@gaunt-sloth/core 2.0.0-alpha.8 → 2.0.0-beta.0

package/dist/config/shell-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"shell-policy.js","sourceRoot":"","sources":["../../src/config/shell-policy.ts"],"names":[],"mappings":"AAkIA;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,OAAO,CAAC;AAEtD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAuC,EACvC,OAAgC;IAEhC,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,CAAC;IAC9B,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;IACtE,gFAAgF;IAChF,OAAO,OAAO,KAAK,MAAM,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAuC;IACvE,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,CAAC;IAC9B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5E,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IAChF,CAAC;IACD,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAuC;IAC5E,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,CAAC;IAC9B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QACnF,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YACtE,OAAO,KAAK,CAAC,cAAc,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,8BAA8B,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAuC;IAC7E,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,CAAC;IAC9B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAClF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAuC;IAC/E,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,CAAC;IAC9B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACzF,OAAO,IAAI,CAAC;AACd,CAAC;AAgBD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAuC;IACzE,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,CAAC;IAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;IACtE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAuC;IAC3E,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,CAAC;IAC9B,MAAM,KAAK,GACT,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAClF,CAAC,CAAC,KAAK,CAAC,KAAK;QACb,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,OAAO;QACP,cAAc,EAAE,KAAK,EAAE,cAAc,IAAI,IAAI;QAC7C,SAAS,EAAE,KAAK,EAAE,SAAS,IAAI,KAAK;QACpC,KAAK,EAAE,KAAK,EAAE,KAAK;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAgE,EAChE,OAA+B;IAE/B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC;IACnE,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC;IAC/D,IAAI,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC;IACpD,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC;IAC/D,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"shell-policy.js","sourceRoot":"","sources":["../../src/config/shell-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAmB,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAgF9E;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,WAAW;IACX,UAAU;IACV,WAAW;IACX,iBAAiB;CACT,CAAC;AAEX,kDAAkD;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB,CAAC,GAAG,sBAAsB,EAAE,eAAe,CAAC,CAAC;AAE9F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAsB;IACvE,GAAG,cAAc;IACjB,sBAAsB;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAKrD;;;;;;GAMG;AACH,SAAS,6BAA6B,CACpC,MAAgE,EAChE,OAA0B;IAE1B,MAAM,SAAS,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,qBAAqB,CAAC,SAAS,EAAE,YAAY,IAAI,MAAM,EAAE,YAAY,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAgE,EAChE,OAA0B;IAE1B,MAAM,QAAQ,GAAG,6BAA6B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,yBAAyB,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAgE,EAChE,OAA0B;IAE1B,MAAM,KAAK,GAAG,6BAA6B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,sBAAsB,CAAC,CAAC;IACrF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7E,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAC,QAAQ,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,8BAA8B,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,YAA6C;IAE7C,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,GAAgD,EAAE,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,YAAY;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAClD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAA8C;IACtF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC;AACjC,CAAC;AAgFD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,OAAO,CAAC;AAEtD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAuC,EACvC,OAAgC;IAEhC,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,CAAC;IAC9B,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,+FAA+F;IAC/F,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,MAAM,CAAC;IACnF,gFAAgF;IAChF,OAAO,OAAO,KAAK,MAAM,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAuC;IACvE,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,CAAC;IAC9B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5E,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IAChF,CAAC;IACD,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAuC;IAC5E,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,CAAC;IAC9B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QACnF,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YACtE,OAAO,KAAK,CAAC,cAAc,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,8BAA8B,CAAC;AACxC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,0BAA0B,CACjC,QAAqD;IAErD,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,KAAK,MAAM,IAAI,IAAI,sBAAsB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;YACrB,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;QACxC,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;QACzB,CAAC;aAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9C,QAAQ,CAAC,KAAK,GAAG;gBACf,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAiF,EACjF,OAA+B;IAE/B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC;IACnE,MAAM,SAAS,GACb,OAAO,KAAK,MAAM;QAChB,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI;QACvB,CAAC,CAAC,QAAQ;YACR,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG;YACtB,CAAC,CAAC,OAAO,KAAK,MAAM;gBAClB,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI;gBACvB,CAAC,CAAC,SAAS,CAAC;IACpB,8EAA8E;IAC9E,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,SAAS,GAAG,SAAS,EAAE,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;IACjE,OAAO,0BAA0B,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;kGAEkG;AAElG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAU,CAAC;AAKzF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAiC;IAChE,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,QAAQ;IACR,UAAU;IACV,MAAM;IACN,QAAQ;CACkC,CAAC;AAE7C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,6FAA6F;IAC7F,+BAA+B,CAAC;AAElC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAiC;IACtE,MAAM,EACJ,6FAA6F;QAC7F,0FAA0F;QAC1F,+FAA+F;QAC/F,kBAAkB;IACpB,KAAK,EACH,2FAA2F;QAC3F,+FAA+F;QAC/F,8FAA8F;QAC9F,UAAU;IACZ,QAAQ,EACN,6FAA6F;QAC7F,8FAA8F;QAC9F,2FAA2F;QAC3F,+DAA+D;IACjE,IAAI,EACF,6FAA6F;QAC7F,6FAA6F;QAC7F,6FAA6F;QAC7F,0BAA0B;IAC5B,MAAM,EACJ,+FAA+F;QAC/F,2FAA2F;QAC3F,wBAAwB;CAC3B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,yGAAyG,CAAC;AAE5G;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsB;IAC/D,kDAAkD;IAClD,4BAA4B;CAC7B,CAAC;AAEF,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5F,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CAAC,IAAkB;IAC5C,OAAO,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,MAAM,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IAClD,OAAO,IAAI,KAAK,MAAM,CAAC;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAkB;IACpD,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAIjC;IACC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAC9C,IAAI,SAAS,IAAI,QAAQ,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,CAAC,0BAA0B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAIrC;IACC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IACpD,OAAO,gBAAgB,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CAC1D,iBAAiB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CACvD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,yBAAyB,GAAgC;IAC7D,GAAG,EAAE,IAAI;IACT,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,IAAI;IACV,EAAE,EAAE,IAAI;IACR,MAAM,EAAE,IAAI;IACZ,uEAAuE;IACvE,GAAG,EAAE,KAAK;CACX,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAA+B;IACrE,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAGzC;IACC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAC9C,OAAO,gBAAgB,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CAC1D,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CACtF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CACvB,SAAkB,EAClB,cAAiC,EACjC,OAAkC;IAElC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAQ,EAAE;QACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC5E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,IAAI,SAAS;QAAE,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAcD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,cAAc;IACd,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;CACP,CAAC;AA+QX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAiB,UAAU,CAAC;AAE9D,gGAAgG;AAChG,SAAS,iBAAiB,CAAC,GAAgC;IACzD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAClD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAA6D,EAC7D,OAA+B;IAE/B,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,iBAAiB,CAClC,OAAO;QACL,CAAC,CAAE,MAAM,EAAE,QAAwE,EAAE,CAAC,OAAO,CAAC;YAC1F,EAAE,SAAS;QACf,CAAC,CAAC,SAAS,CACd,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,qBAAqB;QAC7D,KAAK,EAAE,UAAU,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK;QACvC,2FAA2F;QAC3F,6EAA6E;QAC7E,KAAK,EAAE,UAAU,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE;QAC7C,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1D,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;QACtE,cAAc,EAAE,UAAU,EAAE,cAAc,IAAI,IAAI,EAAE,cAAc;QAClE,2FAA2F;QAC3F,gGAAgG;QAChG,GAAG,EAAE,UAAU,EAAE,GAAG,IAAI,IAAI,EAAE,GAAG;KAClC,CAAC;AACJ,CAAC;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAA+F,EAC/F,OAA+B;IAE/B,MAAM,QAAQ,GAAG,0BAA0B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAErC,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,SAAS;YACT,MAAM,EAAE;gBACN,KAAK,EAAE,WAAW,CAAC,OAAO;gBAC1B,OAAO,EACL,iFAAiF;oBACjF,uFAAuF;oBACvF,sBAAsB;aACzB;SACF,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,2FAA2F;QAC3F,2FAA2F;QAC3F,0FAA0F;QAC1F,8FAA8F;QAC9F,8FAA8F;QAC9F,8FAA8F;QAC9F,sFAAsF;QACtF,OAAO;YACL,SAAS;YACT,MAAM,EAAE;gBACN,KAAK,EAAE,WAAW,CAAC,IAAI;gBACvB,OAAO,EACL,sEAAsE,IAAI,KAAK;oBAC/E,sEAAsE;aACzE;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS;QACT,MAAM,EAAE;YACN,KAAK,EAAE,WAAW,CAAC,IAAI;YACvB,OAAO,EAAE,gFAAgF,IAAI,IAAI;SAClG;KACF,CAAC;AACJ,CAAC"}

package/dist/config/tool-descriptions.d.ts

@@ -0,0 +1,211 @@
+/**
+ * @packageDocumentation
+ * EXT-58 — **rung-aware tool descriptions** (`docs/gaunt-sloth-2.0/approvals-and-rater-spec.md`
+ * §4.5) and the table of built-in tools the rater may offer as a granted alternative (§4.4).
+ *
+ * §4.5 is the *prevention* half of the approvals design. Shell commands are gated; built-in tools
+ * at or below the current rung are not, so a model that reaches for the shell to do something a
+ * granted built-in already does converts a free action into an interruption. A model chooses a
+ * tool by reading that tool's description, so the approvals posture is stated **there** — not as a
+ * global preference in the system prompt, which sits far from the decision and can drift out of
+ * step with the gate.
+ *
+ * Two properties are load-bearing and are why this module exists at all:
+ *
+ * 1. **A tool that is auto-approved gets NO suffix.** The absence of the sentence is what marks it
+ *    free. Appending "this tool is already approved" would be the opposite of the design.
+ * 2. **The suffix is derived from the rung in force AND from the set of tools that rung actually
+ *    gates.** "A description that disagrees with what the gate will actually do is worse than no
+ *    description at all" (§4.5), so {@link isGrantedAtRung} takes the LIVE gated set as a parameter
+ *    and both backends pass the SAME `resolveGatedToolNames` result. The two can therefore not
+ *    drift: widening what a rung gates ([[EXT-30]]) widens the descriptions in the same breath.
+ *    That set is narrower than the rung-independent one wired into the interrupt
+ *    (`resolveInterruptToolNames`), because a call the live rung does not gate is approved on
+ *    arrival and so is genuinely free.
+ *
+ * **Scope, per §4.3.** The *rater* covers the shell only: every other gated tool goes to the human
+ * without a rating call until [[EXT-30]] widens the rater. The *gate* is wider than the rater. At
+ * the two deterministic rungs (`manual`, `write`) both backends gate every bound tool the rung's
+ * access class does not auto-grant — the write built-ins, the shell, MCP tools (whatever their
+ * `readOnlyHint` says) and custom tools — so at those rungs a non-granted call always reaches the
+ * human. At `assisted`, `auto` and `bypass` the gated set is the shell alone.
+ *
+ * `config/shell-policy.ts`'s `isToolGatedAtRung` is the single rule for all of that, and both the
+ * live gated set and this module's grant are projections of it, so what a rung gates and the grant
+ * reported here cannot disagree.
+ */
+import type { ApprovalRung } from '#src/config/shell-policy.js';
+/**
+ * §4.5's table, **verbatim**. The wordings are normative copy the model reads; do not paraphrase,
+ * re-punctuate or "improve" them.
+ *
+ * - `manual` and `write` share one sentence: at both rungs a non-granted call goes to the human,
+ *   so the user's approval is a certainty, not a possibility.
+ * - `assisted` softens `will` to `MAY`: the rater approves what it rates safe, so only some calls
+ *   reach the user.
+ * - `auto` has its own sentence, and the difference it states is real: [[EXT-29]]'s negotiation
+ *   hands a call the rater will not clear back to the **model**, with the reason, so the first
+ *   consequence of an unsafe-looking call there is a refusal it can answer rather than a person
+ *   being asked — what changes is who answers first, and that is the one thing a model choosing a
+ *   tool can act on. A shared wording would hide it in the model's own tool-selection input.
+ *
+ *   Its `MAY` therefore sits **outside** the contrast the three bullets above draw: it qualifies
+ *   *"be refused by the auto-rater"*, not *"require the user's approval"*, so this sentence says
+ *   nothing either way about whether a person can be asked. That silence is deliberate — the
+ *   string is §4.5's row verbatim — and its cost is recorded here rather than left to be
+ *   discovered: `catastrophic` escalates to a human on the FIRST hit with no rounds at all, so a
+ *   person *can* be reached at `auto` and this input does not say so. Silent is not false, which
+ *   is why the wording stands and why the premise quoted above still holds; a wording claiming the
+ *   user is never asked would be false.
+ * - `bypass` appends nothing to anything: no gate, so no sentence could be true.
+ */
+export declare const RUNG_TOOL_DESCRIPTION_SUFFIXES: Readonly<Record<ApprovalRung, string | null>>;
+/**
+ * The access class of a built-in tool, in the sense §2 grants them: `read` = reading and listing
+ * files within the working folder; `write` = creating, editing, moving and deleting files within
+ * the working folder. A tool that does neither (the shell, a network fetch, an MCP call) has no
+ * class and is granted by no rung but `bypass`.
+ */
+export type BuiltInToolAccess = 'read' | 'write';
+/**
+ * Access class per built-in tool name. Keyed by NAME, not by owner, so it covers gsloth's own
+ * `GthFileSystemToolkit` and the conventional filesystem names (`ls`/`glob`/`grep`, and the
+ * `read_file`/`write_file`/`edit_file` the two conventions share) that a graph builder or an MCP
+ * server may register instead. One flat table serves them all.
+ *
+ * Deliberately absent: `run_shell_command`, the fixed dev-command tools,
+ * `gth_web_fetch`, `gth_checklist`, `gth_status_update`, `show_a2ui_surface`, MCP/custom/A2A tools.
+ * None of them is "reading or writing files in the working folder", so none is granted by a rung's
+ * access class, and at `manual`/`write` every one of them escalates to the human.
+ *
+ * **An MCP tool's own `readOnlyHint` earns it nothing here.** A server's self-declared annotation is
+ * least earned exactly where the ladder is strictest, so it must not skip the prompt at those two
+ * rungs; membership of this table is the only thing that does. Adding a name here grants it at a
+ * rung, so add one only for a tool that genuinely reads or writes files in the working folder.
+ */
+export declare const BUILT_IN_TOOL_ACCESS: Readonly<Record<string, BuiltInToolAccess>>;
+/** A built-in tool the rater may offer as an already-granted alternative (§4.4). */
+export interface GrantedToolSummary {
+    /** The registered tool name, exactly as the model sees it. */
+    name: string;
+    /** One line, authored here — locally-generated trusted text (§4.3), never a tool's own blurb. */
+    description: string;
+}
+/**
+ * §4.3/§4.4 — the one-line descriptions handed to the rater with the granted tools' names.
+ *
+ * **Authored here on purpose.** §4.3 admits this list as *"trusted, locally-generated text, not
+ * part of the fenced block"*, so it may not be assembled from tool `description` fields at large:
+ * an MCP server's tool description is attacker-influenceable text, and placing it outside the
+ * fenced block would open an injection channel straight past the rater's untrusted-input preamble.
+ * Only tools named in THIS table are ever offered, so an MCP, custom or A2A tool can never
+ * contribute text to the rater prompt.
+ *
+ * Restricted to tools that could plausibly stand in for a shell command — the file tools, content
+ * search, and the fixed dev-command tools (whose command is human-authored config, so suggesting
+ * `run_tests` over `npm test` is exactly the trade this section exists to make). `gth_checklist`,
+ * `gth_status_update` and `show_a2ui_surface` are omitted: they substitute for nothing a model
+ * would otherwise shell out for, and a suggestion list is only useful while it is short.
+ *
+ * **`gth_web_fetch` is deliberately NOT here**, though it is ungated at every rung. §4.5's
+ * justification for disclosing the posture at all is that the granted tools are "by construction,
+ * the constrained ones confined to the working folder" — a network fetch is not. Offering it would
+ * let a refused `curl`/`wget` come back as a suggestion whose §7 clause tells the model, verbatim,
+ * that the alternative "will not interrupt the user": a refused egress turned into a free one,
+ * through the rater rather than through the gate. An `attack` halts before any message reaches the
+ * model, but a merely `destructive` fetch would not. Same reasoning excludes MCP and custom tools,
+ * which additionally supply text we did not author.
+ */
+export declare const BUILT_IN_TOOL_SUMMARIES: Readonly<Record<string, string>>;
+/** The sentence §4.5 appends at this rung, or `null` when the rung appends nothing (`bypass`). */
+export declare function getRungToolDescriptionSuffix(rung: ApprovalRung): string | null;
+/**
+ * §2 — does `rung`'s own grant cover this tool's **access class**, i.e. is the tool free *on its
+ * class alone*, before anything is asked about whether the gate gates it?
+ *
+ * - `read` — granted at every rung (§2.1).
+ * - `write` — granted from `write` up (§2.2, and §2.3/§2.4 which grant "everything `write` grants"),
+ *   so it escalates at `manual`.
+ * - **no class at all** — the shell, a network call, an MCP tool, a custom or
+ *   agent-authored tool: granted by no rung. There is no implicit exemption; a tool is free here
+ *   only by appearing in {@link BUILT_IN_TOOL_ACCESS}.
+ *
+ * **This is the one implementation of that rule.** {@link isGrantedAtRung} decides a grant with it,
+ * and `config/shell-policy.ts`'s `isToolGatedAtRung` decides gated-set membership with it — which
+ * is in turn what the backends' interrupt set and `GthAgentRunner`'s own live-rung check are built
+ * from. So the gate cannot escalate a call the descriptions and the rater's granted list call free
+ * — the drift §4.5 names as worse than having no description at all. Two derivations of one rule is
+ * exactly what this function exists to prevent; do not inline it back into either caller.
+ *
+ * `bypass` is not special-cased: it grants everything for a reason unrelated to access class (the
+ * gate is off), which {@link isGrantedAtRung} states where that belongs.
+ */
+export declare function isAccessClassGrantedAtRung(toolName: string, rung: ApprovalRung): boolean;
+/**
+ * Is `toolName` auto-approved (granted, free, no prompt and no rating) at `rung`?
+ *
+ * @param toolName The registered tool name.
+ * @param rung The rung in force for the session.
+ * @param gatedTools The LIVE gated set — what `rung` actually gates, i.e.
+ *   `resolveGatedToolNames` for the rung in force. **This is the parameter that keeps the
+ *   descriptions honest**: a tool the rung does not gate cannot require approval, whatever a rung's
+ *   table row says about tool classes, so it is granted. It is deliberately NOT the wider,
+ *   rung-independent set the backends wire into `interruptOn` (`resolveInterruptToolNames`): a call
+ *   the live rung does not gate is auto-approved the moment it arrives at the runner, so describing
+ *   it as needing approval would be a promise nothing keeps.
+ *
+ * Order:
+ * 1. `bypass` grants everything (§2.5) — the gate is off.
+ * 2. A tool the live rung does not gate cannot require approval, so it is granted at every rung.
+ * 3. A gated tool is granted only where the rung's own grant covers its access class —
+ *    {@link isAccessClassGrantedAtRung}, the same rule `resolveGatedToolNames` selects the gated set
+ *    with. At the two deterministic rungs those two uses are complementary by construction: a tool
+ *    is gated there precisely when this returns false, so step 3 answers false for every tool step 2
+ *    let through, and the gate and the description say the same thing.
+ */
+export declare function isGrantedAtRung(toolName: string, rung: ApprovalRung, gatedTools: readonly string[]): boolean;
+/**
+ * Remove a previously-appended §4.5 suffix (any rung's), returning the tool's own description.
+ *
+ * Makes {@link applyRungAwareToolDescriptions} idempotent and re-appliable at a different rung —
+ * which matters because a resolver may hand back the SAME tool instance on a re-init (an MCP
+ * client caches its tool objects), and a second pass would otherwise stack sentences.
+ */
+export declare function stripRungToolDescriptionSuffix(description: string): string;
+/** The minimal shape {@link applyRungAwareToolDescriptions} needs; keeps this module langchain-free. */
+export interface DescribableTool {
+    name?: string;
+    description?: string;
+}
+/**
+ * §4.5 — at tool-registration time, append the rung's sentence to the description of every tool
+ * that is NOT auto-approved at that rung, and leave every granted tool's description untouched.
+ *
+ * Mutates in place (and returns the same array): the tools are about to be handed to
+ * `createAgent`/`createDeepAgent`, and the array is freshly resolved per init. Idempotent — any
+ * previously-appended suffix is stripped first, so re-registration at a different rung replaces
+ * the sentence rather than stacking one.
+ *
+ * A tool with no name is left alone (provider-native "magic object" tools carry no name and cannot
+ * be classified); a tool with an empty description gets the suffix as its whole description rather
+ * than a leading space.
+ */
+export declare function applyRungAwareToolDescriptions<T extends DescribableTool>(tools: T[], options: {
+    rung: ApprovalRung;
+    gatedTools: readonly string[];
+}): T[];
+/**
+ * §4.3/§4.4 — the names and one-line descriptions of the built-in tools already granted at `rung`,
+ * for the rater prompt.
+ *
+ * Filtered three ways, each of which matters:
+ * - to tools **actually registered** in this session (a suggestion naming a tool the model does not
+ *   have is worse than no suggestion);
+ * - to tools in {@link BUILT_IN_TOOL_SUMMARIES}, so only locally-authored text ever reaches the
+ *   rater prompt (never an MCP/custom tool's own description);
+ * - to tools **granted at the rung** — suggesting a tool that would itself need approval defeats
+ *   the point.
+ *
+ * Order follows the registration order so the prompt is stable across runs.
+ */
+export declare function describeGrantedBuiltInTools(registeredToolNames: readonly string[], rung: ApprovalRung, gatedTools: readonly string[]): GrantedToolSummary[];

package/dist/config/tool-descriptions.js

@@ -0,0 +1,272 @@
+/**
+ * §4.5's table, **verbatim**. The wordings are normative copy the model reads; do not paraphrase,
+ * re-punctuate or "improve" them.
+ *
+ * - `manual` and `write` share one sentence: at both rungs a non-granted call goes to the human,
+ *   so the user's approval is a certainty, not a possibility.
+ * - `assisted` softens `will` to `MAY`: the rater approves what it rates safe, so only some calls
+ *   reach the user.
+ * - `auto` has its own sentence, and the difference it states is real: [[EXT-29]]'s negotiation
+ *   hands a call the rater will not clear back to the **model**, with the reason, so the first
+ *   consequence of an unsafe-looking call there is a refusal it can answer rather than a person
+ *   being asked — what changes is who answers first, and that is the one thing a model choosing a
+ *   tool can act on. A shared wording would hide it in the model's own tool-selection input.
+ *
+ *   Its `MAY` therefore sits **outside** the contrast the three bullets above draw: it qualifies
+ *   *"be refused by the auto-rater"*, not *"require the user's approval"*, so this sentence says
+ *   nothing either way about whether a person can be asked. That silence is deliberate — the
+ *   string is §4.5's row verbatim — and its cost is recorded here rather than left to be
+ *   discovered: `catastrophic` escalates to a human on the FIRST hit with no rounds at all, so a
+ *   person *can* be reached at `auto` and this input does not say so. Silent is not false, which
+ *   is why the wording stands and why the premise quoted above still holds; a wording claiming the
+ *   user is never asked would be false.
+ * - `bypass` appends nothing to anything: no gate, so no sentence could be true.
+ */
+export const RUNG_TOOL_DESCRIPTION_SUFFIXES = {
+    manual: "Calling this tool will require the user's approval. Only use it when the result cannot be " +
+        'achieved with the other provided tools.',
+    write: "Calling this tool will require the user's approval. Only use it when the result cannot be " +
+        'achieved with the other provided tools.',
+    assisted: "Calling this tool MAY require the user's approval if it does not look safe. Only use it when " +
+        'it is impossible to achieve the result with the other provided tools.',
+    auto: 'Calling this tool MAY be refused by the auto-rater if it does not look safe. Only use it when ' +
+        'it is impossible to achieve the result with the other provided tools.',
+    bypass: null,
+};
+/** The distinct suffix strings, for {@link stripRungToolDescriptionSuffix}'s idempotency check. */
+const ALL_SUFFIXES = Array.from(new Set(Object.values(RUNG_TOOL_DESCRIPTION_SUFFIXES).filter((s) => s !== null)));
+/**
+ * Access class per built-in tool name. Keyed by NAME, not by owner, so it covers gsloth's own
+ * `GthFileSystemToolkit` and the conventional filesystem names (`ls`/`glob`/`grep`, and the
+ * `read_file`/`write_file`/`edit_file` the two conventions share) that a graph builder or an MCP
+ * server may register instead. One flat table serves them all.
+ *
+ * Deliberately absent: `run_shell_command`, the fixed dev-command tools,
+ * `gth_web_fetch`, `gth_checklist`, `gth_status_update`, `show_a2ui_surface`, MCP/custom/A2A tools.
+ * None of them is "reading or writing files in the working folder", so none is granted by a rung's
+ * access class, and at `manual`/`write` every one of them escalates to the human.
+ *
+ * **An MCP tool's own `readOnlyHint` earns it nothing here.** A server's self-declared annotation is
+ * least earned exactly where the ladder is strictest, so it must not skip the prompt at those two
+ * rungs; membership of this table is the only thing that does. Adding a name here grants it at a
+ * rung, so add one only for a tool that genuinely reads or writes files in the working folder.
+ */
+export const BUILT_IN_TOOL_ACCESS = {
+    // gsloth GthFileSystemToolkit (lean backend)
+    read_file: 'read',
+    read_multiple_files: 'read',
+    gth_read_binary: 'read',
+    list_directory: 'read',
+    list_directory_with_sizes: 'read',
+    directory_tree: 'read',
+    search_files: 'read',
+    get_file_info: 'read',
+    list_allowed_directories: 'read',
+    write_file: 'write',
+    edit_file: 'write',
+    create_directory: 'write',
+    move_file: 'write',
+    delete_file: 'write',
+    delete_directory: 'write',
+    // Conventional filesystem read names not already listed above
+    ls: 'read',
+    glob: 'read',
+    grep: 'read',
+    // gsloth built-ins that read file contents in the working folder
+    gth_grep: 'read',
+};
+/**
+ * §4.3/§4.4 — the one-line descriptions handed to the rater with the granted tools' names.
+ *
+ * **Authored here on purpose.** §4.3 admits this list as *"trusted, locally-generated text, not
+ * part of the fenced block"*, so it may not be assembled from tool `description` fields at large:
+ * an MCP server's tool description is attacker-influenceable text, and placing it outside the
+ * fenced block would open an injection channel straight past the rater's untrusted-input preamble.
+ * Only tools named in THIS table are ever offered, so an MCP, custom or A2A tool can never
+ * contribute text to the rater prompt.
+ *
+ * Restricted to tools that could plausibly stand in for a shell command — the file tools, content
+ * search, and the fixed dev-command tools (whose command is human-authored config, so suggesting
+ * `run_tests` over `npm test` is exactly the trade this section exists to make). `gth_checklist`,
+ * `gth_status_update` and `show_a2ui_surface` are omitted: they substitute for nothing a model
+ * would otherwise shell out for, and a suggestion list is only useful while it is short.
+ *
+ * **`gth_web_fetch` is deliberately NOT here**, though it is ungated at every rung. §4.5's
+ * justification for disclosing the posture at all is that the granted tools are "by construction,
+ * the constrained ones confined to the working folder" — a network fetch is not. Offering it would
+ * let a refused `curl`/`wget` come back as a suggestion whose §7 clause tells the model, verbatim,
+ * that the alternative "will not interrupt the user": a refused egress turned into a free one,
+ * through the rater rather than through the gate. An `attack` halts before any message reaches the
+ * model, but a merely `destructive` fetch would not. Same reasoning excludes MCP and custom tools,
+ * which additionally supply text we did not author.
+ */
+export const BUILT_IN_TOOL_SUMMARIES = {
+    read_file: 'Read one file in the working folder.',
+    read_multiple_files: 'Read several files in the working folder in one call.',
+    gth_read_binary: 'Read an image or other binary file in the working folder.',
+    list_directory: 'List the entries of a directory in the working folder.',
+    list_directory_with_sizes: 'List a directory in the working folder with entry sizes.',
+    directory_tree: 'Show a recursive tree of a directory in the working folder.',
+    search_files: 'Find files in the working folder by name pattern.',
+    get_file_info: 'Show size, timestamps and type of a file in the working folder.',
+    list_allowed_directories: 'List the directories the file tools are allowed to touch.',
+    write_file: 'Create or overwrite a file in the working folder.',
+    edit_file: 'Apply a targeted edit to a file in the working folder.',
+    create_directory: 'Create a directory in the working folder.',
+    move_file: 'Move or rename a file in the working folder.',
+    delete_file: 'Delete a file in the working folder.',
+    delete_directory: 'Delete a directory in the working folder.',
+    ls: 'List the entries of a directory in the working folder.',
+    glob: 'Find files in the working folder by glob pattern.',
+    grep: 'Search file contents in the working folder by regular expression.',
+    gth_grep: 'Search file contents in the working folder by regular expression.',
+    run_tests: "Run the project's configured test command.",
+    run_single_test: "Run one test file with the project's configured test command.",
+    run_lint: "Run the project's configured lint command.",
+    run_build: "Run the project's configured build command.",
+};
+/** The sentence §4.5 appends at this rung, or `null` when the rung appends nothing (`bypass`). */
+export function getRungToolDescriptionSuffix(rung) {
+    return RUNG_TOOL_DESCRIPTION_SUFFIXES[rung] ?? null;
+}
+/**
+ * §2 — does `rung`'s own grant cover this tool's **access class**, i.e. is the tool free *on its
+ * class alone*, before anything is asked about whether the gate gates it?
+ *
+ * - `read` — granted at every rung (§2.1).
+ * - `write` — granted from `write` up (§2.2, and §2.3/§2.4 which grant "everything `write` grants"),
+ *   so it escalates at `manual`.
+ * - **no class at all** — the shell, a network call, an MCP tool, a custom or
+ *   agent-authored tool: granted by no rung. There is no implicit exemption; a tool is free here
+ *   only by appearing in {@link BUILT_IN_TOOL_ACCESS}.
+ *
+ * **This is the one implementation of that rule.** {@link isGrantedAtRung} decides a grant with it,
+ * and `config/shell-policy.ts`'s `isToolGatedAtRung` decides gated-set membership with it — which
+ * is in turn what the backends' interrupt set and `GthAgentRunner`'s own live-rung check are built
+ * from. So the gate cannot escalate a call the descriptions and the rater's granted list call free
+ * — the drift §4.5 names as worse than having no description at all. Two derivations of one rule is
+ * exactly what this function exists to prevent; do not inline it back into either caller.
+ *
+ * `bypass` is not special-cased: it grants everything for a reason unrelated to access class (the
+ * gate is off), which {@link isGrantedAtRung} states where that belongs.
+ */
+export function isAccessClassGrantedAtRung(toolName, rung) {
+    const access = BUILT_IN_TOOL_ACCESS[toolName];
+    if (access === 'read')
+        return true;
+    if (access === 'write')
+        return rung !== 'manual';
+    return false;
+}
+/**
+ * Is `toolName` auto-approved (granted, free, no prompt and no rating) at `rung`?
+ *
+ * @param toolName The registered tool name.
+ * @param rung The rung in force for the session.
+ * @param gatedTools The LIVE gated set — what `rung` actually gates, i.e.
+ *   `resolveGatedToolNames` for the rung in force. **This is the parameter that keeps the
+ *   descriptions honest**: a tool the rung does not gate cannot require approval, whatever a rung's
+ *   table row says about tool classes, so it is granted. It is deliberately NOT the wider,
+ *   rung-independent set the backends wire into `interruptOn` (`resolveInterruptToolNames`): a call
+ *   the live rung does not gate is auto-approved the moment it arrives at the runner, so describing
+ *   it as needing approval would be a promise nothing keeps.
+ *
+ * Order:
+ * 1. `bypass` grants everything (§2.5) — the gate is off.
+ * 2. A tool the live rung does not gate cannot require approval, so it is granted at every rung.
+ * 3. A gated tool is granted only where the rung's own grant covers its access class —
+ *    {@link isAccessClassGrantedAtRung}, the same rule `resolveGatedToolNames` selects the gated set
+ *    with. At the two deterministic rungs those two uses are complementary by construction: a tool
+ *    is gated there precisely when this returns false, so step 3 answers false for every tool step 2
+ *    let through, and the gate and the description say the same thing.
+ */
+export function isGrantedAtRung(toolName, rung, gatedTools) {
+    if (rung === 'bypass')
+        return true;
+    if (!gatedTools.includes(toolName))
+        return true;
+    return isAccessClassGrantedAtRung(toolName, rung);
+}
+/**
+ * Remove a previously-appended §4.5 suffix (any rung's), returning the tool's own description.
+ *
+ * Makes {@link applyRungAwareToolDescriptions} idempotent and re-appliable at a different rung —
+ * which matters because a resolver may hand back the SAME tool instance on a re-init (an MCP
+ * client caches its tool objects), and a second pass would otherwise stack sentences.
+ */
+export function stripRungToolDescriptionSuffix(description) {
+    let result = description;
+    // Loop: a description that was appended to twice by an older build still ends up clean.
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const suffix of ALL_SUFFIXES) {
+            if (result.endsWith(suffix)) {
+                result = result.slice(0, -suffix.length).replace(/\s+$/, '');
+                changed = true;
+            }
+        }
+    }
+    return result;
+}
+/**
+ * §4.5 — at tool-registration time, append the rung's sentence to the description of every tool
+ * that is NOT auto-approved at that rung, and leave every granted tool's description untouched.
+ *
+ * Mutates in place (and returns the same array): the tools are about to be handed to
+ * `createAgent`/`createDeepAgent`, and the array is freshly resolved per init. Idempotent — any
+ * previously-appended suffix is stripped first, so re-registration at a different rung replaces
+ * the sentence rather than stacking one.
+ *
+ * A tool with no name is left alone (provider-native "magic object" tools carry no name and cannot
+ * be classified); a tool with an empty description gets the suffix as its whole description rather
+ * than a leading space.
+ */
+export function applyRungAwareToolDescriptions(tools, options) {
+    const suffix = getRungToolDescriptionSuffix(options.rung);
+    for (const tool of tools) {
+        if (!tool || typeof tool.name !== 'string' || tool.name.length === 0)
+            continue;
+        if (typeof tool.description !== 'string')
+            continue;
+        const base = stripRungToolDescriptionSuffix(tool.description);
+        // A granted tool carries NO sentence — its absence is what marks it free (§4.5).
+        if (suffix === null || isGrantedAtRung(tool.name, options.rung, options.gatedTools)) {
+            tool.description = base;
+            continue;
+        }
+        tool.description = base.length > 0 ? `${base} ${suffix}` : suffix;
+    }
+    return tools;
+}
+/**
+ * §4.3/§4.4 — the names and one-line descriptions of the built-in tools already granted at `rung`,
+ * for the rater prompt.
+ *
+ * Filtered three ways, each of which matters:
+ * - to tools **actually registered** in this session (a suggestion naming a tool the model does not
+ *   have is worse than no suggestion);
+ * - to tools in {@link BUILT_IN_TOOL_SUMMARIES}, so only locally-authored text ever reaches the
+ *   rater prompt (never an MCP/custom tool's own description);
+ * - to tools **granted at the rung** — suggesting a tool that would itself need approval defeats
+ *   the point.
+ *
+ * Order follows the registration order so the prompt is stable across runs.
+ */
+export function describeGrantedBuiltInTools(registeredToolNames, rung, gatedTools) {
+    const seen = new Set();
+    const summaries = [];
+    for (const name of registeredToolNames) {
+        if (seen.has(name))
+            continue;
+        seen.add(name);
+        const description = BUILT_IN_TOOL_SUMMARIES[name];
+        if (!description)
+            continue;
+        if (!isGrantedAtRung(name, rung, gatedTools))
+            continue;
+        summaries.push({ name, description });
+    }
+    return summaries;
+}
+//# sourceMappingURL=tool-descriptions.js.map

package/dist/config/tool-descriptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-descriptions.js","sourceRoot":"","sources":["../../src/config/tool-descriptions.ts"],"names":[],"mappings":"AAsCA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAkD;IAC3F,MAAM,EACJ,4FAA4F;QAC5F,yCAAyC;IAC3C,KAAK,EACH,4FAA4F;QAC5F,yCAAyC;IAC3C,QAAQ,EACN,+FAA+F;QAC/F,uEAAuE;IACzE,IAAI,EACF,gGAAgG;QAChG,uEAAuE;IACzE,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,mGAAmG;AACnG,MAAM,YAAY,GAAsB,KAAK,CAAC,IAAI,CAChD,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAC9F,CAAC;AAUF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAgD;IAC/E,6CAA6C;IAC7C,SAAS,EAAE,MAAM;IACjB,mBAAmB,EAAE,MAAM;IAC3B,eAAe,EAAE,MAAM;IACvB,cAAc,EAAE,MAAM;IACtB,yBAAyB,EAAE,MAAM;IACjC,cAAc,EAAE,MAAM;IACtB,YAAY,EAAE,MAAM;IACpB,aAAa,EAAE,MAAM;IACrB,wBAAwB,EAAE,MAAM;IAChC,UAAU,EAAE,OAAO;IACnB,SAAS,EAAE,OAAO;IAClB,gBAAgB,EAAE,OAAO;IACzB,SAAS,EAAE,OAAO;IAClB,WAAW,EAAE,OAAO;IACpB,gBAAgB,EAAE,OAAO;IACzB,8DAA8D;IAC9D,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,iEAAiE;IACjE,QAAQ,EAAE,MAAM;CACjB,CAAC;AAUF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAqC;IACvE,SAAS,EAAE,sCAAsC;IACjD,mBAAmB,EAAE,uDAAuD;IAC5E,eAAe,EAAE,2DAA2D;IAC5E,cAAc,EAAE,wDAAwD;IACxE,yBAAyB,EAAE,0DAA0D;IACrF,cAAc,EAAE,6DAA6D;IAC7E,YAAY,EAAE,mDAAmD;IACjE,aAAa,EAAE,iEAAiE;IAChF,wBAAwB,EAAE,2DAA2D;IACrF,UAAU,EAAE,mDAAmD;IAC/D,SAAS,EAAE,wDAAwD;IACnE,gBAAgB,EAAE,2CAA2C;IAC7D,SAAS,EAAE,8CAA8C;IACzD,WAAW,EAAE,sCAAsC;IACnD,gBAAgB,EAAE,2CAA2C;IAC7D,EAAE,EAAE,wDAAwD;IAC5D,IAAI,EAAE,mDAAmD;IACzD,IAAI,EAAE,mEAAmE;IACzE,QAAQ,EAAE,mEAAmE;IAC7E,SAAS,EAAE,4CAA4C;IACvD,eAAe,EAAE,+DAA+D;IAChF,QAAQ,EAAE,4CAA4C;IACtD,SAAS,EAAE,6CAA6C;CACzD,CAAC;AAEF,kGAAkG;AAClG,MAAM,UAAU,4BAA4B,CAAC,IAAkB;IAC7D,OAAO,8BAA8B,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB,EAAE,IAAkB;IAC7E,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,KAAK,QAAQ,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,IAAkB,EAClB,UAA6B;IAE7B,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,0BAA0B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,WAAmB;IAChE,IAAI,MAAM,GAAG,WAAW,CAAC;IACzB,wFAAwF;IACxF,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,OAAO,OAAO,EAAE,CAAC;QACf,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;YAClC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC7D,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAQD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAAU,EACV,OAA8D;IAE9D,MAAM,MAAM,GAAG,4BAA4B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC/E,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;YAAE,SAAS;QACnD,MAAM,IAAI,GAAG,8BAA8B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9D,iFAAiF;QACjF,IAAI,MAAM,KAAK,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACpF,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,2BAA2B,CACzC,mBAAsC,EACtC,IAAkB,EAClB,UAA6B;IAE7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,WAAW,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,WAAW;YAAE,SAAS;QAC3B,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC;YAAE,SAAS;QACvD,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}