@gaunt-sloth/core 2.0.0-alpha.35 → 2.0.0-alpha.36

package/dist/core/shell/approvalStop.js

@@ -23,18 +23,145 @@
  * thrown run as `ok: false`, and each command entry point turns that into `setExitCode(1)` — so
  * "immediate non-zero exit carrying the explanation" is what a caller already gets, without a new
  * exit path that could diverge from the existing one.
+ *
+ * ## [[TUI-C71]] — a stop message is UNTRUSTED TEXT, and it is made safe in two places
+ *
+ * Every string a stop carries except this module's own sentences is written by something other
+ * than the user: the command the agent proposed, the rater's outcome and reason, the
+ * `approvals.escalate` entry that matched, and the whole §5 negotiation. On an `attack` verdict
+ * that is the *worst* text in the system by construction — the rater judged the command's own
+ * structure to evidence deception or obfuscation — so a stop is the one message most likely to
+ * carry a payload crafted to forge terminal output, and the last one that may be printed raw.
+ *
+ * The defence [[TUI-C26]] built has two halves, and they belong at different times:
+ *
+ * 1. **Neutralisation is done HERE, at construction, unconditionally.** It needs no width and no
+ *    screen, it is idempotent, and it is the half every consumer needs — a thrown stop reaches the
+ *    Ink transcript, `--no-tui` stderr, a session log, the approvals archive (`record.error`), an
+ *    eval turn record, AG-UI and a CI job's output, and only some of those are terminals. Doing it
+ *    at each render site would mean every present and future consumer had to remember; doing it
+ *    once here means none of them can forget. After it, `{@link message}` contains no control or
+ *    format character at all: a carriage return is the five printable characters `\x0d`, and —
+ *    because LF is a control character too — untrusted text cannot even open a new line, let alone
+ *    reach column 0 on one.
+ * 2. **The gutter and the width bound are done at RENDER, by the surface** ({@link
+ *    approvalStopRows} for the plain surfaces, `<ApprovalStopMessage>` for the Ink TUI). They
+ *    cannot be done here: framing is arithmetic against a terminal width, an `Error.message` has
+ *    no width, and a block wrapped for an 80-column terminal is wrong for every other one. What
+ *    they buy over neutralisation alone is the last case it cannot close — one very long
+ *    neutralised line that the *terminal* wraps, whose continuation starts at column 0 carrying
+ *    whatever the attacker chose to put at that offset. That route is measured, not theorised: on
+ *    a 120-column terminal the neutralised `Command:` line of a hostile command is ~164 columns.
+ *
+ * **Because half of it is the surface's job, the surfaces are enumerated rather than assumed.**
+ * Every place that catches an `ApprovalStopError` and prints it calls {@link approvalStopRows} (or
+ * the Ink component): `runtime/singleShot.ts`, `runtime/conversation.ts`,
+ * `agent/modules/interactiveSessionModule.ts` (both its per-turn catch and its outermost one, which
+ * is where the `-m` path lands), `review/modules/reviewModule.ts`, `app/commands/prCommand.ts`
+ * (which catches what the PR-discovery agent throws) and `app/tui/components/App.tsx`.
+ * **Adding a surface that catches a stop means adding it to that list.**
+ *
+ * **That list is over the ERROR, and the error is not the only way a stop reaches a screen.** Some
+ * consumers take {@link message} and hand the *string* onward, at which point no `instanceof` can
+ * find it again: `runConversation` records it as a turn's `error`, and `evalRunner` folds that into
+ * an eval case's `reasons`, which `batch/reporters/textReporter.ts` prints — a terminal, reached
+ * without any of its code ever seeing this class. That one frames the text itself. So the honest
+ * statement is not "every other consumer is a non-terminal" but: **a consumer that prints to a
+ * terminal frames what it prints, whether it holds the error or only its text**, and the ones that
+ * legitimately do neither are the file and protocol sinks (the approvals archive, the JUnit/JSON
+ * reports, the AG-UI event) plus `reviewModule`'s `displayDebug` of the raw error, which is a debug
+ * channel. All of them still inherit the neutralisation, which is what keeps the worst case a
+ * wrapped line rather than a repainted screen.
+ *
+ * **The structured fields stay RAW; only the message is neutralised.** That is what answers the
+ * obvious objection to construction-time work — that it stops the error being a faithful record of
+ * what was proposed. `{@link ApprovalStopError.command}`, `reason`, `outcome`, `escalatedBy` and
+ * `negotiation` are the command as the agent wrote it, byte for byte, for any consumer that needs
+ * the truth rather than a screen; the message is the *presentation*, and a presentation that can
+ * repaint the terminal is not one. The render path frames from those raw fields, so its gutter
+ * numbers the command's real lines rather than one escaped line.
+ *
+ * **One parts list, two renderings** ({@link ApprovalStopPart}). The message string and the framed
+ * block are both derived from {@link ApprovalStopError.parts}, so they cannot come to describe one
+ * stop two ways — the same argument `renderNegotiationTranscript` makes for its own two surfaces.
+ * A part is tagged with *who wrote it*, which is the only distinction any of this rests on: the
+ * gate's own prose can be painted as it is because nothing can forge it, and everything else goes
+ * through the shared renderer.
  */
+import { frameUntrustedCommand, frameUntrustedText, frameWidthFor, narrowTerminalNotice, neutralizeUntrustedText, } from '#src/core/shell/framing.js';
+/**
+ * The parts as the one string an `Error.message` has to be, with every untrusted part neutralised.
+ *
+ * A `block` is neutralised **line by line**, so the renderer-owned breaks that carry its meaning
+ * survive while its content still cannot introduce one. Everything else is neutralised whole,
+ * which — LF being a control character — is what collapses an untrusted value onto the single line
+ * its label put it on.
+ */
+function composeMessage(parts) {
+    return parts.map(messageLineFor).join('\n');
+}
+function messageLineFor(part) {
+    switch (part.kind) {
+        case 'own':
+            return part.text;
+        case 'block':
+            return part.text.split('\n').map(neutralizeUntrustedText).join('\n');
+        default:
+            return `  ${part.label}: ${neutralizeUntrustedText(part.text)}`;
+    }
+}
+/**
+ * The stop as terminal rows, for a surface that paints lines rather than components.
+ *
+ * Every row is painted **verbatim, one row per line, and never re-wrapped** — that is the
+ * condition `core/shell/framing` states its column-0 guarantee over, and a caller that joins these
+ * and hands them to something that wraps has undone the whole point.
+ *
+ * `columns` is what the surface reports (`stdout.columns`), not a frame width: it is resolved
+ * through {@link frameWidthFor} here so the plain surfaces, the Ink TUI and the approval dialog
+ * cannot come to disagree about how much of a command a human was shown. When it is below core's
+ * floor the frame is wider than the terminal and the guarantee lapses — {@link narrowTerminalNotice}
+ * leads the block in that case, so it lapses out loud.
+ */
+export function approvalStopRows(parts, options) {
+    const width = frameWidthFor(options?.columns);
+    const rows = [];
+    const tooNarrow = narrowTerminalNotice(options?.columns);
+    if (tooNarrow)
+        rows.push(tooNarrow);
+    for (const part of parts) {
+        if (part.kind === 'own') {
+            rows.push(part.text);
+            continue;
+        }
+        // The label is the gate's OWN word for what follows, and it stays on the gate's own row rather
+        // than being prefixed to the first framed row — a label sharing a row with untrusted text is a
+        // row a reader cannot tell apart from one the model wrote all of.
+        if (part.kind !== 'block')
+            rows.push(`  ${part.label}:`);
+        const framed = part.kind === 'command'
+            ? frameUntrustedCommand(part.text, { width })
+            : frameUntrustedText(part.text, { width });
+        rows.push(...framed.notices, ...framed.lines);
+    }
+    return rows;
+}
 /**
  * Base class for the two run-ending approvals outcomes, so a caller that wants to present them as
- * an ending rather than a crash can catch both with one `instanceof`. Every surface shows the
- * message as-is, which is already the whole explanation.
+ * an ending rather than a crash can catch both with one `instanceof`.
+ *
+ * A surface that can frame should render {@link parts} (see {@link approvalStopRows}); one that
+ * cannot shows {@link message}, which is already neutralised and is already the whole explanation.
  */
 export class ApprovalStopError extends Error {
-    /** The command that ended the run. */
+    /** The command that ended the run, exactly as the agent proposed it. */
     command;
-    constructor(message, command) {
-        super(message);
+    /** The message's pieces, tagged with who wrote each — see {@link ApprovalStopPart}. */
+    parts;
+    constructor(parts, command) {
+        super(composeMessage(parts));
         this.command = command;
+        this.parts = parts;
         // Restore the prototype chain across the ES5 `extends Error` downlevel, so `instanceof` works.
         Object.setPrototypeOf(this, new.target.prototype);
         this.name = new.target.name;
@@ -45,11 +172,11 @@ export class ApprovalStopError extends Error {
  * credential targeting, privilege escalation, persistence, deception, obfuscation). Ends the agent
  * loop; the model is told nothing and offered nothing.
  *
- * **This is what reaches a surface that cannot ask.** An interactive surface is offered §6.1's red
- * banner first — `GthAgentRunner.setAttackHaltCallback`, where typing `run anyway` runs this one
- * command and everything else stops the run — and this error is thrown when no banner is wired, or
- * when the banner is answered with anything but that phrase. A non-interactive session wires
- * nothing and so gets this message directly (§6.2).
+ * **This is what reaches a surface that cannot ask.** An interactive surface is offered [[TUI-C68]]
+ * §6.1's red banner first — `GthAgentRunner.setAttackHaltCallback`, where typing `run anyway` runs
+ * this one command and everything else stops the run — and this error is thrown when no banner is
+ * wired, or when the banner is answered with anything but that phrase. A non-interactive session
+ * wires nothing and so gets this message directly (§6.2).
  *
  * The recovery this message names is deliberately the **allow-list**, not `bypass`. §4.2 makes
  * `approvals.allow` the supported way to run such a command unattended (it is consulted before the
@@ -61,13 +188,21 @@ export class AttackHaltError extends ApprovalStopError {
     /** The rater's explanation of what the command's structure showed. */
     reason;
     constructor(command, reason) {
-        super(`Run halted: the auto-rater rated this command as an attack, which ends the run.\n` +
-            `  Command: ${command}\n` +
-            `  Reason: ${reason}\n` +
-            `This is not negotiable. If this command is legitimate and you need it to run, declare ` +
-            `it in approvals.allow — that list is consulted before the auto-rater, so it never ` +
-            `reaches a halt. Dropping to approvals "bypass" also works, but it turns off the rater, ` +
-            `the prompts and the halt for every command in the run.`, command);
+        super([
+            {
+                kind: 'own',
+                text: 'Run halted: the auto-rater rated this command as an attack, which ends the run.',
+            },
+            { kind: 'command', label: 'Command', text: command },
+            { kind: 'value', label: 'Reason', text: reason },
+            {
+                kind: 'own',
+                text: `This is not negotiable. If this command is legitimate and you need it to run, declare ` +
+                    `it in approvals.allow — that list is consulted before the auto-rater, so it never ` +
+                    `reaches a halt. Dropping to approvals "bypass" also works, but it turns off the rater, ` +
+                    `the prompts and the halt for every command in the run.`,
+            },
+        ], command);
         this.reason = reason;
     }
 }
@@ -96,20 +231,35 @@ export class NonInteractiveEscalationError extends ApprovalStopError {
      */
     negotiation;
     constructor(command, outcome, reason, escalatedBy, negotiation) {
-        super(`Approval required, but this session has no one to ask.\n` +
-            `  Command: ${command}\n` +
-            (outcome ? `  Rating: ${outcome}\n` : '') +
-            (reason ? `  Reason: ${reason}\n` : '') +
-            (negotiation ? `${negotiation}\n` : '') +
-            (escalatedBy
-                ? `  Matched approvals.escalate: ${escalatedBy}\n` +
-                    `An escalate entry always asks a human, whatever the rung would have done, so no ` +
+        const parts = [
+            { kind: 'own', text: 'Approval required, but this session has no one to ask.' },
+            { kind: 'command', label: 'Command', text: command },
+        ];
+        if (outcome)
+            parts.push({ kind: 'value', label: 'Rating', text: outcome });
+        if (reason)
+            parts.push({ kind: 'value', label: 'Reason', text: reason });
+        if (negotiation)
+            parts.push({ kind: 'block', text: negotiation });
+        if (escalatedBy) {
+            parts.push({ kind: 'value', label: 'Matched approvals.escalate', text: escalatedBy });
+            parts.push({
+                kind: 'own',
+                text: `An escalate entry always asks a human, whatever the rung would have done, so no ` +
                     `entry in approvals.allow can answer it. Remove the escalate entry if this command ` +
-                    `should run unattended.`
-                : `Declare the commands this run is allowed to execute in approvals.allow — write each ` +
+                    `should run unattended.`,
+            });
+        }
+        else {
+            parts.push({
+                kind: 'own',
+                text: `Declare the commands this run is allowed to execute in approvals.allow — write each ` +
                     `one as an explicit entry, for example { "type": "shell", "matcher": "exact", ` +
                     `"pattern": "npm test" }. That list is consulted before the auto-rater and never ` +
-                    `escalates.`), command);
+                    `escalates.`,
+            });
+        }
+        super(parts, command);
         this.outcome = outcome;
         this.reason = reason;
         this.escalatedBy = escalatedBy;

package/dist/core/shell/approvalStop.js.map

@@ -1 +1 @@
-{"version":3,"file":"approvalStop.js","sourceRoot":"","sources":["../../../src/core/shell/approvalStop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;GAIG;AACH,MAAM,OAAgB,iBAAkB,SAAQ,KAAK;IACnD,sCAAsC;IAC7B,OAAO,CAAS;IAEzB,YAAsB,OAAe,EAAE,OAAe;QACpD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,+FAA+F;QAC/F,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,eAAgB,SAAQ,iBAAiB;IACpD,sEAAsE;IAC7D,MAAM,CAAS;IAExB,YAAY,OAAe,EAAE,MAAc;QACzC,KAAK,CACH,mFAAmF;YACjF,cAAc,OAAO,IAAI;YACzB,aAAa,MAAM,IAAI;YACvB,wFAAwF;YACxF,oFAAoF;YACpF,yFAAyF;YACzF,wDAAwD,EAC1D,OAAO,CACR,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,6BAA8B,SAAQ,iBAAiB;IAClE,gFAAgF;IACvE,OAAO,CAAqB;IACrC,sDAAsD;IAC7C,MAAM,CAAqB;IACpC;;;;;OAKG;IACM,WAAW,CAAqB;IAEzC;;;;;;OAMG;IACM,WAAW,CAAqB;IAEzC,YACE,OAAe,EACf,OAAgB,EAChB,MAAe,EACf,WAAoB,EACpB,WAAoB;QAEpB,KAAK,CACH,0DAA0D;YACxD,cAAc,OAAO,IAAI;YACzB,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,CAAC,WAAW;gBACV,CAAC,CAAC,iCAAiC,WAAW,IAAI;oBAChD,kFAAkF;oBAClF,oFAAoF;oBACpF,wBAAwB;gBAC1B,CAAC,CAAC,sFAAsF;oBACtF,+EAA+E;oBAC/E,kFAAkF;oBAClF,YAAY,CAAC,EACnB,OAAO,CACR,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF"}
+{"version":3,"file":"approvalStop.js","sourceRoot":"","sources":["../../../src/core/shell/approvalStop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AACH,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAsCpC;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,KAAkC;IACxD,OAAO,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc,CAAC,IAAsB;IAC5C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,KAAK;YACR,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE;YACE,OAAO,KAAK,IAAI,CAAC,KAAK,KAAK,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACpE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAkC,EAClC,OAA8B;IAE9B,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,SAAS,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,+FAA+F;QAC/F,+FAA+F;QAC/F,kEAAkE;QAClE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QACzD,MAAM,MAAM,GACV,IAAI,CAAC,IAAI,KAAK,SAAS;YACrB,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC;YAC7C,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAgB,iBAAkB,SAAQ,KAAK;IACnD,wEAAwE;IAC/D,OAAO,CAAS;IAEzB,uFAAuF;IAC9E,KAAK,CAA8B;IAE5C,YAAsB,KAAkC,EAAE,OAAe;QACvE,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,+FAA+F;QAC/F,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,eAAgB,SAAQ,iBAAiB;IACpD,sEAAsE;IAC7D,MAAM,CAAS;IAExB,YAAY,OAAe,EAAE,MAAc;QACzC,KAAK,CACH;YACE;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,iFAAiF;aACxF;YACD,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE;YACpD,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE;YAChD;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EACF,wFAAwF;oBACxF,oFAAoF;oBACpF,yFAAyF;oBACzF,wDAAwD;aAC3D;SACF,EACD,OAAO,CACR,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,6BAA8B,SAAQ,iBAAiB;IAClE,gFAAgF;IACvE,OAAO,CAAqB;IACrC,sDAAsD;IAC7C,MAAM,CAAqB;IACpC;;;;;OAKG;IACM,WAAW,CAAqB;IAEzC;;;;;;OAMG;IACM,WAAW,CAAqB;IAEzC,YACE,OAAe,EACf,OAAgB,EAChB,MAAe,EACf,WAAoB,EACpB,WAAoB;QAEpB,MAAM,KAAK,GAAuB;YAChC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,wDAAwD,EAAE;YAC/E,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE;SACrD,CAAC;QACF,IAAI,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3E,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,IAAI,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAClE,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,4BAA4B,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YACtF,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,KAAK;gBACX,IAAI,EACF,kFAAkF;oBAClF,oFAAoF;oBACpF,wBAAwB;aAC3B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,KAAK;gBACX,IAAI,EACF,sFAAsF;oBACtF,+EAA+E;oBAC/E,kFAAkF;oBAClF,YAAY;aACf,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF"}

package/dist/core/shell/hardline.d.ts

@@ -24,6 +24,28 @@
  * fork-bomb literal (the string *is* the fork bomb).
  */
 export declare const HARDLINE_PATTERNS: ReadonlyArray<readonly [RegExp, string]>;
+/**
+ * **Every string a §8 decision is made of, in one record — exported ONLY for the snapshot gate**
+ * (`shellHardlinePatternSurface.spec.ts`), which freezes it as a literal in its own source. Nothing
+ * in production reads it, and nothing should: it is the module's pattern surface made addressable so
+ * that a narrowing cannot land silently. **Any new pattern constant joins it**, and the gate's
+ * key-set check fails if one does not.
+ *
+ * **Membership is decided by what the patterns are BUILT FROM, not by what this file declares** —
+ * which is why {@link COMMAND_SEPARATOR_CLASS}, imported from `core/shell/normalize`, is a member.
+ * Floor behaviour depends on it and it is edited in another module, so a change there is exactly the
+ * silent narrowing this exists to make loud.
+ *
+ * A value composed at module load carries its parts with it: {@link CMD_POS} expands
+ * {@link WRAPPER_ARMS}, and {@link ROOT_TARGET} expands `quotedOrBare`, so those parts are frozen
+ * whether or not they are also members. The parts are listed anyway, because a diff that names
+ * `H_TOKEN_EXCLUSIONS` is actionable where one that names only `CHOWN_HEAD` is a wall of regex.
+ *
+ * Regexes are recorded as `String(re)` rather than `re.source` **because the flags are part of the
+ * behaviour**: a `g` flag makes `.test()` stateful across calls, a change no source-only record
+ * would show.
+ */
+export declare const HARDLINE_PATTERN_SURFACE: Readonly<Record<string, string | readonly string[]>>;
 /**
  * Whether one pipeline both reads credential material and transmits data off the machine.
  * Exported for tests, which pin BOTH directions: the credential-upload shapes must match, and

package/dist/core/shell/hardline.js

@@ -39,6 +39,34 @@
  * escalation behind it at every rung but `bypass`.** {@link CMD_POS} carries the worked example of
  * a case measured and dropped.
  *
+ * **How it may SHRINK — a narrowing ships with its removal set pinned.** Any edit that makes the
+ * floor refuse strictly fewer commands is a narrowing: a new exclusion, a loosened bound, a
+ * tightened anchor, a narrower character class. **The suite cannot review one.** If the edit had
+ * removed a refusal that any spec asserts, that spec would be red — so a green run proves only that
+ * everything the edit removed was unasserted, which is the same set as "uncovered". Green is
+ * structurally silent about a narrowing, and an AI review of the diff is no better: both read what
+ * the change still does, and the whole risk is in what it quietly stopped doing.
+ *
+ * So the change states its **removal set** — the commands that matched before and do not match
+ * after — characterised from the shape of the edit, never sampled from the corpus
+ * (`shellHardlineCorpus.spec.ts` sees only its own cases *by construction*; its docblock says so). A
+ * regex's removal set cannot be enumerated exactly, so the requirement is a characterisation plus
+ * probes pinned at its dangerous end. **Derived by the reviewer independently, not by the author** —
+ * an author who missed the removal while writing the edit will miss it again while describing it.
+ * {@link HARDLINE_PATTERN_SURFACE} is what makes a narrowing ASK for that declaration: every pattern
+ * constant this module binds at module scope is frozen in `shellHardlinePatternSurface.spec.ts`, so
+ * moving one turns a cell red and only a deliberate edit to that spec's literal turns it green
+ * again. A pattern built inside a function body, and any narrowing that lives in control flow rather
+ * than in a string, are outside it — that spec's docblock names them.
+ *
+ * **The asymmetry above flips at the exfiltration boundary — check which half you are editing.**
+ * For the destructive-verb arms a miss still has the confirmation dialog and the rater behind it,
+ * which is what makes "prefer fewer false positives" safe there. For the exfiltration arms,
+ * removing a refusal **is** the harm, and "a miss still has the rater behind it" is the precise
+ * reliance §3 forbids: the deterministic subset exists *because* the `attack` outcome must not
+ * depend on the rater alone. "Strictly subtractive — it can only remove refusals, never add one" is
+ * a safety property in the first half and a description of the vulnerability in the second.
+ *
  * §8.1 — **the floor is never advertised.** It is documented for people reading the code and the
  * spec, never offered to a user as a reason to feel safe; user-facing copy cites only protections
  * the user can inspect and extend (the deny list).
@@ -634,6 +662,59 @@ const CREDENTIAL_SOURCE_PATTERNS = [
     // The whole environment, piped somewhere.
     new RegExp(CMD_POS + '(?:printenv|env)\\s*(?=\\||$)'),
 ];
+/**
+ * **Every string a §8 decision is made of, in one record — exported ONLY for the snapshot gate**
+ * (`shellHardlinePatternSurface.spec.ts`), which freezes it as a literal in its own source. Nothing
+ * in production reads it, and nothing should: it is the module's pattern surface made addressable so
+ * that a narrowing cannot land silently. **Any new pattern constant joins it**, and the gate's
+ * key-set check fails if one does not.
+ *
+ * **Membership is decided by what the patterns are BUILT FROM, not by what this file declares** —
+ * which is why {@link COMMAND_SEPARATOR_CLASS}, imported from `core/shell/normalize`, is a member.
+ * Floor behaviour depends on it and it is edited in another module, so a change there is exactly the
+ * silent narrowing this exists to make loud.
+ *
+ * A value composed at module load carries its parts with it: {@link CMD_POS} expands
+ * {@link WRAPPER_ARMS}, and {@link ROOT_TARGET} expands `quotedOrBare`, so those parts are frozen
+ * whether or not they are also members. The parts are listed anyway, because a diff that names
+ * `H_TOKEN_EXCLUSIONS` is actionable where one that names only `CHOWN_HEAD` is a wall of regex.
+ *
+ * Regexes are recorded as `String(re)` rather than `re.source` **because the flags are part of the
+ * behaviour**: a `g` flag makes `.test()` stateful across calls, a change no source-only record
+ * would show.
+ */
+export const HARDLINE_PATTERN_SURFACE = Object.freeze({
+    // Structural / shared.
+    COMMAND_SEPARATOR_CLASS,
+    WRAPPER_FLAGS,
+    WRAPPER_ARMS: Object.freeze([...WRAPPER_ARMS]),
+    CMD_POS,
+    TARGET_TOKEN_END,
+    H_SPACE,
+    H_TOKEN_EXCLUSIONS,
+    H_TOKEN_CHAR,
+    H_OPERAND_CHAR,
+    // The destructive-verb arms and the fragments they share.
+    ROOT_TARGET,
+    SYSTEM_DIR_TARGET,
+    RECURSIVE_FLAG,
+    CHOWN_SKIPPABLE_ARG,
+    CHOWN_HEAD,
+    // The pattern list itself, sources only: the human descriptions beside them are prose, and a
+    // reworded one is not a narrowing, so they stay out rather than train a reader to update the
+    // frozen literal without reading why the cell went red.
+    HARDLINE_PATTERNS: Object.freeze(HARDLINE_PATTERNS.map(([pattern]) => String(pattern))),
+    // The exfiltration arms.
+    PIPELINE_SPLIT_RE: String(PIPELINE_SPLIT_RE),
+    NETWORK_SINK_RE: String(NETWORK_SINK_RE),
+    RSYNC_REMOTE_TARGET,
+    RSYNC_REMOTE_SINK_RE: String(RSYNC_REMOTE_SINK_RE),
+    TOKEN_END,
+    NOT_PUBLIC_KEY,
+    DOTENV_RE: String(DOTENV_RE),
+    DOTENV_AS_OUTPUT_TARGET: String(DOTENV_AS_OUTPUT_TARGET),
+    CREDENTIAL_SOURCE_PATTERNS: Object.freeze(CREDENTIAL_SOURCE_PATTERNS.map((pattern) => String(pattern))),
+});
 /**
  * Whether one pipeline both reads credential material and transmits data off the machine.
  * Exported for tests, which pin BOTH directions: the credential-upload shapes must match, and

package/dist/core/shell/hardline.js.map

@@ -1 +1 @@
-{"version":3,"file":"hardline.js","sourceRoot":"","sources":["../../../src/core/shell/hardline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEzF;;;GAGG;AACH,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,YAAY,GAAsB;IACtC,6FAA6F;IAC7F,sEAAsE;IACtE,iGAAiG;IACjG,yBAAyB;IACzB,mEAAmE;IACnE,6FAA6F;IAC7F,6FAA6F;IAC7F,oBAAoB;IACpB,0FAA0F;IAC1F,gGAAgG;IAChG,kDAAkD;IAClD,4DAA4D;IAC5D,aAAa,aAAa,EAAE;IAC5B,gGAAgG;IAChG,iGAAiG;IACjG,2FAA2F;IAC3F,4DAA4D,aAAa,EAAE;CAC5E,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,MAAM,OAAO,GACX,SAAS,uBAAuB,aAAa;IAC7C,MAAM;IACN,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;IAChC,MAAM,CAAC;AAET;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,gBAAgB,GAAG,eAAe,uBAAuB,IAAI,CAAC;AAEpE;;;;;;;;;;;;GAYG;AACH,MAAM,YAAY,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,OAAO,IAAI,MAAM,IAAI,KAAK,IAAI,IAAI,gBAAgB,EAAE,CAAC;AAEpG;;;;;;;;kGAQkG;AAElG;;;;GAIG;AACH,MAAM,WAAW,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAG,YAAY,CACpC,+EAA+E,CAChF,CAAC;AAEF;;;;;;;kGAOkG;AAElG;;;;;;GAMG;AACH,MAAM,OAAO,GAAG,eAAe,CAAC;AAEhC;;;;;;;;;;;;;GAaG;AACH,MAAM,kBAAkB,GAAG,SAAS,uBAAuB,EAAE,CAAC;AAE9D,wDAAwD;AACxD,MAAM,YAAY,GAAG,KAAK,kBAAkB,GAAG,CAAC;AAEhD,oEAAoE;AACpE,MAAM,cAAc,GAAG,KAAK,kBAAkB,IAAI,CAAC;AAEnD;;;;GAIG;AACH,MAAM,cAAc,GAAG,wBAAwB,YAAY,KAAK,YAAY,IAAI,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,OAAO,YAAY,KAAK,cAAc,IAAI,CAAC;AAEvE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,GACd,OAAO;IACP,OAAO;IACP,OAAO;IACP,MAAM,mBAAmB,GAAG,OAAO,IAAI;IACvC,cAAc;IACd,OAAO;IACP,MAAM,mBAAmB,GAAG,OAAO,IAAI,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA6C;IACzE,iGAAiG;IACjG,yFAAyF;IACzF;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,yBAAyB,GAAG,WAAW,CAAC;QAC7D,qCAAqC;KACtC;IACD,2EAA2E;IAC3E;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,yBAAyB,GAAG,iBAAiB,CAAC;QACnE,sCAAsC;KACvC;IACD,oDAAoD;IACpD,4EAA4E;IAC5E;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,+CAA+C,GAAG,gBAAgB,CAAC;QACxF,oCAAoC;KACrC;IACD,6FAA6F;IAC7F,6FAA6F;IAC7F,4BAA4B;IAC5B,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IAC9E,mGAAmG;IACnG;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,8DAA8D,CAAC;QACpF,wBAAwB;KACzB;IACD,0DAA0D;IAC1D,CAAC,oDAAoD,EAAE,8BAA8B,CAAC;IACtF,qCAAqC;IACrC,CAAC,gDAAgD,EAAE,WAAW,CAAC;IAC/D,qEAAqE;IACrE,EAAE;IACF,6FAA6F;IAC7F,6FAA6F;IAC7F,yFAAyF;IACzF,uCAAuC;IACvC,EAAE;IACF,mGAAmG;IACnG,oCAAoC;IACpC,EAAE;IACF,wFAAwF;IACxF,gGAAgG;IAChG,6CAA6C;IAC7C;QACE,IAAI,MAAM,CACR,OAAO;YACL,4BAA4B;YAC5B,cAAc;YACd,qCAAqC;YACrC,WAAW,CACd;QACD,oCAAoC;KACrC;IACD;QACE,IAAI,MAAM,CACR,OAAO;YACL,4BAA4B;YAC5B,cAAc;YACd,qCAAqC;YACrC,iBAAiB,CACpB;QACD,qCAAqC;KACtC;IACD,6FAA6F;IAC7F,+FAA+F;IAC/F,+FAA+F;IAC/F,gGAAgG;IAChG,uBAAuB;IACvB,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,WAAW,CAAC,EAAE,oCAAoC,CAAC;IAC5E,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,iBAAiB,CAAC,EAAE,qCAAqC,CAAC;IACnF,iEAAiE;IACjE,EAAE;IACF,iGAAiG;IACjG,4FAA4F;IAC5F,qFAAqF;IACrF,iGAAiG;IACjG,uFAAuF;IACvF,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,gCAAgC,CAAC,EAAE,oBAAoB,CAAC;IAC9E,6EAA6E;IAC7E,yCAAyC;IACzC,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,sCAAsC,CAAC,EAAE,wBAAwB,CAAC;IACxF,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,iBAAiB,CAAC,EAAE,4BAA4B,CAAC;IACvE;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,gDAAgD,CAAC;QACtE,2BAA2B;KAC5B;IACD,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,oBAAoB,CAAC,EAAE,+BAA+B,CAAC;CAC9E,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kGA6DkG;AAElG;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAErC;;;;;;;;;;GAUG;AACH,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,OAAO;IACL,+FAA+F,CAClG,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,oBAAoB,GAAG,IAAI,MAAM,CAAC,OAAO,GAAG,kBAAkB,GAAG,mBAAmB,CAAC,CAAC;AAE5F;;;;GAIG;AACH,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC;;;;GAIG;AACH,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAE9C,iGAAiG;AACjG,MAAM,SAAS,GAAG,yCAAyC,CAAC;AAE5D;;;;GAIG;AACH,MAAM,uBAAuB,GAC3B,4EAA4E,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,0BAA0B,GAAsB;IACpD,4DAA4D;IAC5D,IAAI,MAAM,CAAC,YAAY,GAAG,cAAc,CAAC;IACzC,IAAI,MAAM,CAAC,oCAAoC,GAAG,cAAc,CAAC;IACjE,gFAAgF;IAChF,IAAI,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;IAChC,IAAI,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;IAChC,IAAI,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IAClC,IAAI,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IACjC,IAAI,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC;IACnC,IAAI,MAAM,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAC1C,gCAAgC;IAChC,sBAAsB;IACtB,WAAW;IACX,WAAW;IACX,0BAA0B;IAC1B,kBAAkB;IAClB,WAAW;IACX,oBAAoB;IACpB,0CAA0C;IAC1C,IAAI,MAAM,CAAC,OAAO,GAAG,+BAA+B,CAAC;CACtD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,sBAA8B;IACxE,KAAK,MAAM,QAAQ,IAAI,sBAAsB,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QACtF,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACtF,0EAA0E;QAC1E,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAwBD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAE7D;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,iBAAiB,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IACD,iGAAiG;IACjG,yFAAyF;IACzF,gCAAgC;IAChC,IAAI,2BAA2B,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,WAAW,EAAE,qCAAqC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,KAAoB;IACxE,OAAO,CACL,wBAAwB,OAAO,uCAAuC;QACtE,IAAI,KAAK,CAAC,WAAW,gEAAgE,CACtF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"hardline.js","sourceRoot":"","sources":["../../../src/core/shell/hardline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AACH,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEzF;;;GAGG;AACH,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,YAAY,GAAsB;IACtC,6FAA6F;IAC7F,sEAAsE;IACtE,iGAAiG;IACjG,yBAAyB;IACzB,mEAAmE;IACnE,6FAA6F;IAC7F,6FAA6F;IAC7F,oBAAoB;IACpB,0FAA0F;IAC1F,gGAAgG;IAChG,kDAAkD;IAClD,4DAA4D;IAC5D,aAAa,aAAa,EAAE;IAC5B,gGAAgG;IAChG,iGAAiG;IACjG,2FAA2F;IAC3F,4DAA4D,aAAa,EAAE;CAC5E,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,MAAM,OAAO,GACX,SAAS,uBAAuB,aAAa;IAC7C,MAAM;IACN,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;IAChC,MAAM,CAAC;AAET;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,gBAAgB,GAAG,eAAe,uBAAuB,IAAI,CAAC;AAEpE;;;;;;;;;;;;GAYG;AACH,MAAM,YAAY,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,OAAO,IAAI,MAAM,IAAI,KAAK,IAAI,IAAI,gBAAgB,EAAE,CAAC;AAEpG;;;;;;;;kGAQkG;AAElG;;;;GAIG;AACH,MAAM,WAAW,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAG,YAAY,CACpC,+EAA+E,CAChF,CAAC;AAEF;;;;;;;kGAOkG;AAElG;;;;;;GAMG;AACH,MAAM,OAAO,GAAG,eAAe,CAAC;AAEhC;;;;;;;;;;;;;GAaG;AACH,MAAM,kBAAkB,GAAG,SAAS,uBAAuB,EAAE,CAAC;AAE9D,wDAAwD;AACxD,MAAM,YAAY,GAAG,KAAK,kBAAkB,GAAG,CAAC;AAEhD,oEAAoE;AACpE,MAAM,cAAc,GAAG,KAAK,kBAAkB,IAAI,CAAC;AAEnD;;;;GAIG;AACH,MAAM,cAAc,GAAG,wBAAwB,YAAY,KAAK,YAAY,IAAI,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,OAAO,YAAY,KAAK,cAAc,IAAI,CAAC;AAEvE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,GACd,OAAO;IACP,OAAO;IACP,OAAO;IACP,MAAM,mBAAmB,GAAG,OAAO,IAAI;IACvC,cAAc;IACd,OAAO;IACP,MAAM,mBAAmB,GAAG,OAAO,IAAI,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA6C;IACzE,iGAAiG;IACjG,yFAAyF;IACzF;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,yBAAyB,GAAG,WAAW,CAAC;QAC7D,qCAAqC;KACtC;IACD,2EAA2E;IAC3E;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,yBAAyB,GAAG,iBAAiB,CAAC;QACnE,sCAAsC;KACvC;IACD,oDAAoD;IACpD,4EAA4E;IAC5E;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,+CAA+C,GAAG,gBAAgB,CAAC;QACxF,oCAAoC;KACrC;IACD,6FAA6F;IAC7F,6FAA6F;IAC7F,4BAA4B;IAC5B,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IAC9E,mGAAmG;IACnG;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,8DAA8D,CAAC;QACpF,wBAAwB;KACzB;IACD,0DAA0D;IAC1D,CAAC,oDAAoD,EAAE,8BAA8B,CAAC;IACtF,qCAAqC;IACrC,CAAC,gDAAgD,EAAE,WAAW,CAAC;IAC/D,qEAAqE;IACrE,EAAE;IACF,6FAA6F;IAC7F,6FAA6F;IAC7F,yFAAyF;IACzF,uCAAuC;IACvC,EAAE;IACF,mGAAmG;IACnG,oCAAoC;IACpC,EAAE;IACF,wFAAwF;IACxF,gGAAgG;IAChG,6CAA6C;IAC7C;QACE,IAAI,MAAM,CACR,OAAO;YACL,4BAA4B;YAC5B,cAAc;YACd,qCAAqC;YACrC,WAAW,CACd;QACD,oCAAoC;KACrC;IACD;QACE,IAAI,MAAM,CACR,OAAO;YACL,4BAA4B;YAC5B,cAAc;YACd,qCAAqC;YACrC,iBAAiB,CACpB;QACD,qCAAqC;KACtC;IACD,6FAA6F;IAC7F,+FAA+F;IAC/F,+FAA+F;IAC/F,gGAAgG;IAChG,uBAAuB;IACvB,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,WAAW,CAAC,EAAE,oCAAoC,CAAC;IAC5E,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,iBAAiB,CAAC,EAAE,qCAAqC,CAAC;IACnF,iEAAiE;IACjE,EAAE;IACF,iGAAiG;IACjG,4FAA4F;IAC5F,qFAAqF;IACrF,iGAAiG;IACjG,uFAAuF;IACvF,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,gCAAgC,CAAC,EAAE,oBAAoB,CAAC;IAC9E,6EAA6E;IAC7E,yCAAyC;IACzC,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,sCAAsC,CAAC,EAAE,wBAAwB,CAAC;IACxF,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,iBAAiB,CAAC,EAAE,4BAA4B,CAAC;IACvE;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,gDAAgD,CAAC;QACtE,2BAA2B;KAC5B;IACD,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,oBAAoB,CAAC,EAAE,+BAA+B,CAAC;CAC9E,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kGA6DkG;AAElG;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAErC;;;;;;;;;;GAUG;AACH,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,OAAO;IACL,+FAA+F,CAClG,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,oBAAoB,GAAG,IAAI,MAAM,CAAC,OAAO,GAAG,kBAAkB,GAAG,mBAAmB,CAAC,CAAC;AAE5F;;;;GAIG;AACH,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC;;;;GAIG;AACH,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAE9C,iGAAiG;AACjG,MAAM,SAAS,GAAG,yCAAyC,CAAC;AAE5D;;;;GAIG;AACH,MAAM,uBAAuB,GAC3B,4EAA4E,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,0BAA0B,GAAsB;IACpD,4DAA4D;IAC5D,IAAI,MAAM,CAAC,YAAY,GAAG,cAAc,CAAC;IACzC,IAAI,MAAM,CAAC,oCAAoC,GAAG,cAAc,CAAC;IACjE,gFAAgF;IAChF,IAAI,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;IAChC,IAAI,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;IAChC,IAAI,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IAClC,IAAI,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IACjC,IAAI,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC;IACnC,IAAI,MAAM,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAC1C,gCAAgC;IAChC,sBAAsB;IACtB,WAAW;IACX,WAAW;IACX,0BAA0B;IAC1B,kBAAkB;IAClB,WAAW;IACX,oBAAoB;IACpB,0CAA0C;IAC1C,IAAI,MAAM,CAAC,OAAO,GAAG,+BAA+B,CAAC;CACtD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,MAAM,CAAC,MAAM,CAAC;IACZ,uBAAuB;IACvB,uBAAuB;IACvB,aAAa;IACb,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC;IAC9C,OAAO;IACP,gBAAgB;IAChB,OAAO;IACP,kBAAkB;IAClB,YAAY;IACZ,cAAc;IACd,0DAA0D;IAC1D,WAAW;IACX,iBAAiB;IACjB,cAAc;IACd,mBAAmB;IACnB,UAAU;IACV,6FAA6F;IAC7F,6FAA6F;IAC7F,wDAAwD;IACxD,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACvF,yBAAyB;IACzB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,CAAC;IAC5C,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC;IACxC,mBAAmB;IACnB,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAClD,SAAS;IACT,cAAc;IACd,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IACxD,0BAA0B,EAAE,MAAM,CAAC,MAAM,CACvC,0BAA0B,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAC7D;CACF,CAAC,CAAC;AAEL;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,sBAA8B;IACxE,KAAK,MAAM,QAAQ,IAAI,sBAAsB,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QACtF,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACtF,0EAA0E;QAC1E,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAwBD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAE7D;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,iBAAiB,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IACD,iGAAiG;IACjG,yFAAyF;IACzF,gCAAgC;IAChC,IAAI,2BAA2B,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,WAAW,EAAE,qCAAqC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,KAAoB;IACxE,OAAO,CACL,wBAAwB,OAAO,uCAAuC;QACtE,IAAI,KAAK,CAAC,WAAW,gEAAgE,CACtF,CAAC;AACJ,CAAC"}

package/dist/core/shell/negotiation.d.ts

@@ -137,13 +137,22 @@ export declare class ShellNegotiationState {
      * **The round is appended BEFORE either bound is tested**, so the rating that escalates is itself
      * on the transcript the human sees. §5.6's escalation example turns on this: what matters on the
      * screen is that the agent proposed the same command three times, and the third proposal is the
-     * one being escalated.
+     * one being escalated. {@link renderNegotiationRows} marks that last round as the pending request
+     * rather than as a prior one, which is the half of this the reader needs and cannot derive.
      */
     recordRejection(round: RaterNegotiationRound): NegotiationVerdict;
     /**
      * §5.3 — a tool call the gate let through. Resets the consecutive counter **and clears the
      * transcript with it**; the reachability bound is deliberately untouched.
      *
+     * **What it must NOT truncate is the human's record of how hard the agent pushed.** The counter's
+     * reset is §5.3's and is sound; the reader at an escalation is asking a different question, and
+     * the answer to theirs is {@link NegotiationCounters.rejectionsSinceHuman}, which this leaves
+     * standing. {@link renderNegotiationRows} reports that count rather than the surviving rounds, so
+     * an argument this erased is still declared even though its rounds are gone; every erased round
+     * itself survives whole in [[TUI-C27]]'s archive, which captures per RATING CALL and so is not
+     * truncated by anything here.
+     *
      * **"Approved" is what the gate can observe, and it is not quite §5.3's "successful".** The
      * decision site sees whether a call was allowed to run, never whether it then exited zero — and
      * the honest alternatives were worse: a tool-result stream carries the *rejected* call's own
@@ -190,6 +199,10 @@ export declare class ShellNegotiationState {
      * was rejected"* and *"the call was the third consecutive rejection, so the next one goes to a
      * person"* are different facts, and a bug report carrying only the first invites the wrong
      * conclusion about why a session started interrupting.
+     *
+     * **`rejectionsSinceHuman` is also what the escalation prompt COUNTS**, and that is the one place
+     * it faces a person rather than a debugging archive. It is read at the escalation site before
+     * {@link humanReached} spends it; reading it after would report zero.
      */
     counters(): NegotiationCounters;
     /** Drop everything, including the user messages — the TUI's `/clear` rotates the thread. */
@@ -211,6 +224,31 @@ export interface NegotiationRow {
     voice: NegotiationVoice;
     text: string;
 }
+/**
+ * Terminal rows one element of a round — the command, the justification, the rater's answer — may
+ * occupy on a screen before the rest of it is elided.
+ *
+ * **MEASURED, and it is the height bound this block needs rather than a cap on rounds.** At 80
+ * columns three rounds of paragraph-length argument cost 37 rows, of which one round was 12; the
+ * whole prompt was 64 rows against a 20-row budget, so the human saw the command and the verdict
+ * and neither the later rounds nor the menu line. A cap on the NUMBER of rounds would have changed
+ * none of that — §5.3 already bounds the transcript at
+ * {@link MAX_CONSECUTIVE_REJECTIONS} — because the cost is per row, not per round. Bounding each
+ * element keeps every round structurally on the screen, which is what §5.6 calls the most important
+ * thing on it, and pays for it out of the tail of a paragraph the reader was never going to need in
+ * full: the archive keeps every round whole ([[TUI-C27]]'s capture is per rating call).
+ *
+ * Two rather than one so a wrapped command keeps the continuation that shows how it differs from
+ * the round above it — the comparison the block exists to make.
+ */
+export declare const NEGOTIATION_MAX_ROWS_PER_ELEMENT = 2;
+/**
+ * Rounds a screen shows, newest last. A backstop rather than today's binding constraint: §5.3
+ * escalates at {@link MAX_CONSECUTIVE_REJECTIONS}, so a transcript reaching a human is never longer
+ * than this — and an unscrollable prompt must not acquire an unbounded section the moment that
+ * number is raised. What is dropped is said out loud in the heading, which carries the true count.
+ */
+export declare const NEGOTIATION_MAX_ROUNDS_SHOWN = 3;
 /**
  * §6/§5.4 — render a negotiation for the human being asked to rule on it, one terminal row per
  * element, each tagged with the voice speaking it.
@@ -233,9 +271,46 @@ export interface NegotiationRow {
  * A wrapped row keeps the voice of the row it continues. A continuation painted as chrome would put
  * the rater's words in the agent's colour at exactly the width where a long argument is hardest to
  * read, which is the confusion §5.4 exists to remove.
+ *
+ * ## The three things this block must not get wrong about its own exchange
+ *
+ * Every label here sits over data that is already correct, so a label that lies does so silently —
+ * and each of these lied toward approving, at the moment a human was deciding whether to overrule
+ * a refusal.
+ *
+ * - **`attempts` is the count, and it is not `rounds.length`.** §5.3 clears the transcript on an
+ *   approved call, so the rounds handed over are the attempts since the last *approval*, while the
+ *   fact the reader is weighing is how hard the agent pushed since the last *human* — the caller's
+ *   `rejectionsSinceHuman`. A measured escalation attempted the same command five times and
+ *   rendered three. Omit it and this falls back to `rounds.length`, which is the honest reading of
+ *   a caller that has no better number rather than a claim that none were erased.
+ * - **The last round IS the pending rating, not a prior one.** {@link
+ *   ShellNegotiationState.recordRejection} appends before either bound is tested, deliberately, so
+ *   that the rating being escalated is on the transcript the human sees. The old heading called
+ *   them all prior rounds, which both under-reported the argument and put the pending command on
+ *   the screen twice with nothing saying they were the same call.
+ * - **The first round was rated on the command alone.** A cleared transcript IS the round-1 case
+ *   (see {@link ShellNegotiationState.contextFor}), so §5.1 withheld the justification and the user
+ *   messages from that rating — while {@link ShellNegotiationState.recordRejection} stores the
+ *   justification the agent supplied whatever the round. Printed unmarked, the round reads as a
+ *   rater brushing past a direct answer to its own objection, which is the opposite of what
+ *   happened and makes the rater look stubborn exactly where the reader is deciding whether to
+ *   overrule it. The withholding is correct and is not what this marks. The same marker answers
+ *   *"were the user's own words in view when this was rated?"* — a justification claiming the user
+ *   asked for a command is exactly what a round-1 rating cannot check, and the user's messages are
+ *   several rows on a surface with none to spare.
+ *
+ * **The prompt this feeds does not scroll and nothing else on it can give up rows**, so the height
+ * bound is {@link NEGOTIATION_MAX_ROWS_PER_ELEMENT} and every fact above is carried by a row that
+ * already exists.
  */
 export declare function renderNegotiationRows(rounds: readonly RaterNegotiationRound[], options?: {
     width?: number;
+    /**
+     * Rejected attempts since a human was last involved — `rejectionsSinceHuman` from {@link
+     * ShellNegotiationState.counters}, read BEFORE the escalation spends it.
+     */
+    attempts?: number;
 }): NegotiationRow[];
 /**
  * The same transcript as one string, for a consumer with no screen to lay it out on: §6.2's
@@ -245,5 +320,9 @@ export declare function renderNegotiationRows(rounds: readonly RaterNegotiationR
  * Defined as {@link renderNegotiationRows} joined, so the string and the rows can never come to
  * describe one exchange two ways — the whole reason there is one renderer and two surfaces.
  * `null` when there is nothing to show.
+ *
+ * `attempts` carries the same fact it carries on a screen. It is the one thing a caller must pass
+ * for this message to be true, because the count it defaults to is the one an approved call
+ * truncated.
  */
-export declare function renderNegotiationTranscript(rounds: readonly RaterNegotiationRound[]): string | null;
+export declare function renderNegotiationTranscript(rounds: readonly RaterNegotiationRound[], attempts?: number): string | null;