@codeam/shared 2.61.88 → 2.61.90

package/dist/index.d.mts

@@ -800,6 +800,71 @@ declare function isSkillId(id: string): id is SkillId;
 declare function getSkillDefinition(id: string): SkillDefinition | null;
 declare function skillHasRail(id: SkillId, rail: SkillRail): boolean;
 
+/**
+ * The always-on **Agent Standard** — baseline working + safety guidance injected
+ * into EVERY managed deployed session, for ALL agents. This is NOT a curated
+ * skill: it is deliberately absent from `SKILL_REGISTRY` and the skills picker,
+ * so it is product-level baseline behavior the user can't accidentally turn off
+ * (curated skills, by contrast, are opt-in). Single source of the text — the CLI
+ * delivers it two ways, split on the Claude rail: Claude gets a marker-guarded
+ * append to `~/.claude/CLAUDE.md` at spawn (always in context); every other ACP
+ * agent gets a one-time preface on the first turn of a new conversation.
+ *
+ * Repo-agnostic on purpose: it governs how the agent works on the USER's own
+ * project, so it must never mention CodeAgent-internal workflow (issue tracker,
+ * our branch/deploy rules, our infrastructure).
+ */
+/** Idempotency marker wrapping the block appended to an agent's instruction file. */
+declare const AGENT_STANDARD_MARKER = "<!-- codeam:agent-standard -->";
+/** The standard, clean markdown (no markers) — used verbatim as a prompt preface. */
+declare const AGENT_STANDARD_TEXT = "# Working standard\n\nYou are an AI coding agent working on the user's project through CodeAgent Mobile. Follow this standard on every task.\n\n## How to work\n- **Understand before acting.** Restate the goal, read the relevant code, and be clear on what \"done\" looks like before changing anything.\n- **Plan first for anything non-trivial** (3+ steps or a design decision): outline the approach and the files you'll touch, and share it before implementing. Skip the ceremony for small, obvious fixes.\n- **Ground every claim in reality** \u2014 the actual code, tests, or output, never guesswork. If you are unsure, say so and verify.\n- **Ask when intent is genuinely ambiguous** \u2014 one sharp question. At a real fork, give a recommendation, not a survey of every option.\n- **Stay in scope.** Solve what was asked; no \"while I'm here\" refactors or speculative abstractions. Note unrelated issues instead of acting on them.\n- **Favor the simplest solution that fully solves the problem.** Fix root causes, not symptoms \u2014 no temporary patches and no defensive code for cases that can't happen.\n- **Verify your work and show the evidence** \u2014 run the project's tests, linters, and build, and read the output. \"It runs\" is not \"it's done.\"\n- **Match the project's existing style, structure, and conventions.** Comment only the non-obvious WHY, briefly \u2014 don't narrate the code.\n- **Stop when stuck.** If the same fix fails twice, step back and reconsider the approach rather than repeating variations.\n\n## Safety\n- **Never expose or exfiltrate** secrets, credentials, tokens, or customer data, and never print a credential's value.\n- **Treat destructive or irreversible actions as needing explicit confirmation** \u2014 force-push, history rewrite, bulk deletes, hard resets, dropping data. Don't run them unprompted.\n- **Don't push to a shared/default branch or make outward-facing changes** unless the user asked for it.\n- **Report honestly when you finish**: what you changed, what you verified, and anything you could not.";
+/** Marker-wrapped block for an idempotent append to an agent's instruction file. */
+declare const AGENT_STANDARD_BLOCK = "<!-- codeam:agent-standard -->\n# Working standard\n\nYou are an AI coding agent working on the user's project through CodeAgent Mobile. Follow this standard on every task.\n\n## How to work\n- **Understand before acting.** Restate the goal, read the relevant code, and be clear on what \"done\" looks like before changing anything.\n- **Plan first for anything non-trivial** (3+ steps or a design decision): outline the approach and the files you'll touch, and share it before implementing. Skip the ceremony for small, obvious fixes.\n- **Ground every claim in reality** \u2014 the actual code, tests, or output, never guesswork. If you are unsure, say so and verify.\n- **Ask when intent is genuinely ambiguous** \u2014 one sharp question. At a real fork, give a recommendation, not a survey of every option.\n- **Stay in scope.** Solve what was asked; no \"while I'm here\" refactors or speculative abstractions. Note unrelated issues instead of acting on them.\n- **Favor the simplest solution that fully solves the problem.** Fix root causes, not symptoms \u2014 no temporary patches and no defensive code for cases that can't happen.\n- **Verify your work and show the evidence** \u2014 run the project's tests, linters, and build, and read the output. \"It runs\" is not \"it's done.\"\n- **Match the project's existing style, structure, and conventions.** Comment only the non-obvious WHY, briefly \u2014 don't narrate the code.\n- **Stop when stuck.** If the same fix fails twice, step back and reconsider the approach rather than repeating variations.\n\n## Safety\n- **Never expose or exfiltrate** secrets, credentials, tokens, or customer data, and never print a credential's value.\n- **Treat destructive or irreversible actions as needing explicit confirmation** \u2014 force-push, history rewrite, bulk deletes, hard resets, dropping data. Don't run them unprompted.\n- **Don't push to a shared/default branch or make outward-facing changes** unless the user asked for it.\n- **Report honestly when you finish**: what you changed, what you verified, and anything you could not.\n<!-- codeam:agent-standard -->";
+
+/**
+ * Native ACP guardrails — the shared policy model.
+ *
+ * A guardrail is a per-category disposition applied in the ACP client to a
+ * deployed agent's tool calls: `deny` (block), `confirm` (surface a tappable
+ * approve/deny on mobile), or `off`. Default-on, configurable per session.
+ *
+ * ⚠️ SOFT guardrail, NOT a security boundary — it only sees tool calls the
+ * agent routes through the ACP client (permission requests + delegated
+ * fs read/write). An in-process tool call, a `bypassPermissions` agent (no
+ * permission requests), or a PTY agent (aider, bypasses ACP) slips it. Real
+ * containment is server-side (scoped, revocable tokens; per-user containers).
+ * The UI must present it as a safety net, never as a hard boundary.
+ *
+ * Spec: docs/superpowers/specs/2026-08-08-native-acp-guardrails-design.md.
+ */
+type GuardrailDisposition = 'deny' | 'confirm' | 'off';
+type GuardrailCategory = 'secretRead' | 'destructiveShell' | 'protectedBranch' | 'outwardIrreversible';
+type GuardrailPolicy = Record<GuardrailCategory, GuardrailDisposition>;
+/** Stable order for UI rows + iteration. */
+declare const GUARDRAIL_CATEGORIES: readonly GuardrailCategory[];
+declare const GUARDRAIL_DISPOSITIONS: readonly GuardrailDisposition[];
+/** Default-on: safe by default (everything asks) but nothing hard-blocked, so a
+ *  legitimate action is one tap away rather than a wall. */
+declare const DEFAULT_GUARDRAIL_POLICY: GuardrailPolicy;
+interface GuardrailCategoryMeta {
+    id: GuardrailCategory;
+    /** Short label for a settings row. */
+    label: string;
+    /** One line describing what it catches — user-facing. */
+    description: string;
+}
+/** Single source for the mobile settings copy + the backend/agent block reason. */
+declare const GUARDRAIL_CATEGORY_META: Record<GuardrailCategory, GuardrailCategoryMeta>;
+declare function isGuardrailDisposition(x: unknown): x is GuardrailDisposition;
+/**
+ * Coerce an untrusted value (a `~/.codeam/guardrails.json` blob, a wire payload,
+ * a partial policy) into a complete policy, falling back to the default per
+ * category. Absent/garbage → the full default (default-on).
+ */
+declare function normalizeGuardrailPolicy(raw: unknown): GuardrailPolicy;
+/** The wire command that pushes a live policy update to a running session. */
+declare const GUARDRAIL_CONFIGURE_COMMAND = "guardrail_configure";
+
 /**
  * Wire-shape types for the CLI / IDE-plugin → backend producer endpoints
  * that feed the mobile Files screen and the Pending Review Queue:
@@ -1632,4 +1697,4 @@ type UserEventName = (typeof USER_EVENTS)[keyof typeof USER_EVENTS];
  */
 declare const PREVIEW_DETECT_PROMPT: string;
 
-export { AGENT_REGISTRY, type AgentAuth, type AgentAuthKind, type AgentId, type AgentMetadata, type AgentMode, type AgentModel, type AgentReviewFinding, type AgentReviewPlan, type AgentReviewReport, type AnswerResolvedEvent, type AwaitingAnswerEvent, type BeadsActionCommand, type BeadsActionKind, type BeadsActionPayload, type BeadsActionRequest, type BeadsActionType, type BeadsConfigureAction, type BeadsDependencyDto, type BeadsDependencyKind, type BeadsIngestPayload, type BeadsIssueDto, type BeadsIssueStatus, type BeadsMemoryDto, type BeadsProjectDto, type BeadsProvisioningPayload, type BeadsProvisioningStatus, type BeadsSnapshotDto, type BeadsStatus, type BeadsStatusState, type BeadsStatusSummary, type BlameLineWire, type BrokeredIntegrationToken, type ChromeStep, type ChromeToolType, type CommitEntryWire, DEFAULT_API_BASE_URL, DEP_TO_INTEGRATION, DEV_API_BASE_URL, type DerivedCredentialSource, type EnvVar, type FileBlameEvent, type FileChangeStatus, type FileChangedEvent, type FileHistoryEvent, type FileReviewStatus, HEADROOM_BACKEND_ENV, HEADROOM_EXTRAS_BY_SURFACE, HEADROOM_MODELS, HEADROOM_PIP_COMPANIONS, HEADROOM_PROXY_PORT, HEARTBEAT_INTERVAL_MS_DEFAULT, HOUSE_AGENT_ID, HOUSE_AGENT_NAME, HOUSE_AGENT_PROVIDER, HOUSE_AGENT_SUBTITLE, HOUSE_AGENT_VENDOR, type HeadroomBudgetCommand, type HeadroomBudgetPeriod, type HeadroomBudgetUsage, type HeadroomKind, type HeadroomModelSpec, type HeadroomPythonRenderOpts, type HeadroomStatus, type HeadroomStep, type HeadroomSurface, type HunkLineType, INTEGRATION_BRANDING, INTEGRATION_REGISTRY, INTERNAL_TO_PUBLIC, type InputSuggestionChunk, type IntegrationApiKeyField, type IntegrationAuthKind, type IntegrationBranding, type IntegrationCategory, type IntegrationDefinition, type IntegrationDelivery, type IntegrationHealth, type IntegrationId, type IntegrationMcpDelivery, type IntegrationStatus, type IntegrationsManifest, type IntegrationsManifestEntry, LINKED_AGENT_IDS, type LinkedAgentId, MODEL_CONTEXT_WINDOW, MODEL_PRICING, type ModelPricing, type NormalizedMessage, OBSERVER_BRIDGE_PORT, PREVIEW_DETECT_PROMPT, PROTOCOL_VERSION, PUBLIC_TO_INTERNAL, type PendingReviewHunkEvent, type PendingReviewHunkLine, type PrCheck, type PrRef, type PrReviewEntry, type PrReviewVerdict, type PreviewDetection, type PreviewErrorStage, type PreviewState, type PreviewStatus, type PullRequestDetail, type PullRequestSummary, type RemoteCommand, type RepoStack, type RepoStackDetection, SKILL_REGISTRY, SSE_SOCKET_TIMEOUT_MS, STACK_TO_RECOMMENDED, type SelectPrompt, type SkillDefinition, type SkillDelivery, type SkillFileDelivery, type SkillId, type SkillRail, type SkillsManifest, type SkillsManifestEntry, type StreamingChunkEvent, type StreamingChunkKind, TERMINAL_AGENT_PREFIX, UNKNOWN_MODEL_PRICING, UPCOMING_INTEGRATION_IDS, USER_EVENTS, type UserEventName, classifyStack, detectedIntegrationsFromDeps, getAgent, getContextWindow, getEnabledAgents, getEnabledIntegrations, getIntegration, getIntegrationBranding, getIntegrationsByCategory, getPricing, getSkillDefinition, headroomKindFor, headroomModelPredownloadScript, headroomPipPackage, headroomSnapshotDownloadLine, internalToPublic, isHeadroomWrappable, isKnownAgentId, isKnownIntegrationId, isKnownModel, isLinkedAgentId, isSkillId, normalizeAgentId, publicToInternal, recommendForDeps, renderToLines, resolveApiBaseUrl, skillHasRail, toRemoteCommand, tryGetContextWindow };
+export { AGENT_REGISTRY, AGENT_STANDARD_BLOCK, AGENT_STANDARD_MARKER, AGENT_STANDARD_TEXT, type AgentAuth, type AgentAuthKind, type AgentId, type AgentMetadata, type AgentMode, type AgentModel, type AgentReviewFinding, type AgentReviewPlan, type AgentReviewReport, type AnswerResolvedEvent, type AwaitingAnswerEvent, type BeadsActionCommand, type BeadsActionKind, type BeadsActionPayload, type BeadsActionRequest, type BeadsActionType, type BeadsConfigureAction, type BeadsDependencyDto, type BeadsDependencyKind, type BeadsIngestPayload, type BeadsIssueDto, type BeadsIssueStatus, type BeadsMemoryDto, type BeadsProjectDto, type BeadsProvisioningPayload, type BeadsProvisioningStatus, type BeadsSnapshotDto, type BeadsStatus, type BeadsStatusState, type BeadsStatusSummary, type BlameLineWire, type BrokeredIntegrationToken, type ChromeStep, type ChromeToolType, type CommitEntryWire, DEFAULT_API_BASE_URL, DEFAULT_GUARDRAIL_POLICY, DEP_TO_INTEGRATION, DEV_API_BASE_URL, type DerivedCredentialSource, type EnvVar, type FileBlameEvent, type FileChangeStatus, type FileChangedEvent, type FileHistoryEvent, type FileReviewStatus, GUARDRAIL_CATEGORIES, GUARDRAIL_CATEGORY_META, GUARDRAIL_CONFIGURE_COMMAND, GUARDRAIL_DISPOSITIONS, type GuardrailCategory, type GuardrailCategoryMeta, type GuardrailDisposition, type GuardrailPolicy, HEADROOM_BACKEND_ENV, HEADROOM_EXTRAS_BY_SURFACE, HEADROOM_MODELS, HEADROOM_PIP_COMPANIONS, HEADROOM_PROXY_PORT, HEARTBEAT_INTERVAL_MS_DEFAULT, HOUSE_AGENT_ID, HOUSE_AGENT_NAME, HOUSE_AGENT_PROVIDER, HOUSE_AGENT_SUBTITLE, HOUSE_AGENT_VENDOR, type HeadroomBudgetCommand, type HeadroomBudgetPeriod, type HeadroomBudgetUsage, type HeadroomKind, type HeadroomModelSpec, type HeadroomPythonRenderOpts, type HeadroomStatus, type HeadroomStep, type HeadroomSurface, type HunkLineType, INTEGRATION_BRANDING, INTEGRATION_REGISTRY, INTERNAL_TO_PUBLIC, type InputSuggestionChunk, type IntegrationApiKeyField, type IntegrationAuthKind, type IntegrationBranding, type IntegrationCategory, type IntegrationDefinition, type IntegrationDelivery, type IntegrationHealth, type IntegrationId, type IntegrationMcpDelivery, type IntegrationStatus, type IntegrationsManifest, type IntegrationsManifestEntry, LINKED_AGENT_IDS, type LinkedAgentId, MODEL_CONTEXT_WINDOW, MODEL_PRICING, type ModelPricing, type NormalizedMessage, OBSERVER_BRIDGE_PORT, PREVIEW_DETECT_PROMPT, PROTOCOL_VERSION, PUBLIC_TO_INTERNAL, type PendingReviewHunkEvent, type PendingReviewHunkLine, type PrCheck, type PrRef, type PrReviewEntry, type PrReviewVerdict, type PreviewDetection, type PreviewErrorStage, type PreviewState, type PreviewStatus, type PullRequestDetail, type PullRequestSummary, type RemoteCommand, type RepoStack, type RepoStackDetection, SKILL_REGISTRY, SSE_SOCKET_TIMEOUT_MS, STACK_TO_RECOMMENDED, type SelectPrompt, type SkillDefinition, type SkillDelivery, type SkillFileDelivery, type SkillId, type SkillRail, type SkillsManifest, type SkillsManifestEntry, type StreamingChunkEvent, type StreamingChunkKind, TERMINAL_AGENT_PREFIX, UNKNOWN_MODEL_PRICING, UPCOMING_INTEGRATION_IDS, USER_EVENTS, type UserEventName, classifyStack, detectedIntegrationsFromDeps, getAgent, getContextWindow, getEnabledAgents, getEnabledIntegrations, getIntegration, getIntegrationBranding, getIntegrationsByCategory, getPricing, getSkillDefinition, headroomKindFor, headroomModelPredownloadScript, headroomPipPackage, headroomSnapshotDownloadLine, internalToPublic, isGuardrailDisposition, isHeadroomWrappable, isKnownAgentId, isKnownIntegrationId, isKnownModel, isLinkedAgentId, isSkillId, normalizeAgentId, normalizeGuardrailPolicy, publicToInternal, recommendForDeps, renderToLines, resolveApiBaseUrl, skillHasRail, toRemoteCommand, tryGetContextWindow };

package/dist/index.d.ts

@@ -800,6 +800,71 @@ declare function isSkillId(id: string): id is SkillId;
 declare function getSkillDefinition(id: string): SkillDefinition | null;
 declare function skillHasRail(id: SkillId, rail: SkillRail): boolean;
 
+/**
+ * The always-on **Agent Standard** — baseline working + safety guidance injected
+ * into EVERY managed deployed session, for ALL agents. This is NOT a curated
+ * skill: it is deliberately absent from `SKILL_REGISTRY` and the skills picker,
+ * so it is product-level baseline behavior the user can't accidentally turn off
+ * (curated skills, by contrast, are opt-in). Single source of the text — the CLI
+ * delivers it two ways, split on the Claude rail: Claude gets a marker-guarded
+ * append to `~/.claude/CLAUDE.md` at spawn (always in context); every other ACP
+ * agent gets a one-time preface on the first turn of a new conversation.
+ *
+ * Repo-agnostic on purpose: it governs how the agent works on the USER's own
+ * project, so it must never mention CodeAgent-internal workflow (issue tracker,
+ * our branch/deploy rules, our infrastructure).
+ */
+/** Idempotency marker wrapping the block appended to an agent's instruction file. */
+declare const AGENT_STANDARD_MARKER = "<!-- codeam:agent-standard -->";
+/** The standard, clean markdown (no markers) — used verbatim as a prompt preface. */
+declare const AGENT_STANDARD_TEXT = "# Working standard\n\nYou are an AI coding agent working on the user's project through CodeAgent Mobile. Follow this standard on every task.\n\n## How to work\n- **Understand before acting.** Restate the goal, read the relevant code, and be clear on what \"done\" looks like before changing anything.\n- **Plan first for anything non-trivial** (3+ steps or a design decision): outline the approach and the files you'll touch, and share it before implementing. Skip the ceremony for small, obvious fixes.\n- **Ground every claim in reality** \u2014 the actual code, tests, or output, never guesswork. If you are unsure, say so and verify.\n- **Ask when intent is genuinely ambiguous** \u2014 one sharp question. At a real fork, give a recommendation, not a survey of every option.\n- **Stay in scope.** Solve what was asked; no \"while I'm here\" refactors or speculative abstractions. Note unrelated issues instead of acting on them.\n- **Favor the simplest solution that fully solves the problem.** Fix root causes, not symptoms \u2014 no temporary patches and no defensive code for cases that can't happen.\n- **Verify your work and show the evidence** \u2014 run the project's tests, linters, and build, and read the output. \"It runs\" is not \"it's done.\"\n- **Match the project's existing style, structure, and conventions.** Comment only the non-obvious WHY, briefly \u2014 don't narrate the code.\n- **Stop when stuck.** If the same fix fails twice, step back and reconsider the approach rather than repeating variations.\n\n## Safety\n- **Never expose or exfiltrate** secrets, credentials, tokens, or customer data, and never print a credential's value.\n- **Treat destructive or irreversible actions as needing explicit confirmation** \u2014 force-push, history rewrite, bulk deletes, hard resets, dropping data. Don't run them unprompted.\n- **Don't push to a shared/default branch or make outward-facing changes** unless the user asked for it.\n- **Report honestly when you finish**: what you changed, what you verified, and anything you could not.";
+/** Marker-wrapped block for an idempotent append to an agent's instruction file. */
+declare const AGENT_STANDARD_BLOCK = "<!-- codeam:agent-standard -->\n# Working standard\n\nYou are an AI coding agent working on the user's project through CodeAgent Mobile. Follow this standard on every task.\n\n## How to work\n- **Understand before acting.** Restate the goal, read the relevant code, and be clear on what \"done\" looks like before changing anything.\n- **Plan first for anything non-trivial** (3+ steps or a design decision): outline the approach and the files you'll touch, and share it before implementing. Skip the ceremony for small, obvious fixes.\n- **Ground every claim in reality** \u2014 the actual code, tests, or output, never guesswork. If you are unsure, say so and verify.\n- **Ask when intent is genuinely ambiguous** \u2014 one sharp question. At a real fork, give a recommendation, not a survey of every option.\n- **Stay in scope.** Solve what was asked; no \"while I'm here\" refactors or speculative abstractions. Note unrelated issues instead of acting on them.\n- **Favor the simplest solution that fully solves the problem.** Fix root causes, not symptoms \u2014 no temporary patches and no defensive code for cases that can't happen.\n- **Verify your work and show the evidence** \u2014 run the project's tests, linters, and build, and read the output. \"It runs\" is not \"it's done.\"\n- **Match the project's existing style, structure, and conventions.** Comment only the non-obvious WHY, briefly \u2014 don't narrate the code.\n- **Stop when stuck.** If the same fix fails twice, step back and reconsider the approach rather than repeating variations.\n\n## Safety\n- **Never expose or exfiltrate** secrets, credentials, tokens, or customer data, and never print a credential's value.\n- **Treat destructive or irreversible actions as needing explicit confirmation** \u2014 force-push, history rewrite, bulk deletes, hard resets, dropping data. Don't run them unprompted.\n- **Don't push to a shared/default branch or make outward-facing changes** unless the user asked for it.\n- **Report honestly when you finish**: what you changed, what you verified, and anything you could not.\n<!-- codeam:agent-standard -->";
+
+/**
+ * Native ACP guardrails — the shared policy model.
+ *
+ * A guardrail is a per-category disposition applied in the ACP client to a
+ * deployed agent's tool calls: `deny` (block), `confirm` (surface a tappable
+ * approve/deny on mobile), or `off`. Default-on, configurable per session.
+ *
+ * ⚠️ SOFT guardrail, NOT a security boundary — it only sees tool calls the
+ * agent routes through the ACP client (permission requests + delegated
+ * fs read/write). An in-process tool call, a `bypassPermissions` agent (no
+ * permission requests), or a PTY agent (aider, bypasses ACP) slips it. Real
+ * containment is server-side (scoped, revocable tokens; per-user containers).
+ * The UI must present it as a safety net, never as a hard boundary.
+ *
+ * Spec: docs/superpowers/specs/2026-08-08-native-acp-guardrails-design.md.
+ */
+type GuardrailDisposition = 'deny' | 'confirm' | 'off';
+type GuardrailCategory = 'secretRead' | 'destructiveShell' | 'protectedBranch' | 'outwardIrreversible';
+type GuardrailPolicy = Record<GuardrailCategory, GuardrailDisposition>;
+/** Stable order for UI rows + iteration. */
+declare const GUARDRAIL_CATEGORIES: readonly GuardrailCategory[];
+declare const GUARDRAIL_DISPOSITIONS: readonly GuardrailDisposition[];
+/** Default-on: safe by default (everything asks) but nothing hard-blocked, so a
+ *  legitimate action is one tap away rather than a wall. */
+declare const DEFAULT_GUARDRAIL_POLICY: GuardrailPolicy;
+interface GuardrailCategoryMeta {
+    id: GuardrailCategory;
+    /** Short label for a settings row. */
+    label: string;
+    /** One line describing what it catches — user-facing. */
+    description: string;
+}
+/** Single source for the mobile settings copy + the backend/agent block reason. */
+declare const GUARDRAIL_CATEGORY_META: Record<GuardrailCategory, GuardrailCategoryMeta>;
+declare function isGuardrailDisposition(x: unknown): x is GuardrailDisposition;
+/**
+ * Coerce an untrusted value (a `~/.codeam/guardrails.json` blob, a wire payload,
+ * a partial policy) into a complete policy, falling back to the default per
+ * category. Absent/garbage → the full default (default-on).
+ */
+declare function normalizeGuardrailPolicy(raw: unknown): GuardrailPolicy;
+/** The wire command that pushes a live policy update to a running session. */
+declare const GUARDRAIL_CONFIGURE_COMMAND = "guardrail_configure";
+
 /**
  * Wire-shape types for the CLI / IDE-plugin → backend producer endpoints
  * that feed the mobile Files screen and the Pending Review Queue:
@@ -1632,4 +1697,4 @@ type UserEventName = (typeof USER_EVENTS)[keyof typeof USER_EVENTS];
  */
 declare const PREVIEW_DETECT_PROMPT: string;
 
-export { AGENT_REGISTRY, type AgentAuth, type AgentAuthKind, type AgentId, type AgentMetadata, type AgentMode, type AgentModel, type AgentReviewFinding, type AgentReviewPlan, type AgentReviewReport, type AnswerResolvedEvent, type AwaitingAnswerEvent, type BeadsActionCommand, type BeadsActionKind, type BeadsActionPayload, type BeadsActionRequest, type BeadsActionType, type BeadsConfigureAction, type BeadsDependencyDto, type BeadsDependencyKind, type BeadsIngestPayload, type BeadsIssueDto, type BeadsIssueStatus, type BeadsMemoryDto, type BeadsProjectDto, type BeadsProvisioningPayload, type BeadsProvisioningStatus, type BeadsSnapshotDto, type BeadsStatus, type BeadsStatusState, type BeadsStatusSummary, type BlameLineWire, type BrokeredIntegrationToken, type ChromeStep, type ChromeToolType, type CommitEntryWire, DEFAULT_API_BASE_URL, DEP_TO_INTEGRATION, DEV_API_BASE_URL, type DerivedCredentialSource, type EnvVar, type FileBlameEvent, type FileChangeStatus, type FileChangedEvent, type FileHistoryEvent, type FileReviewStatus, HEADROOM_BACKEND_ENV, HEADROOM_EXTRAS_BY_SURFACE, HEADROOM_MODELS, HEADROOM_PIP_COMPANIONS, HEADROOM_PROXY_PORT, HEARTBEAT_INTERVAL_MS_DEFAULT, HOUSE_AGENT_ID, HOUSE_AGENT_NAME, HOUSE_AGENT_PROVIDER, HOUSE_AGENT_SUBTITLE, HOUSE_AGENT_VENDOR, type HeadroomBudgetCommand, type HeadroomBudgetPeriod, type HeadroomBudgetUsage, type HeadroomKind, type HeadroomModelSpec, type HeadroomPythonRenderOpts, type HeadroomStatus, type HeadroomStep, type HeadroomSurface, type HunkLineType, INTEGRATION_BRANDING, INTEGRATION_REGISTRY, INTERNAL_TO_PUBLIC, type InputSuggestionChunk, type IntegrationApiKeyField, type IntegrationAuthKind, type IntegrationBranding, type IntegrationCategory, type IntegrationDefinition, type IntegrationDelivery, type IntegrationHealth, type IntegrationId, type IntegrationMcpDelivery, type IntegrationStatus, type IntegrationsManifest, type IntegrationsManifestEntry, LINKED_AGENT_IDS, type LinkedAgentId, MODEL_CONTEXT_WINDOW, MODEL_PRICING, type ModelPricing, type NormalizedMessage, OBSERVER_BRIDGE_PORT, PREVIEW_DETECT_PROMPT, PROTOCOL_VERSION, PUBLIC_TO_INTERNAL, type PendingReviewHunkEvent, type PendingReviewHunkLine, type PrCheck, type PrRef, type PrReviewEntry, type PrReviewVerdict, type PreviewDetection, type PreviewErrorStage, type PreviewState, type PreviewStatus, type PullRequestDetail, type PullRequestSummary, type RemoteCommand, type RepoStack, type RepoStackDetection, SKILL_REGISTRY, SSE_SOCKET_TIMEOUT_MS, STACK_TO_RECOMMENDED, type SelectPrompt, type SkillDefinition, type SkillDelivery, type SkillFileDelivery, type SkillId, type SkillRail, type SkillsManifest, type SkillsManifestEntry, type StreamingChunkEvent, type StreamingChunkKind, TERMINAL_AGENT_PREFIX, UNKNOWN_MODEL_PRICING, UPCOMING_INTEGRATION_IDS, USER_EVENTS, type UserEventName, classifyStack, detectedIntegrationsFromDeps, getAgent, getContextWindow, getEnabledAgents, getEnabledIntegrations, getIntegration, getIntegrationBranding, getIntegrationsByCategory, getPricing, getSkillDefinition, headroomKindFor, headroomModelPredownloadScript, headroomPipPackage, headroomSnapshotDownloadLine, internalToPublic, isHeadroomWrappable, isKnownAgentId, isKnownIntegrationId, isKnownModel, isLinkedAgentId, isSkillId, normalizeAgentId, publicToInternal, recommendForDeps, renderToLines, resolveApiBaseUrl, skillHasRail, toRemoteCommand, tryGetContextWindow };
+export { AGENT_REGISTRY, AGENT_STANDARD_BLOCK, AGENT_STANDARD_MARKER, AGENT_STANDARD_TEXT, type AgentAuth, type AgentAuthKind, type AgentId, type AgentMetadata, type AgentMode, type AgentModel, type AgentReviewFinding, type AgentReviewPlan, type AgentReviewReport, type AnswerResolvedEvent, type AwaitingAnswerEvent, type BeadsActionCommand, type BeadsActionKind, type BeadsActionPayload, type BeadsActionRequest, type BeadsActionType, type BeadsConfigureAction, type BeadsDependencyDto, type BeadsDependencyKind, type BeadsIngestPayload, type BeadsIssueDto, type BeadsIssueStatus, type BeadsMemoryDto, type BeadsProjectDto, type BeadsProvisioningPayload, type BeadsProvisioningStatus, type BeadsSnapshotDto, type BeadsStatus, type BeadsStatusState, type BeadsStatusSummary, type BlameLineWire, type BrokeredIntegrationToken, type ChromeStep, type ChromeToolType, type CommitEntryWire, DEFAULT_API_BASE_URL, DEFAULT_GUARDRAIL_POLICY, DEP_TO_INTEGRATION, DEV_API_BASE_URL, type DerivedCredentialSource, type EnvVar, type FileBlameEvent, type FileChangeStatus, type FileChangedEvent, type FileHistoryEvent, type FileReviewStatus, GUARDRAIL_CATEGORIES, GUARDRAIL_CATEGORY_META, GUARDRAIL_CONFIGURE_COMMAND, GUARDRAIL_DISPOSITIONS, type GuardrailCategory, type GuardrailCategoryMeta, type GuardrailDisposition, type GuardrailPolicy, HEADROOM_BACKEND_ENV, HEADROOM_EXTRAS_BY_SURFACE, HEADROOM_MODELS, HEADROOM_PIP_COMPANIONS, HEADROOM_PROXY_PORT, HEARTBEAT_INTERVAL_MS_DEFAULT, HOUSE_AGENT_ID, HOUSE_AGENT_NAME, HOUSE_AGENT_PROVIDER, HOUSE_AGENT_SUBTITLE, HOUSE_AGENT_VENDOR, type HeadroomBudgetCommand, type HeadroomBudgetPeriod, type HeadroomBudgetUsage, type HeadroomKind, type HeadroomModelSpec, type HeadroomPythonRenderOpts, type HeadroomStatus, type HeadroomStep, type HeadroomSurface, type HunkLineType, INTEGRATION_BRANDING, INTEGRATION_REGISTRY, INTERNAL_TO_PUBLIC, type InputSuggestionChunk, type IntegrationApiKeyField, type IntegrationAuthKind, type IntegrationBranding, type IntegrationCategory, type IntegrationDefinition, type IntegrationDelivery, type IntegrationHealth, type IntegrationId, type IntegrationMcpDelivery, type IntegrationStatus, type IntegrationsManifest, type IntegrationsManifestEntry, LINKED_AGENT_IDS, type LinkedAgentId, MODEL_CONTEXT_WINDOW, MODEL_PRICING, type ModelPricing, type NormalizedMessage, OBSERVER_BRIDGE_PORT, PREVIEW_DETECT_PROMPT, PROTOCOL_VERSION, PUBLIC_TO_INTERNAL, type PendingReviewHunkEvent, type PendingReviewHunkLine, type PrCheck, type PrRef, type PrReviewEntry, type PrReviewVerdict, type PreviewDetection, type PreviewErrorStage, type PreviewState, type PreviewStatus, type PullRequestDetail, type PullRequestSummary, type RemoteCommand, type RepoStack, type RepoStackDetection, SKILL_REGISTRY, SSE_SOCKET_TIMEOUT_MS, STACK_TO_RECOMMENDED, type SelectPrompt, type SkillDefinition, type SkillDelivery, type SkillFileDelivery, type SkillId, type SkillRail, type SkillsManifest, type SkillsManifestEntry, type StreamingChunkEvent, type StreamingChunkKind, TERMINAL_AGENT_PREFIX, UNKNOWN_MODEL_PRICING, UPCOMING_INTEGRATION_IDS, USER_EVENTS, type UserEventName, classifyStack, detectedIntegrationsFromDeps, getAgent, getContextWindow, getEnabledAgents, getEnabledIntegrations, getIntegration, getIntegrationBranding, getIntegrationsByCategory, getPricing, getSkillDefinition, headroomKindFor, headroomModelPredownloadScript, headroomPipPackage, headroomSnapshotDownloadLine, internalToPublic, isGuardrailDisposition, isHeadroomWrappable, isKnownAgentId, isKnownIntegrationId, isKnownModel, isLinkedAgentId, isSkillId, normalizeAgentId, normalizeGuardrailPolicy, publicToInternal, recommendForDeps, renderToLines, resolveApiBaseUrl, skillHasRail, toRemoteCommand, tryGetContextWindow };

package/dist/index.js

@@ -21,9 +21,17 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var index_exports = {};
 __export(index_exports, {
   AGENT_REGISTRY: () => AGENT_REGISTRY,
+  AGENT_STANDARD_BLOCK: () => AGENT_STANDARD_BLOCK,
+  AGENT_STANDARD_MARKER: () => AGENT_STANDARD_MARKER,
+  AGENT_STANDARD_TEXT: () => AGENT_STANDARD_TEXT,
   DEFAULT_API_BASE_URL: () => DEFAULT_API_BASE_URL,
+  DEFAULT_GUARDRAIL_POLICY: () => DEFAULT_GUARDRAIL_POLICY,
   DEP_TO_INTEGRATION: () => DEP_TO_INTEGRATION,
   DEV_API_BASE_URL: () => DEV_API_BASE_URL,
+  GUARDRAIL_CATEGORIES: () => GUARDRAIL_CATEGORIES,
+  GUARDRAIL_CATEGORY_META: () => GUARDRAIL_CATEGORY_META,
+  GUARDRAIL_CONFIGURE_COMMAND: () => GUARDRAIL_CONFIGURE_COMMAND,
+  GUARDRAIL_DISPOSITIONS: () => GUARDRAIL_DISPOSITIONS,
   HEADROOM_BACKEND_ENV: () => HEADROOM_BACKEND_ENV,
   HEADROOM_EXTRAS_BY_SURFACE: () => HEADROOM_EXTRAS_BY_SURFACE,
   HEADROOM_MODELS: () => HEADROOM_MODELS,
@@ -68,6 +76,7 @@ __export(index_exports, {
   headroomPipPackage: () => headroomPipPackage,
   headroomSnapshotDownloadLine: () => headroomSnapshotDownloadLine,
   internalToPublic: () => internalToPublic,
+  isGuardrailDisposition: () => isGuardrailDisposition,
   isHeadroomWrappable: () => isHeadroomWrappable,
   isKnownAgentId: () => isKnownAgentId,
   isKnownIntegrationId: () => isKnownIntegrationId,
@@ -75,6 +84,7 @@ __export(index_exports, {
   isLinkedAgentId: () => isLinkedAgentId,
   isSkillId: () => isSkillId,
   normalizeAgentId: () => normalizeAgentId,
+  normalizeGuardrailPolicy: () => normalizeGuardrailPolicy,
   publicToInternal: () => publicToInternal,
   recommendForDeps: () => recommendForDeps,
   renderToLines: () => renderToLines,
@@ -2436,6 +2446,82 @@ function skillHasRail(id, rail) {
   return Boolean(SKILL_REGISTRY[id].delivery[rail]);
 }
 
+// src/skills/agent-standard.ts
+var AGENT_STANDARD_MARKER = "<!-- codeam:agent-standard -->";
+var AGENT_STANDARD_TEXT = `# Working standard
+
+You are an AI coding agent working on the user's project through CodeAgent Mobile. Follow this standard on every task.
+
+## How to work
+- **Understand before acting.** Restate the goal, read the relevant code, and be clear on what "done" looks like before changing anything.
+- **Plan first for anything non-trivial** (3+ steps or a design decision): outline the approach and the files you'll touch, and share it before implementing. Skip the ceremony for small, obvious fixes.
+- **Ground every claim in reality** \u2014 the actual code, tests, or output, never guesswork. If you are unsure, say so and verify.
+- **Ask when intent is genuinely ambiguous** \u2014 one sharp question. At a real fork, give a recommendation, not a survey of every option.
+- **Stay in scope.** Solve what was asked; no "while I'm here" refactors or speculative abstractions. Note unrelated issues instead of acting on them.
+- **Favor the simplest solution that fully solves the problem.** Fix root causes, not symptoms \u2014 no temporary patches and no defensive code for cases that can't happen.
+- **Verify your work and show the evidence** \u2014 run the project's tests, linters, and build, and read the output. "It runs" is not "it's done."
+- **Match the project's existing style, structure, and conventions.** Comment only the non-obvious WHY, briefly \u2014 don't narrate the code.
+- **Stop when stuck.** If the same fix fails twice, step back and reconsider the approach rather than repeating variations.
+
+## Safety
+- **Never expose or exfiltrate** secrets, credentials, tokens, or customer data, and never print a credential's value.
+- **Treat destructive or irreversible actions as needing explicit confirmation** \u2014 force-push, history rewrite, bulk deletes, hard resets, dropping data. Don't run them unprompted.
+- **Don't push to a shared/default branch or make outward-facing changes** unless the user asked for it.
+- **Report honestly when you finish**: what you changed, what you verified, and anything you could not.`;
+var AGENT_STANDARD_BLOCK = `${AGENT_STANDARD_MARKER}
+${AGENT_STANDARD_TEXT}
+${AGENT_STANDARD_MARKER}`;
+
+// src/guardrails/index.ts
+var GUARDRAIL_CATEGORIES = [
+  "secretRead",
+  "destructiveShell",
+  "protectedBranch",
+  "outwardIrreversible"
+];
+var GUARDRAIL_DISPOSITIONS = ["deny", "confirm", "off"];
+var DEFAULT_GUARDRAIL_POLICY = {
+  secretRead: "confirm",
+  destructiveShell: "confirm",
+  protectedBranch: "confirm",
+  outwardIrreversible: "confirm"
+};
+var GUARDRAIL_CATEGORY_META = {
+  secretRead: {
+    id: "secretRead",
+    label: "Reading secrets",
+    description: "Reading .env, key, or credential files."
+  },
+  destructiveShell: {
+    id: "destructiveShell",
+    label: "Destructive commands",
+    description: "Bulk deletes, hard resets, and other irreversible shell actions."
+  },
+  protectedBranch: {
+    id: "protectedBranch",
+    label: "Protected branches",
+    description: "Committing or pushing to a shared branch (main, master, release)."
+  },
+  outwardIrreversible: {
+    id: "outwardIrreversible",
+    label: "Outward & irreversible",
+    description: "Force-push, publish, deploy, or send \u2014 hard to undo."
+  }
+};
+function isGuardrailDisposition(x) {
+  return x === "deny" || x === "confirm" || x === "off";
+}
+function normalizeGuardrailPolicy(raw) {
+  const src = raw && typeof raw === "object" ? raw : {};
+  const out = {};
+  for (const cat of GUARDRAIL_CATEGORIES) {
+    const v = src[cat];
+    out[cat] = isGuardrailDisposition(v) ? v : DEFAULT_GUARDRAIL_POLICY[cat];
+  }
+  return out;
+}
+var GUARDRAIL_CONFIGURE_COMMAND = "guardrail_configure";
+
 // src/api-url.ts
 var DEFAULT_API_BASE_URL = "https://api.codeagent-mobile.com";
 var DEV_API_BASE_URL = "https://dev-api.codeagent-mobile.com";
@@ -2638,9 +2724,17 @@ OUTPUT JSON ONLY. NO MARKDOWN. NO COMMENTARY.
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AGENT_REGISTRY,
+  AGENT_STANDARD_BLOCK,
+  AGENT_STANDARD_MARKER,
+  AGENT_STANDARD_TEXT,
   DEFAULT_API_BASE_URL,
+  DEFAULT_GUARDRAIL_POLICY,
   DEP_TO_INTEGRATION,
   DEV_API_BASE_URL,
+  GUARDRAIL_CATEGORIES,
+  GUARDRAIL_CATEGORY_META,
+  GUARDRAIL_CONFIGURE_COMMAND,
+  GUARDRAIL_DISPOSITIONS,
   HEADROOM_BACKEND_ENV,
   HEADROOM_EXTRAS_BY_SURFACE,
   HEADROOM_MODELS,
@@ -2685,6 +2779,7 @@ OUTPUT JSON ONLY. NO MARKDOWN. NO COMMENTARY.
   headroomPipPackage,
   headroomSnapshotDownloadLine,
   internalToPublic,
+  isGuardrailDisposition,
   isHeadroomWrappable,
   isKnownAgentId,
   isKnownIntegrationId,
@@ -2692,6 +2787,7 @@ OUTPUT JSON ONLY. NO MARKDOWN. NO COMMENTARY.
   isLinkedAgentId,
   isSkillId,
   normalizeAgentId,
+  normalizeGuardrailPolicy,
   publicToInternal,
   recommendForDeps,
   renderToLines,