@controlvector/cv-agent 1.11.1 → 1.12.0

package/dist/utils/meter.js

@@ -0,0 +1,125 @@
+"use strict";
+/**
+ * cv-meter token-metering plumbing.
+ *
+ * Pure helpers (no I/O) so the env wiring is unit-testable. The agent reads
+ * meter config once at startup and injects it into every Claude Code spawn;
+ * cv-code (the producer) reads CVMETER_* from that env and emits usage events.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveMeterConfig = resolveMeterConfig;
+exports.mapReasonToAction = mapReasonToAction;
+exports.resolveErrorAction = resolveErrorAction;
+exports.pollBackoffMs = pollBackoffMs;
+exports.noteDeny = noteDeny;
+exports.checkDenyCache = checkDenyCache;
+exports.meterCheck = meterCheck;
+exports.applyMeterEnv = applyMeterEnv;
+exports.stampTaskEnv = stampTaskEnv;
+/**
+ * Resolve meter config from agent config + process env.
+ * Config file wins over env (explicit config beats ambient environment).
+ */
+function resolveMeterConfig(config, env) {
+    return {
+        url: config.meter_url ?? env.CVMETER_URL,
+        token: config.meter_token ?? env.CVMETER_TOKEN,
+        enforce: (config.meter_enforce ?? env.CVMETER_ENFORCE ?? 'off'),
+        org: config.meter_org ?? env.CVMETER_ORG,
+    };
+}
+// Pure: map the server's reason_code to a gate action. NO_BUDGET/OK ⇒ allow.
+function mapReasonToAction(code) {
+    return code === 'HARD_DENY' ? 'deny' : code === 'SOFT_WARN' ? 'warn' : 'allow';
+}
+// Pure: on a check error/timeout, fail-open (allow) unless configured fail_closed (deny).
+function resolveErrorAction(enforce) {
+    return enforce === 'fail_closed' ? 'deny' : 'allow';
+}
+// Pure: poll sleep with exponential backoff after consecutive budget denials (cap 5 min).
+// denyStreak 0 ⇒ base interval; resets are the caller's job (any allow/warn sets streak 0).
+function pollBackoffMs(baseIntervalMs, denyStreak, capMs = 5 * 60_000) {
+    if (denyStreak <= 0)
+        return baseIntervalMs;
+    return Math.min(baseIntervalMs * 2 ** Math.min(denyStreak - 1, 6), capMs);
+}
+// Pure: negative-cache of denied scope keys → expiry, so a burst of same-scope tasks
+// doesn't fire N /v1/check calls for a scope already known over-cap.
+function noteDeny(cache, governingKey, now, ttlMs = 90_000) {
+    if (governingKey)
+        cache.set(governingKey, now + ttlMs);
+}
+function checkDenyCache(cache, scopes, now) {
+    for (const [k, v] of Object.entries(scopes)) {
+        if (!v)
+            continue;
+        const until = cache.get(`${k}:${v}`);
+        if (until && until > now)
+            return true;
+        if (until && until <= now)
+            cache.delete(`${k}:${v}`); // lazy eviction
+    }
+    return false;
+}
+/**
+ * Call cv-meter POST /v1/check. Returns the mapped server verdict on HTTP 200, or
+ * null on any error/timeout/non-200 (caller applies resolveErrorAction). Never throws.
+ * ~1s target timeout, 3s hard ceiling. Side-effect-free ⇒ safe to skip/retry.
+ */
+async function meterCheck(meter, org, scopes, timeoutMs = 1000) {
+    if (!meter.url)
+        return null;
+    const ctl = new AbortController();
+    const timer = setTimeout(() => ctl.abort(), Math.min(timeoutMs, 3000));
+    try {
+        const res = await fetch(`${meter.url.replace(/\/$/, '')}/v1/check`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', ...(meter.token ? { Authorization: `Bearer ${meter.token}` } : {}) },
+            body: JSON.stringify({ org, scopes }),
+            signal: ctl.signal,
+        });
+        if (!res.ok)
+            return null; // 400/401/403/5xx are errors, not budget denials
+        const body = await res.json();
+        const g = body.governing;
+        return {
+            action: mapReasonToAction(body.reason_code),
+            reasonCode: body.reason_code,
+            reason: body.reason ?? '',
+            governingKey: g ? `${g.scope}:${g.scope_id}` : undefined,
+        };
+    }
+    catch {
+        return null; // timeout / network / abort
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Inject resolved meter config into a spawn env (mutates in place).
+ * The token is only set when a URL is present — a token without an endpoint is
+ * useless and we don't want to leak it into a child that won't meter.
+ */
+function applyMeterEnv(targetEnv, meter) {
+    if (!meter.url)
+        return;
+    targetEnv.CVMETER_URL = meter.url;
+    if (meter.token)
+        targetEnv.CVMETER_TOKEN = meter.token;
+}
+/**
+ * Clone a base spawn env and stamp the per-task CVMETER_TASK_ID.
+ *
+ * Returns a fresh object so the daemon's base env is never mutated — this is
+ * what prevents one task's id from leaking into the next task's events. The id
+ * is only stamped when metering is active (CVMETER_URL present in the base env).
+ */
+function stampTaskEnv(baseEnv, taskId) {
+    const taskEnv = { ...baseEnv };
+    if (taskEnv.CVMETER_URL) {
+        taskEnv.CVMETER_TASK_ID = taskId;
+    }
+    return taskEnv;
+}
+//# sourceMappingURL=meter.js.map

package/dist/utils/meter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"meter.js","sourceRoot":"","sources":["../../src/utils/meter.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAeH,gDAUC;AAkBD,8CAEC;AAGD,gDAEC;AAID,sCAGC;AAID,4BAEC;AACD,wCAQC;AAOD,gCA8BC;AAOD,sCAIC;AASD,oCAMC;AA5HD;;;GAGG;AACH,SAAgB,kBAAkB,CAChC,MAA0B,EAC1B,GAAsB;IAEtB,OAAO;QACL,GAAG,EAAM,MAAM,CAAC,SAAS,IAAM,GAAG,CAAC,WAAW;QAC9C,KAAK,EAAI,MAAM,CAAC,WAAW,IAAI,GAAG,CAAC,aAAa;QAChD,OAAO,EAAE,CAAC,MAAM,CAAC,aAAa,IAAK,GAAG,CAAC,eAA4C,IAAI,KAAK,CAAC;QAC7F,GAAG,EAAM,MAAM,CAAC,SAAS,IAAM,GAAG,CAAC,WAAW;KAC/C,CAAC;AACJ,CAAC;AAiBD,6EAA6E;AAC7E,SAAgB,iBAAiB,CAAC,IAAqB;IACrD,OAAO,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AACjF,CAAC;AAED,0FAA0F;AAC1F,SAAgB,kBAAkB,CAAC,OAAqB;IACtD,OAAO,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AACtD,CAAC;AAED,0FAA0F;AAC1F,4FAA4F;AAC5F,SAAgB,aAAa,CAAC,cAAsB,EAAE,UAAkB,EAAE,KAAK,GAAG,CAAC,GAAG,MAAM;IAC1F,IAAI,UAAU,IAAI,CAAC;QAAE,OAAO,cAAc,CAAC;IAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAC5E,CAAC;AAED,qFAAqF;AACrF,qEAAqE;AACrE,SAAgB,QAAQ,CAAC,KAA0B,EAAE,YAAgC,EAAE,GAAW,EAAE,KAAK,GAAG,MAAM;IAChH,IAAI,YAAY;QAAE,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC;AACzD,CAAC;AACD,SAAgB,cAAc,CAAC,KAA0B,EAAE,MAAwB,EAAE,GAAW;IAC9F,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,KAAK,IAAI,KAAK,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,KAAK,IAAI,KAAK,IAAI,GAAG;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,UAAU,CAC9B,KAAsB,EACtB,GAAW,EACX,MAAwB,EACxB,SAAS,GAAG,IAAI;IAEhB,IAAI,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,eAAe,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACnH,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,CAAC,iDAAiD;QAC3E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA+G,CAAC;QAC3I,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACzB,OAAO;YACL,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC;YAC3C,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;YACzB,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SACzD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,4BAA4B;IAC3C,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,SAA4B,EAAE,KAAsB;IAChF,IAAI,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO;IACvB,SAAS,CAAC,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC;IAClC,IAAI,KAAK,CAAC,KAAK;QAAE,SAAS,CAAC,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,YAAY,CAAC,OAA0B,EAAE,MAAc;IACrE,MAAM,OAAO,GAAsB,EAAE,GAAG,OAAO,EAAE,CAAC;IAClD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,OAAO,CAAC,eAAe,GAAG,MAAM,CAAC;IACnC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/utils/profile.d.ts

@@ -0,0 +1,123 @@
+/**
+ * Agent profiles (P14). A profile is data, not a fork: a manifest + system prompt +
+ * tool policy that constrains what a cva session can do. It is loaded at start and
+ * enforced as a hard gate, so a profiled session cannot exceed its manifest no matter
+ * what the model attempts. cv-deploy (P15) is the first profile.
+ *
+ * This module is pure and self-contained: the manifest schema, the loader, and the
+ * enforcement decisions (tool policy, task-type routing, scope ceiling, base semver
+ * gate) are all here as testable functions. agent.ts wires them into the run loop and
+ * the permission relay; the frozen contract other profiles author against is SPEC.md.
+ */
+import { z } from 'zod';
+/**
+ * The profile manifest. `.strict()` at every level makes an unknown key an ERROR, not
+ * a warning (P14 item 2): a typo or a key from a newer schema fails the load loudly
+ * rather than being silently ignored.
+ */
+export declare const ProfileManifestSchema: z.ZodObject<{
+    name: z.ZodString;
+    version: z.ZodString;
+    base: z.ZodString;
+    system_prompt: z.ZodString;
+    tools: z.ZodObject<{
+        allow: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+    task_types: z.ZodArray<z.ZodString>;
+    credential_scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    limits: z.ZodDefault<z.ZodObject<{
+        max_turns: z.ZodOptional<z.ZodNumber>;
+        max_tool_calls: z.ZodOptional<z.ZodNumber>;
+        timeout_s: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ProfileManifest = z.infer<typeof ProfileManifestSchema>;
+export declare class ProfileError extends Error {
+    readonly detail: Record<string, unknown>;
+    constructor(message: string, detail?: Record<string, unknown>);
+}
+/** Validate an already-parsed object as a manifest. Throws ProfileError on any issue. */
+export declare function validateManifest(input: unknown): ProfileManifest;
+/**
+ * Check the manifest `base` constraint against the running host. The grammar is
+ * frozen (SPEC): `[<host-name>] <op> <version>`, op one of >= > <= < =, version a
+ * bare `major.minor.patch`; a bare version with no op means `=`. A host-name token,
+ * when present, must match hostName (a profile for a different host is refused).
+ */
+export declare function checkBaseConstraint(base: string, hostName: string, hostVersion: string): {
+    ok: boolean;
+    reason?: string;
+};
+/**
+ * A tool spec's base name. Claude Code tools appear as "Bash" or scoped like
+ * "Bash(git*)"; policy entries may be "Bash", "Bash(*)", or "Bash(git*)". Policy is
+ * evaluated by base name so an allow/deny of "Bash" covers every Bash invocation.
+ */
+export declare function toolBaseName(spec: string): string;
+export interface ToolDecision {
+    allowed: boolean;
+    reason?: string;
+}
+/**
+ * The tool-policy decision: a deny-list entry wins over an allow-list entry, and
+ * absence from the allow-list means denied. This is the hard gate the relay and the
+ * auto-approve allowlist are both built from.
+ */
+export declare function evaluateTool(manifest: ProfileManifest, tool: string): ToolDecision;
+/** The `--allowedTools` list for auto-approve mode: allow entries not shadowed by a deny. */
+export declare function allowedToolsList(manifest: ProfileManifest): string[];
+/** Pull the tool name out of a Claude Code permission prompt, or null if not present. */
+export declare function extractToolFromPrompt(promptText: string): string | null;
+/**
+ * The relay decision for a permission prompt under a profile. A tool the profile
+ * denies is refused AT THE RELAY (action "deny" -> the relay answers no); an allowed
+ * (or unidentifiable) tool falls through to the normal human/CV-Hub relay. The profile
+ * only hard-denies; it never auto-approves what the operator would otherwise gate.
+ */
+export declare function relayPermissionDecision(manifest: ProfileManifest, promptText: string): {
+    action: 'deny' | 'relay';
+    tool?: string;
+    reason?: string;
+};
+/** A dispatched task whose type is outside `task_types` is refused (before any model call). */
+export declare function checkTaskType(manifest: ProfileManifest, taskType: string): ToolDecision;
+/**
+ * Apply the credential-scope ceiling: keep only offered scopes that the profile
+ * permits, dropping anything broader. The profile's credential_scopes is a MAXIMUM,
+ * so this is the intersection (offered that is within the ceiling).
+ */
+export declare function capScopes(ceiling: string[], offered: string[]): string[];
+export interface LoadedProfile {
+    manifest: ProfileManifest;
+    systemPrompt: string;
+    /** Directory the manifest was loaded from (system_prompt resolves against it). */
+    dir: string;
+    /** The spec the caller passed (a path or an @scope/pkg). */
+    source: string;
+}
+export interface LoadProfileOptions {
+    /** Running host version, e.g. the cva version, for the base gate. */
+    hostVersion: string;
+    /** Host binary name the base constraint may name. Defaults to "cv-agent". */
+    hostName?: string;
+    /** Injectable file reader (tests). Defaults to fs.readFileSync utf8. */
+    readFile?: (path: string) => string;
+    /** Injectable package resolver for @scope/pkg specs (tests). Defaults to require.resolve. */
+    resolvePackage?: (spec: string) => string;
+}
+/**
+ * Resolve a profile spec to a manifest file path. A spec beginning with "@" (or any
+ * bare package name) is resolved as a package whose root holds profile.yaml; anything
+ * else is a filesystem path (a directory implies <dir>/profile.yaml, a file is used
+ * as-is).
+ */
+export declare function resolveProfileSpec(spec: string, opts: LoadProfileOptions): string;
+/**
+ * Load and validate a profile: resolve the spec, parse + strictly validate the
+ * manifest, gate the host version against `base`, then load the system prompt. Every
+ * failure is a ProfileError with a specific reason (P14: unknown keys, bad semver, and
+ * a failed base gate are all hard errors).
+ */
+export declare function loadProfile(spec: string, opts: LoadProfileOptions): LoadedProfile;
+//# sourceMappingURL=profile.d.ts.map

package/dist/utils/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../src/utils/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAuBxB;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;kBAcvB,CAAC;AAEZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBADxC,OAAO,EAAE,MAAM,EACN,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAKhD;AAED,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAOhE;AAsBD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAuBlC;AAMD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAOlF;AAED,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,EAAE,CAGpE;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGvE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,eAAe,EACzB,UAAU,EAAE,MAAM,GACjB;IAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAM9D;AAMD,+FAA+F;AAC/F,wBAAgB,aAAa,CAAC,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,CAMvF;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAGxE;AAMD,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,eAAe,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,kFAAkF;IAClF,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,6FAA6F;IAC7F,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CAC3C;AAMD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAOjF;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,aAAa,CAyCjF"}

package/dist/utils/profile.js

@@ -0,0 +1,266 @@
+"use strict";
+/**
+ * Agent profiles (P14). A profile is data, not a fork: a manifest + system prompt +
+ * tool policy that constrains what a cva session can do. It is loaded at start and
+ * enforced as a hard gate, so a profiled session cannot exceed its manifest no matter
+ * what the model attempts. cv-deploy (P15) is the first profile.
+ *
+ * This module is pure and self-contained: the manifest schema, the loader, and the
+ * enforcement decisions (tool policy, task-type routing, scope ceiling, base semver
+ * gate) are all here as testable functions. agent.ts wires them into the run loop and
+ * the permission relay; the frozen contract other profiles author against is SPEC.md.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProfileError = exports.ProfileManifestSchema = void 0;
+exports.validateManifest = validateManifest;
+exports.checkBaseConstraint = checkBaseConstraint;
+exports.toolBaseName = toolBaseName;
+exports.evaluateTool = evaluateTool;
+exports.allowedToolsList = allowedToolsList;
+exports.extractToolFromPrompt = extractToolFromPrompt;
+exports.relayPermissionDecision = relayPermissionDecision;
+exports.checkTaskType = checkTaskType;
+exports.capScopes = capScopes;
+exports.resolveProfileSpec = resolveProfileSpec;
+exports.loadProfile = loadProfile;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const js_yaml_1 = require("js-yaml");
+const zod_1 = require("zod");
+// ============================================================================
+// Manifest schema (profile.yaml)
+// ============================================================================
+const ToolsSchema = zod_1.z
+    .object({
+    // Explicit allowlist. Absence of a tool here means denied.
+    allow: zod_1.z.array(zod_1.z.string().min(1)).default([]),
+    // Redundant hard-denies for auditability; a deny wins over an allow.
+    deny: zod_1.z.array(zod_1.z.string().min(1)).default([]),
+})
+    .strict();
+const LimitsSchema = zod_1.z
+    .object({
+    max_turns: zod_1.z.number().int().positive().optional(),
+    max_tool_calls: zod_1.z.number().int().positive().optional(),
+    timeout_s: zod_1.z.number().int().positive().optional(),
+})
+    .strict();
+/**
+ * The profile manifest. `.strict()` at every level makes an unknown key an ERROR, not
+ * a warning (P14 item 2): a typo or a key from a newer schema fails the load loudly
+ * rather than being silently ignored.
+ */
+exports.ProfileManifestSchema = zod_1.z
+    .object({
+    name: zod_1.z.string().min(1),
+    version: zod_1.z.string().min(1),
+    /** semver constraint on the host binary, e.g. "cv-agent >= 2.0.0". */
+    base: zod_1.z.string().min(1),
+    /** Path to the system prompt, relative to the manifest (or absolute). */
+    system_prompt: zod_1.z.string().min(1),
+    tools: ToolsSchema,
+    task_types: zod_1.z.array(zod_1.z.string().min(1)).min(1),
+    /** The MAXIMUM credential scopes this profile may hold; the ceiling. */
+    credential_scopes: zod_1.z.array(zod_1.z.string().min(1)).default([]),
+    limits: LimitsSchema.default({}),
+})
+    .strict();
+class ProfileError extends Error {
+    detail;
+    constructor(message, detail = {}) {
+        super(message);
+        this.detail = detail;
+        this.name = 'ProfileError';
+    }
+}
+exports.ProfileError = ProfileError;
+/** Validate an already-parsed object as a manifest. Throws ProfileError on any issue. */
+function validateManifest(input) {
+    const result = exports.ProfileManifestSchema.safeParse(input);
+    if (!result.success) {
+        const issues = result.error.issues.map((i) => `${i.path.join('.') || '(root)'}: ${i.message}`).join('; ');
+        throw new ProfileError(`invalid profile manifest: ${issues}`, { issues: result.error.issues });
+    }
+    return result.data;
+}
+const OPS = ['>=', '<=', '>', '<', '='];
+function parseSemver(v) {
+    const m = v.trim().match(/^(\d+)\.(\d+)\.(\d+)$/);
+    if (!m)
+        throw new ProfileError(`not a semver (major.minor.patch): ${v}`);
+    return [Number(m[1]), Number(m[2]), Number(m[3])];
+}
+function cmpSemver(a, b) {
+    for (let i = 0; i < 3; i++) {
+        if (a[i] !== b[i])
+            return a[i] < b[i] ? -1 : 1;
+    }
+    return 0;
+}
+/**
+ * Check the manifest `base` constraint against the running host. The grammar is
+ * frozen (SPEC): `[<host-name>] <op> <version>`, op one of >= > <= < =, version a
+ * bare `major.minor.patch`; a bare version with no op means `=`. A host-name token,
+ * when present, must match hostName (a profile for a different host is refused).
+ */
+function checkBaseConstraint(base, hostName, hostVersion) {
+    const m = base.trim().match(/^(?:([A-Za-z][A-Za-z0-9_-]*)\s+)?(>=|<=|>|<|=)?\s*(\d+\.\d+\.\d+)$/);
+    if (!m)
+        return { ok: false, reason: `unparseable base constraint: "${base}" (expected e.g. "cv-agent >= 2.0.0")` };
+    const [, name, opRaw, wantVersion] = m;
+    if (name && name !== hostName) {
+        return { ok: false, reason: `base names host "${name}", but this is "${hostName}"` };
+    }
+    const op = (opRaw ?? '=');
+    if (!OPS.includes(op))
+        return { ok: false, reason: `unsupported operator "${op}" in base constraint` };
+    const host = parseSemver(hostVersion);
+    const want = parseSemver(wantVersion);
+    const c = cmpSemver(host, want);
+    const satisfied = (op === '>=' && c >= 0) ||
+        (op === '>' && c > 0) ||
+        (op === '<=' && c <= 0) ||
+        (op === '<' && c < 0) ||
+        (op === '=' && c === 0);
+    if (!satisfied) {
+        return { ok: false, reason: `host ${hostName} ${hostVersion} does not satisfy base "${base}"` };
+    }
+    return { ok: true };
+}
+// ============================================================================
+// Tool policy
+// ============================================================================
+/**
+ * A tool spec's base name. Claude Code tools appear as "Bash" or scoped like
+ * "Bash(git*)"; policy entries may be "Bash", "Bash(*)", or "Bash(git*)". Policy is
+ * evaluated by base name so an allow/deny of "Bash" covers every Bash invocation.
+ */
+function toolBaseName(spec) {
+    const paren = spec.indexOf('(');
+    return (paren === -1 ? spec : spec.slice(0, paren)).trim();
+}
+/**
+ * The tool-policy decision: a deny-list entry wins over an allow-list entry, and
+ * absence from the allow-list means denied. This is the hard gate the relay and the
+ * auto-approve allowlist are both built from.
+ */
+function evaluateTool(manifest, tool) {
+    const base = toolBaseName(tool);
+    const deny = manifest.tools.deny.map(toolBaseName);
+    const allow = manifest.tools.allow.map(toolBaseName);
+    if (deny.includes(base))
+        return { allowed: false, reason: `tool "${base}" is on the profile deny-list` };
+    if (allow.includes(base))
+        return { allowed: true };
+    return { allowed: false, reason: `tool "${base}" is not on the profile allow-list` };
+}
+/** The `--allowedTools` list for auto-approve mode: allow entries not shadowed by a deny. */
+function allowedToolsList(manifest) {
+    const deny = new Set(manifest.tools.deny.map(toolBaseName));
+    return manifest.tools.allow.filter((spec) => !deny.has(toolBaseName(spec)));
+}
+/** Pull the tool name out of a Claude Code permission prompt, or null if not present. */
+function extractToolFromPrompt(promptText) {
+    const m = promptText.match(/Allow\s+([A-Za-z][A-Za-z0-9_]*)\b/);
+    return m ? m[1] : null;
+}
+/**
+ * The relay decision for a permission prompt under a profile. A tool the profile
+ * denies is refused AT THE RELAY (action "deny" -> the relay answers no); an allowed
+ * (or unidentifiable) tool falls through to the normal human/CV-Hub relay. The profile
+ * only hard-denies; it never auto-approves what the operator would otherwise gate.
+ */
+function relayPermissionDecision(manifest, promptText) {
+    const tool = extractToolFromPrompt(promptText);
+    if (!tool)
+        return { action: 'relay' };
+    const decision = evaluateTool(manifest, tool);
+    if (!decision.allowed)
+        return { action: 'deny', tool, reason: decision.reason };
+    return { action: 'relay', tool };
+}
+// ============================================================================
+// Task-type routing + scope ceiling
+// ============================================================================
+/** A dispatched task whose type is outside `task_types` is refused (before any model call). */
+function checkTaskType(manifest, taskType) {
+    if (manifest.task_types.includes(taskType))
+        return { allowed: true };
+    return {
+        allowed: false,
+        reason: `task type "${taskType}" is not permitted by profile "${manifest.name}" (allowed: ${manifest.task_types.join(', ')})`,
+    };
+}
+/**
+ * Apply the credential-scope ceiling: keep only offered scopes that the profile
+ * permits, dropping anything broader. The profile's credential_scopes is a MAXIMUM,
+ * so this is the intersection (offered that is within the ceiling).
+ */
+function capScopes(ceiling, offered) {
+    const max = new Set(ceiling);
+    return offered.filter((s) => max.has(s));
+}
+function defaultRead(path) {
+    return (0, node_fs_1.readFileSync)(path, 'utf8');
+}
+/**
+ * Resolve a profile spec to a manifest file path. A spec beginning with "@" (or any
+ * bare package name) is resolved as a package whose root holds profile.yaml; anything
+ * else is a filesystem path (a directory implies <dir>/profile.yaml, a file is used
+ * as-is).
+ */
+function resolveProfileSpec(spec, opts) {
+    if (spec.startsWith('@') || (!spec.includes('/') && !spec.includes('\\') && !spec.endsWith('.yaml') && !spec.endsWith('.yml'))) {
+        const resolver = opts.resolvePackage ?? ((s) => require.resolve(`${s}/profile.yaml`));
+        return resolver(spec);
+    }
+    if (spec.endsWith('.yaml') || spec.endsWith('.yml'))
+        return spec;
+    return (0, node_path_1.join)(spec, 'profile.yaml');
+}
+/**
+ * Load and validate a profile: resolve the spec, parse + strictly validate the
+ * manifest, gate the host version against `base`, then load the system prompt. Every
+ * failure is a ProfileError with a specific reason (P14: unknown keys, bad semver, and
+ * a failed base gate are all hard errors).
+ */
+function loadProfile(spec, opts) {
+    const read = opts.readFile ?? defaultRead;
+    const manifestPath = resolveProfileSpec(spec, opts);
+    let rawText;
+    try {
+        rawText = read(manifestPath);
+    }
+    catch (err) {
+        throw new ProfileError(`could not read profile manifest at ${manifestPath}: ${err.message}`);
+    }
+    let parsed;
+    try {
+        parsed = (0, js_yaml_1.load)(rawText);
+    }
+    catch (err) {
+        throw new ProfileError(`profile manifest is not valid YAML: ${err.message}`);
+    }
+    if (parsed === null || typeof parsed !== 'object') {
+        throw new ProfileError('profile manifest must be a YAML mapping');
+    }
+    const manifest = validateManifest(parsed);
+    const gate = checkBaseConstraint(manifest.base, opts.hostName ?? 'cv-agent', opts.hostVersion);
+    if (!gate.ok) {
+        throw new ProfileError(`profile "${manifest.name}" base gate failed: ${gate.reason}`, { base: manifest.base, hostVersion: opts.hostVersion });
+    }
+    const dir = (0, node_path_1.dirname)(manifestPath);
+    const promptPath = (0, node_path_1.isAbsolute)(manifest.system_prompt) ? manifest.system_prompt : (0, node_path_1.resolve)(dir, manifest.system_prompt);
+    let systemPrompt;
+    try {
+        systemPrompt = read(promptPath);
+    }
+    catch (err) {
+        throw new ProfileError(`could not read system_prompt at ${promptPath}: ${err.message}`);
+    }
+    if (!systemPrompt.trim()) {
+        throw new ProfileError(`system_prompt at ${promptPath} is empty`);
+    }
+    return { manifest, systemPrompt, dir, source: spec };
+}
+//# sourceMappingURL=profile.js.map

package/dist/utils/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/utils/profile.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AA+DH,4CAOC;AA4BD,kDA2BC;AAWD,oCAGC;AAYD,oCAOC;AAGD,4CAGC;AAGD,sDAGC;AAQD,0DASC;AAOD,sCAMC;AAOD,8BAGC;AAoCD,gDAOC;AAQD,kCAyCC;AA5SD,qCAAuC;AACvC,yCAA8E;AAE9E,qCAA2C;AAC3C,6BAAwB;AAExB,+EAA+E;AAC/E,iCAAiC;AACjC,+EAA+E;AAE/E,MAAM,WAAW,GAAG,OAAC;KAClB,MAAM,CAAC;IACN,2DAA2D;IAC3D,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7C,qEAAqE;IACrE,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,YAAY,GAAG,OAAC;KACnB,MAAM,CAAC;IACN,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjD,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;GAIG;AACU,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,sEAAsE;IACtE,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,yEAAyE;IACzE,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,KAAK,EAAE,WAAW;IAClB,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,wEAAwE;IACxE,iBAAiB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAa,YAAa,SAAQ,KAAK;IAG1B;IAFX,YACE,OAAe,EACN,SAAkC,EAAE;QAE7C,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,WAAM,GAAN,MAAM,CAA8B;QAG7C,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AARD,oCAQC;AAED,yFAAyF;AACzF,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,MAAM,MAAM,GAAG,6BAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1G,MAAM,IAAI,YAAY,CAAC,6BAA6B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAOD,MAAM,GAAG,GAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAE9C,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC;IACzE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,CAA2B,EAAE,CAA2B;IACzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,IAAY,EACZ,QAAgB,EAChB,WAAmB;IAEnB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;IAClG,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,IAAI,uCAAuC,EAAE,CAAC;IACnH,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,IAAI,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,IAAI,mBAAmB,QAAQ,GAAG,EAAE,CAAC;IACvF,CAAC;IACD,MAAM,EAAE,GAAG,CAAC,KAAK,IAAI,GAAG,CAAO,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,CAAC;IAEvG,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,MAAM,SAAS,GACb,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,QAAQ,IAAI,WAAW,2BAA2B,IAAI,GAAG,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E;;;;GAIG;AACH,SAAgB,YAAY,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7D,CAAC;AAOD;;;;GAIG;AACH,SAAgB,YAAY,CAAC,QAAyB,EAAE,IAAY;IAClE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,IAAI,+BAA+B,EAAE,CAAC;IACzG,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,IAAI,oCAAoC,EAAE,CAAC;AACvF,CAAC;AAED,6FAA6F;AAC7F,SAAgB,gBAAgB,CAAC,QAAyB;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5D,OAAO,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,yFAAyF;AACzF,SAAgB,qBAAqB,CAAC,UAAkB;IACtD,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAChE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CACrC,QAAyB,EACzB,UAAkB;IAElB,MAAM,IAAI,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAChF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,+EAA+E;AAC/E,oCAAoC;AACpC,+EAA+E;AAE/E,+FAA+F;AAC/F,SAAgB,aAAa,CAAC,QAAyB,EAAE,QAAgB;IACvE,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACrE,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,cAAc,QAAQ,kCAAkC,QAAQ,CAAC,IAAI,eAAe,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;KAC9H,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,SAAS,CAAC,OAAiB,EAAE,OAAiB;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AA0BD,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,IAAY,EAAE,IAAwB;IACvE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC/H,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAC9F,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,IAAA,gBAAI,EAAC,IAAI,EAAE,cAAc,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,IAAY,EAAE,IAAwB;IAChE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC;IAC1C,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEpD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,sCAAsC,YAAY,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,cAAQ,EAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,uCAAwC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,YAAY,CAAC,yCAAyC,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAE1C,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/F,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,YAAY,QAAQ,CAAC,IAAI,uBAAuB,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAChJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,YAAY,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,IAAA,sBAAU,EAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,IAAA,mBAAW,EAAC,GAAG,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC1H,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,mCAAmC,UAAU,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,oBAAoB,UAAU,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACvD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@controlvector/cv-agent",
-  "version": "1.11.1",
+  "version": "1.12.0",
   "description": "Standalone agent daemon for CV-Hub — bridges Claude Code with CV-Hub task dispatch",
   "bin": {
     "cva": "./dist/bundle.cjs"
@@ -12,16 +12,23 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "clean": "rm -rf dist",
-    "prepublishOnly": "npm run build"
+    "verify-pack": "node scripts/verify-pack.mjs",
+    "prepublishOnly": "npm run clean && npm run build && npm run verify-pack"
   },
-  "keywords": ["cv-hub", "claude-code", "agent", "controlvector"],
+  "keywords": [
+    "cv-hub",
+    "claude-code",
+    "agent",
+    "controlvector"
+  ],
   "author": "Control Vector LLC",
-  "license": "MIT",
+  "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "https://hub.controlvector.io/schmotz/cv-agent.git"
+    "url": "https://git.hub.controlvector.io/controlvector/cv-agent.git"
   },
   "devDependencies": {
+    "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
@@ -30,12 +37,15 @@
     "vitest": "^2.1.0"
   },
   "dependencies": {
-    "@controlvector/cv-git": "^1.4.0"
+    "@controlvector/cv-git": "^1.4.0",
+    "js-yaml": "^5.2.1",
+    "zod": "^4.4.3"
   },
   "engines": {
     "node": ">=20"
   },
   "files": [
-    "dist"
+    "dist",
+    "NOTICE"
   ]
 }