@fusengine/harness 0.1.43 → 0.1.44

package/dist/evaluate-d7Pp8XJH.mjs

@@ -0,0 +1,784 @@
+import { i as splitTarget, r as resolveMaxLines } from "./limits-CHn8AIL1.mjs";
+import { r as fusengineCache, t as claudeHome } from "./home-state-mKZxP4oZ.mjs";
+import { basename, dirname, join, normalize } from "node:path";
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+//#region src/policy/file-size.ts
+/**
+* Fixed marketplace plugins root — parity with Python `enforce-file-size.py`'s
+* literal, unexpanded `~/...` string. Exported: reused by
+* `policy/apex.ts::solidReadGate` for its "no reference matched" deny message.
+*/
+const PLUGINS_DIR = "~/.claude/plugins/marketplaces/fusengine-plugins/plugins";
+/**
+* Skill-dir fragment per framework — parity with Python
+* `enforce-file-size.py::get_solid_ref()` (falls back to `generic/`). Exported:
+* reused by `policy/apex.ts::solidReadGate` (see {@link PLUGINS_DIR}).
+*/
+const SOLID_REF = {
+	react: "react-expert/skills/solid-react/",
+	nextjs: "nextjs-expert/skills/solid-nextjs/",
+	laravel: "laravel-expert/skills/solid-php/",
+	swift: "swift-apple-expert/skills/solid-swift/"
+};
+/**
+* Count physical lines — parity with the Python `enforce-file-size.py`
+* (`sum(1 for _ in f)`): every line counts (blanks and comments included), and a
+* single trailing newline does not add a phantom line. The SOLID ceiling is
+* measured on raw file length, not substantive code, to match the upstream plugin.
+*/
+function countLines(content) {
+	if (content === "") return 0;
+	return content.split("\n").length - (content.endsWith("\n") ? 1 : 0);
+}
+/**
+* Count non-empty, non-comment lines — parity with the Python `count_code_lines`
+* shared by the framework-specific SOLID validators: `_shared/scripts/validate_solid_common.py`
+* (imported by `nextjs-expert/scripts/validate-nextjs-solid.py` and
+* `swift-apple-expert/scripts/validate-swift-solid.py`), duplicated verbatim in
+* `react-expert/scripts/validate-react-solid.py` / `laravel-expert/scripts/validate-laravel-solid.py`.
+* Strips blank lines and lines starting with `//` or `*` — a SINGLE fixed rule
+* for all 4 callers (the Python `comment` param defaults to, and every real
+* call site leaves it at, `"//"` — never per-language despite covering
+* ts/tsx/js/jsx, php and swift).
+*
+* Deliberately distinct from two other "code-only" counters already in this
+* repo, neither of which is a faithful substitute here:
+*  - `countLoc` (`runtime/lifecycle/check-file-size.ts`): a genuinely
+*    per-language table (PHP additionally strips `#`, Python strips
+*    `#`/`"""`/`'''`) — ported from the unrelated `solid/scripts/check-file-size.py`.
+*  - `countCodeLines` (`runtime/lifecycle/aipilot/solid-compliance.ts`): also
+*    strips `#` — ported from `ai-pilot/scripts/check-solid-compliance.py`.
+* Reusing either would silently strip PHP `#`/Python-style comments that the
+* real react/nextjs/laravel/swift validators do NOT strip.
+* @param content - The file content to measure.
+*/
+function countFrameworkCodeLines(content) {
+	let count = 0;
+	for (const raw of content.split("\n")) {
+		const line = raw.trim();
+		if (!line || line.startsWith("//") || line.startsWith("*")) continue;
+		count++;
+	}
+	return count;
+}
+/**
+* Evaluate a file's line count against the SOLID limit.
+* @param lines - the file's line count
+* @param max - the limit (defaults to `resolveMaxLines()`)
+*/
+function evaluateFileSize(lines, max = resolveMaxLines(), filePath = "", framework = "generic", displayLines = lines) {
+	if (lines <= max) return {
+		ok: true,
+		lines,
+		max,
+		message: null
+	};
+	const split = splitTarget(max);
+	const fname = filePath ? basename(filePath) : "file";
+	return {
+		ok: false,
+		lines,
+		max,
+		message: `BLOCKED: '${fname}' has ${displayLines} lines (max: ${max}). TO SPLIT: 1) Read SOLID rules: ${PLUGINS_DIR}/${SOLID_REF[framework] ?? "generic/"} 2) Create new module files (<${split} lines each) 3) Use Write to replace '${fname}' with <${max} lines version.`
+	};
+}
+//#endregion
+//#region src/policy/patterns.ts
+/**
+* Guard pattern data, ported verbatim from the fusengine git/install guards.
+* Note (faithful): `git push.*--force` also matches `--force-with-lease` —
+* preserved from the source guard.
+*/
+/** Destructive git operations to block outright. */
+const GIT_BLOCKED = [
+	/git push.*--force/,
+	/git push.*-f/,
+	/git reset.*--hard/,
+	/git clean.*-fd/,
+	/git branch.*-D/,
+	/git rebase.*--force/
+];
+/** Git operations that warrant a confirmation prompt. */
+const GIT_ASK = [
+	/git push/,
+	/git checkout/,
+	/git reset/,
+	/git rebase/,
+	/git merge/,
+	/git stash/,
+	/git clean/,
+	/git rm/,
+	/git mv/,
+	/git restore/,
+	/git revert/,
+	/git cherry-pick/,
+	/git commit/,
+	/git add/,
+	/git branch -d/
+];
+/** System-level package installs (need confirmation). */
+const SYSTEM_INSTALL = [
+	/brew install/,
+	/brew upgrade/,
+	/brew cask/,
+	/apt install/,
+	/apt-get install/,
+	/dnf install/,
+	/pacman -S/
+];
+/** Project-level package installs. */
+const PROJECT_INSTALL = [
+	/npm install/,
+	/npm i /,
+	/yarn add/,
+	/pnpm add/,
+	/pip install/,
+	/pip3 install/,
+	/composer require/,
+	/bun add/,
+	/bun install/,
+	/cargo install/,
+	/go install/,
+	/gem install/,
+	/pipx install/
+];
+/** True when `cmd` matches any pattern in `patterns`. */
+function matchPatterns(cmd, patterns) {
+	return patterns.some((re) => re.test(cmd));
+}
+//#endregion
+//#region src/policy/file-size-scope.ts
+/**
+* File-size gate scope — parity `enforce-file-size.py` CODE_EXT (both pre- and
+* post-tool-use variants; deliberately excludes `.css`, matching the product
+* decision already applied to `runtime/gate-helpers.ts::isApexScoped` for the
+* sibling `require-apex-agents.py`). NOT `util/project-root.ts::isCodeFile`, a
+* broader general-purpose predicate whose other two callers (`cli/run.ts`,
+* `lifecycle/lessons/dispatch.ts`) are unrelated to this Python source.
+*/
+const FILE_SIZE_CODE_EXT = /\.(ts|tsx|js|jsx|py|go|rs|java|php|cpp|c|rb|swift|kt|dart|vue|svelte|astro)$/;
+/** True when `filePath` is in scope for the SOLID file-size gate (see {@link FILE_SIZE_CODE_EXT}). */
+function isFileSizeScoped(filePath) {
+	return FILE_SIZE_CODE_EXT.test(filePath);
+}
+/**
+* Resolve the SOLID_REF framework key for a file — parity with Python
+* `enforce-file-size.py::get_solid_ref()` (NOT `detectFramework()`, which backs
+* the unrelated require-solid-read pipeline and keys off filename/content
+* heuristics that script never checks). Matches Python exactly:
+* - ts/tsx/js/jsx: "nextjs" only when `next.config.js`/`next.config.ts` sits in
+*   the SAME directory as the file (Python's literal `os.path.dirname(fp)`
+*   check, not a project-root search) — else "react".
+* - vue/svelte/py/go/rs/java/cpp/c/rb/kt/dart/astro: "generic" (Python's
+*   `SOLID_MAP.get(ext, 'generic/')` fallback — none of these are map keys).
+* - php: "laravel"; swift: "swift".
+* @param filePath - Absolute path of the file being written/edited.
+*/
+function resolveSolidRefFramework(filePath) {
+	const ext = filePath.includes(".") ? filePath.slice(filePath.lastIndexOf(".") + 1) : "";
+	if (ext === "ts" || ext === "tsx" || ext === "js" || ext === "jsx") {
+		const dir = dirname(filePath);
+		return ["next.config.js", "next.config.ts"].some((c) => existsSync(join(dir, c))) ? "nextjs" : "react";
+	}
+	if (ext === "php") return "laravel";
+	if (ext === "swift") return "swift";
+	return "generic";
+}
+//#endregion
+//#region src/policy/guards/security.ts
+/** Critical patterns that must always be blocked — parity `security_rules.py`'s cumulated violation names. */
+const CRITICAL_PATTERNS = [
+	{
+		re: /\brm\s+(?:-[a-z]*\s+)*-[a-z]*[rf][a-z]*\s+(?:-[a-z]+\s+)*(?:\/|~)(?:\s|$)/,
+		label: "DANGEROUS PATTERN: recursive delete of / or ~"
+	},
+	{
+		re: /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/,
+		label: "DANGEROUS PATTERN: fork bomb"
+	},
+	{
+		re: /\b(?:curl|wget)\b[^|]*\|\s*(?:sudo\s+)?(?:ba|z|da|k)?sh\b/,
+		label: "DANGEROUS PATTERN: remote script piped to a shell"
+	},
+	{
+		re: /\bchmod\s+(?:-[a-zA-Z]+\s+)*777\s+\//,
+		label: "DANGEROUS PATTERN: chmod 777 on /"
+	},
+	{
+		re: /\bmkfs(?:\.[a-z0-9]+)?\b/,
+		label: "CRITICAL: Detected dangerous command 'mkfs'"
+	},
+	{
+		re: /\bdd\b[^\n]*\bof=\/dev\/(?:r?disk|sd|hd|nvme|mmcblk|vd|xvd)/i,
+		label: "CRITICAL: Detected dangerous command 'dd if='"
+	},
+	{
+		re: /\bshred\b/,
+		label: "CRITICAL: Detected dangerous command 'shred'"
+	},
+	{
+		re: /\bfdisk\b/,
+		label: "CRITICAL: Detected dangerous command 'fdisk'"
+	},
+	{
+		re: /\bdiskutil\s+(?:erase|partitionDisk)/i,
+		label: "CRITICAL: Detected dangerous command 'diskutil erase'"
+	},
+	{
+		re: /(?:>|>>)\s*\/dev\/(?:sda|hda|nvme)/,
+		label: "DANGEROUS PATTERN: redirect to a raw disk device"
+	},
+	{
+		re: /\brm\s+(?:-[a-z]*\s+)*-[a-z]*[rf][a-z]*\s+(?:-[a-z]+\s+)*\/(?:etc|usr|var|bin|sbin|boot|lib)\b/,
+		label: "DANGEROUS PATTERN: recursive delete of a system directory"
+	},
+	{
+		re: /(?:^|[\s;|&])sudo(?:[\s;|&]|$)/,
+		label: "PRIVILEGE ESCALATION: sudo"
+	},
+	{
+		re: /(?:^|[\s;|&])su(?:[\s;|&]|$)/,
+		label: "PRIVILEGE ESCALATION: su"
+	},
+	{
+		re: /(?:^|[\s;|&])doas(?:[\s;|&]|$)/,
+		label: "PRIVILEGE ESCALATION: doas"
+	},
+	{
+		re: /(?:^|[\s;|&])passwd(?:[\s;|&]|$)/,
+		label: "PRIVILEGE ESCALATION: passwd"
+	},
+	{
+		re: /(?:^|[\s;|&])del(?:[\s;|&]|$)/,
+		label: "CRITICAL: Detected dangerous command 'del'"
+	}
+];
+/** Patterns that warrant explicit confirmation before running — parity `security_rules.py`'s ask-level violation names. */
+const ASK_PATTERNS = [
+	{
+		re: /\bchmod\s+(?:-[a-zA-Z]+\s+)*777\b/,
+		label: "DANGEROUS PATTERN: chmod 777"
+	},
+	{
+		re: /\bchown\s+-R\b/,
+		label: "DANGEROUS PATTERN: recursive chown"
+	},
+	{
+		re: /\beval\s/,
+		label: "DANGEROUS PATTERN: eval"
+	},
+	{
+		re: /(?:>|>>|\btee\b)\s*\/etc\//,
+		label: "DANGEROUS PATTERN: write to /etc"
+	},
+	{
+		re: /\brm\s/,
+		label: "DELETE: 'rm' permanently deletes - confirmation required"
+	},
+	{
+		re: /\bunlink\s/,
+		label: "DELETE: 'unlink' command detected - confirmation required"
+	}
+];
+/**
+* Strip heredoc bodies so their content isn't matched as a command (false positives).
+* Two-phase scan: a backreference-free opener regex finds `<<[-]DELIM`, then the body
+* is cut up to the closing delimiter via `indexOf` — O(n), no catastrophic backtracking.
+*/
+function stripHeredoc(cmd) {
+	const opener = /<<-?\s*['"]?(\w+)['"]?/g;
+	let out = cmd;
+	let m;
+	while ((m = opener.exec(out)) !== null) {
+		const delim = m[1] ?? "";
+		const closer = new RegExp(`\\n[ \\t]*${delim}\\b`);
+		const rest = out.slice(m.index + m[0].length);
+		const hit = closer.exec(rest);
+		if (!hit || hit.index === void 0) break;
+		const end = m.index + m[0].length + hit.index + hit[0].length;
+		out = `${out.slice(0, m.index)} ${out.slice(end)}`;
+		opener.lastIndex = m.index;
+	}
+	return out;
+}
+/** Guards against dangerous Bash commands (critical → block, sensitive → ask). */
+function securityGuard(ctx) {
+	if (ctx.tool !== "Bash" || !ctx.command) return null;
+	const cmd = stripHeredoc(ctx.command);
+	for (const { re, label } of CRITICAL_PATTERNS) if (re.test(cmd)) return {
+		kind: "block",
+		title: "Dangerous command",
+		reason: `${label}.`,
+		actions: ["Remove the destructive command", "Scope the operation to a specific safe path"]
+	};
+	for (const { re, label } of ASK_PATTERNS) if (re.test(cmd)) return {
+		kind: "ask",
+		title: "Dangerous command",
+		reason: `${label}.`,
+		actions: ["Confirm this command is intended", "Run with least privilege"]
+	};
+	return null;
+}
+//#endregion
+//#region src/policy/guards/protected-path.ts
+/**
+* Path fragments that mark a location as internal/generated state.
+*
+* Parity with safe_paths.py: `~/.fuse-harness/cache` is a *writable*
+* cache the harness owns (lessons, MCP cache, per-type state) — only the
+* `cache/sessions` subtree is protected, not the whole cache.
+*/
+const PROTECTED_FRAGMENTS = [
+	".claude/plugins/marketplaces",
+	".claude/plugins/cache",
+	".claude/logs/00-apex",
+	".fuse-harness/cache/sessions",
+	".claude/apex/",
+	".harness/track",
+	".harness/memory/state"
+];
+/**
+* Matches a real `.git` directory segment (`/.git/`, `~/.git`, leading or
+* trailing `.git`) without matching unrelated names like `foo.git/` or
+* `.github/`. Kept separate from the substring fragments for precise scoping.
+*/
+const PROTECTED_GIT_RE = /(?:^|[/~\s])\.git(?:\/|$)/;
+/** Standard block response for any protected-path violation. */
+const BLOCK = {
+	kind: "block",
+	title: "Protected path",
+	reason: "This is internal/generated enforcement state — do not edit it directly.",
+	actions: ["Edit the source, not the generated/cache/state copy"]
+};
+/** Returns true if `str` references a protected fragment or a real `.git` segment. */
+function containsProtected(str) {
+	return PROTECTED_FRAGMENTS.some((f) => str.includes(f)) || PROTECTED_GIT_RE.test(str);
+}
+/** Strips surrounding quotes from a captured shell token. */
+function unquote(t) {
+	return t.replace(/^['"]|['"]$/g, "");
+}
+/**
+* Extracts the genuine write *targets* of a shell command, so a protected path
+* appearing only as a *read source* (e.g. `grep x .claude/apex/ > out.txt`,
+* `cat .git/config > /dev/null`) is not mistaken for a write.
+*
+* Covers `>` / `>>` redirects (skipping `2>`, `&>`, `1>` fd-redirects and
+* `/dev/null`), `tee`, `dd of=`, and the destination / in-place file of
+* `cp` / `mv` / `sed -i` / `perl -i` (last path token of the segment).
+* Best-effort: obfuscated shell (base64, indirection, process substitution)
+* can still evade this — residual risk, mitigated by the freshness gate.
+*/
+function extractWriteTargets(cmd) {
+	const out = [];
+	const push = (t) => {
+		const v = unquote((t ?? "").trim());
+		if (v && v !== "/dev/null") out.push(v);
+	};
+	for (const m of cmd.matchAll(/(?<![2&\d])>{1,2}\s*('[^']+'|"[^"]+"|\S+)/g)) push(m[1]);
+	for (const m of cmd.matchAll(/\btee\b(?:\s+-\S+)*\s+('[^']+'|"[^"]+"|\S+)/g)) push(m[1]);
+	for (const m of cmd.matchAll(/\bdd\b[^|;&]*\bof=('[^']+'|"[^"]+"|\S+)/g)) push(m[1]);
+	for (const seg of cmd.split(/[;&|]+/)) {
+		if (!/\b(?:cp|mv)\b|\b(?:sed|perl)\b[^|;&]*\s-i/.test(seg)) continue;
+		const toks = (seg.split(/[<>]/)[0] ?? "").trim().split(/\s+/).filter((t) => Boolean(t) && !t.startsWith("-"));
+		push(toks[toks.length - 1]);
+	}
+	return out;
+}
+/**
+* Blocks direct edits to internal/generated state directories.
+*
+* Covers:
+*  - Write / Edit tool calls whose `filePath` targets a protected fragment.
+*  - Bash commands whose actual write *target* is a protected fragment
+*    (read sources are ignored; see `extractWriteTargets`).
+*
+* @param ctx - The guard context (tool, filePath, command).
+* @returns A blocking {@link Prompt}, or null to allow.
+*/
+function protectedPathGuard(ctx) {
+	if ((ctx.tool === "Write" || ctx.tool === "Edit") && ctx.filePath) {
+		if (containsProtected(ctx.filePath)) return BLOCK;
+	}
+	if (ctx.tool === "Bash" && ctx.command) {
+		if (extractWriteTargets(ctx.command).some(containsProtected)) return BLOCK;
+	}
+	return null;
+}
+//#endregion
+//#region src/policy/guards/bash-write-safe-paths.ts
+/**
+* Writable paths the harness owns — writes here never need Write/Edit's APEX
+* gates. Parity safe_paths.py `SAFE_WRITE_PATHS`; `~/.claude/fusengine-cache`
+* is rebranded to `~/.fuse-harness/cache`, `~/.claude/logs` is unchanged.
+*/
+const SAFE_WRITE_PATHS = [fusengineCache(), join(claudeHome(), "logs")];
+/** Raw, un-expanded forms of {@link SAFE_WRITE_PATHS} for substring matching
+* when a shell didn't expand `~` (parity safe_paths.py `_SAFE_RAW`). */
+const SAFE_WRITE_RAW = ["~/.fuse-harness/cache", "~/.claude/logs"];
+/** Strip quotes, expand `~`/`$HOME`, normalize (parity safe_paths.resolve_path). */
+function resolvePath(raw) {
+	const stripped = raw.trim().replace(/^['"]|['"]$/g, "");
+	return normalize((stripped === "~" || stripped.startsWith("~/") ? homedir() + stripped.slice(1) : stripped).replace(/\$HOME/g, homedir()));
+}
+/** Extract the file path after a `>`/`>>` redirect (parity extract_redirect_target). */
+function extractRedirectTarget(cmd) {
+	const m = cmd.match(/>>\s*(\S+)|(?<![0-9&])>\s*(\S+)/);
+	return m ? resolvePath(m[1] ?? m[2] ?? "") : null;
+}
+/** True when a `>`/`>>` redirect targets a harness-owned safe path (parity is_safe_write_path). */
+function isSafeWritePath(cmd) {
+	const target = extractRedirectTarget(cmd);
+	return target !== null && SAFE_WRITE_PATHS.some((safe) => target === safe || target.startsWith(safe + "/"));
+}
+/** Extract the file argument of `tee`/`dd of=` (parity extract_command_target). */
+function extractCommandTarget(cmd) {
+	const tee = cmd.match(/\btee\s+(?:-[a-z]\s+)*(\S+)/);
+	if (tee?.[1]) return resolvePath(tee[1]);
+	const dd = cmd.match(/\bdd\b[^|]*\bof=(\S+)/);
+	return dd?.[1] ? resolvePath(dd[1]) : null;
+}
+/** True when a `tee`/`dd` target is a harness-owned safe path (parity is_safe_command_target). */
+function isSafeCommandTarget(cmd) {
+	const target = extractCommandTarget(cmd);
+	return target !== null && SAFE_WRITE_PATHS.some((safe) => target === safe || target.startsWith(safe + "/"));
+}
+/**
+* True when the command quotes a safe path as a string literal (parity
+* has_safe_write_target, hardened: the Python original — and this function
+* before this fix — does an unanchored substring match, which fail-opens any
+* `node -e` containing the safe path text anywhere, including inside an inert
+* comment. Requiring it to appear as a quoted literal still covers the real
+* use case (`fs.appendFileSync('~/.fuse-harness/cache/x.json', ...)`).
+*/
+function hasSafeWriteTarget(cmd) {
+	const quoted = (p) => cmd.includes(`'${p}'`) || cmd.includes(`"${p}"`) || cmd.includes(`'${p}/`) || cmd.includes(`"${p}/`);
+	return SAFE_WRITE_PATHS.some(quoted) || SAFE_WRITE_RAW.some(quoted);
+}
+//#endregion
+//#region src/policy/guards/bash-write-patterns.ts
+/** Redirect (`>`/`>>`) targeting a code-file extension. */
+const CODE_REDIRECT = /(?:>>?)\s*[^\s|;&]*\.(?:ts|tsx|js|jsx|py|go|rb|rs|java|kt|php|swift|vue|svelte|astro|css|c|cpp|h)\b/;
+/**
+* Interpreters / tools that mutate source in place, plus heredoc-into-file —
+* split into labeled sub-patterns (parity bash-write-guard.py `DENY_PATTERNS`,
+* each with its own `desc`) so the deny reason names which motif matched
+* instead of a single generic message for all six.
+*/
+const CODE_MUTATORS = [
+	{
+		re: /\bpython3?\s+-\s*<</,
+		desc: "Python heredoc input"
+	},
+	{
+		re: /\bpython3?\s+-c\b/,
+		desc: "Python inline script"
+	},
+	{
+		re: /\bsed\b[^|]*\s-i/,
+		desc: "sed in-place edit"
+	},
+	{
+		re: /\bperl\b[^|]*\s-[pi]i?\b/,
+		desc: "perl in-place edit"
+	},
+	{
+		re: /\bawk\b[^|]*-i\s*inplace/,
+		desc: "awk in-place edit"
+	},
+	{
+		re: /\bpatch\b/,
+		desc: "patch file modification"
+	},
+	{
+		re: /<<[-~]?\s*['"]?\w+['"]?[\s\S]*?>/,
+		desc: "heredoc redirected into a file"
+	}
+];
+/** File-mutating one-liners via `node -e` / `ruby -e` (parity NODE_WRITES/RUBY_WRITES). */
+const NODE_WRITES = /writeFile|appendFile|createWriteStream|fs\.(?:write|rename|unlink|mkdir|rmdir|copyFile)|execSync|spawnSync|child_process/;
+const RUBY_WRITES = /File\.(?:write|open|delete|rename)|IO\.write|FileUtils|\bsystem\b|\bexec\b|`[^`]/;
+/** Redirect to a non-code file. Excludes `/dev/null`, `2>`/`N>` and `>&N` fd
+* redirects via the `(?<![0-9&])` lookbehind + `(?!…|&)` (parity has_file_redirect). */
+const FILE_REDIRECT = /(?<![0-9&])\s*>>?\s*(?!\/dev\/null|&)[a-zA-Z./~$]/;
+/** Other ambiguous file writers (ASK): `tee <file>` (not `tee -a`/path) and `dd … of=` —
+* labeled sub-patterns (parity bash-write-guard.py `ASK_PATTERNS`). */
+const ASK_WRITERS = [{
+	re: /\btee\s+[^-/\s]/,
+	desc: "tee to file"
+}, {
+	re: /\bdd\b[^|]*\bof=/,
+	desc: "dd output to file"
+}];
+/** Commands whose first token never writes, skipped when a real redirect is
+* present (parity bash-write-guard.py `SAFE_PREFIXES`). */
+const SAFE_PREFIXES = [
+	"ls",
+	"pwd",
+	"which",
+	"cat ",
+	"head ",
+	"tail ",
+	"wc ",
+	"file ",
+	"stat ",
+	"tree",
+	"du ",
+	"df ",
+	"find ",
+	"grep ",
+	"rg ",
+	"git ",
+	"cd ",
+	"source ",
+	"export ",
+	"unset ",
+	"env ",
+	"printenv",
+	"bun test",
+	"bun run",
+	"bunx ",
+	"npm test",
+	"npm run",
+	"npx ",
+	"biome ",
+	"eslint ",
+	"prettier ",
+	"ruff ",
+	"pyright ",
+	"tsc ",
+	"mkdir ",
+	"mv ",
+	"cp "
+];
+/**
+* Session-state directory the freshness/APEX gates rely on. Any Bash command
+* touching it is a hook-bypass vector, so it is blocked outright — a blunt
+* substring match (read OR write), parity with bash-write-guard.py DENY_PATTERNS
+* `fusengine-cache/sessions` (rebranded to the harness cache path).
+*/
+const SESSION_STATE_FRAGMENT = ".fuse-harness/cache/sessions";
+//#endregion
+//#region src/policy/guards/bash-write.ts
+function blockCodeWrite(reason) {
+	return {
+		kind: "block",
+		title: "Bash write to code file",
+		reason,
+		actions: ["Use the Write/Edit tool instead"]
+	};
+}
+function askFileWrite(reason) {
+	return {
+		kind: "ask",
+		title: "Bash file write",
+		reason,
+		actions: ["Use the Write/Edit tool instead"]
+	};
+}
+/**
+* Blocks shell commands that mutate code files in place (and heredocs/redirects
+* to source files); asks before other file-writing shell commands unless the
+* target is a harness-owned safe path. Forces use of the Write/Edit tool so
+* APEX/SOLID checks are not bypassed.
+*/
+function bashWriteGuard(ctx) {
+	if (ctx.tool !== "Bash" || !ctx.command) return null;
+	const cmd = ctx.command;
+	const stripped = cmd.trim();
+	if (SAFE_PREFIXES.some((p) => stripped.startsWith(p)) && !FILE_REDIRECT.test(stripped)) return null;
+	if (cmd.includes(".fuse-harness/cache/sessions")) return {
+		kind: "block",
+		title: "Session-state tampering",
+		reason: "Bash access to the harness session-state directory is a hook-bypass vector — the freshness/APEX enforcement reads it to decide block/allow.",
+		actions: ["Never read or write session state from the shell"]
+	};
+	const mutator = CODE_MUTATORS.find((m) => m.re.test(cmd));
+	if (mutator) return blockCodeWrite(`${mutator.desc} — Use Edit/Write tools instead`);
+	if (FILE_REDIRECT.test(cmd)) {
+		if (isSafeWritePath(cmd)) return null;
+		return CODE_REDIRECT.test(cmd) ? blockCodeWrite("Bash redirect to code file — Use Write/Edit tools (enforces APEX + SOLID specs)") : askFileWrite("Shell redirect to file detected. Authorize?");
+	}
+	if (/\bnode\s+-e\b/.test(cmd) && NODE_WRITES.test(cmd)) return hasSafeWriteTarget(cmd) ? null : askFileWrite("Node.js write operation detected. Authorize?");
+	if (/\bruby\s+-e\b/.test(cmd) && RUBY_WRITES.test(cmd)) return askFileWrite("Ruby write operation detected. Authorize?");
+	const asker = ASK_WRITERS.find((a) => a.re.test(cmd));
+	if (asker) return isSafeCommandTarget(cmd) ? null : askFileWrite(`${asker.desc} detected. Authorize?`);
+	return null;
+}
+//#endregion
+//#region src/policy/guards/interface-separation.ts
+/** TS/JS component files: top-level `interface`/`type Foo`. */
+const TS_DECL_RE = /^\s*(export\s+)?(interface|type)\s+[A-Z]/m;
+/** Python view models: class subclassing a schema/protocol base. */
+const PY_MODEL_RE = /^\s*class\s+\w+\((BaseModel|TypedDict|Protocol)\)/m;
+/**
+* PHP controllers: top-level `interface`, `abstract class`, or a concrete
+* `class …Interface/DTO/Request`. Union of the TS-only `abstract class` rule
+* and the Python rule (`class [A-Z].*(Interface|DTO|Request)`, enforce-interfaces.py:16).
+*/
+const PHP_DECL_RE = /^\s*(?:abstract\s+class\b|interface\b|class\s+[A-Z].*(?:Interface|DTO|Request))/m;
+/** Swift views: top-level `protocol Foo`. */
+const SWIFT_PROTO_RE = /^\s*protocol\s+[A-Z]/m;
+/** Go handlers/controllers: top-level `type Foo interface`. */
+const GO_DECL_RE = /^\s*type\s+[A-Z]\w*\s+interface\b/m;
+/** Java/Kotlin controllers/handlers: top-level `interface`/`record`. */
+const JAVA_DECL_RE = /^\s*(?:public\s+|private\s+|protected\s+|internal\s+)?(?:interface|record)\s+[A-Z]/m;
+/**
+* Blocks top-level interface/type/protocol declarations in component, view or
+* controller files (Interface Segregation). Fires only when BOTH the path
+* category AND the content pattern match.
+*
+* Destination text for TS/JS/Vue/Svelte, PHP and Swift matches the user's own
+* `claude-rules/rules/04-solid-dry-rules.md` ("SOLID Skill per Stack" table),
+* the current authoritative convention — NOT the older `enforce-interfaces.py`
+* text, which this guard originally ported. Go/Python/Java/Kotlin aren't
+* covered by that table, so their destinations stay as a reasonable default.
+*
+* Parity note: enforce-interfaces.py only inspects `Write` (tool_input.content).
+* We deliberately also fire on `Edit` — an in-place edit can introduce the same
+* violation — and the path fragments accept singular *and* plural directory
+* names (`view/` + `views/`), mirroring the Python `s?` regexes.
+*/
+function interfaceSeparationGuard(ctx) {
+	if (ctx.tool !== "Write" && ctx.tool !== "Edit") return null;
+	const path = ctx.filePath;
+	const content = ctx.content;
+	if (!path || !content) return null;
+	const blockWith = (msg, action) => ({
+		kind: "block",
+		title: "Separate the interface",
+		reason: `SOLID VIOLATION: ${msg}`,
+		actions: [action]
+	});
+	const inAny = (...frags) => frags.some((f) => path.includes(f));
+	if (/\.(tsx|jsx|vue|svelte)$/.test(path) && TS_DECL_RE.test(content)) return blockWith("Interface/type in component file. Move to modules/[feature]/src/interfaces/", "Move the interface/type to modules/[feature]/src/interfaces/");
+	if (/\.py$/.test(path) && inAny("view/", "views/", "controller/", "controllers/", "route/", "routes/") && PY_MODEL_RE.test(content)) return blockWith("Type class in view file. Move to src/interfaces/", "Move the type class to src/interfaces/");
+	if (/\.go$/.test(path) && inAny("handler/", "handlers/", "controller/", "controllers/") && GO_DECL_RE.test(content)) return blockWith("Interface in handler file. Move to internal/interfaces/", "Move the interface to internal/interfaces/");
+	if (/\.(java|kt)$/.test(path) && inAny("controller/", "controllers/", "handler/", "handlers/") && JAVA_DECL_RE.test(content)) return blockWith("Interface in controller file. Move to interfaces/ package", "Move the interface to the interfaces/ package");
+	if (/\.php$/.test(path) && inAny("Controller/", "Controllers/", "Handler/", "Handlers/") && PHP_DECL_RE.test(content)) return blockWith("Interface in controller file. Move to app/Contracts/", "Move the interface to app/Contracts/");
+	if (/\.swift$/.test(path) && inAny("View/", "Views/", "Component/", "Components/") && SWIFT_PROTO_RE.test(content)) return blockWith("Protocol in view file. Move to Sources/Interfaces/", "Move the protocol to Sources/Interfaces/");
+	return null;
+}
+//#endregion
+//#region src/policy/guards/install.ts
+/** Asks for confirmation before a dependency or system package install. */
+function installGuard(ctx) {
+	if (ctx.tool !== "Bash" || !ctx.command) return null;
+	if (matchPatterns(ctx.command, PROJECT_INSTALL) || matchPatterns(ctx.command, SYSTEM_INSTALL)) return {
+		kind: "ask",
+		title: "Dependency install",
+		reason: `This command installs packages: ${ctx.command.trim()}`,
+		actions: ["Confirm this install is intended"]
+	};
+	return null;
+}
+//#endregion
+//#region src/policy/guards/index.ts
+/** Ordered guard chain: critical/security + protected first, then writes/installs. */
+const GUARDS = [
+	securityGuard,
+	protectedPathGuard,
+	bashWriteGuard,
+	interfaceSeparationGuard,
+	installGuard
+];
+/** Block prompt returned when a guard or gate throws (fail-closed). */
+const FAIL_CLOSED = {
+	kind: "block",
+	title: "Policy error",
+	reason: "A policy check errored — blocked for safety (fail-closed).",
+	actions: ["Fix the failing guard/gate, then retry"]
+};
+const USER_GUARDS = [];
+/** Register a user guard — runs AFTER the privileged core chain (two-tier). */
+function registerGuard(guard) {
+	USER_GUARDS.push(guard);
+}
+/** Remove all registered user guards (mainly for tests). */
+function clearUserGuards() {
+	USER_GUARDS.length = 0;
+}
+/**
+* Run the guard chain — privileged core guards first, then user guards — and
+* return the first firing Prompt, else null. Fail-closed: a guard that throws
+* blocks (never silently passes).
+*/
+function runGuards(ctx) {
+	for (const guard of [...GUARDS, ...USER_GUARDS]) {
+		let hit;
+		try {
+			hit = guard(ctx);
+		} catch {
+			return FAIL_CLOSED;
+		}
+		if (hit) return hit;
+	}
+	return null;
+}
+//#endregion
+//#region src/policy/evaluate.ts
+/**
+* Evaluate a single tool-use against the bundled policies, returning a pure
+* decision plus a portable {@link Prompt}. Adapters translate the prompt into
+* their harness's native response (Claude `permissionDecision`, etc.).
+*/
+function evaluate(ctx) {
+	const guard = runGuards(ctx);
+	if (guard) return {
+		decision: "deny",
+		message: guard.reason,
+		prompt: guard
+	};
+	if (ctx.command && matchPatterns(ctx.command, GIT_BLOCKED)) {
+		const reason = `Destructive git command: ${ctx.command}`;
+		return {
+			decision: "deny",
+			message: reason,
+			prompt: {
+				kind: "block",
+				title: "Destructive git command",
+				reason,
+				actions: ["Use a non-destructive alternative (e.g. --force-with-lease; avoid --hard / -D)"]
+			}
+		};
+	}
+	if (ctx.command && matchPatterns(ctx.command, GIT_ASK)) return {
+		decision: "deny",
+		message: `Git operation requires confirmation: ${ctx.command}`,
+		prompt: {
+			kind: "ask",
+			title: "Confirm git operation",
+			reason: `Authorize: ${ctx.command.trim()}`,
+			actions: ["Approve if this git operation is intended"]
+		}
+	};
+	if (ctx.filePath && isFileSizeScoped(ctx.filePath) && ctx.agentType !== "Explore" && ctx.agentType !== "Plan") {
+		const incoming = ctx.content !== void 0 ? countLines(ctx.content) : 0;
+		const lines = ctx.tool === "Edit" ? Math.max(incoming, ctx.existingLines ?? 0) : incoming || (ctx.existingLines ?? 0);
+		const framework = resolveSolidRefFramework(ctx.filePath);
+		const displayLines = ctx.tool === "Write" ? ctx.existingLines ?? lines : lines;
+		const verdict = evaluateFileSize(lines, ctx.maxLines, ctx.filePath, framework, displayLines);
+		if (lines > 0 && !verdict.ok) return {
+			decision: "deny",
+			message: verdict.message,
+			prompt: {
+				kind: "block",
+				title: "SOLID file-size limit",
+				reason: verdict.message ?? "",
+				actions: [`Split into modules under ${verdict.max} lines (Single Responsibility)`, "Then re-run the write"]
+			},
+			meta: {
+				framework,
+				lines: verdict.lines,
+				max: verdict.max
+			}
+		};
+	}
+	return {
+		decision: "allow",
+		message: null
+	};
+}
+//#endregion
+export { PROJECT_INSTALL as A, PROTECTED_GIT_RE as C, securityGuard as D, CRITICAL_PATTERNS as E, countFrameworkCodeLines as F, countLines as I, evaluateFileSize as L, matchPatterns as M, PLUGINS_DIR as N, GIT_ASK as O, SOLID_REF as P, PROTECTED_FRAGMENTS as S, ASK_PATTERNS as T, CODE_MUTATORS as _, registerGuard as a, SAFE_PREFIXES as b, GO_DECL_RE as c, PY_MODEL_RE as d, SWIFT_PROTO_RE as f, ASK_WRITERS as g, bashWriteGuard as h, clearUserGuards as i, SYSTEM_INSTALL as j, GIT_BLOCKED as k, JAVA_DECL_RE as l, interfaceSeparationGuard as m, FAIL_CLOSED as n, runGuards as o, TS_DECL_RE as p, GUARDS as r, installGuard as s, evaluate as t, PHP_DECL_RE as u, CODE_REDIRECT as v, protectedPathGuard as w, SESSION_STATE_FRAGMENT as x, FILE_REDIRECT as y };