@controlvector/cv-agent 1.11.1 → 1.13.0

package/dist/utils/profile.js

@@ -0,0 +1,266 @@
+"use strict";
+/**
+ * Agent profiles (P14). A profile is data, not a fork: a manifest + system prompt +
+ * tool policy that constrains what a cva session can do. It is loaded at start and
+ * enforced as a hard gate, so a profiled session cannot exceed its manifest no matter
+ * what the model attempts. cv-deploy (P15) is the first profile.
+ *
+ * This module is pure and self-contained: the manifest schema, the loader, and the
+ * enforcement decisions (tool policy, task-type routing, scope ceiling, base semver
+ * gate) are all here as testable functions. agent.ts wires them into the run loop and
+ * the permission relay; the frozen contract other profiles author against is SPEC.md.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProfileError = exports.ProfileManifestSchema = void 0;
+exports.validateManifest = validateManifest;
+exports.checkBaseConstraint = checkBaseConstraint;
+exports.toolBaseName = toolBaseName;
+exports.evaluateTool = evaluateTool;
+exports.allowedToolsList = allowedToolsList;
+exports.extractToolFromPrompt = extractToolFromPrompt;
+exports.relayPermissionDecision = relayPermissionDecision;
+exports.checkTaskType = checkTaskType;
+exports.capScopes = capScopes;
+exports.resolveProfileSpec = resolveProfileSpec;
+exports.loadProfile = loadProfile;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const js_yaml_1 = require("js-yaml");
+const zod_1 = require("zod");
+// ============================================================================
+// Manifest schema (profile.yaml)
+// ============================================================================
+const ToolsSchema = zod_1.z
+    .object({
+    // Explicit allowlist. Absence of a tool here means denied.
+    allow: zod_1.z.array(zod_1.z.string().min(1)).default([]),
+    // Redundant hard-denies for auditability; a deny wins over an allow.
+    deny: zod_1.z.array(zod_1.z.string().min(1)).default([]),
+})
+    .strict();
+const LimitsSchema = zod_1.z
+    .object({
+    max_turns: zod_1.z.number().int().positive().optional(),
+    max_tool_calls: zod_1.z.number().int().positive().optional(),
+    timeout_s: zod_1.z.number().int().positive().optional(),
+})
+    .strict();
+/**
+ * The profile manifest. `.strict()` at every level makes an unknown key an ERROR, not
+ * a warning (P14 item 2): a typo or a key from a newer schema fails the load loudly
+ * rather than being silently ignored.
+ */
+exports.ProfileManifestSchema = zod_1.z
+    .object({
+    name: zod_1.z.string().min(1),
+    version: zod_1.z.string().min(1),
+    /** semver constraint on the host binary, e.g. "cv-agent >= 2.0.0". */
+    base: zod_1.z.string().min(1),
+    /** Path to the system prompt, relative to the manifest (or absolute). */
+    system_prompt: zod_1.z.string().min(1),
+    tools: ToolsSchema,
+    task_types: zod_1.z.array(zod_1.z.string().min(1)).min(1),
+    /** The MAXIMUM credential scopes this profile may hold; the ceiling. */
+    credential_scopes: zod_1.z.array(zod_1.z.string().min(1)).default([]),
+    limits: LimitsSchema.default({}),
+})
+    .strict();
+class ProfileError extends Error {
+    detail;
+    constructor(message, detail = {}) {
+        super(message);
+        this.detail = detail;
+        this.name = 'ProfileError';
+    }
+}
+exports.ProfileError = ProfileError;
+/** Validate an already-parsed object as a manifest. Throws ProfileError on any issue. */
+function validateManifest(input) {
+    const result = exports.ProfileManifestSchema.safeParse(input);
+    if (!result.success) {
+        const issues = result.error.issues.map((i) => `${i.path.join('.') || '(root)'}: ${i.message}`).join('; ');
+        throw new ProfileError(`invalid profile manifest: ${issues}`, { issues: result.error.issues });
+    }
+    return result.data;
+}
+const OPS = ['>=', '<=', '>', '<', '='];
+function parseSemver(v) {
+    const m = v.trim().match(/^(\d+)\.(\d+)\.(\d+)$/);
+    if (!m)
+        throw new ProfileError(`not a semver (major.minor.patch): ${v}`);
+    return [Number(m[1]), Number(m[2]), Number(m[3])];
+}
+function cmpSemver(a, b) {
+    for (let i = 0; i < 3; i++) {
+        if (a[i] !== b[i])
+            return a[i] < b[i] ? -1 : 1;
+    }
+    return 0;
+}
+/**
+ * Check the manifest `base` constraint against the running host. The grammar is
+ * frozen (SPEC): `[<host-name>] <op> <version>`, op one of >= > <= < =, version a
+ * bare `major.minor.patch`; a bare version with no op means `=`. A host-name token,
+ * when present, must match hostName (a profile for a different host is refused).
+ */
+function checkBaseConstraint(base, hostName, hostVersion) {
+    const m = base.trim().match(/^(?:([A-Za-z][A-Za-z0-9_-]*)\s+)?(>=|<=|>|<|=)?\s*(\d+\.\d+\.\d+)$/);
+    if (!m)
+        return { ok: false, reason: `unparseable base constraint: "${base}" (expected e.g. "cv-agent >= 2.0.0")` };
+    const [, name, opRaw, wantVersion] = m;
+    if (name && name !== hostName) {
+        return { ok: false, reason: `base names host "${name}", but this is "${hostName}"` };
+    }
+    const op = (opRaw ?? '=');
+    if (!OPS.includes(op))
+        return { ok: false, reason: `unsupported operator "${op}" in base constraint` };
+    const host = parseSemver(hostVersion);
+    const want = parseSemver(wantVersion);
+    const c = cmpSemver(host, want);
+    const satisfied = (op === '>=' && c >= 0) ||
+        (op === '>' && c > 0) ||
+        (op === '<=' && c <= 0) ||
+        (op === '<' && c < 0) ||
+        (op === '=' && c === 0);
+    if (!satisfied) {
+        return { ok: false, reason: `host ${hostName} ${hostVersion} does not satisfy base "${base}"` };
+    }
+    return { ok: true };
+}
+// ============================================================================
+// Tool policy
+// ============================================================================
+/**
+ * A tool spec's base name. Claude Code tools appear as "Bash" or scoped like
+ * "Bash(git*)"; policy entries may be "Bash", "Bash(*)", or "Bash(git*)". Policy is
+ * evaluated by base name so an allow/deny of "Bash" covers every Bash invocation.
+ */
+function toolBaseName(spec) {
+    const paren = spec.indexOf('(');
+    return (paren === -1 ? spec : spec.slice(0, paren)).trim();
+}
+/**
+ * The tool-policy decision: a deny-list entry wins over an allow-list entry, and
+ * absence from the allow-list means denied. This is the hard gate the relay and the
+ * auto-approve allowlist are both built from.
+ */
+function evaluateTool(manifest, tool) {
+    const base = toolBaseName(tool);
+    const deny = manifest.tools.deny.map(toolBaseName);
+    const allow = manifest.tools.allow.map(toolBaseName);
+    if (deny.includes(base))
+        return { allowed: false, reason: `tool "${base}" is on the profile deny-list` };
+    if (allow.includes(base))
+        return { allowed: true };
+    return { allowed: false, reason: `tool "${base}" is not on the profile allow-list` };
+}
+/** The `--allowedTools` list for auto-approve mode: allow entries not shadowed by a deny. */
+function allowedToolsList(manifest) {
+    const deny = new Set(manifest.tools.deny.map(toolBaseName));
+    return manifest.tools.allow.filter((spec) => !deny.has(toolBaseName(spec)));
+}
+/** Pull the tool name out of a Claude Code permission prompt, or null if not present. */
+function extractToolFromPrompt(promptText) {
+    const m = promptText.match(/Allow\s+([A-Za-z][A-Za-z0-9_]*)\b/);
+    return m ? m[1] : null;
+}
+/**
+ * The relay decision for a permission prompt under a profile. A tool the profile
+ * denies is refused AT THE RELAY (action "deny" -> the relay answers no); an allowed
+ * (or unidentifiable) tool falls through to the normal human/CV-Hub relay. The profile
+ * only hard-denies; it never auto-approves what the operator would otherwise gate.
+ */
+function relayPermissionDecision(manifest, promptText) {
+    const tool = extractToolFromPrompt(promptText);
+    if (!tool)
+        return { action: 'relay' };
+    const decision = evaluateTool(manifest, tool);
+    if (!decision.allowed)
+        return { action: 'deny', tool, reason: decision.reason };
+    return { action: 'relay', tool };
+}
+// ============================================================================
+// Task-type routing + scope ceiling
+// ============================================================================
+/** A dispatched task whose type is outside `task_types` is refused (before any model call). */
+function checkTaskType(manifest, taskType) {
+    if (manifest.task_types.includes(taskType))
+        return { allowed: true };
+    return {
+        allowed: false,
+        reason: `task type "${taskType}" is not permitted by profile "${manifest.name}" (allowed: ${manifest.task_types.join(', ')})`,
+    };
+}
+/**
+ * Apply the credential-scope ceiling: keep only offered scopes that the profile
+ * permits, dropping anything broader. The profile's credential_scopes is a MAXIMUM,
+ * so this is the intersection (offered that is within the ceiling).
+ */
+function capScopes(ceiling, offered) {
+    const max = new Set(ceiling);
+    return offered.filter((s) => max.has(s));
+}
+function defaultRead(path) {
+    return (0, node_fs_1.readFileSync)(path, 'utf8');
+}
+/**
+ * Resolve a profile spec to a manifest file path. A spec beginning with "@" (or any
+ * bare package name) is resolved as a package whose root holds profile.yaml; anything
+ * else is a filesystem path (a directory implies <dir>/profile.yaml, a file is used
+ * as-is).
+ */
+function resolveProfileSpec(spec, opts) {
+    if (spec.startsWith('@') || (!spec.includes('/') && !spec.includes('\\') && !spec.endsWith('.yaml') && !spec.endsWith('.yml'))) {
+        const resolver = opts.resolvePackage ?? ((s) => require.resolve(`${s}/profile.yaml`));
+        return resolver(spec);
+    }
+    if (spec.endsWith('.yaml') || spec.endsWith('.yml'))
+        return spec;
+    return (0, node_path_1.join)(spec, 'profile.yaml');
+}
+/**
+ * Load and validate a profile: resolve the spec, parse + strictly validate the
+ * manifest, gate the host version against `base`, then load the system prompt. Every
+ * failure is a ProfileError with a specific reason (P14: unknown keys, bad semver, and
+ * a failed base gate are all hard errors).
+ */
+function loadProfile(spec, opts) {
+    const read = opts.readFile ?? defaultRead;
+    const manifestPath = resolveProfileSpec(spec, opts);
+    let rawText;
+    try {
+        rawText = read(manifestPath);
+    }
+    catch (err) {
+        throw new ProfileError(`could not read profile manifest at ${manifestPath}: ${err.message}`);
+    }
+    let parsed;
+    try {
+        parsed = (0, js_yaml_1.load)(rawText);
+    }
+    catch (err) {
+        throw new ProfileError(`profile manifest is not valid YAML: ${err.message}`);
+    }
+    if (parsed === null || typeof parsed !== 'object') {
+        throw new ProfileError('profile manifest must be a YAML mapping');
+    }
+    const manifest = validateManifest(parsed);
+    const gate = checkBaseConstraint(manifest.base, opts.hostName ?? 'cv-agent', opts.hostVersion);
+    if (!gate.ok) {
+        throw new ProfileError(`profile "${manifest.name}" base gate failed: ${gate.reason}`, { base: manifest.base, hostVersion: opts.hostVersion });
+    }
+    const dir = (0, node_path_1.dirname)(manifestPath);
+    const promptPath = (0, node_path_1.isAbsolute)(manifest.system_prompt) ? manifest.system_prompt : (0, node_path_1.resolve)(dir, manifest.system_prompt);
+    let systemPrompt;
+    try {
+        systemPrompt = read(promptPath);
+    }
+    catch (err) {
+        throw new ProfileError(`could not read system_prompt at ${promptPath}: ${err.message}`);
+    }
+    if (!systemPrompt.trim()) {
+        throw new ProfileError(`system_prompt at ${promptPath} is empty`);
+    }
+    return { manifest, systemPrompt, dir, source: spec };
+}
+//# sourceMappingURL=profile.js.map

package/dist/utils/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/utils/profile.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AA+DH,4CAOC;AA4BD,kDA2BC;AAWD,oCAGC;AAYD,oCAOC;AAGD,4CAGC;AAGD,sDAGC;AAQD,0DASC;AAOD,sCAMC;AAOD,8BAGC;AAoCD,gDAOC;AAQD,kCAyCC;AA5SD,qCAAuC;AACvC,yCAA8E;AAE9E,qCAA2C;AAC3C,6BAAwB;AAExB,+EAA+E;AAC/E,iCAAiC;AACjC,+EAA+E;AAE/E,MAAM,WAAW,GAAG,OAAC;KAClB,MAAM,CAAC;IACN,2DAA2D;IAC3D,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7C,qEAAqE;IACrE,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,YAAY,GAAG,OAAC;KACnB,MAAM,CAAC;IACN,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjD,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;GAIG;AACU,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,sEAAsE;IACtE,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,yEAAyE;IACzE,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,KAAK,EAAE,WAAW;IAClB,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,wEAAwE;IACxE,iBAAiB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAa,YAAa,SAAQ,KAAK;IAG1B;IAFX,YACE,OAAe,EACN,SAAkC,EAAE;QAE7C,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,WAAM,GAAN,MAAM,CAA8B;QAG7C,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AARD,oCAQC;AAED,yFAAyF;AACzF,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,MAAM,MAAM,GAAG,6BAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1G,MAAM,IAAI,YAAY,CAAC,6BAA6B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAOD,MAAM,GAAG,GAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAE9C,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC;IACzE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,CAA2B,EAAE,CAA2B;IACzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,IAAY,EACZ,QAAgB,EAChB,WAAmB;IAEnB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;IAClG,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,IAAI,uCAAuC,EAAE,CAAC;IACnH,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,IAAI,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,IAAI,mBAAmB,QAAQ,GAAG,EAAE,CAAC;IACvF,CAAC;IACD,MAAM,EAAE,GAAG,CAAC,KAAK,IAAI,GAAG,CAAO,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,CAAC;IAEvG,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,MAAM,SAAS,GACb,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,QAAQ,IAAI,WAAW,2BAA2B,IAAI,GAAG,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E;;;;GAIG;AACH,SAAgB,YAAY,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7D,CAAC;AAOD;;;;GAIG;AACH,SAAgB,YAAY,CAAC,QAAyB,EAAE,IAAY;IAClE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,IAAI,+BAA+B,EAAE,CAAC;IACzG,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,IAAI,oCAAoC,EAAE,CAAC;AACvF,CAAC;AAED,6FAA6F;AAC7F,SAAgB,gBAAgB,CAAC,QAAyB;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5D,OAAO,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,yFAAyF;AACzF,SAAgB,qBAAqB,CAAC,UAAkB;IACtD,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAChE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CACrC,QAAyB,EACzB,UAAkB;IAElB,MAAM,IAAI,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAChF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,+EAA+E;AAC/E,oCAAoC;AACpC,+EAA+E;AAE/E,+FAA+F;AAC/F,SAAgB,aAAa,CAAC,QAAyB,EAAE,QAAgB;IACvE,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACrE,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,cAAc,QAAQ,kCAAkC,QAAQ,CAAC,IAAI,eAAe,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;KAC9H,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,SAAS,CAAC,OAAiB,EAAE,OAAiB;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AA0BD,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,IAAY,EAAE,IAAwB;IACvE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC/H,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAC9F,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,IAAA,gBAAI,EAAC,IAAI,EAAE,cAAc,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,IAAY,EAAE,IAAwB;IAChE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC;IAC1C,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEpD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,sCAAsC,YAAY,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,cAAQ,EAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,uCAAwC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,YAAY,CAAC,yCAAyC,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAE1C,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/F,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,YAAY,QAAQ,CAAC,IAAI,uBAAuB,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAChJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,YAAY,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,IAAA,sBAAU,EAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,IAAA,mBAAW,EAAC,GAAG,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC1H,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,mCAAmC,UAAU,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,oBAAoB,UAAU,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACvD,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@controlvector/cv-agent",
-  "version": "1.11.1",
-  "description": "Standalone agent daemon for CV-Hub — bridges Claude Code with CV-Hub task dispatch",
+  "version": "1.13.0",
+  "description": "Standalone agent daemon for CV-Hub \u2014 bridges Claude Code with CV-Hub task dispatch",
   "bin": {
     "cva": "./dist/bundle.cjs"
   },
@@ -12,16 +12,23 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "clean": "rm -rf dist",
-    "prepublishOnly": "npm run build"
+    "verify-pack": "node scripts/verify-pack.mjs",
+    "prepublishOnly": "npm run clean && npm run build && npm run verify-pack"
   },
-  "keywords": ["cv-hub", "claude-code", "agent", "controlvector"],
+  "keywords": [
+    "cv-hub",
+    "claude-code",
+    "agent",
+    "controlvector"
+  ],
   "author": "Control Vector LLC",
-  "license": "MIT",
+  "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "https://hub.controlvector.io/schmotz/cv-agent.git"
+    "url": "https://git.hub.controlvector.io/controlvector/cv-agent.git"
   },
   "devDependencies": {
+    "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
@@ -30,12 +37,15 @@
     "vitest": "^2.1.0"
   },
   "dependencies": {
-    "@controlvector/cv-git": "^1.4.0"
+    "@controlvector/cv-git": "^1.4.0",
+    "js-yaml": "^5.2.1",
+    "zod": "^4.4.3"
   },
   "engines": {
     "node": ">=20"
   },
   "files": [
-    "dist"
+    "dist",
+    "NOTICE"
   ]
 }