ROLE=worker
+ *     - CLEO_WORKTREE_ROOT set to an absolute path
+ *     - A mutation subcommand (add, commit, rm, mv, restore, apply, am)
+ *     - cwd outside CLEO_WORKTREE_ROOT
+ * - The check is skipped for non-worker roles (lead, subagent, orchestrator).
+ * - The check is skipped when CLEO_WORKTREE_ROOT is absent.
+ * - The check is skipped for read-only subcommands (log, status, diff).
+ * - The check passes when cwd equals the worktree root or is a descendant.
+ * - Drift detection: `ISOLATION_ENV_KEYS` from `@cleocode/contracts` contains
+ *   exactly the two keys consumed by `evaluateIsolationBoundary`
+ *   (`CLEO_WORKTREE_ROOT` and `CLEO_AGENT_ROLE`), so a schema change in
+ *   contracts will cause this test to fail loudly.
+ *
+ * @task T1761
+ */
+export {};
+//# sourceMappingURL=isolation-boundary.test.d.ts.map

package/dist/__tests__/isolation-boundary.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolation-boundary.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/isolation-boundary.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG"}

package/dist/__tests__/isolation-boundary.test.js

@@ -0,0 +1,291 @@
+/**
+ * Tests for the T1761 isolation boundary check in the git-shim.
+ *
+ * Verifies:
+ * - `isCwdInsideWorktree` correctly identifies in/out-of-boundary paths.
+ * - `evaluateIsolationBoundary` fires ONLY for:
+ *     - CLEO_AGENT_ROLE=worker
+ *     - CLEO_WORKTREE_ROOT set to an absolute path
+ *     - A mutation subcommand (add, commit, rm, mv, restore, apply, am)
+ *     - cwd outside CLEO_WORKTREE_ROOT
+ * - The check is skipped for non-worker roles (lead, subagent, orchestrator).
+ * - The check is skipped when CLEO_WORKTREE_ROOT is absent.
+ * - The check is skipped for read-only subcommands (log, status, diff).
+ * - The check passes when cwd equals the worktree root or is a descendant.
+ * - Drift detection: `ISOLATION_ENV_KEYS` from `@cleocode/contracts` contains
+ *   exactly the two keys consumed by `evaluateIsolationBoundary`
+ *   (`CLEO_WORKTREE_ROOT` and `CLEO_AGENT_ROLE`), so a schema change in
+ *   contracts will cause this test to fail loudly.
+ *
+ * @task T1761
+ */
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { ISOLATION_ENV_KEYS } from '@cleocode/contracts';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { evaluateIsolationBoundary, isCwdInsideWorktree } from '../isolation-boundary.js';
+// ---------------------------------------------------------------------------
+// Environment management
+// ---------------------------------------------------------------------------
+const ENV_KEYS_UNDER_TEST = [
+    'CLEO_AGENT_ROLE',
+    'CLEO_WORKTREE_ROOT',
+    'XDG_DATA_HOME',
+    'CLEO_AUDIT_LOG_PATH',
+];
+const savedEnv = {};
+let workspace;
+beforeEach(() => {
+    for (const key of ENV_KEYS_UNDER_TEST)
+        savedEnv[key] = process.env[key];
+    workspace = mkdtempSync(join(tmpdir(), 'cleo-git-shim-T1761-'));
+    process.env['XDG_DATA_HOME'] = workspace;
+    process.env['CLEO_AUDIT_LOG_PATH'] = join(workspace, 'audit', 'git-shim.jsonl');
+});
+afterEach(() => {
+    for (const key of ENV_KEYS_UNDER_TEST) {
+        const v = savedEnv[key];
+        if (v === undefined)
+            delete process.env[key];
+        else
+            process.env[key] = v;
+    }
+    rmSync(workspace, { recursive: true, force: true });
+});
+// ---------------------------------------------------------------------------
+// isCwdInsideWorktree — pure path helper
+// ---------------------------------------------------------------------------
+describe('isCwdInsideWorktree', () => {
+    it('returns true when cwd equals the worktree root', () => {
+        expect(isCwdInsideWorktree('/home/user/wt/T1761', '/home/user/wt/T1761')).toBe(true);
+    });
+    it('returns true when cwd is a direct child of the worktree root', () => {
+        expect(isCwdInsideWorktree('/home/user/wt/T1761/packages', '/home/user/wt/T1761')).toBe(true);
+    });
+    it('returns true when cwd is a deeply nested descendant', () => {
+        expect(isCwdInsideWorktree('/home/user/wt/T1761/packages/core/src', '/home/user/wt/T1761')).toBe(true);
+    });
+    it('returns false when cwd is the parent of the worktree root', () => {
+        expect(isCwdInsideWorktree('/home/user/wt', '/home/user/wt/T1761')).toBe(false);
+    });
+    it('returns false when cwd is a sibling worktree', () => {
+        expect(isCwdInsideWorktree('/home/user/wt/T1760', '/home/user/wt/T1761')).toBe(false);
+    });
+    it('returns false when cwd is the project root (main repo)', () => {
+        expect(isCwdInsideWorktree('/mnt/projects/cleocode', '/home/user/wt/T1761')).toBe(false);
+    });
+    it('returns false when cwd shares a prefix but is not a descendant', () => {
+        // "/home/user/wt/T1761extra" should NOT match "/home/user/wt/T1761"
+        expect(isCwdInsideWorktree('/home/user/wt/T1761extra', '/home/user/wt/T1761')).toBe(false);
+    });
+    it('handles trailing slash on worktreeRoot gracefully', () => {
+        // resolve() strips trailing slashes — both should behave identically
+        expect(isCwdInsideWorktree('/home/user/wt/T1761/sub', '/home/user/wt/T1761/')).toBe(true);
+    });
+});
+// ---------------------------------------------------------------------------
+// evaluateIsolationBoundary — env-driven logic
+// ---------------------------------------------------------------------------
+describe('evaluateIsolationBoundary', () => {
+    const worktreeRoot = '/home/user/.local/share/cleo/worktrees/abc123/T1761';
+    const outsideCwd = '/mnt/projects/cleocode';
+    /**
+     * Helper: spy on process.cwd() to return a synthetic value.
+     */
+    function mockCwd(path) {
+        return vi.spyOn(process, 'cwd').mockReturnValue(path);
+    }
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+    // -- worker + mutation subcommands + outside worktree = BLOCKED ----------------
+    it('blocks git add when worker cwd is outside CLEO_WORKTREE_ROOT', () => {
+        process.env['CLEO_AGENT_ROLE'] = 'worker';
+        process.env['CLEO_WORKTREE_ROOT'] = worktreeRoot;
+        mockCwd(outsideCwd);
+        const result = evaluateIsolationBoundary('add');
+        expect(result).not.toBeNull();
+        expect(result?.code).toBe('E_GIT_BOUNDARY_CWD_OUTSIDE_WORKTREE');
+        expect(result?.boundary).toBe('isolation');
+        expect(result?.context['cwd']).toBe(outsideCwd);
+        expect(result?.context['worktree_root']).toBe(worktreeRoot);
+    });
+    it('blocks git commit when worker cwd is outside CLEO_WORKTREE_ROOT', () => {
+        process.env['CLEO_AGENT_ROLE'] = 'worker';
+        process.env['CLEO_WORKTREE_ROOT'] = worktreeRoot;
+        mockCwd(outsideCwd);
+        const result = evaluateIsolationBoundary('commit');
+        expect(result).not.toBeNull();
+        expect(result?.code).toBe('E_GIT_BOUNDARY_CWD_OUTSIDE_WORKTREE');
+    });
+    it('blocks git rm when worker cwd is outside CLEO_WORKTREE_ROOT', () => {
+        process.env['CLEO_AGENT_ROLE'] = 'worker';
+        process.env['CLEO_WORKTREE_ROOT'] = worktreeRoot;
+        mockCwd(outsideCwd);
+        expect(evaluateIsolationBoundary('rm')).not.toBeNull();
+    });
+    it('blocks git mv when worker cwd is outside CLEO_WORKTREE_ROOT', () => {
+        process.env['CLEO_AGENT_ROLE'] = 'worker';
+        process.env['CLEO_WORKTREE_ROOT'] = worktreeRoot;
+        mockCwd(outsideCwd);
+        expect(evaluateIsolationBoundary('mv')).not.toBeNull();
+    });
+    it('blocks git restore when worker cwd is outside CLEO_WORKTREE_ROOT', () => {
+        process.env['CLEO_AGENT_ROLE'] = 'worker';
+        process.env['CLEO_WORKTREE_ROOT'] = worktreeRoot;
+        mockCwd(outsideCwd);
+        expect(evaluateIsolationBoundary('restore')).not.toBeNull();
+    });
+    it('blocks git apply when worker cwd is outside CLEO_WORKTREE_ROOT', () => {
+        process.env['CLEO_AGENT_ROLE'] = 'worker';
+        process.env['CLEO_WORKTREE_ROOT'] = worktreeRoot;
+        mockCwd(outsideCwd);
+        expect(evaluateIsolationBoundary('apply')).not.toBeNull();
+    });
+    it('blocks git am when worker cwd is outside CLEO_WORKTREE_ROOT', () => {
+        process.env['CLEO_AGENT_ROLE'] = 'worker';
+        process.env['CLEO_WORKTREE_ROOT'] = worktreeRoot;
+        mockCwd(outsideCwd);
+        expect(evaluateIsolationBoundary('am')).not.toBeNull();
+    });
+    // -- cwd inside worktree = allowed -------------------------------------------
+    it('allows git add when worker cwd equals the worktree root', () => {
+        process.env['CLEO_AGENT_ROLE'] = 'worker';
+        process.env['CLEO_WORKTREE_ROOT'] = worktreeRoot;
+        mockCwd(worktreeRoot);
+        expect(evaluateIsolationBoundary('add')).toBeNull();
+    });
+    it('allows git add when worker cwd is a subdirectory of worktree root', () => {
+        process.env['CLEO_AGENT_ROLE'] = 'worker';
+        process.env['CLEO_WORKTREE_ROOT'] = worktreeRoot;
+        mockCwd(`${worktreeRoot}/packages/core/src`);
+        expect(evaluateIsolationBoundary('add')).toBeNull();
+    });
+    // -- non-worker roles = skip check -------------------------------------------
+    it('skips check when CLEO_AGENT_ROLE=lead', () => {
+        process.env['CLEO_AGENT_ROLE'] = 'lead';
+        process.env['CLEO_WORKTREE_ROOT'] = worktreeRoot;
+        mockCwd(outsideCwd);
+        expect(evaluateIsolationBoundary('add')).toBeNull();
+    });
+    it('skips check when CLEO_AGENT_ROLE=subagent', () => {
+        process.env['CLEO_AGENT_ROLE'] = 'subagent';
+        process.env['CLEO_WORKTREE_ROOT'] = worktreeRoot;
+        mockCwd(outsideCwd);
+        expect(evaluateIsolationBoundary('add')).toBeNull();
+    });
+    it('skips check when CLEO_AGENT_ROLE=orchestrator', () => {
+        process.env['CLEO_AGENT_ROLE'] = 'orchestrator';
+        process.env['CLEO_WORKTREE_ROOT'] = worktreeRoot;
+        mockCwd(outsideCwd);
+        expect(evaluateIsolationBoundary('add')).toBeNull();
+    });
+    it('skips check when CLEO_AGENT_ROLE is absent', () => {
+        delete process.env['CLEO_AGENT_ROLE'];
+        process.env['CLEO_WORKTREE_ROOT'] = worktreeRoot;
+        mockCwd(outsideCwd);
+        expect(evaluateIsolationBoundary('add')).toBeNull();
+    });
+    // -- CLEO_WORKTREE_ROOT absent = skip check ----------------------------------
+    it('skips check when CLEO_WORKTREE_ROOT is not set', () => {
+        process.env['CLEO_AGENT_ROLE'] = 'worker';
+        delete process.env['CLEO_WORKTREE_ROOT'];
+        mockCwd(outsideCwd);
+        expect(evaluateIsolationBoundary('add')).toBeNull();
+    });
+    it('skips check when CLEO_WORKTREE_ROOT is empty string', () => {
+        process.env['CLEO_AGENT_ROLE'] = 'worker';
+        process.env['CLEO_WORKTREE_ROOT'] = '';
+        mockCwd(outsideCwd);
+        expect(evaluateIsolationBoundary('add')).toBeNull();
+    });
+    // -- read-only subcommands = skip check --------------------------------------
+    it('skips check for git log (read-only)', () => {
+        process.env['CLEO_AGENT_ROLE'] = 'worker';
+        process.env['CLEO_WORKTREE_ROOT'] = worktreeRoot;
+        mockCwd(outsideCwd);
+        expect(evaluateIsolationBoundary('log')).toBeNull();
+    });
+    it('skips check for git status (read-only)', () => {
+        process.env['CLEO_AGENT_ROLE'] = 'worker';
+        process.env['CLEO_WORKTREE_ROOT'] = worktreeRoot;
+        mockCwd(outsideCwd);
+        expect(evaluateIsolationBoundary('status')).toBeNull();
+    });
+    it('skips check for git diff (read-only)', () => {
+        process.env['CLEO_AGENT_ROLE'] = 'worker';
+        process.env['CLEO_WORKTREE_ROOT'] = worktreeRoot;
+        mockCwd(outsideCwd);
+        expect(evaluateIsolationBoundary('diff')).toBeNull();
+    });
+    it('skips check for git show (read-only)', () => {
+        process.env['CLEO_AGENT_ROLE'] = 'worker';
+        process.env['CLEO_WORKTREE_ROOT'] = worktreeRoot;
+        mockCwd(outsideCwd);
+        expect(evaluateIsolationBoundary('show')).toBeNull();
+    });
+    // -- error message content ---------------------------------------------------
+    it('includes cwd, worktree_root, and role in the violation context', () => {
+        process.env['CLEO_AGENT_ROLE'] = 'worker';
+        process.env['CLEO_WORKTREE_ROOT'] = worktreeRoot;
+        mockCwd(outsideCwd);
+        const result = evaluateIsolationBoundary('commit');
+        expect(result?.context).toMatchObject({
+            cwd: outsideCwd,
+            worktree_root: worktreeRoot,
+            role: 'worker',
+        });
+    });
+    it('message mentions the subcommand and outside-worktree context', () => {
+        process.env['CLEO_AGENT_ROLE'] = 'worker';
+        process.env['CLEO_WORKTREE_ROOT'] = worktreeRoot;
+        mockCwd(outsideCwd);
+        const result = evaluateIsolationBoundary('add');
+        expect(result?.message).toContain('git add');
+        expect(result?.message).toContain('outside');
+        expect(result?.message).toContain('worktree');
+    });
+    it('remediation mentions CLEO_ALLOW_GIT=1', () => {
+        process.env['CLEO_AGENT_ROLE'] = 'worker';
+        process.env['CLEO_WORKTREE_ROOT'] = worktreeRoot;
+        mockCwd(outsideCwd);
+        const result = evaluateIsolationBoundary('add');
+        expect(result?.remediation).toContain('CLEO_ALLOW_GIT=1');
+    });
+});
+// ---------------------------------------------------------------------------
+// Drift detection — ISOLATION_ENV_KEYS must cover the vars this file uses
+// ---------------------------------------------------------------------------
+describe('drift detection: ISOLATION_ENV_KEYS alignment', () => {
+    it('ISOLATION_ENV_KEYS includes CLEO_WORKTREE_ROOT', () => {
+        expect(ISOLATION_ENV_KEYS).toContain('CLEO_WORKTREE_ROOT');
+    });
+    it('ISOLATION_ENV_KEYS includes CLEO_AGENT_ROLE', () => {
+        expect(ISOLATION_ENV_KEYS).toContain('CLEO_AGENT_ROLE');
+    });
+    it('evaluateIsolationBoundary uses ISOLATION_ENV_KEYS[0] for CLEO_WORKTREE_ROOT and ISOLATION_ENV_KEYS[1] for CLEO_AGENT_ROLE', () => {
+        // This test encodes the positional expectations so that if the const tuple
+        // order changes in @cleocode/contracts, this test fails loudly — forcing a
+        // corresponding update in shim.ts.
+        expect(ISOLATION_ENV_KEYS[0]).toBe('CLEO_WORKTREE_ROOT');
+        expect(ISOLATION_ENV_KEYS[1]).toBe('CLEO_AGENT_ROLE');
+    });
+    it('ISOLATION_ENV_KEYS has no unknown keys relative to GitShimEnv interface', () => {
+        // GitShimEnv documents the env vars consumed by the shim as a whole.
+        // ISOLATION_ENV_KEYS is the subset injected by provisionIsolatedShell.
+        // All ISOLATION_ENV_KEYS must be a subset of the documented GitShimEnv keys.
+        const knownShimEnvKeys = new Set([
+            'CLEO_AGENT_ROLE',
+            'CLEO_ALLOW_BRANCH_OPS',
+            'CLEO_WORKTREE_ROOT',
+            'CLEO_BRANCH_PROTECTION',
+            'CLEO_WORKTREE_BRANCH',
+            'CLEO_PROJECT_HASH',
+        ]);
+        for (const key of ISOLATION_ENV_KEYS) {
+            expect(knownShimEnvKeys.has(key)).toBe(true);
+        }
+    });
+});
+//# sourceMappingURL=isolation-boundary.test.js.map

package/dist/__tests__/isolation-boundary.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolation-boundary.test.js","sourceRoot":"","sources":["../../src/__tests__/isolation-boundary.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE1F,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,MAAM,mBAAmB,GAAG;IAC1B,iBAAiB;IACjB,oBAAoB;IACpB,eAAe;IACf,qBAAqB;CACtB,CAAC;AACF,MAAM,QAAQ,GAAuC,EAAE,CAAC;AAExD,IAAI,SAAiB,CAAC;AAEtB,UAAU,CAAC,GAAG,EAAE;IACd,KAAK,MAAM,GAAG,IAAI,mBAAmB;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxE,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,SAAS,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;AAClF,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;YACxC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAE9E,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,mBAAmB,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,mBAAmB,CAAC,8BAA8B,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CACJ,mBAAmB,CAAC,uCAAuC,EAAE,qBAAqB,CAAC,CACpF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,mBAAmB,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,mBAAmB,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,mBAAmB,CAAC,wBAAwB,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,oEAAoE;QACpE,MAAM,CAAC,mBAAmB,CAAC,0BAA0B,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,qEAAqE;QACrE,MAAM,CAAC,mBAAmB,CAAC,yBAAyB,EAAE,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAE9E,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,MAAM,YAAY,GAAG,qDAAqD,CAAC;IAC3E,MAAM,UAAU,GAAG,wBAAwB,CAAC;IAE5C;;OAEG;IACH,SAAS,OAAO,CAAC,IAAY;QAC3B,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC;IAED,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,iFAAiF;IAEjF,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,YAAY,CAAC;QACjD,OAAO,CAAC,UAAU,CAAC,CAAC;QAEpB,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,YAAY,CAAC;QACjD,OAAO,CAAC,UAAU,CAAC,CAAC;QAEpB,MAAM,MAAM,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,YAAY,CAAC;QACjD,OAAO,CAAC,UAAU,CAAC,CAAC;QACpB,MAAM,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,YAAY,CAAC;QACjD,OAAO,CAAC,UAAU,CAAC,CAAC;QACpB,MAAM,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,YAAY,CAAC;QACjD,OAAO,CAAC,UAAU,CAAC,CAAC;QACpB,MAAM,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,YAAY,CAAC;QACjD,OAAO,CAAC,UAAU,CAAC,CAAC;QACpB,MAAM,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,YAAY,CAAC;QACjD,OAAO,CAAC,UAAU,CAAC,CAAC;QACpB,MAAM,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAE/E,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,YAAY,CAAC;QACjD,OAAO,CAAC,YAAY,CAAC,CAAC;QACtB,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,YAAY,CAAC;QACjD,OAAO,CAAC,GAAG,YAAY,oBAAoB,CAAC,CAAC;QAC7C,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAE/E,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,YAAY,CAAC;QACjD,OAAO,CAAC,UAAU,CAAC,CAAC;QACpB,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,UAAU,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,YAAY,CAAC;QACjD,OAAO,CAAC,UAAU,CAAC,CAAC;QACpB,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,cAAc,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,YAAY,CAAC;QACjD,OAAO,CAAC,UAAU,CAAC,CAAC;QACpB,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,YAAY,CAAC;QACjD,OAAO,CAAC,UAAU,CAAC,CAAC;QACpB,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAE/E,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;QAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACzC,OAAO,CAAC,UAAU,CAAC,CAAC;QACpB,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAC;QACvC,OAAO,CAAC,UAAU,CAAC,CAAC;QACpB,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAE/E,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,YAAY,CAAC;QACjD,OAAO,CAAC,UAAU,CAAC,CAAC;QACpB,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,YAAY,CAAC;QACjD,OAAO,CAAC,UAAU,CAAC,CAAC;QACpB,MAAM,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,YAAY,CAAC;QACjD,OAAO,CAAC,UAAU,CAAC,CAAC;QACpB,MAAM,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,YAAY,CAAC;QACjD,OAAO,CAAC,UAAU,CAAC,CAAC;QACpB,MAAM,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAE/E,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,YAAY,CAAC;QACjD,OAAO,CAAC,UAAU,CAAC,CAAC;QAEpB,MAAM,MAAM,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,aAAa,CAAC;YACpC,GAAG,EAAE,UAAU;YACf,aAAa,EAAE,YAAY;YAC3B,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,YAAY,CAAC;QACjD,OAAO,CAAC,UAAU,CAAC,CAAC;QAEpB,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,YAAY,CAAC;QACjD,OAAO,CAAC,UAAU,CAAC,CAAC;QAEpB,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAE9E,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;IAC7D,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,kBAAkB,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,kBAAkB,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2HAA2H,EAAE,GAAG,EAAE;QACnI,2EAA2E;QAC3E,2EAA2E;QAC3E,mCAAmC;QACnC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACzD,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,qEAAqE;QACrE,uEAAuE;QACvE,6EAA6E;QAC7E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;YAC/B,iBAAiB;YACjB,uBAAuB;YACvB,oBAAoB;YACpB,wBAAwB;YACxB,sBAAsB;YACtB,mBAAmB;SACpB,CAAC,CAAC;QACH,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACrC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/audit-log.d.ts

@@ -14,8 +14,11 @@ export interface AuditRecord {
     ts: string;
     /** What happened. */
     outcome: AuditOutcome;
-    /** Boundary letter (a-d) or "denylist" for legacy denylist hits. */
-    boundary: 'a' | 'b' | 'c' | 'd' | 'denylist';
+    /**
+     * Boundary letter (a-d), "denylist" for legacy denylist hits, or
+     * "isolation" for the T1761 cwd-outside-worktree check.
+     */
+    boundary: 'a' | 'b' | 'c' | 'd' | 'denylist' | 'isolation';
     /** CLEO error code, when blocked. */
     code: string;
     /** Git subcommand. */

package/dist/audit-log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../src/audit-log.ts"],"names":[],"mappings":"AAoBA;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,oBAAoB,GAAG,4BAA4B,CAAC;AAE3F;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,8BAA8B;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,qBAAqB;IACrB,OAAO,EAAE,YAAY,CAAC;IACtB,oEAAoE;IACpE,QAAQ,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,UAAU,CAAC;IAC7C,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,4DAA4D;IAC5D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,uCAAuC;IACvC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAK5C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAmB1D"}
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../src/audit-log.ts"],"names":[],"mappings":"AAoBA;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,oBAAoB,GAAG,4BAA4B,CAAC;AAE3F;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,8BAA8B;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,qBAAqB;IACrB,OAAO,EAAE,YAAY,CAAC;IACtB;;;OAGG;IACH,QAAQ,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,UAAU,GAAG,WAAW,CAAC;IAC3D,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,4DAA4D;IAC5D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,uCAAuC;IACvC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAK5C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAmB1D"}

package/dist/audit-log.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../src/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAuC1C;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACpD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnF,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAmB;IAClD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IACD,8CAA8C;IAC9C,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,MAAM,CAAC,QAAQ,SAAS,MAAM,CAAC,IAAI,IAAI,CAC3E,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oCAAoC,MAAM,CAAC,QAAQ,QAAQ,MAAM,CAAC,OAAO,IAAI,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../src/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA0C1C;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACpD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnF,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAmB;IAClD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IACD,8CAA8C;IAC9C,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,MAAM,CAAC,QAAQ,SAAS,MAAM,CAAC,IAAI,IAAI,CAC3E,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oCAAoC,MAAM,CAAC,QAAQ,QAAQ,MAAM,CAAC,OAAO,IAAI,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/boundary.d.ts

@@ -7,9 +7,13 @@
  */
 export interface BoundaryViolation {
     /** CLEO error code (`E_GIT_BOUNDARY_*`). */
-    code: 'E_GIT_BOUNDARY_WORKTREE_PATH' | 'E_GIT_BOUNDARY_COMMIT_TASK_ID' | 'E_GIT_BOUNDARY_MERGE_FORBIDDEN' | 'E_GIT_BOUNDARY_CHERRY_PICK_TASK_BRANCH';
-    /** Which boundary letter (a/b/c/d) — kept in audit log for grouping. */
-    boundary: 'a' | 'b' | 'c' | 'd';
+    code: 'E_GIT_BOUNDARY_WORKTREE_PATH' | 'E_GIT_BOUNDARY_COMMIT_TASK_ID' | 'E_GIT_BOUNDARY_MERGE_FORBIDDEN' | 'E_GIT_BOUNDARY_CHERRY_PICK_TASK_BRANCH' | 'E_GIT_BOUNDARY_CWD_OUTSIDE_WORKTREE';
+    /**
+     * Which boundary fired — kept in audit log for grouping.
+     * Letters a-d are T1591 fence predicates; "isolation" is the T1761
+     * cwd-outside-worktree check that fires before all others.
+     */
+    boundary: 'a' | 'b' | 'c' | 'd' | 'isolation';
     /** Short human-readable summary of the violation. */
     message: string;
     /** Suggested operator action (always includes the override path). */

package/dist/boundary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"boundary.d.ts","sourceRoot":"","sources":["../src/boundary.ts"],"names":[],"mappings":"AAuBA;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,4CAA4C;IAC5C,IAAI,EACA,8BAA8B,GAC9B,+BAA+B,GAC/B,gCAAgC,GAChC,wCAAwC,CAAC;IAC7C,wEAAwE;IACxE,QAAQ,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAChC,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAQD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAC3B,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,iBAAiB,GAAG,IAAI,CAyB1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAoB3E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,OAAO,CAE3E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,GAC5B,iBAAiB,GAAG,IAAI,CAgC1B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAC3B,GAAG,EAAE;IAAE,sBAAsB,CAAC,EAAE,MAAM,CAAA;CAAE,GACvC,iBAAiB,GAAG,IAAI,CAoB1B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,iBAAiB,GAAG,IAAI,CAoB9F"}
+{"version":3,"file":"boundary.d.ts","sourceRoot":"","sources":["../src/boundary.ts"],"names":[],"mappings":"AAuBA;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,4CAA4C;IAC5C,IAAI,EACA,8BAA8B,GAC9B,+BAA+B,GAC/B,gCAAgC,GAChC,wCAAwC,GACxC,qCAAqC,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,WAAW,CAAC;IAC9C,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAQD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAC3B,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,iBAAiB,GAAG,IAAI,CAyB1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAoB3E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,OAAO,CAE3E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,GAC5B,iBAAiB,GAAG,IAAI,CAgC1B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAC3B,GAAG,EAAE;IAAE,sBAAsB,CAAC,EAAE,MAAM,CAAA;CAAE,GACvC,iBAAiB,GAAG,IAAI,CAoB1B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,iBAAiB,GAAG,IAAI,CAoB9F"}

package/dist/boundary.js.map

@@ -1 +1 @@
-{"version":3,"file":"boundary.js","sourceRoot":"","sources":["../src/boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AA0B1D,6EAA6E;AAC7E,MAAM,eAAe,GAAG,UAAU,CAAC;AAEnC,gEAAgE;AAChE,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAE3C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAA2B,EAC3B,GAAW,EACX,YAAoB;IAEpB,uDAAuD;IACvD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,cAAc;QACjD,6EAA6E;QAC7E,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,EAAE;YAAE,SAAS;QACvD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAElC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,IAAI,EAAE,8BAA8B;gBACpC,QAAQ,EAAE,GAAG;gBACb,OAAO,EAAE,2BAA2B,GAAG,sCAAsC,YAAY,GAAG;gBAC5F,WAAW,EACT,sGAAsG;gBACxG,OAAO,EAAE;oBACP,cAAc,EAAE,GAAG;oBACnB,aAAa,EAAE,QAAQ;oBACvB,aAAa,EAAE,YAAY;iBAC5B;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAA2B;IAC/D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAA2B;IAChE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAA2B,EAC3B,cAA6B;IAE7B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,yCAAyC;IACjF,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAElC,IAAI,cAAc,EAAE,CAAC;QACnB,oEAAoE;QACpE,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,cAAc,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,IAAI,EAAE,+BAA+B;gBACrC,QAAQ,EAAE,GAAG;gBACb,OAAO,EAAE,iCAAiC,OAAO,sBAAsB,cAAc,GAAG;gBACxF,WAAW,EAAE,YAAY,cAAc,gCAAgC,cAAc,iDAAiD;gBACtI,OAAO,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE;aACvD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iFAAiF;IACjF,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,IAAI,EAAE,+BAA+B;YACrC,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,iCAAiC,OAAO,iCAAiC;YAClF,WAAW,EACT,8FAA8F;YAChG,OAAO,EAAE,EAAE,OAAO,EAAE;SACrB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAA2B,EAC3B,GAAwC;IAExC,uDAAuD;IACvD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,sBAAsB,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAEpD,OAAO;QACL,IAAI,EAAE,gCAAgC;QACtC,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,sEAAsE;QAC/E,WAAW,EACT,iJAAiJ;QACnJ,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;SACrB;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAA2B;IAClE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,kEAAkE;QAClE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,OAAO;oBACL,IAAI,EAAE,wCAAwC;oBAC9C,QAAQ,EAAE,GAAG;oBACb,OAAO,EAAE,yCAAyC,OAAO,gEAAgE;oBACzH,WAAW,EACT,0GAA0G;oBAC5G,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE;iBACpD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"boundary.js","sourceRoot":"","sources":["../src/boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AA+B1D,6EAA6E;AAC7E,MAAM,eAAe,GAAG,UAAU,CAAC;AAEnC,gEAAgE;AAChE,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAE3C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAA2B,EAC3B,GAAW,EACX,YAAoB;IAEpB,uDAAuD;IACvD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,cAAc;QACjD,6EAA6E;QAC7E,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,EAAE;YAAE,SAAS;QACvD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAElC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,IAAI,EAAE,8BAA8B;gBACpC,QAAQ,EAAE,GAAG;gBACb,OAAO,EAAE,2BAA2B,GAAG,sCAAsC,YAAY,GAAG;gBAC5F,WAAW,EACT,sGAAsG;gBACxG,OAAO,EAAE;oBACP,cAAc,EAAE,GAAG;oBACnB,aAAa,EAAE,QAAQ;oBACvB,aAAa,EAAE,YAAY;iBAC5B;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAA2B;IAC/D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAA2B;IAChE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAA2B,EAC3B,cAA6B;IAE7B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,yCAAyC;IACjF,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAElC,IAAI,cAAc,EAAE,CAAC;QACnB,oEAAoE;QACpE,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,cAAc,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,IAAI,EAAE,+BAA+B;gBACrC,QAAQ,EAAE,GAAG;gBACb,OAAO,EAAE,iCAAiC,OAAO,sBAAsB,cAAc,GAAG;gBACxF,WAAW,EAAE,YAAY,cAAc,gCAAgC,cAAc,iDAAiD;gBACtI,OAAO,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE;aACvD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iFAAiF;IACjF,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,IAAI,EAAE,+BAA+B;YACrC,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,iCAAiC,OAAO,iCAAiC;YAClF,WAAW,EACT,8FAA8F;YAChG,OAAO,EAAE,EAAE,OAAO,EAAE;SACrB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAA2B,EAC3B,GAAwC;IAExC,uDAAuD;IACvD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,sBAAsB,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAEpD,OAAO;QACL,IAAI,EAAE,gCAAgC;QACtC,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,sEAAsE;QAC/E,WAAW,EACT,iJAAiJ;QACnJ,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;SACrB;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAA2B;IAClE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,kEAAkE;QAClE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,OAAO;oBACL,IAAI,EAAE,wCAAwC;oBAC9C,QAAQ,EAAE,GAAG;oBACb,OAAO,EAAE,yCAAyC,OAAO,gEAAgE;oBACzH,WAAW,EACT,0GAA0G;oBAC5G,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE;iBACpD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * @cleocode/git-shim — Harness-agnostic git fence (T1118 + T1591).
+ * @cleocode/git-shim — Harness-agnostic git fence (T1118 + T1591 + T1761).
  *
  * Re-exports the denylist + boundary predicates so other packages can inspect
  * the shim's enforcement without executing the binary. The shim binary itself
@@ -9,6 +9,7 @@
  * @task T1118
  * @task T1121
  * @task T1591
+ * @task T1761
  * @packageDocumentation
  */
 export type { AuditOutcome, AuditRecord } from './audit-log.js';
@@ -16,6 +17,7 @@ export { resolveAuditLogPath, writeAuditRecord } from './audit-log.js';
 export type { BoundaryViolation } from './boundary.js';
 export { commitHasInlineMessage, extractCommitMessages, validateAddPaths, validateCherryPickSource, validateCommitSubject, validateMergeAllowed, } from './boundary.js';
 export { findDeniedOp, GIT_OP_DENYLIST, RESTRICTED_ROLES } from './denylist.js';
+export { evaluateIsolationBoundary, isCwdInsideWorktree, MUTATION_SUBCOMMANDS, } from './isolation-boundary.js';
 export { extractTaskIdFromWorktreePath, isInsideWorktreesRoot, isPathInsideWorktree, resolveActiveWorktree, resolveCleoWorktreesRoot, resolveProjectWorktreeRoot, } from './worktree-path.js';
 /**
  * Install the shim symlink so that `git` resolves to this shim when

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvE,YAAY,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiC/F"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvE,YAAY,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiC/F"}

package/dist/index.js

@@ -1,5 +1,5 @@
 /**
- * @cleocode/git-shim — Harness-agnostic git fence (T1118 + T1591).
+ * @cleocode/git-shim — Harness-agnostic git fence (T1118 + T1591 + T1761).
  *
  * Re-exports the denylist + boundary predicates so other packages can inspect
  * the shim's enforcement without executing the binary. The shim binary itself
@@ -9,11 +9,13 @@
  * @task T1118
  * @task T1121
  * @task T1591
+ * @task T1761
  * @packageDocumentation
  */
 export { resolveAuditLogPath, writeAuditRecord } from './audit-log.js';
 export { commitHasInlineMessage, extractCommitMessages, validateAddPaths, validateCherryPickSource, validateCommitSubject, validateMergeAllowed, } from './boundary.js';
 export { findDeniedOp, GIT_OP_DENYLIST, RESTRICTED_ROLES } from './denylist.js';
+export { evaluateIsolationBoundary, isCwdInsideWorktree, MUTATION_SUBCOMMANDS, } from './isolation-boundary.js';
 export { extractTaskIdFromWorktreePath, isInsideWorktreesRoot, isPathInsideWorktree, resolveActiveWorktree, resolveCleoWorktreesRoot, resolveProjectWorktreeRoot, } from './worktree-path.js';
 /**
  * Install the shim symlink so that `git` resolves to this shim when

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvE,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAe,EAAE,WAAmB;IAC3E,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACnF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAE3C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEtC,qDAAqD;IACrD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,MAAM,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;YAC3D,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,UAAU,CAAC,QAAQ,CAAC,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACnC,wCAAwC;QACxC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9C,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvE,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAe,EAAE,WAAmB;IAC3E,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACnF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAE3C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEtC,qDAAqD;IACrD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,MAAM,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;YAC3D,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,UAAU,CAAC,QAAQ,CAAC,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACnC,wCAAwC;QACxC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9C,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC"}

package/dist/isolation-boundary.d.ts

@@ -0,0 +1,70 @@
+/**
+ * T1761 isolation boundary check for the git-shim.
+ *
+ * Provides the "last line of defense" cwd-outside-worktree check that fires
+ * BEFORE the T1118 denylist. When a worker agent is injected with
+ * `CLEO_WORKTREE_ROOT` (via T1759's `provisionIsolatedShell` preamble) but
+ * somehow drifts to the main project root, any mutation subcommand is blocked
+ * with exit code 77 and a structured `cwd-outside-worktree` error.
+ *
+ * Design:
+ *  - Reads env keys via `ISOLATION_ENV_KEYS` from `@cleocode/contracts` —
+ *    the single source of truth — so the key names are never duplicated here.
+ *  - Pure functions: no I/O, no spawning, easy to unit-test.
+ *  - Only `CLEO_AGENT_ROLE=worker` (exact match) triggers the check — lead /
+ *    subagent / orchestrator are not subject to this isolation constraint.
+ *
+ * @task T1761
+ * @adr ADR-055
+ */
+import type { BoundaryViolation } from './boundary.js';
+/**
+ * Mutation subcommands that write to the git index or create commits.
+ *
+ * Only these subcommands trigger the isolation boundary check, since
+ * read-only commands (log, status, diff, show, …) cannot pollute the main
+ * project even when run from the wrong cwd.
+ *
+ * @task T1761
+ */
+export declare const MUTATION_SUBCOMMANDS: ReadonlySet<string>;
+/**
+ * Check whether `cwd` is inside `worktreeRoot`.
+ *
+ * A path is considered "inside" when it is exactly equal to the root OR
+ * starts with the root followed by the POSIX path separator `/`. Both paths
+ * are resolved to absolute form first to guard against trailing-slash
+ * inconsistencies and symlink quirks.
+ *
+ * @param cwd - Working directory to test (may be relative — resolved internally).
+ * @param worktreeRoot - Expected worktree root (may be relative — resolved internally).
+ * @returns true when cwd is the root or a descendant, false otherwise.
+ *
+ * @task T1761
+ */
+export declare function isCwdInsideWorktree(cwd: string, worktreeRoot: string): boolean;
+/**
+ * Evaluate the T1761 isolation boundary for the current git invocation.
+ *
+ * Fires BEFORE the T1118 denylist — if the agent's cwd is outside its
+ * assigned worktree, any mutation is an isolation violation regardless of
+ * what specific op is being attempted.
+ *
+ * Conditions required to trigger (all must be true):
+ *   1. `CLEO_AGENT_ROLE=worker` (exact string match — not lead/subagent)
+ *   2. `CLEO_WORKTREE_ROOT` is set to a non-empty value
+ *   3. The git subcommand is a mutation op (add, commit, rm, mv, …)
+ *   4. `process.cwd()` is NOT inside `CLEO_WORKTREE_ROOT`
+ *
+ * `ISOLATION_ENV_KEYS` from `@cleocode/contracts` is the single source of
+ * truth for the env var names — this function never duplicates the key list.
+ * Index 0 = `CLEO_WORKTREE_ROOT`, Index 1 = `CLEO_AGENT_ROLE` (enforced by
+ * the drift-detection test in isolation-boundary.test.ts).
+ *
+ * @param subcommand - Git subcommand (argv[0], e.g. "add" or "commit").
+ * @returns A {@link BoundaryViolation} when blocked, or `null` when allowed.
+ *
+ * @task T1761
+ */
+export declare function evaluateIsolationBoundary(subcommand: string): BoundaryViolation | null;
+//# sourceMappingURL=isolation-boundary.d.ts.map

package/dist/isolation-boundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolation-boundary.d.ts","sourceRoot":"","sources":["../src/isolation-boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAQnD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAI9E;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CA4BtF"}

package/dist/isolation-boundary.js

@@ -0,0 +1,109 @@
+/**
+ * T1761 isolation boundary check for the git-shim.
+ *
+ * Provides the "last line of defense" cwd-outside-worktree check that fires
+ * BEFORE the T1118 denylist. When a worker agent is injected with
+ * `CLEO_WORKTREE_ROOT` (via T1759's `provisionIsolatedShell` preamble) but
+ * somehow drifts to the main project root, any mutation subcommand is blocked
+ * with exit code 77 and a structured `cwd-outside-worktree` error.
+ *
+ * Design:
+ *  - Reads env keys via `ISOLATION_ENV_KEYS` from `@cleocode/contracts` —
+ *    the single source of truth — so the key names are never duplicated here.
+ *  - Pure functions: no I/O, no spawning, easy to unit-test.
+ *  - Only `CLEO_AGENT_ROLE=worker` (exact match) triggers the check — lead /
+ *    subagent / orchestrator are not subject to this isolation constraint.
+ *
+ * @task T1761
+ * @adr ADR-055
+ */
+import { resolve } from 'node:path';
+import { ISOLATION_ENV_KEYS } from '@cleocode/contracts';
+/**
+ * Mutation subcommands that write to the git index or create commits.
+ *
+ * Only these subcommands trigger the isolation boundary check, since
+ * read-only commands (log, status, diff, show, …) cannot pollute the main
+ * project even when run from the wrong cwd.
+ *
+ * @task T1761
+ */
+export const MUTATION_SUBCOMMANDS = new Set([
+    'add',
+    'commit',
+    'rm',
+    'mv',
+    'restore',
+    'apply',
+    'am',
+]);
+/**
+ * Check whether `cwd` is inside `worktreeRoot`.
+ *
+ * A path is considered "inside" when it is exactly equal to the root OR
+ * starts with the root followed by the POSIX path separator `/`. Both paths
+ * are resolved to absolute form first to guard against trailing-slash
+ * inconsistencies and symlink quirks.
+ *
+ * @param cwd - Working directory to test (may be relative — resolved internally).
+ * @param worktreeRoot - Expected worktree root (may be relative — resolved internally).
+ * @returns true when cwd is the root or a descendant, false otherwise.
+ *
+ * @task T1761
+ */
+export function isCwdInsideWorktree(cwd, worktreeRoot) {
+    const resolvedCwd = resolve(cwd);
+    const resolvedRoot = resolve(worktreeRoot);
+    return resolvedCwd === resolvedRoot || resolvedCwd.startsWith(`${resolvedRoot}/`);
+}
+/**
+ * Evaluate the T1761 isolation boundary for the current git invocation.
+ *
+ * Fires BEFORE the T1118 denylist — if the agent's cwd is outside its
+ * assigned worktree, any mutation is an isolation violation regardless of
+ * what specific op is being attempted.
+ *
+ * Conditions required to trigger (all must be true):
+ *   1. `CLEO_AGENT_ROLE=worker` (exact string match — not lead/subagent)
+ *   2. `CLEO_WORKTREE_ROOT` is set to a non-empty value
+ *   3. The git subcommand is a mutation op (add, commit, rm, mv, …)
+ *   4. `process.cwd()` is NOT inside `CLEO_WORKTREE_ROOT`
+ *
+ * `ISOLATION_ENV_KEYS` from `@cleocode/contracts` is the single source of
+ * truth for the env var names — this function never duplicates the key list.
+ * Index 0 = `CLEO_WORKTREE_ROOT`, Index 1 = `CLEO_AGENT_ROLE` (enforced by
+ * the drift-detection test in isolation-boundary.test.ts).
+ *
+ * @param subcommand - Git subcommand (argv[0], e.g. "add" or "commit").
+ * @returns A {@link BoundaryViolation} when blocked, or `null` when allowed.
+ *
+ * @task T1761
+ */
+export function evaluateIsolationBoundary(subcommand) {
+    // Only the `worker` role is subject to this isolation check.
+    if (process.env[ISOLATION_ENV_KEYS[1]] !== 'worker')
+        return null;
+    const worktreeRoot = process.env[ISOLATION_ENV_KEYS[0]];
+    if (!worktreeRoot)
+        return null;
+    // Only mutation subcommands can cause cross-worktree writes.
+    if (!MUTATION_SUBCOMMANDS.has(subcommand))
+        return null;
+    const cwd = process.cwd();
+    if (isCwdInsideWorktree(cwd, worktreeRoot))
+        return null;
+    return {
+        code: 'E_GIT_BOUNDARY_CWD_OUTSIDE_WORKTREE',
+        boundary: 'isolation',
+        message: `git ${subcommand} refused — cwd "${cwd}" is outside the assigned worktree ` +
+            `"${worktreeRoot}" (CLEO_AGENT_ROLE=worker)`,
+        remediation: 'Run all git mutations from inside your assigned worktree. ' +
+            'To bypass for an emergency hotfix set CLEO_ALLOW_GIT=1 (audited).',
+        context: {
+            cwd,
+            worktree_root: worktreeRoot,
+            role: 'worker',
+        },
+    };
+}
+//# sourceMappingURL=isolation-boundary.js.map

package/dist/isolation-boundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolation-boundary.js","sourceRoot":"","sources":["../src/isolation-boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGzD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IAC/D,KAAK;IACL,QAAQ;IACR,IAAI;IACJ,IAAI;IACJ,SAAS;IACT,OAAO;IACP,IAAI;CACL,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,YAAoB;IACnE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3C,OAAO,WAAW,KAAK,YAAY,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,YAAY,GAAG,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAkB;IAC1D,6DAA6D;IAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEjE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAE/B,6DAA6D;IAC7D,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,IAAI,mBAAmB,CAAC,GAAG,EAAE,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAExD,OAAO;QACL,IAAI,EAAE,qCAAqC;QAC3C,QAAQ,EAAE,WAAW;QACrB,OAAO,EACL,OAAO,UAAU,mBAAmB,GAAG,qCAAqC;YAC5E,IAAI,YAAY,4BAA4B;QAC9C,WAAW,EACT,4DAA4D;YAC5D,mEAAmE;QACrE,OAAO,EAAE;YACP,GAAG;YACH,aAAa,EAAE,YAAY;YAC3B,IAAI,EAAE,QAAQ;SACf;KACF,CAAC;AACJ,CAAC"}

package/dist/shim.d.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * git-shim — harness-agnostic git fence (T1118 L2 + T1591 boundary fence).
+ * git-shim — harness-agnostic git fence (T1118 L2 + T1591 boundary fence + T1761 isolation).
  *
  * Usage: place this binary on PATH BEFORE real git, and export:
  *   CLEO_AGENT_ROLE=worker   (or lead|subagent)
@@ -8,6 +8,11 @@
  *   CLEO_TASK_ID=T<NUM>        (optional — auto-detected from worktree path)
  *
  * Layered enforcement (in order, all under restricted-role gate):
+ *   0. T1761 isolation fence (FIRST — fires before denylist):
+ *      When CLEO_AGENT_ROLE=worker AND CLEO_WORKTREE_ROOT is set AND the
+ *      mutation subcommand (add/commit/rm/…) is invoked, verify that cwd is
+ *      inside CLEO_WORKTREE_ROOT. Exits 77 with `cwd-outside-worktree` error.
+ *      Bypass: `CLEO_ALLOW_GIT=1` (audited).
  *   1. T1118 denylist (branch-mutation ops). Bypass: `CLEO_ALLOW_BRANCH_OPS=1`.
  *   2. T1591 boundary fence:
  *      (a) git add path inside worktree
@@ -27,6 +32,7 @@
  * @task T1118
  * @task T1121
  * @task T1591
+ * @task T1761
  */
 export {};
 //# sourceMappingURL=shim.d.ts.map

package/dist/shim.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shim.d.ts","sourceRoot":"","sources":["../src/shim.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG"}
+{"version":3,"file":"shim.d.ts","sourceRoot":"","sources":["../src/shim.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG"}

package/dist/shim.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * git-shim — harness-agnostic git fence (T1118 L2 + T1591 boundary fence).
+ * git-shim — harness-agnostic git fence (T1118 L2 + T1591 boundary fence + T1761 isolation).
  *
  * Usage: place this binary on PATH BEFORE real git, and export:
  *   CLEO_AGENT_ROLE=worker   (or lead|subagent)
@@ -8,6 +8,11 @@
  *   CLEO_TASK_ID=T<NUM>        (optional — auto-detected from worktree path)
  *
  * Layered enforcement (in order, all under restricted-role gate):
+ *   0. T1761 isolation fence (FIRST — fires before denylist):
+ *      When CLEO_AGENT_ROLE=worker AND CLEO_WORKTREE_ROOT is set AND the
+ *      mutation subcommand (add/commit/rm/…) is invoked, verify that cwd is
+ *      inside CLEO_WORKTREE_ROOT. Exits 77 with `cwd-outside-worktree` error.
+ *      Bypass: `CLEO_ALLOW_GIT=1` (audited).
  *   1. T1118 denylist (branch-mutation ops). Bypass: `CLEO_ALLOW_BRANCH_OPS=1`.
  *   2. T1591 boundary fence:
  *      (a) git add path inside worktree
@@ -27,6 +32,7 @@
  * @task T1118
  * @task T1121
  * @task T1591
+ * @task T1761
  */
 import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
@@ -34,6 +40,7 @@ import { join } from 'node:path';
 import { writeAuditRecord } from './audit-log.js';
 import { validateAddPaths, validateCherryPickSource, validateCommitSubject, validateMergeAllowed, } from './boundary.js';
 import { findDeniedOp, RESTRICTED_ROLES } from './denylist.js';
+import { evaluateIsolationBoundary } from './isolation-boundary.js';
 import { resolveActiveWorktree } from './worktree-path.js';
 /** Sentinel exit code for a shim-blocked git operation. */
 const BLOCKED_EXIT_CODE = 77;
@@ -153,7 +160,7 @@ function evaluateBoundaries(subcommand, args) {
  * Build a structured audit record for the current invocation.
  *
  * @param outcome - "blocked" | "bypassed-allow-git" | "bypassed-orchestrate-merge".
- * @param boundary - Which boundary fired (a-d, or "denylist").
+ * @param boundary - Which boundary fired (a-d, denylist, or isolation).
  * @param code - CLEO error code.
  * @param subcommand - Git subcommand.
  * @param args - Argv tail.
@@ -180,8 +187,8 @@ function buildAuditRecord(outcome, boundary, code, subcommand, args, context) {
 /**
  * Main shim entry point.
  *
- * Reads argv, env, applies the denylist + the boundary fence, and either
- * blocks or passes through to the real git binary.
+ * Reads argv, env, applies the isolation fence + denylist + boundary fence,
+ * and either blocks or passes through to the real git binary.
  */
 function main() {
     const argv = process.argv.slice(2);
@@ -213,6 +220,26 @@ function main() {
     const allowBranchOps = process.env['CLEO_ALLOW_BRANCH_OPS'] === '1';
     const allowGit = process.env['CLEO_ALLOW_GIT'] === '1';
     // ---------------------------------------------------------------------------
+    // Layer 0 — T1761 isolation fence (cwd-outside-worktree, BEFORE denylist).
+    //
+    // This is the "last line of defense" — even if T1759's structural preamble
+    // and T1758's prompt hardening both fail, a worker agent that has been
+    // injected with CLEO_WORKTREE_ROOT but somehow drifted to the main project
+    // root is caught here before it can mutate the primary repository.
+    // ---------------------------------------------------------------------------
+    const isolationViolation = evaluateIsolationBoundary(subcommand);
+    if (isolationViolation && !allowGit) {
+        emitBoundaryViolation(isolationViolation, subcommand);
+        writeAuditRecord(buildAuditRecord('blocked', 'isolation', isolationViolation.code, subcommand, remainingArgs, isolationViolation.context));
+        process.exit(BLOCKED_EXIT_CODE);
+        return;
+    }
+    if (isolationViolation && allowGit) {
+        process.stderr.write(`[git-shim] WARNING: CLEO_ALLOW_GIT=1 bypassed isolation boundary ` +
+            `(${isolationViolation.code}) for 'git ${subcommand}' (role=${role}). This bypass is audited.\n`);
+        writeAuditRecord(buildAuditRecord('bypassed-allow-git', 'isolation', isolationViolation.code, subcommand, remainingArgs, isolationViolation.context));
+    }
+    // ---------------------------------------------------------------------------
     // Layer 1 — T1118 denylist (branch-mutation ops).
     // ---------------------------------------------------------------------------
     const denied = findDeniedOp(subcommand, remainingArgs);

package/dist/shim.js.map

@@ -1 +1 @@
-{"version":3,"file":"shim.js","sourceRoot":"","sources":["../src/shim.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAoB,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAEL,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;GAIG;AACH,SAAS,YAAY;IACnB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc;IACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACnD,IAAI,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,oBAAoB,CAAC;IAC3E,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAExD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,SAAS;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,cAAc,EAAE,oBAAoB,EAAE,uBAAuB,CAAC,CAAC;IAClF,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe,EAAE,OAA+B;IACtF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,CAAC,SAAS,CAAC;QAChB,UAAU,EAAE,IAAI;QAChB,IAAI;QACJ,OAAO;QACP,GAAG,OAAO;KACX,CAAC,IAAI,CACP,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,OAAO,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,SAA4B,EAAE,UAAkB;IAC7E,gBAAgB,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE;QAClD,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,UAAU;QACV,GAAG,SAAS,CAAC,OAAO;KACrB,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,SAAS,CAAC,WAAW,IAAI,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,UAAkB,EAAE,IAAc;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE1C,6EAA6E;IAC7E,IAAI,UAAU,KAAK,KAAK,IAAI,MAAM,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,oDAAoD;IACpD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/C,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,wDAAwD;IACxD,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,EAAE;YACnC,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,0DAA0D;IAC1D,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB,CACvB,OAA+B,EAC/B,QAAiC,EACjC,IAAY,EACZ,UAAkB,EAClB,IAAc,EACd,OAA+B;IAE/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO;QACL,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,OAAO;QACP,QAAQ;QACR,IAAI;QACJ,UAAU;QACV,IAAI;QACJ,GAAG;QACH,aAAa,EAAE,MAAM,EAAE,YAAY,IAAI,IAAI;QAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI;QAC/B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI;QAC5C,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,IAAI;IACX,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAE3B,0EAA0E;IAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAE5B,gEAAgE;IAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,GAAG,CAAC;IACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,GAAG,CAAC;IAEvD,8EAA8E;IAC9E,kDAAkD;IAClD,8EAA8E;IAC9E,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACvD,IAAI,MAAM,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,WAAW,CAAC;QACtE,gBAAgB,CACd,kBAAkB,EAClB,OAAO,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,6BAA6B,IAAI,MAAM,MAAM,CAAC,MAAM,EAAE,EAC9G;YACE,UAAU;YACV,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACvB,IAAI;YACJ,aAAa,EAAE,YAAY;SAC5B,CACF,CAAC;QACF,gBAAgB,CACd,gBAAgB,CAAC,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,UAAU,EAAE,aAAa,EAAE;YACrF,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CACH,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,MAAM,IAAI,CAAC,cAAc,IAAI,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uBAAuB,cAAc,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,gBAAgB,KAAK;YACrF,8BAA8B,UAAU,WAAW,IAAI,8BAA8B,CACxF,CAAC;QACF,gBAAgB,CACd,gBAAgB,CACd,oBAAoB,EACpB,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CACnD,CACF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,4CAA4C;IAC5C,8EAA8E;IAC9E,MAAM,SAAS,GAAG,kBAAkB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAChE,IAAI,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3B,qBAAqB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC7C,gBAAgB,CACd,gBAAgB,CACd,SAAS,EACT,SAAS,CAAC,QAAQ,EAClB,SAAS,CAAC,IAAI,EACd,UAAU,EACV,aAAa,EACb,SAAS,CAAC,OAAO,CAClB,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0DAA0D,SAAS,CAAC,QAAQ,GAAG;YAC7E,IAAI,SAAS,CAAC,IAAI,cAAc,UAAU,WAAW,IAAI,8BAA8B,CAC1F,CAAC;QACF,gBAAgB,CACd,gBAAgB,CACd,oBAAoB,EACpB,SAAS,CAAC,QAAQ,EAClB,SAAS,CAAC,IAAI,EACd,UAAU,EACV,aAAa,EACb,SAAS,CAAC,OAAO,CAClB,CACF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,4BAA4B;IAC5B,8EAA8E;IAC9E,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,IAAI,EAAE,CAAC"}
+{"version":3,"file":"shim.js","sourceRoot":"","sources":["../src/shim.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAoB,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAEL,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;GAIG;AACH,SAAS,YAAY;IACnB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc;IACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACnD,IAAI,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,oBAAoB,CAAC;IAC3E,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAExD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,SAAS;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,cAAc,EAAE,oBAAoB,EAAE,uBAAuB,CAAC,CAAC;IAClF,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe,EAAE,OAA+B;IACtF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,CAAC,SAAS,CAAC;QAChB,UAAU,EAAE,IAAI;QAChB,IAAI;QACJ,OAAO;QACP,GAAG,OAAO;KACX,CAAC,IAAI,CACP,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,OAAO,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,SAA4B,EAAE,UAAkB;IAC7E,gBAAgB,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE;QAClD,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,UAAU;QACV,GAAG,SAAS,CAAC,OAAO;KACrB,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,SAAS,CAAC,WAAW,IAAI,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,UAAkB,EAAE,IAAc;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE1C,6EAA6E;IAC7E,IAAI,UAAU,KAAK,KAAK,IAAI,MAAM,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,oDAAoD;IACpD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/C,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,wDAAwD;IACxD,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,EAAE;YACnC,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,0DAA0D;IAC1D,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB,CACvB,OAA+B,EAC/B,QAAiC,EACjC,IAAY,EACZ,UAAkB,EAClB,IAAc,EACd,OAA+B;IAE/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO;QACL,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,OAAO;QACP,QAAQ;QACR,IAAI;QACJ,UAAU;QACV,IAAI;QACJ,GAAG;QACH,aAAa,EAAE,MAAM,EAAE,YAAY,IAAI,IAAI;QAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI;QAC/B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI;QAC5C,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,IAAI;IACX,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAE3B,0EAA0E;IAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAE5B,gEAAgE;IAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,GAAG,CAAC;IACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,GAAG,CAAC;IAEvD,8EAA8E;IAC9E,2EAA2E;IAC3E,EAAE;IACF,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,mEAAmE;IACnE,8EAA8E;IAC9E,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACjE,IAAI,kBAAkB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,qBAAqB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;QACtD,gBAAgB,CACd,gBAAgB,CACd,SAAS,EACT,WAAW,EACX,kBAAkB,CAAC,IAAI,EACvB,UAAU,EACV,aAAa,EACb,kBAAkB,CAAC,OAAO,CAC3B,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,kBAAkB,IAAI,QAAQ,EAAE,CAAC;QACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mEAAmE;YACjE,IAAI,kBAAkB,CAAC,IAAI,cAAc,UAAU,WAAW,IAAI,8BAA8B,CACnG,CAAC;QACF,gBAAgB,CACd,gBAAgB,CACd,oBAAoB,EACpB,WAAW,EACX,kBAAkB,CAAC,IAAI,EACvB,UAAU,EACV,aAAa,EACb,kBAAkB,CAAC,OAAO,CAC3B,CACF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,kDAAkD;IAClD,8EAA8E;IAC9E,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACvD,IAAI,MAAM,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,WAAW,CAAC;QACtE,gBAAgB,CACd,kBAAkB,EAClB,OAAO,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,6BAA6B,IAAI,MAAM,MAAM,CAAC,MAAM,EAAE,EAC9G;YACE,UAAU;YACV,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACvB,IAAI;YACJ,aAAa,EAAE,YAAY;SAC5B,CACF,CAAC;QACF,gBAAgB,CACd,gBAAgB,CAAC,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,UAAU,EAAE,aAAa,EAAE;YACrF,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CACH,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,MAAM,IAAI,CAAC,cAAc,IAAI,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uBAAuB,cAAc,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,gBAAgB,KAAK;YACrF,8BAA8B,UAAU,WAAW,IAAI,8BAA8B,CACxF,CAAC;QACF,gBAAgB,CACd,gBAAgB,CACd,oBAAoB,EACpB,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CACnD,CACF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,4CAA4C;IAC5C,8EAA8E;IAC9E,MAAM,SAAS,GAAG,kBAAkB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAChE,IAAI,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3B,qBAAqB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC7C,gBAAgB,CACd,gBAAgB,CACd,SAAS,EACT,SAAS,CAAC,QAAQ,EAClB,SAAS,CAAC,IAAI,EACd,UAAU,EACV,aAAa,EACb,SAAS,CAAC,OAAO,CAClB,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0DAA0D,SAAS,CAAC,QAAQ,GAAG;YAC7E,IAAI,SAAS,CAAC,IAAI,cAAc,UAAU,WAAW,IAAI,8BAA8B,CAC1F,CAAC;QACF,gBAAgB,CACd,gBAAgB,CACd,oBAAoB,EACpB,SAAS,CAAC,QAAQ,EAClB,SAAS,CAAC,IAAI,EACd,UAAU,EACV,aAAa,EACb,SAAS,CAAC,OAAO,CAClB,CACF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,4BAA4B;IAC5B,8EAA8E;IAC9E,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,IAAI,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/git-shim",
-  "version": "2026.5.16",
+  "version": "2026.5.17",
   "private": false,
   "type": "module",
   "description": "Harness-agnostic git shim for CLEO agent branch-protection (T1118)",
@@ -32,7 +32,7 @@
   "author": "CLEO Code <hello@cleocode.dev>",
   "license": "MIT",
   "dependencies": {
-    "@cleocode/contracts": "2026.5.16"
+    "@cleocode/contracts": "2026.5.17"
   },
   "devDependencies": {
     "@types/node": "^24.3.0",