@inhuman.tools/harness 0.0.0-stage → 0.1.0

package/dist/models/shared/policy/mode-policy.js

@@ -0,0 +1,106 @@
+/**
+ * Mode merge over one KV bag — the caller names the storage.
+ * Session owns `harness.mode.active` and `harness.mode.override.*`.
+ * Pack/axis JSON keys resolve only if that bag has them (catalogs are files).
+ *
+ * effective = override ?? pack[axis] ?? axis-default
+ */
+export const MODE_ACTIVE_KEY = "harness.mode.active";
+export const MODE_PACK_KV_PREFIX = "harness.mode.pack.";
+export const MODE_AXIS_KV_PREFIX = "harness.mode.axis.";
+export function modePackKvKey(id) {
+    return `${MODE_PACK_KV_PREFIX}${id}`;
+}
+export function modeAxisKvKey(id) {
+    return `${MODE_AXIS_KV_PREFIX}${id}`;
+}
+export function modeOverrideKey(axis) {
+    return `harness.mode.override.${axis}`;
+}
+function getKv(kv, key) {
+    if (kv instanceof Map)
+        return kv.get(key);
+    return kv[key];
+}
+function asAxisType(raw) {
+    if (raw === "symbol" || raw === "number" || raw === "string" || raw === "boolean" || raw === "list") {
+        return raw;
+    }
+    return "string";
+}
+export function axisDefOf(kv, axis) {
+    const raw = getKv(kv, modeAxisKvKey(axis));
+    if (raw === undefined)
+        return undefined;
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed === "string")
+            return { type: asAxisType(parsed) };
+        if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+            const rec = parsed;
+            return { type: asAxisType(rec.type), default: rec.default };
+        }
+    }
+    catch {
+        return { type: asAxisType(raw) };
+    }
+    return undefined;
+}
+export function parseAxisValue(type, raw, fallback = null) {
+    if (raw === undefined || raw === "")
+        return fallback;
+    switch (type) {
+        case "number": {
+            const n = Number(raw);
+            return Number.isFinite(n) ? n : fallback;
+        }
+        case "boolean":
+            return raw === "true" || raw === "1" || raw === "#t";
+        case "list": {
+            try {
+                const parsed = JSON.parse(raw);
+                return Array.isArray(parsed) ? parsed.map(String) : fallback;
+            }
+            catch {
+                return fallback;
+            }
+        }
+        case "symbol":
+        case "string":
+            return raw;
+        default:
+            return raw;
+    }
+}
+export function activeModeId(kv) {
+    return getKv(kv, MODE_ACTIVE_KEY) ?? "default";
+}
+function packOf(kv, id) {
+    const raw = getKv(kv, modePackKvKey(id));
+    if (raw === undefined)
+        return {};
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+            return parsed;
+        }
+    }
+    catch {
+        return {};
+    }
+    return {};
+}
+/** Effective axis value on this bag: override ?? pack ?? axis-default. */
+export function effective(kv, axis) {
+    const def = axisDefOf(kv, axis);
+    const over = getKv(kv, modeOverrideKey(axis));
+    if (over !== undefined && over !== "") {
+        return parseAxisValue(def?.type ?? "string", over, def?.default ?? null);
+    }
+    const pack = packOf(kv, activeModeId(kv));
+    if (Object.prototype.hasOwnProperty.call(pack, axis)) {
+        return pack[axis];
+    }
+    return def?.default ?? null;
+}
+//# sourceMappingURL=mode-policy.js.map

package/dist/models/shared/policy/mode-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode-policy.js","sourceRoot":"","sources":["../../../../src/models/shared/policy/mode-policy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AACrD,MAAM,CAAC,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AACxD,MAAM,CAAC,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AAExD,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,OAAO,GAAG,mBAAmB,GAAG,EAAE,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,OAAO,GAAG,mBAAmB,GAAG,EAAE,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,yBAAyB,IAAI,EAAE,CAAC;AACzC,CAAC;AAUD,SAAS,KAAK,CACZ,EAAkE,EAClE,GAAW;IAEX,IAAI,EAAE,YAAY,GAAG;QAAE,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAQ,EAAuC,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACpG,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,EAAkE,EAClE,IAAY;IAEZ,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,MAAM,GAAG,GAAG,MAAqD,CAAC;YAClE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAC9D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAkB,EAAE,GAAuB,EAAE,QAAQ,GAAkB,IAAI;IACxG,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACrD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3C,CAAC;QACD,KAAK,SAAS;YACZ,OAAO,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,CAAC;QACvD,KAAK,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACxC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QACD,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,GAAG,CAAC;QACb;YACE,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,EAAkE;IAElE,OAAO,KAAK,CAAC,EAAE,EAAE,eAAe,CAAC,IAAI,SAAS,CAAC;AACjD,CAAC;AAED,SAAS,MAAM,CACb,EAAkE,EAClE,EAAU;IAEV,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,OAAO,MAAuC,CAAC;QACjD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,SAAS,CACvB,EAAkE,EAClE,IAAY;IAEZ,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACtC,OAAO,cAAc,CAAC,GAAG,EAAE,IAAI,IAAI,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC,IAAI,CAAkB,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,EAAE,OAAO,IAAI,IAAI,CAAC;AAC9B,CAAC"}

package/dist/models/shared/residual.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Shared types + constants. Union law: every model union has an `x-plugin`
+ * escape or says why not.
+ */
+/**
+ * On-disk shape of harness:* entities. Bump only for breaking materialization.
+ * Additive PEW fields keep empty defaults — do not bump: single major;
+ * inequality world-stops coexistence.
+ */
+export declare const SCHEMA_VERSION = 8;
+/**
+ * Plugins propose, never apply. Form-keyed; vocabulary SSOT: `policy/dispose-series.ts`.
+ */
+export type KvProposal = {
+    readonly form: "kv-set";
+    readonly key: string;
+    readonly value: string;
+} | {
+    readonly form: "kv-clear";
+    readonly key: string;
+};
+//# sourceMappingURL=residual.d.ts.map

package/dist/models/shared/residual.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"residual.d.ts","sourceRoot":"","sources":["../../../src/models/shared/residual.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC;;GAEG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACzE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC"}

package/dist/models/shared/residual.js

@@ -0,0 +1,11 @@
+/**
+ * Shared types + constants. Union law: every model union has an `x-plugin`
+ * escape or says why not.
+ */
+/**
+ * On-disk shape of harness:* entities. Bump only for breaking materialization.
+ * Additive PEW fields keep empty defaults — do not bump: single major;
+ * inequality world-stops coexistence.
+ */
+export const SCHEMA_VERSION = 8;
+//# sourceMappingURL=residual.js.map

package/dist/models/shared/residual.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"residual.js","sourceRoot":"","sources":["../../../src/models/shared/residual.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC"}

package/dist/oauth-loopback.d.ts

@@ -0,0 +1,24 @@
+export type OAuthLoopbackListen = {
+    readonly host?: string;
+    readonly port?: number;
+    readonly path?: string;
+};
+/** Injectable listen. `typeof listenOAuthLoopback` makes `opts` optional because of `= {}`. */
+export type ListenOAuthLoopback = (opts: OAuthLoopbackListen) => Promise<OAuthLoopback>;
+export type OAuthCallback = {
+    readonly code: string;
+    readonly state: string;
+};
+export type OAuthLoopback = {
+    readonly callbackUrl: string;
+    readonly wait: Promise<OAuthCallback>;
+    close(): void;
+};
+export type OAuthCallbackStyle = {
+    readonly param: "callback_url" | "redirect_uri";
+    readonly listen: Required<OAuthLoopbackListen>;
+};
+export declare function oauthCallbackFor(authUrl: string): OAuthCallbackStyle;
+export declare function withCallbackParam(authUrl: string, callbackUrl: string, param: "callback_url" | "redirect_uri"): string;
+export declare function listenOAuthLoopback(opts?: OAuthLoopbackListen): Promise<OAuthLoopback>;
+//# sourceMappingURL=oauth-loopback.d.ts.map

package/dist/oauth-loopback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-loopback.d.ts","sourceRoot":"","sources":["../src/oauth-loopback.ts"],"names":[],"mappings":"AAiBA,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,+FAA+F;AAC/F,MAAM,MAAM,mBAAmB,GAAG,CAAC,IAAI,EAAE,mBAAmB,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAExF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACtC,KAAK,IAAI,IAAI,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,KAAK,EAAE,cAAc,GAAG,cAAc,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;CAChD,CAAC;AAQF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,CAiBpE;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,cAAc,GAAG,cAAc,GACrC,MAAM,CAIR;AAED,wBAAsB,mBAAmB,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,aAAa,CAAC,CAyEhG"}

package/dist/oauth-loopback.js

@@ -0,0 +1,120 @@
+/**
+ * Localhost OAuth callback for CLI PKCE.
+ *
+ * Only the configured path with `code` or `error` settles. Browsers request
+ * icons and other paths in parallel; those must not abort the waiter —
+ * otherwise the HTML says Connected while the parked RPC never gets `ui/resolve`.
+ *
+ * OpenRouter takes `callback_url` on a random 127.0.0.1 port. OIDC (Grok,
+ * ChatGPT) takes `redirect_uri`. ChatGPT's public client is registered at
+ * localhost:1455/auth/callback.
+ * BIND_ADVERTISE: listen on 127.0.0.1 while advertising localhost —
+ * Node IPv6 `localhost` bind would miss the public client.
+ */
+import { createServer } from "node:http";
+import { fail, step } from "./diagnostics/index.js";
+const DEFAULT_LISTEN = {
+    host: "127.0.0.1",
+    port: 0,
+    path: "/callback",
+};
+export function oauthCallbackFor(authUrl) {
+    let host;
+    try {
+        host = new URL(authUrl).host;
+    }
+    catch {
+        host = "";
+    }
+    if (host === "openrouter.ai" || host === "www.openrouter.ai") {
+        return { param: "callback_url", listen: { ...DEFAULT_LISTEN } };
+    }
+    if (host === "auth.openai.com") {
+        return {
+            param: "redirect_uri",
+            listen: { host: "localhost", port: 1455, path: "/auth/callback" },
+        };
+    }
+    return { param: "redirect_uri", listen: { ...DEFAULT_LISTEN } };
+}
+export function withCallbackParam(authUrl, callbackUrl, param) {
+    const url = new URL(authUrl);
+    url.searchParams.set(param, callbackUrl);
+    return url.toString();
+}
+export async function listenOAuthLoopback(opts = {}) {
+    const host = opts.host ?? DEFAULT_LISTEN.host;
+    const port = opts.port ?? DEFAULT_LISTEN.port;
+    const path = opts.path ?? DEFAULT_LISTEN.path;
+    const server = createServer();
+    const wait = new Promise((resolve, reject) => {
+        let settled = false;
+        const settle = (error, callback) => {
+            if (settled)
+                return;
+            settled = true;
+            if (error === null) {
+                resolve(callback ?? { code: "", state: "" });
+            }
+            else {
+                reject(error);
+            }
+            server.close();
+        };
+        server.on("request", (req, res) => {
+            let parsed;
+            try {
+                parsed = new URL(req.url ?? "/", "http://127.0.0.1");
+            }
+            catch {
+                res.writeHead(400).end();
+                return;
+            }
+            if (parsed.pathname !== path) {
+                res.writeHead(204).end();
+                return;
+            }
+            const code = parsed.searchParams.get("code")?.trim() ?? "";
+            const state = parsed.searchParams.get("state")?.trim() ?? "";
+            const error = parsed.searchParams.get("error")?.trim() ?? "";
+            if (code !== "") {
+                res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+                res.end("<!doctype html><p>Connected. You can close this window.</p>");
+                step(`oauth loopback code=${code.length} state=${state.length}`);
+                settle(null, { code, state });
+                return;
+            }
+            if (error !== "") {
+                res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+                res.end("<!doctype html><p>Authorization did not complete. You can close this window.</p>");
+                fail("oauth loopback", error);
+                settle(new Error(error));
+                return;
+            }
+            step(`oauth loopback ignore ${parsed.pathname}`);
+            res.writeHead(204).end();
+        });
+        server.on("error", (error) => {
+            fail("oauth loopback server", error);
+            settle(error);
+        });
+    });
+    await new Promise((resolve, reject) => {
+        server.listen(port, host === "localhost" ? "127.0.0.1" : host, () => resolve());
+        server.once("error", reject);
+    });
+    const address = server.address();
+    if (typeof address !== "object" || address === null) {
+        server.close();
+        throw new Error("oauth loopback: no address");
+    }
+    const advertisedHost = host === "localhost" ? "localhost" : "127.0.0.1";
+    return {
+        callbackUrl: `http://${advertisedHost}:${address.port}${path}`,
+        wait,
+        close: () => {
+            server.close();
+        },
+    };
+}
+//# sourceMappingURL=oauth-loopback.js.map

package/dist/oauth-loopback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-loopback.js","sourceRoot":"","sources":["../src/oauth-loopback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AA2B1C,MAAM,cAAc,GAAkC;IACpD,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,WAAW;CAClB,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE;SAClE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,WAAmB,EACnB,KAAsC;IAEtC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACzC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAA4B,EAAE;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC;IAC9C,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1D,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,KAAmB,EAAE,QAAwB,EAAQ,EAAE;YACrE,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,CAAC,QAAQ,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/C,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC;YACD,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAChC,IAAI,MAAW,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC7D,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBAChB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;gBACvE,IAAI,CAAC,uBAAuB,IAAI,CAAC,MAAM,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC9B,OAAO;YACT,CAAC;YACD,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACjB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;gBAC5F,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,IAAI,CAAC,yBAAyB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACjD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3B,IAAI,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;IACxE,OAAO;QACL,WAAW,EAAE,UAAU,cAAc,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,EAAE;QAC9D,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE;YACV,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/open-external.d.ts

@@ -0,0 +1,2 @@
+export declare function openExternalUrl(url: string): void;
+//# sourceMappingURL=open-external.d.ts.map

package/dist/open-external.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-external.d.ts","sourceRoot":"","sources":["../src/open-external.ts"],"names":[],"mappings":"AAOA,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAcjD"}

package/dist/open-external.js

@@ -0,0 +1,24 @@
+/**
+ * Fire-and-forget URL open. No display (SSH / container) is fine.
+ * WIN_START: cmd.exe `start "" url` — without the empty title the quoted
+ * URL becomes the window title and navigation is swallowed.
+ */
+import { spawn } from "node:child_process";
+export function openExternalUrl(url) {
+    if (!/^https?:\/\//i.test(url.trim()))
+        return;
+    try {
+        const target = url.trim();
+        if (process.platform === "darwin") {
+            spawn("open", [target], { detached: true, stdio: "ignore" }).unref();
+            return;
+        }
+        if (process.platform === "win32") {
+            spawn("cmd", ["/c", "start", "", target], { detached: true, stdio: "ignore" }).unref();
+            return;
+        }
+        spawn("xdg-open", [target], { detached: true, stdio: "ignore" }).unref();
+    }
+    catch { }
+}
+//# sourceMappingURL=open-external.js.map

package/dist/open-external.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-external.js","sourceRoot":"","sources":["../src/open-external.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;YACrE,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;YACvF,OAAO;QACT,CAAC;QACD,KAAK,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACZ,CAAC"}

package/dist/paths.d.ts

@@ -0,0 +1,7 @@
+export declare const HARNESS_DIR = ".harness";
+export declare function daemonSocketPath(systemRoot: string): string;
+/** One append-only log for host, worker, and daemon. */
+export declare function daemonLogPath(systemRoot: string): string;
+export declare function projectHarnessDir(workspacePath: string): string;
+export declare function projectSessionsDir(workspacePath: string): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,WAAW,aAAa,CAAC;AAEtC,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wDAAwD;AACxD,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAEhE"}

package/dist/paths.js

@@ -0,0 +1,16 @@
+import { join } from "node:path";
+export const HARNESS_DIR = ".harness";
+export function daemonSocketPath(systemRoot) {
+    return join(systemRoot, "daemon.sock");
+}
+/** One append-only log for host, worker, and daemon. */
+export function daemonLogPath(systemRoot) {
+    return join(systemRoot, "harness.log");
+}
+export function projectHarnessDir(workspacePath) {
+    return join(workspacePath, HARNESS_DIR);
+}
+export function projectSessionsDir(workspacePath) {
+    return join(projectHarnessDir(workspacePath), "sessions");
+}
+//# sourceMappingURL=paths.js.map

package/dist/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,WAAW,GAAG,UAAU,CAAC;AAEtC,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,OAAO,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AACzC,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,OAAO,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,aAAqB;IACrD,OAAO,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,aAAqB;IACtD,OAAO,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,UAAU,CAAC,CAAC;AAC5D,CAAC"}

package/dist/policy-processor/check.d.ts

@@ -0,0 +1,19 @@
+/**
+ * String processors over a compiled YAML term. Prep, unparsed→ask, empty I→ask,
+ * and the pipeline lattice live here — not on the host.
+ *
+ * Shape (policy / matcher / subcommands) is one vote. File effects from
+ * arg_types / arg_rest_type join on their own lattice — they cannot lift ask.
+ * `"--"` present: suffix is re-parsed with that body's flag vocabulary
+ * (undeclared dash tokens stay positionals). `"--"` absent: cutoff, consume
+ * the delimiter, leftovers are positionals.
+ */
+import { type Which } from "./identity.js";
+import { type PathTerm } from "./path-policy.js";
+import type { CommandNode, Disposition } from "./types.js";
+export type PathClusters = {
+    readonly read?: PathTerm;
+    readonly write?: PathTerm;
+};
+export declare function checkBash(term: CommandNode, command: string, paths?: PathClusters, which?: Which): Disposition;
+//# sourceMappingURL=check.d.ts.map

package/dist/policy-processor/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/policy-processor/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAgB,KAAK,KAAK,EAAE,MAAM,eAAe,CAAC;AAEzD,OAAO,EAAa,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,KAAK,EAAW,WAAW,EAAE,WAAW,EAA2B,MAAM,YAAY,CAAC;AAE7F,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;CAC3B,CAAC;AAUF,wBAAgB,SAAS,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,YAAiB,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,WAAW,CAiClH"}

package/dist/policy-processor/check.js

@@ -0,0 +1,251 @@
+/**
+ * String processors over a compiled YAML term. Prep, unparsed→ask, empty I→ask,
+ * and the pipeline lattice live here — not on the host.
+ *
+ * Shape (policy / matcher / subcommands) is one vote. File effects from
+ * arg_types / arg_rest_type join on their own lattice — they cannot lift ask.
+ * `"--"` present: suffix is re-parsed with that body's flag vocabulary
+ * (undeclared dash tokens stay positionals). `"--"` absent: cutoff, consume
+ * the delimiter, leftovers are positionals.
+ */
+import { flagVocab, valueFlagNames } from "./compile.js";
+import { identityName } from "./identity.js";
+import { lattice } from "./lift.js";
+import { checkPath } from "./path-policy.js";
+import { partition, prep } from "./prep.js";
+const CUT = "--";
+export function checkBash(term, command, paths = {}, which) {
+    const names = new Set(Object.keys(term.subcommands));
+    const prepared = prep(command, {
+        which,
+        valueFlagsFor: (argv0, suffix) => collectSpineValueFlags(term, identityName(argv0, names, which), suffix),
+    });
+    const hits = prepared.questions.flatMap((question) => {
+        const argv0 = identityName(question.argv0, names, which);
+        const floorToks = [argv0];
+        const floor = evalCommand(term, { toks: floorToks, flags: {}, cutConsumed: false }, walkSpine(term, floorToks, 0, false, {}), 0, requiredPolicy(term), paths);
+        const votes = question.readings.map((reading) => {
+            const toks = [argv0, ...reading.tokens];
+            return evalCommand(term, { toks, flags: reading.flags, cutConsumed: false }, walkSpine(term, toks, 0, false, {}), 0, requiredPolicy(term), paths);
+        });
+        return [liftReadings(votes, question.overflow === true, floor), ...redirVotes(question.redirects, paths)];
+    });
+    hits.push(...redirVotes(prepared.redirects, paths));
+    if (prepared.unparsed.length > 0)
+        hits.push("ask");
+    return hits.length === 0 ? "ask" : lattice(hits);
+}
+function requiredPolicy(node) {
+    return node.policy ?? "ask";
+}
+function collectSpineValueFlags(term, argv0, suffix) {
+    const names = new Set();
+    addValueFlags(term, names);
+    const child = commandChild(term, argv0);
+    if (!child)
+        return names;
+    collectFromNode(child, suffix, 0, names);
+    return names;
+}
+function collectFromNode(node, words, i, names, cutConsumed = false) {
+    addValueFlags(node, names);
+    let at = i;
+    let consumed = cutConsumed;
+    if (tokenAt(words, at) === CUT && node.dash === undefined && !consumed) {
+        at += 1;
+        consumed = true;
+    }
+    if (tokenAt(words, at) === CUT && node.dash !== undefined)
+        return;
+    const next = tokenAt(words, at);
+    if (next === undefined || !isLeadingPositional(next))
+        return;
+    const child = commandChild(node, next);
+    if (child)
+        collectFromNode(child, words, at + 1, names, consumed);
+}
+function addValueFlags(node, names) {
+    for (const name of valueFlagNames(node))
+        names.add(name);
+}
+function isLeadingPositional(word) {
+    return word !== CUT && (word === "-" || !word.startsWith("-"));
+}
+function tokenAt(toks, i) {
+    return i >= 0 && i < toks.length ? toks[i] : undefined;
+}
+function commandChild(node, name) {
+    return name !== undefined && Object.hasOwn(node.subcommands, name) ? node.subcommands[name] : undefined;
+}
+function liftReadings(evals, overflow, floor) {
+    if (evals.includes("block") || (overflow && floor === "block"))
+        return "block";
+    if (overflow)
+        return floor === "deny" ? "deny" : "ask";
+    if (evals.length === 0)
+        return "ask";
+    if (evals.every((vote) => vote === "deny"))
+        return "deny";
+    if (evals.every((vote) => vote === "approve"))
+        return "approve";
+    return "ask";
+}
+function evalCommand(node, ctx, bindings, depth, inherited, paths) {
+    const policy = node.policy ?? inherited;
+    const here = bindings;
+    let toks = ctx.toks;
+    let cutConsumed = ctx.cutConsumed;
+    if (toks[0] === CUT && node.dash === undefined && !cutConsumed) {
+        toks = toks.slice(1);
+        cutConsumed = true;
+    }
+    if (toks[0] === CUT && node.dash !== undefined) {
+        const dashVote = evalDash(node.dash, toks.slice(1), here, depth + 1, policy, paths);
+        const matcherHits = matcherVotes(node, toks, ctx.flags, here, depth);
+        return shapeOf([...matcherHits, dashVote], policy);
+    }
+    const next = tokenAt(toks, 0);
+    const child = commandChild(node, next);
+    const matcherHits = matcherVotes(node, toks, ctx.flags, here, depth);
+    if (child) {
+        const childVote = evalCommand(child, { toks: toks.slice(1), flags: ctx.flags, cutConsumed }, here, depth + 1, policy, paths);
+        return shapeOf([...matcherHits, childVote], policy);
+    }
+    const files = fileVotes(node, stripCut(toks), paths);
+    return lattice([shapeOf(matcherHits, policy), ...files]);
+}
+function matcherVotes(node, toks, flags, bindings, depth) {
+    return node.matchers.flatMap((matcher) => {
+        const vote = evalMatcher(matcher, toks, flags, bindings, depth);
+        return vote === undefined ? [] : [vote];
+    });
+}
+function evalDash(node, suffix, bindings, depth, inherited, paths) {
+    const closed = flagVocab(node);
+    const valueFlags = valueFlagNames(node);
+    const { readings, overflow } = partition(suffix, valueFlags, closed);
+    const floor = evalCommand(node, { toks: [], flags: {}, cutConsumed: true }, bindings, depth, inherited, paths);
+    if (readings.length === 0) {
+        return liftReadings([evalCommand(node, { toks: suffix, flags: {}, cutConsumed: true }, bindings, depth, inherited, paths)], overflow, floor);
+    }
+    const votes = readings.map((reading) => evalCommand(node, { toks: reading.tokens, flags: reading.flags, cutConsumed: true }, bindings, depth, inherited, paths));
+    return liftReadings(votes, overflow, floor);
+}
+function shapeOf(hits, policy) {
+    if (hits.length === 0)
+        return policy;
+    if (policy === "block")
+        return "block";
+    return lattice(hits);
+}
+function walkSpine(node, toks, depth, cutConsumed, acc) {
+    for (const name of flagVocab(node))
+        acc[name] = Math.max(acc[name] ?? -1, depth);
+    let rest = toks;
+    let consumed = cutConsumed;
+    if (rest[0] === CUT && node.dash === undefined && !consumed) {
+        rest = rest.slice(1);
+        consumed = true;
+    }
+    if (rest[0] === CUT && node.dash !== undefined) {
+        return walkSpine(node.dash, rest.slice(1), depth + 1, true, acc);
+    }
+    const next = tokenAt(rest, 0);
+    const child = commandChild(node, next);
+    if (child)
+        walkSpine(child, rest.slice(1), depth + 1, consumed, acc);
+    return acc;
+}
+function stripCut(toks) {
+    const i = toks.indexOf(CUT);
+    if (i === -1)
+        return toks;
+    return [...toks.slice(0, i), ...toks.slice(i + 1)];
+}
+function evalMatcher(matcher, toks, flags, bindings, depth) {
+    if (!flagsMatch(matcher.flags, flags, bindings, depth))
+        return undefined;
+    if (!positionalsMatch(matcher, toks))
+        return undefined;
+    const nested = matcher.matchers
+        .map((child) => evalMatcher(child, toks, flags, bindings, depth))
+        .filter((vote) => vote !== undefined);
+    if (matcher.policy === undefined) {
+        if (nested.length === 0)
+            return undefined;
+        return lattice(nested);
+    }
+    if (matcher.policy === "block")
+        return lattice(["block", ...nested]);
+    if (nested.length === 0)
+        return matcher.policy;
+    return lattice(nested);
+}
+function flagsMatch(spec, flags, bindings, depth) {
+    const entries = Object.values(spec);
+    if (entries.length === 0)
+        return true;
+    const applyShadow = entries.length === 1;
+    return entries.every((flag) => flagHits(flag, flags, bindings, depth, applyShadow));
+}
+function flagHits(flag, flags, bindings, depth, applyShadow) {
+    const live = applyShadow ? flag.names.filter((name) => (bindings[name] ?? depth) === depth) : flag.names;
+    if (live.length === 0)
+        return false;
+    const present = live.filter((name) => Object.hasOwn(flags, name));
+    if (present.length === 0)
+        return false;
+    if (flag.vals.length === 0)
+        return true;
+    return present.some((name) => (flags[name] ?? []).some((value) => flag.vals.some((glob) => globMatch(glob, value))));
+}
+function positionalsMatch(matcher, toks) {
+    if (matcher.globs.length === 0 && matcher.toks.length === 0)
+        return true;
+    return toks.some((tok) => matcher.toks.includes(tok) || matcher.globs.some((glob) => globMatch(glob, tok)));
+}
+function fileVotes(node, toks, paths) {
+    if (toks.length === 0)
+        return [];
+    const votes = [];
+    for (const [i, tok] of toks.entries()) {
+        const kind = i < node.argTypes.length ? node.argTypes[i] : node.argRestType;
+        if (!kind)
+            continue;
+        votes.push(pathVote(kind, tok, paths));
+    }
+    return votes;
+}
+function pathVote(kind, path, paths) {
+    const cluster = kind === "read_path" ? paths.read : paths.write;
+    return cluster === undefined ? "ask" : checkPath(cluster, path);
+}
+function redirVotes(redirects, paths) {
+    return redirects.flatMap((redirect) => {
+        const cluster = redirCluster(redirect.operator);
+        if (cluster === undefined)
+            return [];
+        const term = paths[cluster];
+        return [term === undefined ? "ask" : checkPath(term, redirect.target)];
+    });
+}
+function redirCluster(operator) {
+    if (operator.includes("<<"))
+        return undefined;
+    if (operator.includes(">"))
+        return "write";
+    if (operator.includes("<"))
+        return "read";
+    return undefined;
+}
+const GLOB_SPECIALS = /[.+^${}()|[\]\\]/g;
+function globMatch(pattern, value) {
+    const body = pattern
+        .replaceAll(GLOB_SPECIALS, String.raw `\$&`)
+        .replaceAll("*", ".*")
+        .replaceAll("?", ".");
+    // body is escaped; glob is policy-author data, not an untrusted regex.
+    // eslint-disable-next-line security/detect-non-literal-regexp
+    return new RegExp(`^${body}$`).test(value);
+}
+//# sourceMappingURL=check.js.map