@iowarp/clio-coder 0.3.0

package/dist/chunk-XV4ZJ6ZM.js

@@ -0,0 +1,3177 @@
+import {
+  AGENT_AUTOMATION_AUTHORITIES,
+  canonicalizeExistingPath,
+  classify,
+  detectValidationCommand,
+  extractCommandDeleteTargets,
+  extractCommandWriteTargets,
+  inlineShellScript,
+  isVerificationScriptName,
+  tokenizeShellLike,
+  toolMutationPaths
+} from "./chunk-WD6AJM35.js";
+import {
+  ToolNames
+} from "./chunk-QV47YRF4.js";
+import {
+  clioConfigDir
+} from "./chunk-X3NE4WVW.js";
+import {
+  resolvePackageRoot
+} from "./chunk-DXQNI4PC.js";
+
+// src/domains/agents/result-contract.ts
+import { createHash } from "node:crypto";
+import path from "node:path";
+function canonical(value) {
+  if (value === null) return "null";
+  if (typeof value === "string" || typeof value === "boolean") return JSON.stringify(value);
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new Error("result contract cannot digest non-finite numbers");
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (typeof value === "object") {
+    const record = value;
+    return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonical(record[key])}`).join(",")}}`;
+  }
+  throw new Error(`result contract cannot digest ${typeof value}`);
+}
+function digest(value) {
+  return createHash("sha256").update(canonical(value), "utf8").digest("hex");
+}
+function resultContractDigest(contract) {
+  return digest(contract);
+}
+function resultContractSourceId(contract) {
+  return `agent-result-contract:${contract.kind}:${resultContractDigest(contract)}`;
+}
+function failure(contract, quality, reason) {
+  return {
+    conformance: "fail",
+    quality,
+    sourceId: resultContractSourceId(contract),
+    validatorDigest: digest({ contract, reason }),
+    reason
+  };
+}
+function success(contract, quality, value, extra = {}) {
+  return {
+    conformance: "pass",
+    quality,
+    sourceId: resultContractSourceId(contract),
+    validatorDigest: digest({ contract, value }),
+    ...extra
+  };
+}
+function parseJson(output) {
+  if (output === null || output.trim().length === 0) return { ok: false, reason: "missing final result" };
+  try {
+    const value = JSON.parse(output);
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+      return { ok: false, reason: "result must be a JSON object" };
+    }
+    return { ok: true, value };
+  } catch {
+    return { ok: false, reason: "result must be valid JSON" };
+  }
+}
+function hasOnlyKeys(value, keys) {
+  const allowed = new Set(keys);
+  return Object.keys(value).every((key) => allowed.has(key));
+}
+function string(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function parseFindings(value) {
+  if (!Array.isArray(value)) return null;
+  const findings = [];
+  for (const entry of value) {
+    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return null;
+    const finding = entry;
+    const line = finding.line;
+    if (!hasOnlyKeys(finding, ["claim", "path", "line"]) || !string(finding.claim) || !string(finding.path) || typeof line !== "number" || !Number.isSafeInteger(line) || line < 1) {
+      return null;
+    }
+    findings.push({ claim: finding.claim, path: finding.path, line });
+  }
+  return findings;
+}
+var RESULT_CONTRACT_KINDS = [
+  "architect-plan",
+  "scout-report",
+  "verifier-report",
+  "debugger-report",
+  "research-report",
+  "mutation-report",
+  "provenance-report",
+  "external-delegation"
+];
+function parseSubtasks(value) {
+  if (!Array.isArray(value) || value.length > 4) return null;
+  const subtasks = [];
+  const ids = /* @__PURE__ */ new Set();
+  for (const entry of value) {
+    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return null;
+    const subtask = entry;
+    if (!hasOnlyKeys(subtask, ["id", "task", "dependencies", "expectedResultContract", "requestedAuthority"]) || !string(subtask.id) || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(subtask.id) || ids.has(subtask.id) || !string(subtask.task) || Buffer.byteLength(subtask.task, "utf8") > 4096 || !Array.isArray(subtask.dependencies) || subtask.dependencies.length > 4 || subtask.dependencies.some((dependency) => !string(dependency)) || new Set(subtask.dependencies).size !== subtask.dependencies.length || !RESULT_CONTRACT_KINDS.includes(subtask.expectedResultContract) || !AGENT_AUTOMATION_AUTHORITIES.includes(subtask.requestedAuthority)) {
+      return null;
+    }
+    ids.add(subtask.id);
+    subtasks.push({
+      id: subtask.id,
+      task: subtask.task,
+      dependencies: [...subtask.dependencies],
+      expectedResultContract: subtask.expectedResultContract,
+      requestedAuthority: subtask.requestedAuthority
+    });
+  }
+  for (const subtask of subtasks) {
+    if (subtask.dependencies.some((dependency) => dependency === subtask.id || !ids.has(dependency))) return null;
+  }
+  const remaining = new Set(ids);
+  const completed = /* @__PURE__ */ new Set();
+  while (remaining.size > 0) {
+    const ready = subtasks.filter(
+      (subtask) => remaining.has(subtask.id) && subtask.dependencies.every((dependency) => completed.has(dependency))
+    );
+    if (ready.length === 0) return null;
+    for (const subtask of ready) {
+      remaining.delete(subtask.id);
+      completed.add(subtask.id);
+    }
+  }
+  return subtasks;
+}
+function isContextHandbookResult(value) {
+  if (!hasOnlyKeys(value, ["projectName", "identity", "conventions", "invariants", "sections"])) return false;
+  if (!string(value.projectName) || !string(value.identity)) return false;
+  if (!Array.isArray(value.conventions) || value.conventions.some((entry) => !string(entry))) return false;
+  if (!Array.isArray(value.invariants) || value.invariants.some((entry) => !string(entry))) return false;
+  if (!Array.isArray(value.sections)) return false;
+  return value.sections.every((entry) => {
+    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return false;
+    const section = entry;
+    return hasOnlyKeys(section, ["title", "body"]) && string(section.title) && string(section.body);
+  });
+}
+function validateContextHandbook(contract, output) {
+  const parsed = parseJson(output);
+  if (!parsed.ok) return failure(contract, "fail", parsed.reason);
+  if (!isContextHandbookResult(parsed.value)) {
+    return failure(
+      contract,
+      "fail",
+      "context handbook result must carry projectName, identity, conventions[], invariants[], and sections[{title, body}] and nothing else"
+    );
+  }
+  return success(contract, "unmeasured", parsed.value);
+}
+function salvageScoutClaims(value) {
+  const grounded = [];
+  const ungrounded = [];
+  if (!Array.isArray(value)) return { grounded, ungrounded };
+  for (const entry of value) {
+    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const finding = entry;
+    if (!string(finding.claim)) continue;
+    const line = finding.line;
+    if (string(finding.path) && typeof line === "number" && Number.isSafeInteger(line) && line >= 1) {
+      grounded.push({ claim: finding.claim, path: finding.path, line });
+      continue;
+    }
+    ungrounded.push(finding.claim);
+  }
+  return { grounded, ungrounded };
+}
+function degradedScout(contract, value, reason) {
+  const salvaged = salvageScoutClaims(value.findings);
+  if (salvaged.grounded.length === 0 && salvaged.ungrounded.length === 0) return null;
+  const degradedReason = `${reason} (accepted as a degraded reconnaissance result; findings are leads, not validation evidence)`;
+  const scout = {
+    findings: salvaged.grounded,
+    citations: salvaged.grounded.map(({ path: citedPath, line }) => ({ path: citedPath, line })),
+    needsSplit: false,
+    proposedSubtasks: [],
+    ungroundedClaims: salvaged.ungrounded,
+    degradedReason
+  };
+  return success(contract, "unmeasured", scout, { scout, reason: degradedReason });
+}
+function validateScout(contract, output) {
+  const parsed = parseJson(output);
+  if (!parsed.ok) return failure(contract, "fail", parsed.reason);
+  const value = parsed.value;
+  const degrade = (reason) => degradedScout(contract, value, reason) ?? failure(contract, "fail", reason);
+  if (!hasOnlyKeys(value, ["findings", "needsSplit", "proposedSubtasks"])) {
+    return degrade("Scout result has unknown fields");
+  }
+  const findings = parseFindings(value.findings);
+  const proposedSubtasks = parseSubtasks(value.proposedSubtasks);
+  if (findings === null || typeof value.needsSplit !== "boolean" || proposedSubtasks === null) {
+    return degrade(
+      "Scout result must carry findings as {claim, path, line} objects, needsSplit, and 0..4 typed proposed subtasks"
+    );
+  }
+  if (value.needsSplit !== proposedSubtasks.length > 0) {
+    return degrade("Scout needsSplit must agree with proposedSubtasks");
+  }
+  if (findings.length === 0 && !value.needsSplit) {
+    return degrade("Scout result must carry at least one cited finding, or set needsSplit");
+  }
+  if (value.needsSplit && findings.length > 0) {
+    return degrade("Scout split recommendations carry typed subtasks instead of findings");
+  }
+  const scout = {
+    findings,
+    citations: findings.map(({ path: citedPath, line }) => ({ path: citedPath, line })),
+    needsSplit: value.needsSplit,
+    proposedSubtasks
+  };
+  return success(contract, "pass", scout, { scout });
+}
+function parseChecks(value) {
+  if (!Array.isArray(value) || value.length === 0) return null;
+  const checks = [];
+  for (const entry of value) {
+    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return null;
+    const check = entry;
+    if (!hasOnlyKeys(check, ["name", "passed", "evidence"]) || !string(check.name) || typeof check.passed !== "boolean" || !string(check.evidence)) {
+      return null;
+    }
+    checks.push({ name: check.name, passed: check.passed, evidence: check.evidence });
+  }
+  return checks;
+}
+function validateScoutCitation(input, citation) {
+  const cwd = path.resolve(input.cwd);
+  const citedPath = path.resolve(cwd, citation.path);
+  const relative = path.relative(cwd, citedPath);
+  if (relative === "" || relative.startsWith(`..${path.sep}`) || relative === ".." || path.isAbsolute(relative)) {
+    return { ok: false, reason: `Scout citation path escapes the workspace: ${citation.path}` };
+  }
+  const content = input.filesystem.readFile(citedPath);
+  if (content === null) return { ok: false, reason: `Scout citation cannot be read: ${citation.path}` };
+  const lineCount = content.split(/\r\n|\r|\n/u).length;
+  if (citation.line > lineCount) {
+    return { ok: false, reason: `Scout citation is past end of file: ${citation.path}:${citation.line}` };
+  }
+  if (input.observedReadRanges !== void 0) {
+    const spans = input.observedReadRanges.get(citedPath) ?? [];
+    if (!spans.some(([start, end]) => citation.line >= start && citation.line <= end)) {
+      const observed = spans.length === 0 ? "this run never read that file" : `this run read only ${spans.map(([start, end]) => `${start}-${end}`).join(", ")}`;
+      return {
+        ok: false,
+        reason: `Scout citation is not grounded in a live read: ${citation.path}:${citation.line} (${observed})`
+      };
+    }
+  }
+  return {
+    ok: true,
+    evidence: { ...citation, contentDigest: createHash("sha256").update(content, "utf8").digest("hex") }
+  };
+}
+function validateScoutCitations(input, citations) {
+  const evidence = [];
+  for (const citation of citations) {
+    const checked = validateScoutCitation(input, citation);
+    if (!checked.ok) return checked;
+    evidence.push(checked.evidence);
+  }
+  return { ok: true, evidence };
+}
+function groundDegradedScout(contract, input, scout, degradedReason) {
+  const grounded = [];
+  const evidence = [];
+  const demoted = [];
+  for (const finding of scout.findings) {
+    const checked = validateScoutCitation(input, { path: finding.path, line: finding.line });
+    if (checked.ok) {
+      grounded.push(finding);
+      evidence.push(checked.evidence);
+      continue;
+    }
+    demoted.push(finding.claim);
+  }
+  const degraded = {
+    findings: grounded,
+    citations: grounded.map(({ path: citedPath, line }) => ({ path: citedPath, line })),
+    needsSplit: false,
+    proposedSubtasks: [],
+    ungroundedClaims: [...scout.ungroundedClaims ?? [], ...demoted],
+    degradedReason
+  };
+  return success(contract, "unmeasured", { scout: degraded, evidence }, { scout: degraded, reason: degradedReason });
+}
+function validateVerifier(contract, output) {
+  const parsed = parseJson(output);
+  if (!parsed.ok) return failure(contract, "fail", parsed.reason);
+  const value = parsed.value;
+  if (!hasOnlyKeys(value, ["verdict", "checks"]) || value.verdict !== "pass" && value.verdict !== "fail") {
+    return failure(contract, "fail", "Verifier result must carry pass or fail verdict and checks");
+  }
+  const checks = parseChecks(value.checks);
+  if (checks === null || value.verdict === "pass" !== checks.every((check) => check.passed)) {
+    return failure(contract, "fail", "Verifier verdict must agree with every typed check");
+  }
+  const verifier = { verdict: value.verdict, checks };
+  return success(contract, value.verdict, verifier, { verifier });
+}
+function parseVerifierResult(output) {
+  const validation = validateVerifier({ kind: "verifier-report" }, output);
+  return validation.verifier ?? null;
+}
+function validateCodeReport(contract, output) {
+  const parsed = parseJson(output);
+  if (!parsed.ok) return failure(contract, "unmeasured", parsed.reason);
+  const value = parsed.value;
+  if (!hasOnlyKeys(value, ["passed", "exitCode", "checks", "artifactPaths", "outputExcerpt"]) || typeof value.passed !== "boolean" || typeof value.exitCode !== "number" || !Number.isSafeInteger(value.exitCode) || typeof value.outputExcerpt !== "string" || !Array.isArray(value.artifactPaths) || value.artifactPaths.some((entry) => !string(entry))) {
+    return failure(
+      contract,
+      "unmeasured",
+      "Code result must carry passed, integer exitCode, checks, artifactPaths, and outputExcerpt"
+    );
+  }
+  const checks = parseChecks(value.checks);
+  if (checks === null) return failure(contract, "unmeasured", "Code result must carry typed checks");
+  if (value.passed !== (value.exitCode === 0) || value.passed !== checks.every((check) => check.passed)) {
+    return failure(contract, "unmeasured", "Code result passed must agree with its exit code and every check");
+  }
+  return success(contract, "unmeasured", value);
+}
+var RESULT_COMMIT_MESSAGE_MAX_BYTES = 1e3;
+var AUTHORSHIP_FIELDS = ["commitMessage", "summary"];
+function hasControlCharacters(value) {
+  for (const character of value) {
+    const code = character.codePointAt(0) ?? 0;
+    if (code === 127) return true;
+    if (code < 32 && character !== "\n" && character !== "\r" && character !== "	") return true;
+  }
+  return false;
+}
+function normalizeAuthored(value) {
+  return value.replace(/\r\n/gu, "\n").replace(/\r/gu, "\n").trim();
+}
+function validateAuthorship(value) {
+  for (const field of AUTHORSHIP_FIELDS) {
+    const raw = value[field];
+    if (raw === void 0 || raw === null) continue;
+    if (typeof raw !== "string") return `${field} must be a string when present`;
+    if (raw.trim().length === 0) continue;
+    if (Buffer.byteLength(raw, "utf8") > RESULT_COMMIT_MESSAGE_MAX_BYTES) {
+      return `${field} must be at most ${RESULT_COMMIT_MESSAGE_MAX_BYTES} bytes`;
+    }
+    if (hasControlCharacters(raw)) return `${field} must not contain control characters`;
+  }
+  return null;
+}
+function resultContractAuthorship(contract, output) {
+  const empty = { commitMessage: null, summary: null };
+  if (contract.kind !== "mutation-report" && contract.kind !== "architect-plan") return empty;
+  const parsed = parseJson(output);
+  if (!parsed.ok || validateAuthorship(parsed.value) !== null) return empty;
+  const read = (field) => {
+    const raw = parsed.value[field];
+    if (typeof raw !== "string") return null;
+    const normalized = normalizeAuthored(raw);
+    return normalized.length === 0 ? null : normalized;
+  };
+  return { commitMessage: read("commitMessage"), summary: read("summary") };
+}
+function validateDebugger(contract, output) {
+  const parsed = parseJson(output);
+  if (!parsed.ok) return failure(contract, "unmeasured", parsed.reason);
+  const value = parsed.value;
+  if (!hasOnlyKeys(value, ["diagnosis", "reproduction", "evidence"]) || !string(value.diagnosis) || value.reproduction !== "reproduced" && value.reproduction !== "not-reproduced" && value.reproduction !== "unknown" || !Array.isArray(value.evidence) || value.evidence.some((entry) => !string(entry))) {
+    return failure(
+      contract,
+      "unmeasured",
+      "Debugger result must carry diagnosis, reproduction status, and evidence without a verdict"
+    );
+  }
+  return success(contract, "unmeasured", value);
+}
+function validateResearch(contract, output, networkAllowed) {
+  const parsed = parseJson(output);
+  if (!parsed.ok) return failure(contract, "unmeasured", parsed.reason);
+  const value = parsed.value;
+  if (!hasOnlyKeys(value, ["source", "findings"]) || value.source !== "local" && value.source !== "external" || !Array.isArray(value.findings)) {
+    return failure(
+      contract,
+      "unmeasured",
+      "Research result must distinguish local or external sources and carry findings"
+    );
+  }
+  if (value.source === "external" && !networkAllowed) {
+    return failure(contract, "unmeasured", "external research requires an allowed network posture");
+  }
+  for (const finding of value.findings) {
+    if (finding === null || typeof finding !== "object" || Array.isArray(finding)) {
+      return failure(contract, "unmeasured", "Research findings must be objects");
+    }
+    const record = finding;
+    if (!hasOnlyKeys(record, ["claim", "evidence"]) || !string(record.claim) || !string(record.evidence)) {
+      return failure(contract, "unmeasured", "Research findings must carry claim and evidence");
+    }
+  }
+  return success(contract, "unmeasured", value);
+}
+function describeWriteSet(effects, cwd) {
+  if (effects.mutatedPaths.size === 0) return "this run wrote nothing";
+  const written = [...effects.mutatedPaths].map((target) => path.relative(cwd, target) || target).sort().slice(0, MUTATION_WRITE_SET_REASON_LIMIT);
+  const more = effects.mutatedPaths.size - written.length;
+  return `this run wrote ${written.join(", ")}${more > 0 ? ` (+${more} more)` : ""}`;
+}
+var MUTATION_WRITE_SET_REASON_LIMIT = 8;
+function pathIsPresent(filesystem, target) {
+  if (filesystem.pathExists === void 0) return true;
+  return filesystem.pathExists(target);
+}
+function validateMutation(contract, input) {
+  const parsed = parseJson(input.output);
+  if (!parsed.ok) return failure(contract, "unmeasured", parsed.reason);
+  const value = parsed.value;
+  if (!hasOnlyKeys(value, ["mutatedPaths", "validations", "commitMessage", "summary"]) || !Array.isArray(value.mutatedPaths) || value.mutatedPaths.some((entry) => !string(entry))) {
+    return failure(contract, "unmeasured", "Mutation result must carry mutatedPaths and validations");
+  }
+  const authorship = validateAuthorship(value);
+  if (authorship !== null) return failure(contract, "unmeasured", authorship);
+  const validations = parseChecks(value.validations);
+  if (validations === null)
+    return failure(contract, "unmeasured", "Mutation result must carry typed validation results");
+  const reportedFailure = !validations.every((check) => check.passed);
+  const effects = input.observedRunEffects;
+  if (effects === void 0) return success(contract, reportedFailure ? "fail" : "pass", value);
+  const cwd = path.resolve(input.cwd);
+  let unverifiedMutation = false;
+  for (const reported of value.mutatedPaths) {
+    const target = path.resolve(cwd, reported);
+    if (effects.mutatedPaths.has(target)) continue;
+    if (effects.failedMutationPaths.has(target)) {
+      return failure(
+        contract,
+        "unmeasured",
+        `Mutation result names a path whose only write this run attempted was refused: ${reported} (${describeWriteSet(effects, cwd)})`
+      );
+    }
+    if (pathIsPresent(input.filesystem, target)) {
+      unverifiedMutation = true;
+      continue;
+    }
+    return failure(
+      contract,
+      "unmeasured",
+      `Mutation result names a path this run never wrote and that does not exist: ${reported} (${describeWriteSet(effects, cwd)})`
+    );
+  }
+  if (reportedFailure) return success(contract, "fail", value);
+  const measured = !unverifiedMutation && effects.validationCommands.size > 0;
+  return success(contract, measured ? "pass" : "unmeasured", value);
+}
+function validateProvenance(contract, output) {
+  const parsed = parseJson(output);
+  if (!parsed.ok) return failure(contract, "unmeasured", parsed.reason);
+  const value = parsed.value;
+  if (!hasOnlyKeys(value, ["confirmedFacts", "missingEvidence", "nextInspections"]) || ![value.confirmedFacts, value.missingEvidence, value.nextInspections].every(
+    (entry) => Array.isArray(entry) && entry.every((item) => string(item))
+  )) {
+    return failure(
+      contract,
+      "unmeasured",
+      "Provenance result must carry confirmedFacts, missingEvidence, and nextInspections"
+    );
+  }
+  return success(contract, "unmeasured", value);
+}
+function validateArchitect(contract, input) {
+  const artifactPath = path.resolve(input.cwd, contract.path);
+  const content = input.filesystem.readFile(artifactPath);
+  if (content === null || content.trim().length === 0) {
+    return failure(contract, "unmeasured", `required plan artifact is missing or empty: ${contract.path}`);
+  }
+  return success(contract, "unmeasured", {
+    path: contract.path,
+    artifactDigest: createHash("sha256").update(content, "utf8").digest("hex")
+  });
+}
+function parseScoutResult(output) {
+  const validation = validateScout({ kind: "scout-report" }, output);
+  if (validation.conformance !== "pass" || validation.scout === void 0) return null;
+  return validation.scout.degradedReason === void 0 ? validation.scout : null;
+}
+function validateResultContract(input) {
+  switch (input.contract.kind) {
+    case "architect-plan":
+      return validateArchitect(input.contract, input);
+    case "scout-report": {
+      const validation = validateScout(input.contract, input.output);
+      if (validation.scout === void 0) return validation;
+      const degradedReason = validation.scout.degradedReason;
+      if (degradedReason !== void 0) {
+        return groundDegradedScout(input.contract, input, validation.scout, degradedReason);
+      }
+      const citations = validateScoutCitations(input, validation.scout.citations);
+      return citations.ok ? success(
+        input.contract,
+        "pass",
+        { scout: validation.scout, evidence: citations.evidence },
+        { scout: validation.scout }
+      ) : failure(input.contract, "fail", citations.reason);
+    }
+    case "verifier-report":
+      return validateVerifier(input.contract, input.output);
+    case "debugger-report":
+      return validateDebugger(input.contract, input.output);
+    case "research-report":
+      return validateResearch(input.contract, input.output, input.networkAllowed);
+    case "mutation-report":
+      return validateMutation(input.contract, input);
+    case "provenance-report":
+      return validateProvenance(input.contract, input.output);
+    case "external-delegation":
+      return success(input.contract, "unmeasured", { external: true });
+    case "artifact-report":
+      return success(input.contract, "unmeasured", { artifact: true });
+    case "context-handbook":
+      return validateContextHandbook(input.contract, input.output);
+    case "code-report":
+      return validateCodeReport(input.contract, input.output);
+  }
+}
+function validateRecipeResult(input) {
+  if (input.contract === null) return null;
+  if (!input.reachedTerminalResult) {
+    return {
+      applicable: false,
+      fact: {
+        sourceId: resultContractSourceId(input.contract),
+        validatorDigest: digest({ contract: input.contract, reached: false }),
+        conformance: "not-reached",
+        quality: "unmeasured"
+      }
+    };
+  }
+  const validation = validateResultContract({
+    contract: input.contract,
+    output: input.output,
+    cwd: input.cwd,
+    networkAllowed: input.networkAllowed,
+    filesystem: input.filesystem,
+    ...input.observedRunEffects !== void 0 ? { observedRunEffects: input.observedRunEffects } : {}
+  });
+  return {
+    applicable: true,
+    validation,
+    fact: {
+      sourceId: validation.sourceId,
+      validatorDigest: validation.validatorDigest,
+      conformance: validation.conformance,
+      quality: validation.quality
+    }
+  };
+}
+var RESULT_CONTRACT_REPAIR_LIMIT = 2;
+var RESULT_CONTRACT_ANCHOR_LIMIT = 12;
+function resultContractShape(contract) {
+  switch (contract.kind) {
+    case "architect-plan":
+      return `a plan artifact written to ${contract.path}, then optionally {"commitMessage":"...","summary":"..."} describing it`;
+    case "scout-report":
+      return '{"findings":[{"claim":"what you observed","path":"src/file.ts","line":1}],"needsSplit":false,"proposedSubtasks":[]} or {"findings":[],"needsSplit":true,"proposedSubtasks":[{"id":"inspect","task":"Inspect the boundary","dependencies":[],"expectedResultContract":"scout-report","requestedAuthority":"read-only"}]} or, if you cannot produce a citation you are sure of, at least {"findings":[{"claim":"what you observed"}]}, which is accepted as an ungrounded lead rather than losing the run';
+    case "verifier-report":
+      return '{"verdict":"pass","checks":[{"name":"npm run typecheck","passed":true,"evidence":"exit 0"}]}';
+    case "debugger-report":
+      return '{"diagnosis":"...","reproduction":"reproduced","evidence":["..."]}';
+    case "research-report":
+      return '{"source":"local","findings":[{"claim":"...","evidence":"..."}]}';
+    case "mutation-report":
+      return '{"mutatedPaths":["src/file.ts"],"validations":[{"name":"npm test","passed":true,"evidence":"exit 0"}],"commitMessage":"optional: the commit message for this change","summary":"optional: one line"}';
+    case "provenance-report":
+      return '{"confirmedFacts":["..."],"missingEvidence":["..."],"nextInspections":["..."]}';
+    case "external-delegation":
+      return "any final text";
+    case "artifact-report":
+      return "any final text; the artifact you wrote at the location the task named is the result";
+    case "context-handbook":
+      return '{"projectName":"string","identity":"one sentence","conventions":[],"invariants":[],"sections":[{"title":"Architecture","body":"markdown that cites `real/path.ts` tokens"}]}';
+    case "code-report":
+      return '{"passed":false,"exitCode":1,"checks":[{"name":"test","passed":false,"evidence":"exit 1"}],"artifactPaths":["/path/command.log"],"outputExcerpt":"..."}';
+  }
+}
+function resultContractRepairMessage(input) {
+  const last = input.attempt >= RESULT_CONTRACT_REPAIR_LIMIT;
+  const lines = [
+    last ? "FINAL RESULT REQUIRED IN THIS RESPONSE. Your previous response still did not satisfy this run's result contract." : "Your previous response did not satisfy this run's result contract.",
+    `Validator reason: ${input.reason}`,
+    "Tool use is over. Answer from the evidence you already gathered.",
+    `Emit exactly this shape and nothing else: ${resultContractShape(input.contract)}`,
+    "Do not add prose, code fences, or commentary around it. Do not describe work you intend to do next."
+  ];
+  if (input.anchors.length > 0) {
+    lines.push(
+      "",
+      "Locations you read successfully in this run (use these exact path:line values):",
+      ...input.anchors.slice(-RESULT_CONTRACT_ANCHOR_LIMIT).map((anchor) => `- ${anchor}`)
+    );
+  }
+  return lines.join("\n");
+}
+function parseResultContract(value, sourcePath) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`agent recipe: ${sourcePath}: resultContract must be an object`);
+  }
+  const record = value;
+  if (typeof record.kind !== "string") throw new Error(`agent recipe: ${sourcePath}: resultContract.kind is required`);
+  const keys = Object.keys(record);
+  const only = (...allowed) => keys.every((key) => allowed.includes(key));
+  if (record.kind === "architect-plan") {
+    if (!only("kind", "path") || !string(record.path)) {
+      throw new Error(`agent recipe: ${sourcePath}: architect-plan requires only non-empty path`);
+    }
+    if (path.isAbsolute(record.path) || record.path.split(/[\\/]/u).includes("..")) {
+      throw new Error(`agent recipe: ${sourcePath}: architect-plan path must be workspace-relative`);
+    }
+    return { kind: "architect-plan", path: record.path };
+  }
+  const kinds = [
+    "scout-report",
+    "verifier-report",
+    "debugger-report",
+    "research-report",
+    "mutation-report",
+    "provenance-report",
+    "external-delegation",
+    "artifact-report",
+    "context-handbook"
+  ];
+  if (!kinds.includes(record.kind) || !only("kind")) {
+    throw new Error(`agent recipe: ${sourcePath}: resultContract.kind is unsupported or has unknown keys`);
+  }
+  return { kind: record.kind };
+}
+
+// src/domains/agents/fleet-commands.ts
+import { existsSync, readFileSync } from "node:fs";
+import { isAbsolute, join, normalize } from "node:path";
+import { Type } from "typebox";
+import { Value } from "typebox/value";
+import yaml from "yaml";
+var FLEET_COMMAND_MAX_TIMEOUT_MS = 36e5;
+var FLEET_COMMAND_MIN_TIMEOUT_MS = 1e3;
+var FLEET_COMMAND_DEFAULT_TIMEOUT_MS = 6e5;
+var FLEET_COMMAND_BASE_ENV = ["PATH", "HOME", "LANG", "LC_ALL", "TZ", "TMPDIR"];
+var CommandSchema = Type.Object(
+  {
+    argv: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),
+    cwd: Type.Optional(Type.String({ minLength: 1 })),
+    timeoutMs: Type.Optional(
+      Type.Integer({ minimum: FLEET_COMMAND_MIN_TIMEOUT_MS, maximum: FLEET_COMMAND_MAX_TIMEOUT_MS })
+    ),
+    env: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
+    description: Type.Optional(Type.String())
+  },
+  { additionalProperties: false }
+);
+var RegistrySchema = Type.Object(
+  {
+    version: Type.Literal(1),
+    commands: Type.Record(Type.String({ minLength: 1 }), CommandSchema, { minProperties: 1 })
+  },
+  { additionalProperties: false }
+);
+var COMMAND_ID_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/u;
+var ENV_NAME_RE = /^[A-Z_][A-Z0-9_]*$/u;
+function fleetCommandsPath(cwd) {
+  return join(cwd, ".clio-coder", "fleets", "commands.yaml");
+}
+function firstSchemaError(value) {
+  if (Value.Check(RegistrySchema, value)) return null;
+  const first = [...Value.Errors(RegistrySchema, value)][0];
+  return first ? `${first.instancePath || "(root)"}: ${first.message}` : "command registry failed validation";
+}
+function checkCwd(id, value, sourcePath) {
+  if (isAbsolute(value)) {
+    throw new Error(`fleet commands ${sourcePath}: command '${id}' cwd must be workspace-relative`);
+  }
+  const normalized = normalize(value);
+  if (normalized === ".." || normalized.startsWith(`..${"/"}`) || normalized.split(/[\\/]/u).includes("..")) {
+    throw new Error(`fleet commands ${sourcePath}: command '${id}' cwd escapes the workspace`);
+  }
+  return normalized === "." ? "" : normalized;
+}
+function parseFleetCommands(raw, sourcePath) {
+  let parsed;
+  try {
+    parsed = yaml.parse(raw);
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    throw new Error(`fleet commands ${sourcePath}: invalid YAML (${reason})`);
+  }
+  const schemaError = firstSchemaError(parsed);
+  if (schemaError !== null) throw new Error(`fleet commands ${sourcePath}: ${schemaError}`);
+  const registry = parsed;
+  const commands = /* @__PURE__ */ new Map();
+  for (const [id, entry] of Object.entries(registry.commands)) {
+    if (!COMMAND_ID_RE.test(id)) {
+      throw new Error(`fleet commands ${sourcePath}: command id '${id}' must match ${COMMAND_ID_RE.source}`);
+    }
+    const executable = entry.argv[0] ?? "";
+    if (executable.trim().length === 0) {
+      throw new Error(`fleet commands ${sourcePath}: command '${id}' has an empty executable`);
+    }
+    for (const name of entry.env ?? []) {
+      if (!ENV_NAME_RE.test(name)) {
+        throw new Error(`fleet commands ${sourcePath}: command '${id}' env name '${name}' is not a variable name`);
+      }
+    }
+    commands.set(id, {
+      id,
+      argv: [...entry.argv],
+      cwd: entry.cwd === void 0 ? "" : checkCwd(id, entry.cwd, sourcePath),
+      timeoutMs: entry.timeoutMs ?? FLEET_COMMAND_DEFAULT_TIMEOUT_MS,
+      env: [...entry.env ?? []],
+      description: entry.description ?? ""
+    });
+  }
+  return { version: 1, commands, path: sourcePath };
+}
+function loadFleetCommands(cwd) {
+  const path7 = fleetCommandsPath(cwd);
+  if (!existsSync(path7)) return null;
+  return parseFleetCommands(readFileSync(path7, "utf8"), path7);
+}
+
+// src/domains/agents/fleet-contract.ts
+import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2 } from "node:fs";
+import { basename, join as join2 } from "node:path";
+import { Type as Type2 } from "typebox";
+import { Value as Value2 } from "typebox/value";
+
+// src/domains/agents/frontmatter.ts
+import yaml2 from "yaml";
+function parseFrontmatter(raw, sourcePath) {
+  const opening = raw.match(/^---\r?\n/);
+  if (!opening) {
+    throw new Error(`frontmatter: ${sourcePath}: missing YAML frontmatter opening delimiter`);
+  }
+  const closeRegex = /\r?\n---(?:\r?\n|$)/g;
+  closeRegex.lastIndex = opening[0].length;
+  const closing = closeRegex.exec(raw);
+  if (!closing) {
+    throw new Error(`frontmatter: ${sourcePath}: missing YAML frontmatter closing delimiter`);
+  }
+  const frontmatterText = raw.slice(opening[0].length, closing.index);
+  const body = raw.slice(closing.index + closing[0].length);
+  let parsed;
+  try {
+    parsed = yaml2.parse(frontmatterText);
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    throw new Error(`frontmatter: ${sourcePath}: invalid YAML frontmatter (${reason})`);
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`frontmatter: ${sourcePath}: frontmatter must be a YAML object`);
+  }
+  return {
+    frontmatter: parsed,
+    body
+  };
+}
+
+// src/domains/agents/write-boundary.ts
+var WRITE_BOUNDARY_MAX_ENTRIES = 32;
+var GLOB_CHARACTERS = /[*?[\]{}]/u;
+function normalizeWriteBoundaryEntry(entry) {
+  const raw = entry.trim();
+  if (raw.length === 0) throw new Error("write boundary: entry must be a non-empty path");
+  if (raw.includes("\\")) {
+    throw new Error(`write boundary: entry '${entry}' must use '/' separators`);
+  }
+  if (GLOB_CHARACTERS.test(raw)) {
+    throw new Error(`write boundary: entry '${entry}' looks like a glob, which v1 does not support`);
+  }
+  if (raw.startsWith("/") || /^[A-Za-z]:/u.test(raw)) {
+    throw new Error(`write boundary: entry '${entry}' must be repository-relative, not absolute`);
+  }
+  const subtree = raw.endsWith("/");
+  const segments = raw.split("/").filter((segment) => segment.length > 0);
+  if (segments.length === 0) {
+    throw new Error(`write boundary: entry '${entry}' must name a path inside the repository`);
+  }
+  for (const segment of segments) {
+    if (segment === "..") throw new Error(`write boundary: entry '${entry}' must not contain '..'`);
+    if (segment === ".") throw new Error(`write boundary: entry '${entry}' must not contain '.' segments`);
+  }
+  const joined = segments.join("/");
+  return subtree ? `${joined}/` : joined;
+}
+function normalizeWriteBoundary(entries) {
+  if (entries.length > WRITE_BOUNDARY_MAX_ENTRIES) {
+    throw new Error(`write boundary: at most ${WRITE_BOUNDARY_MAX_ENTRIES} entries may be declared`);
+  }
+  const normalized = new Set(entries.map(normalizeWriteBoundaryEntry));
+  return [...normalized].sort();
+}
+function toRepoRelativePosix(path7) {
+  return path7.split("\\").join("/");
+}
+function writeBoundaryCovers(boundary, path7) {
+  const candidate = toRepoRelativePosix(path7);
+  return boundary.some((entry) => entry.endsWith("/") ? candidate.startsWith(entry) : candidate === entry);
+}
+function describeWriteBoundary(boundary) {
+  return boundary.length === 0 ? "(nothing: readonly)" : boundary.join(", ");
+}
+
+// src/domains/agents/fleet-contract.ts
+var FLEET_WRITE_BOUNDARY_VERSION = 4;
+var FLEET_LOOP_MAX_ATTEMPTS = 5;
+var FleetScopeSchema = Type2.Union([Type2.Literal("readonly"), Type2.Literal("workspace")]);
+function writesSchema(version) {
+  return version >= FLEET_WRITE_BOUNDARY_VERSION ? { writes: Type2.Optional(Type2.Array(Type2.String({ minLength: 1 }), { maxItems: WRITE_BOUNDARY_MAX_ENTRIES })) } : {};
+}
+function agentStepSchema(version) {
+  return Type2.Object(
+    {
+      kind: Type2.Optional(Type2.Literal("agent")),
+      id: Type2.String({ minLength: 1 }),
+      agent: Type2.String({ minLength: 1 }),
+      scope: FleetScopeSchema,
+      dependencies: Type2.Array(Type2.String({ minLength: 1 })),
+      ...writesSchema(version)
+    },
+    { additionalProperties: false }
+  );
+}
+function codeStepSchema(version) {
+  return Type2.Object(
+    {
+      kind: Type2.Literal("code"),
+      id: Type2.String({ minLength: 1 }),
+      command: Type2.String({ minLength: 1 }),
+      scope: FleetScopeSchema,
+      dependencies: Type2.Array(Type2.String({ minLength: 1 })),
+      ...version >= 3 ? { commitFrom: Type2.Optional(Type2.Array(Type2.String({ minLength: 1 }), { minItems: 1 })) } : {},
+      ...writesSchema(version)
+    },
+    { additionalProperties: false }
+  );
+}
+function loopStepSchema(version) {
+  return Type2.Object(
+    {
+      kind: Type2.Literal("loop"),
+      id: Type2.String({ minLength: 1 }),
+      // Required and finite: this is the whole point of the construct.
+      maxAttempts: Type2.Integer({ minimum: 1, maximum: FLEET_LOOP_MAX_ATTEMPTS }),
+      dependencies: Type2.Array(Type2.String({ minLength: 1 })),
+      check: Type2.Union([
+        Type2.Object(
+          {
+            kind: Type2.Literal("code"),
+            command: Type2.String({ minLength: 1 }),
+            scope: FleetScopeSchema,
+            ...writesSchema(version)
+          },
+          { additionalProperties: false }
+        ),
+        Type2.Object(
+          {
+            kind: Type2.Literal("agent"),
+            agent: Type2.String({ minLength: 1 }),
+            scope: FleetScopeSchema,
+            ...writesSchema(version)
+          },
+          { additionalProperties: false }
+        )
+      ]),
+      repair: Type2.Object(
+        {
+          kind: Type2.Optional(Type2.Literal("agent")),
+          agent: Type2.String({ minLength: 1 }),
+          scope: FleetScopeSchema,
+          ...writesSchema(version)
+        },
+        { additionalProperties: false }
+      )
+    },
+    { additionalProperties: false }
+  );
+}
+function stepSchema(version) {
+  if (version === 1) return agentStepSchema(1);
+  if (version === 2) return Type2.Union([agentStepSchema(2), codeStepSchema(2)]);
+  return Type2.Union([agentStepSchema(version), codeStepSchema(version), loopStepSchema(version)]);
+}
+function frontmatterSchema(version) {
+  return Type2.Object(
+    {
+      version: Type2.Literal(version),
+      name: Type2.String({ minLength: 1 }),
+      description: Type2.Optional(Type2.String()),
+      steps: Type2.Array(stepSchema(version), { minItems: 1 }),
+      maxWorkers: Type2.Integer({ minimum: 1 }),
+      budgetUsd: Type2.Optional(Type2.Number()),
+      onFailure: Type2.Union([Type2.Literal("stop"), Type2.Literal("continue")])
+    },
+    { additionalProperties: false }
+  );
+}
+var SCHEMAS = {
+  1: frontmatterSchema(1),
+  2: frontmatterSchema(2),
+  3: frontmatterSchema(3),
+  4: frontmatterSchema(4)
+};
+function contractVersion(frontmatter) {
+  const value = frontmatter.version;
+  return value === 1 || value === 2 || value === 3 || value === 4 ? value : null;
+}
+function firstSchemaError2(frontmatter, version) {
+  const schema = SCHEMAS[version];
+  if (Value2.Check(schema, frontmatter)) return null;
+  const first = [...Value2.Errors(schema, frontmatter)][0];
+  return first ? `${first.instancePath || "(root)"}: ${first.message}` : "front matter failed validation";
+}
+function fleetsDir(cwd) {
+  return join2(cwd, ".clio-coder", "fleets");
+}
+function normalizedWrites(writes) {
+  return writes === void 0 ? {} : { writes: normalizeWriteBoundary(writes) };
+}
+function normalizeStep(step) {
+  if (step.kind === "loop") {
+    const check = step.check;
+    const repair = step.repair;
+    return {
+      kind: "loop",
+      id: step.id,
+      maxAttempts: step.maxAttempts ?? 0,
+      dependencies: [...step.dependencies],
+      check: check.kind === "code" ? { kind: "code", command: check.command ?? "", scope: check.scope, ...normalizedWrites(check.writes) } : { kind: "agent", agent: check.agent ?? "", scope: check.scope, ...normalizedWrites(check.writes) },
+      repair: { kind: "agent", agent: repair.agent, scope: repair.scope, ...normalizedWrites(repair.writes) }
+    };
+  }
+  if (step.kind === "code") {
+    return {
+      kind: "code",
+      id: step.id,
+      command: step.command ?? "",
+      scope: step.scope,
+      dependencies: [...step.dependencies],
+      ...step.commitFrom !== void 0 ? { commitFrom: [...step.commitFrom] } : {},
+      ...normalizedWrites(step.writes)
+    };
+  }
+  return {
+    kind: "agent",
+    id: step.id,
+    agent: step.agent ?? "",
+    scope: step.scope,
+    dependencies: [...step.dependencies],
+    ...normalizedWrites(step.writes)
+  };
+}
+function fleetLoopCheckStepId(loopId, attempt) {
+  return `${loopId}.check.${attempt}`;
+}
+function fleetLoopRepairStepId(loopId, attempt) {
+  return `${loopId}.repair.${attempt}`;
+}
+function occupiedIds(contract) {
+  const owners = /* @__PURE__ */ new Map();
+  for (const step of contract.steps) {
+    owners.set(step.id, step.id);
+    if (step.kind !== "loop") continue;
+    for (let attempt = 1; attempt <= step.maxAttempts; attempt++) {
+      owners.set(fleetLoopCheckStepId(step.id, attempt), step.id);
+      if (attempt < step.maxAttempts) owners.set(fleetLoopRepairStepId(step.id, attempt), step.id);
+    }
+  }
+  return owners;
+}
+function validateFleetGraph(contract) {
+  const declared = /* @__PURE__ */ new Set();
+  for (const step of contract.steps) {
+    if (declared.has(step.id)) throw new Error(`fleet contract ${contract.path}: duplicate step id '${step.id}'`);
+    declared.add(step.id);
+  }
+  const owners = /* @__PURE__ */ new Map();
+  for (const step of contract.steps) {
+    if (step.kind !== "loop") continue;
+    for (const [generated, owner] of occupiedIds({ steps: [step] })) {
+      if (generated === step.id) continue;
+      if (declared.has(generated)) {
+        throw new Error(
+          `fleet contract ${contract.path}: step id '${generated}' collides with an id loop '${owner}' generates`
+        );
+      }
+      owners.set(generated, owner);
+    }
+  }
+  for (const step of contract.steps) {
+    for (const dependency of step.dependencies) {
+      if (dependency === step.id) throw new Error(`fleet contract ${contract.path}: step '${step.id}' depends on itself`);
+      if (!declared.has(dependency)) {
+        throw new Error(`fleet contract ${contract.path}: step '${step.id}' has unknown dependency '${dependency}'`);
+      }
+    }
+  }
+  const remaining = new Set(declared);
+  const settled = /* @__PURE__ */ new Set();
+  while (remaining.size > 0) {
+    const ready = contract.steps.filter(
+      (step) => remaining.has(step.id) && step.dependencies.every((dependency) => settled.has(dependency))
+    );
+    if (ready.length === 0) {
+      throw new Error(`fleet contract ${contract.path}: dependency cycle among steps ${[...remaining].sort().join(", ")}`);
+    }
+    for (const step of ready) {
+      remaining.delete(step.id);
+      settled.add(step.id);
+    }
+  }
+  const ancestors = fleetStepAncestors(contract.steps);
+  for (const step of contract.steps) {
+    if (step.kind !== "code" || step.commitFrom === void 0) continue;
+    for (const source of step.commitFrom) {
+      const target = contract.steps.find((candidate) => candidate.id === source);
+      if (target === void 0) {
+        throw new Error(`fleet contract ${contract.path}: commit step '${step.id}' names unknown source '${source}'`);
+      }
+      if (target.kind === "code") {
+        throw new Error(
+          `fleet contract ${contract.path}: commit step '${step.id}' source '${source}' is a code step and authors no commit message`
+        );
+      }
+      if (!(ancestors.get(step.id)?.has(source) ?? false)) {
+        throw new Error(
+          `fleet contract ${contract.path}: commit step '${step.id}' must depend on its message source '${source}'`
+        );
+      }
+    }
+  }
+}
+function fleetStepWriteBoundary(version, scope, writes) {
+  if (version < FLEET_WRITE_BOUNDARY_VERSION) return void 0;
+  return scope === "readonly" ? [] : [...writes ?? []];
+}
+function fleetStepBoundaries(contract) {
+  const boundaries = [];
+  const add = (id, scope, writes) => {
+    boundaries.push({ id, scope, writes: fleetStepWriteBoundary(contract.version, scope, writes) });
+  };
+  for (const step of contract.steps) {
+    if (step.kind === "loop") {
+      add(`${step.id}.check`, step.check.scope, step.check.writes);
+      add(`${step.id}.repair`, step.repair.scope, step.repair.writes);
+      continue;
+    }
+    add(step.id, step.scope, step.writes);
+  }
+  return boundaries;
+}
+function validateWriteBoundaries(contract) {
+  if (contract.version < FLEET_WRITE_BOUNDARY_VERSION) return;
+  for (const position of fleetStepBoundaries(contract)) {
+    if (position.scope === "workspace" && (position.writes?.length ?? 0) === 0) {
+      throw new Error(
+        `fleet contract ${contract.path}: step '${position.id}' has scope 'workspace' and must declare a non-empty 'writes' allowlist at version ${FLEET_WRITE_BOUNDARY_VERSION}`
+      );
+    }
+  }
+  for (const step of contract.steps) {
+    const declared = step.kind === "loop" ? [
+      { id: `${step.id}.check`, scope: step.check.scope, writes: step.check.writes },
+      { id: `${step.id}.repair`, scope: step.repair.scope, writes: step.repair.writes }
+    ] : [{ id: step.id, scope: step.scope, writes: step.writes }];
+    for (const position of declared) {
+      if (position.scope === "readonly" && position.writes !== void 0) {
+        throw new Error(
+          `fleet contract ${contract.path}: step '${position.id}' is 'readonly', which is the empty allowlist; remove its 'writes' or give it scope 'workspace'`
+        );
+      }
+    }
+  }
+}
+function fleetStepAncestors(steps) {
+  const direct = new Map(steps.map((step) => [step.id, step.dependencies]));
+  const closure = /* @__PURE__ */ new Map();
+  const resolve = (id, seen) => {
+    const cached = closure.get(id);
+    if (cached !== void 0) return cached;
+    const result = /* @__PURE__ */ new Set();
+    if (seen.has(id)) return result;
+    seen.add(id);
+    for (const dependency of direct.get(id) ?? []) {
+      result.add(dependency);
+      for (const inherited of resolve(dependency, seen)) result.add(inherited);
+    }
+    closure.set(id, result);
+    return result;
+  };
+  for (const step of steps) resolve(step.id, /* @__PURE__ */ new Set());
+  return closure;
+}
+function parseFleetContract(raw, sourcePath) {
+  const { frontmatter, body } = parseFrontmatter(raw, sourcePath);
+  const version = contractVersion(frontmatter);
+  if (version === null) {
+    throw new Error(
+      `fleet contract ${sourcePath}: version must be 1 (agent steps), 2 (agent and code steps), 3 (adds bounded loops and commit steps), or 4 (adds enforced write boundaries)`
+    );
+  }
+  if (version < FLEET_WRITE_BOUNDARY_VERSION) assertNoWritesBefore(frontmatter, sourcePath, version);
+  const schemaError = firstSchemaError2(frontmatter, version);
+  if (schemaError !== null) {
+    throw new Error(`fleet contract ${sourcePath}: ${schemaError}`);
+  }
+  const fm = frontmatter;
+  if (fm.budgetUsd !== void 0 && !(fm.budgetUsd > 0)) {
+    throw new Error(`fleet contract ${sourcePath}: budgetUsd must be a positive number`);
+  }
+  const trimmedBody = body.trim();
+  if (trimmedBody.length === 0) {
+    throw new Error(`fleet contract ${sourcePath}: prompt body is empty`);
+  }
+  const contract = {
+    version,
+    name: fm.name,
+    description: fm.description ?? "",
+    steps: fm.steps.map(normalizeStep),
+    maxWorkers: fm.maxWorkers,
+    budgetUsd: fm.budgetUsd ?? null,
+    onFailure: fm.onFailure,
+    body: trimmedBody,
+    path: sourcePath
+  };
+  validateFleetGraph(contract);
+  validateWriteBoundaries(contract);
+  return contract;
+}
+function assertNoWritesBefore(frontmatter, sourcePath, version) {
+  const steps = Array.isArray(frontmatter.steps) ? frontmatter.steps : [];
+  const declaresWrites = (value) => typeof value === "object" && value !== null && "writes" in value;
+  for (const step of steps) {
+    const raw = step;
+    if (declaresWrites(raw) || declaresWrites(raw.check) || declaresWrites(raw.repair)) {
+      throw new Error(
+        `fleet contract ${sourcePath}: 'writes' requires contract version ${FLEET_WRITE_BOUNDARY_VERSION}; this contract declares version ${version}, where the declaration would not be enforced`
+      );
+    }
+  }
+}
+function fleetCodeSteps(contract) {
+  const steps = [];
+  for (const step of contract.steps) {
+    if (step.kind === "code") steps.push({ id: step.id, command: step.command });
+    else if (step.kind === "loop" && step.check.kind === "code") {
+      steps.push({ id: fleetLoopCheckStepId(step.id, 1), command: step.check.command });
+    }
+  }
+  return steps;
+}
+var FLEET_COMMANDS_REPO_PATH = ".clio-coder/fleets/commands.yaml";
+var FLEET_COMMANDS_REMEDY = "declare each id there under `commands:` with an `argv` list; `clio-coder docs fleet_dispatch` has the schema";
+var FleetCommandRegistryMissingError = class extends Error {
+  constructor(contractPath, commands) {
+    super(
+      `fleet contract ${contractPath}: code steps require a command registry at ${FLEET_COMMANDS_REPO_PATH} declaring ${commands.join(", ")}`
+    );
+    this.contractPath = contractPath;
+    this.commands = commands;
+    this.name = "FleetCommandRegistryMissingError";
+  }
+  contractPath;
+  commands;
+};
+function validateFleetCommands(contract, registry) {
+  const codeSteps = fleetCodeSteps(contract);
+  if (codeSteps.length === 0) return;
+  if (registry === null) {
+    throw new FleetCommandRegistryMissingError(contract.path, [...new Set(codeSteps.map((step) => step.command))].sort());
+  }
+  for (const step of codeSteps) {
+    if (!registry.commands.has(step.command)) {
+      const known = [...registry.commands.keys()].sort().join(", ");
+      throw new Error(
+        `fleet contract ${contract.path}: step '${step.id}' names unknown command '${step.command}' (registered: ${known || "none"})`
+      );
+    }
+  }
+}
+function builtinFleetsDir() {
+  return join2(resolvePackageRoot(), "src", "domains", "agents", "fleets");
+}
+function fleetContractPath(cwd, name) {
+  const projectPath = join2(fleetsDir(cwd), `${name}.md`);
+  if (existsSync2(projectPath)) return { path: projectPath, source: "project" };
+  const builtinPath = join2(builtinFleetsDir(), `${name}.md`);
+  if (existsSync2(builtinPath)) return { path: builtinPath, source: "builtin" };
+  return null;
+}
+function loadFleetContract(cwd, name) {
+  const located = fleetContractPath(cwd, name);
+  if (located === null) {
+    throw new Error(`fleet contract not found: ${join2(fleetsDir(cwd), `${name}.md`)} (and no builtin named '${name}')`);
+  }
+  const contract = parseFleetContract(readFileSync2(located.path, "utf8"), located.path);
+  validateFleetCommands(contract, loadFleetCommands(cwd));
+  return contract;
+}
+function listDirectory(dir) {
+  if (!existsSync2(dir)) return [];
+  try {
+    return readdirSync(dir).filter((name) => name.endsWith(".md")).sort();
+  } catch {
+    return [];
+  }
+}
+function listFleetContracts(cwd) {
+  let registry = null;
+  let registryError = null;
+  try {
+    registry = loadFleetCommands(cwd);
+  } catch (err) {
+    registryError = err instanceof Error ? err.message : String(err);
+  }
+  const listings = /* @__PURE__ */ new Map();
+  const sources = [
+    { dir: builtinFleetsDir(), source: "builtin" },
+    { dir: fleetsDir(cwd), source: "project" }
+  ];
+  for (const { dir, source } of sources) {
+    for (const file of listDirectory(dir)) {
+      const path7 = join2(dir, file);
+      const name = basename(file, ".md");
+      try {
+        const contract = parseFleetContract(readFileSync2(path7, "utf8"), path7);
+        if (registryError !== null && fleetCodeSteps(contract).length > 0) throw new Error(registryError);
+        validateFleetCommands(contract, registry);
+        listings.set(name, { name, path: path7, source, contract, error: null, needsCommands: null });
+      } catch (err) {
+        listings.set(name, {
+          name,
+          path: path7,
+          source,
+          contract: null,
+          error: err instanceof Error ? err.message : String(err),
+          // A registry this repo never wrote is unfinished setup. A registry
+          // that exists and does not parse, or one missing an id the contract
+          // names, is a real error and stays one.
+          needsCommands: err instanceof FleetCommandRegistryMissingError ? err.commands : null
+        });
+      }
+    }
+  }
+  return [...listings.values()].sort((left, right) => left.name.localeCompare(right.name));
+}
+var PLACEHOLDER_RE = /\{\{\s*([A-Za-z_][A-Za-z0-9_-]*)\s*\}\}/g;
+function renderFleetPrompt(body, vars) {
+  const missing = /* @__PURE__ */ new Set();
+  const rendered = body.replace(PLACEHOLDER_RE, (_match, name) => {
+    const value = vars[name];
+    if (value === void 0) {
+      missing.add(name);
+      return "";
+    }
+    return value;
+  });
+  if (missing.size > 0) {
+    throw new Error(`fleet prompt: unresolved template variables: ${[...missing].join(", ")} (pass --var name=value)`);
+  }
+  return rendered;
+}
+
+// src/domains/safety/autonomy.ts
+var AUTONOMY_LEVELS = ["read-only", "suggest", "auto-edit", "full-auto"];
+var DEFAULT_AUTONOMY_LEVEL = "auto-edit";
+function isAutonomyLevel(value) {
+  return typeof value === "string" && AUTONOMY_LEVELS.includes(value);
+}
+function mapAutonomy(level, actionClass, options = {}) {
+  if (actionClass === "read") return "allow";
+  if (actionClass === "git_destructive") return "deny";
+  if (level === "read-only") return "deny";
+  if (level === "suggest") return "ask";
+  switch (actionClass) {
+    case "write":
+      return "allow";
+    case "dispatch":
+      if (options.dispatchPlanScale === true && level !== "full-auto") return "ask";
+      return "allow";
+    case "execute": {
+      if (options.executeRecognized !== false) return "allow";
+      return level === "full-auto" ? "allow" : "ask";
+    }
+    case "unknown":
+      return "ask";
+    default:
+      return "ask";
+  }
+}
+function autonomyDenyRejection(level, tool, actionClass) {
+  return {
+    short: `${tool} denied: autonomy level is ${level}`,
+    detail: `Clio is at autonomy ${level}: ${actionClass} actions are denied without prompting. Describe the change you would make instead, so the operator can apply it or raise the autonomy level.`,
+    hints: ["Propose the exact edit or command as text.", "The operator can change the level in /settings."]
+  };
+}
+function autonomyAskRejection(level, tool, actionClass) {
+  return {
+    short: `${tool} needs approval (${actionClass}) at autonomy ${level}`,
+    detail: `Autonomy ${level} routes ${actionClass} actions through operator approval. The call is parked until the operator approves it once or cancels it.`,
+    hints: [
+      "Approving resumes only this call.",
+      "Recognized commands can be added to .clio-coder/safety.yaml.",
+      // The sanctioned pivots for a gated shell command: typed verification
+      // and read-class observe tools run without approval at this level,
+      // and models otherwise stall retrying denied bash for checks or
+      // directory listings.
+      ...actionClass === "execute" ? [
+        'A declared package.json check runs without approval through the verify tool: verify(check="<script>").',
+        "Read-only inspection runs without approval through the ls, read, grep, and find tools."
+      ] : []
+    ]
+  };
+}
+
+// src/domains/safety/loop-detector.ts
+var DEFAULT_WINDOW_MS = 3e4;
+var DEFAULT_MAX_REPEATS = 3;
+var DEFAULT_KEEP_LAST_ATTEMPTS = 4;
+function createLoopState(opts) {
+  const windowMs = opts?.windowMs ?? DEFAULT_WINDOW_MS;
+  const maxRepeats = opts?.maxRepeats ?? DEFAULT_MAX_REPEATS;
+  const keepLastAttempts = opts?.keepLastAttempts ?? DEFAULT_KEEP_LAST_ATTEMPTS;
+  return { recent: [], windowMs, maxRepeats, keepLastAttempts };
+}
+function hashToolCall(tool, args) {
+  let argPart;
+  try {
+    argPart = canonicalSerialize(args ?? {}, /* @__PURE__ */ new WeakSet());
+  } catch {
+    argPart = "<unrepresentable>";
+  }
+  return `${tool}${argPart}`;
+}
+function canonicalSerialize(value, seen) {
+  if (value === null) return "null";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new Error(`canonicalSerialize: non-finite number ${String(value)} is not representable`);
+    }
+    return JSON.stringify(value);
+  }
+  if (typeof value === "string" || typeof value === "boolean") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "bigint") {
+    throw new Error("canonicalSerialize: bigint is not representable");
+  }
+  if (typeof value === "symbol" || typeof value === "function" || value === void 0) {
+    throw new Error(`canonicalSerialize: ${typeof value} is not representable`);
+  }
+  if (Array.isArray(value)) {
+    if (seen.has(value)) throw new Error("canonicalSerialize: circular reference is not representable");
+    seen.add(value);
+    try {
+      const parts = [];
+      for (let i = 0; i < value.length; i++) {
+        if (!(i in value) || value[i] === void 0) {
+          parts.push("null");
+          continue;
+        }
+        parts.push(canonicalSerialize(value[i], seen));
+      }
+      return `[${parts.join(",")}]`;
+    } finally {
+      seen.delete(value);
+    }
+  }
+  if (typeof value === "object") {
+    if (value instanceof Date) {
+      const jsonValue = value.toJSON();
+      return jsonValue === null ? "null" : JSON.stringify(jsonValue);
+    }
+    if (seen.has(value)) throw new Error("canonicalSerialize: circular reference is not representable");
+    seen.add(value);
+    const obj = value;
+    try {
+      const keys = Object.keys(obj).sort();
+      const parts = [];
+      for (const key of keys) {
+        const child = obj[key];
+        if (child === void 0) continue;
+        parts.push(`${JSON.stringify(key)}:${canonicalSerialize(child, seen)}`);
+      }
+      return `{${parts.join(",")}}`;
+    } finally {
+      seen.delete(value);
+    }
+  }
+  throw new Error(`canonicalSerialize: unsupported value of type ${typeof value}`);
+}
+function observe(state, key, now) {
+  const cutoff = now - state.windowMs;
+  const keepLast = state.keepLastAttempts ?? DEFAULT_KEEP_LAST_ATTEMPTS;
+  const appended = [...state.recent, { key, at: now }];
+  const floorStart = Math.max(0, appended.length - keepLast);
+  const next = appended.filter((entry, index) => index >= floorStart || entry.at >= cutoff);
+  let count = 0;
+  for (const entry of next) {
+    if (entry.key === key) count += 1;
+  }
+  const looping = count >= state.maxRepeats;
+  const newState = {
+    recent: next,
+    windowMs: state.windowMs,
+    maxRepeats: state.maxRepeats
+  };
+  return [newState, { looping, key, count }];
+}
+
+// src/domains/safety/path-policy.ts
+import { homedir } from "node:os";
+import path2 from "node:path";
+var ORDERED_KINDS = ["zeroAccessPaths", "readOnlyPaths", "noDeletePaths"];
+function isSameOrDescendant(candidatePath, policyPath) {
+  const candidate = path2.resolve(candidatePath);
+  const policy = path2.resolve(policyPath);
+  const relative = path2.relative(policy, candidate);
+  return relative === "" || !relative.startsWith("..") && !path2.isAbsolute(relative);
+}
+function expandTilde(rawPath) {
+  if (rawPath === "~") return homedir();
+  if (rawPath.startsWith("~/")) return path2.join(homedir(), rawPath.slice(2));
+  return rawPath;
+}
+function normalizePolicyEntry(rawPath, root) {
+  const expanded = expandTilde(rawPath.trim());
+  const resolved = path2.isAbsolute(expanded) ? path2.resolve(expanded) : path2.resolve(root, expanded);
+  return canonicalizeExistingPath(resolved);
+}
+function blocksOperation(kind, operation) {
+  if (kind === "zeroAccessPaths") return true;
+  if (kind === "readOnlyPaths") return operation === "write" || operation === "delete";
+  return operation === "delete";
+}
+function compilePathPolicy(input, root = process.cwd()) {
+  const resolvedRoot = canonicalizeExistingPath(path2.resolve(root));
+  const entries = [];
+  const diagnostics = [];
+  for (const kind of ORDERED_KINDS) {
+    for (const rawPath of input[kind] ?? []) {
+      const trimmed = rawPath.trim();
+      if (trimmed.length === 0) {
+        diagnostics.push(`${kind}: path must not be empty`);
+        continue;
+      }
+      const entry = { kind, path: normalizePolicyEntry(trimmed, resolvedRoot), source: trimmed };
+      const pattern = compilePathPattern(trimmed, resolvedRoot);
+      if (pattern !== null) entry.pattern = pattern;
+      entries.push(entry);
+    }
+  }
+  return {
+    root: resolvedRoot,
+    entries: entries.sort((a, b) => a.kind.localeCompare(b.kind) || a.path.localeCompare(b.path)),
+    diagnostics
+  };
+}
+function evaluatePathPolicy(policy, operation, targetPath, cwd = policy.root) {
+  const expanded = expandTilde(targetPath);
+  const lexicalTarget = path2.isAbsolute(expanded) ? path2.resolve(expanded) : path2.resolve(cwd, expanded);
+  const resolvedTarget = canonicalizeExistingPath(lexicalTarget);
+  const normalizedResolvedTarget = normalizeSeparators(resolvedTarget);
+  const normalizedRelativeTarget = normalizeSeparators(path2.relative(policy.root, resolvedTarget));
+  const normalizedRawTarget = normalizeSeparators(targetPath);
+  for (const entry of policy.entries) {
+    if (!blocksOperation(entry.kind, operation)) continue;
+    if (!matchesEntry(entry, resolvedTarget, normalizedResolvedTarget, normalizedRelativeTarget, normalizedRawTarget))
+      continue;
+    return {
+      kind: "block",
+      reasonCode: `path-policy:${entry.kind}`,
+      reason: `${operation} denied by ${entry.kind} entry ${entry.source}`,
+      matchedPath: entry.path,
+      policyKind: entry.kind
+    };
+  }
+  return { kind: "allow" };
+}
+function matchesEntry(entry, resolvedTarget, normalizedResolvedTarget, normalizedRelativeTarget, normalizedRawTarget) {
+  if (isSameOrDescendant(resolvedTarget, entry.path)) return true;
+  if (entry.pattern === void 0) return false;
+  return entry.pattern.test(normalizedResolvedTarget) || entry.pattern.test(normalizedRelativeTarget) || entry.pattern.test(normalizedRawTarget);
+}
+function compilePathPattern(rawPath, root) {
+  if (!rawPath.includes("*")) return null;
+  const expanded = expandTilde(rawPath.trim());
+  const source = path2.isAbsolute(expanded) ? expanded : path2.join(root, expanded);
+  const normalized = normalizeSeparators(canonicalizePatternSource(source));
+  const relative = normalizeSeparators(path2.isAbsolute(expanded) ? expanded : expanded);
+  const absolutePattern = segmentPattern(normalized);
+  const relativePattern = segmentPattern(relative);
+  return new RegExp(`(?:${absolutePattern})|(?:${relativePattern})`);
+}
+function canonicalizePatternSource(patternPath) {
+  const wildcardIndex = patternPath.indexOf("*");
+  if (wildcardIndex === -1) return canonicalizeExistingPath(patternPath);
+  const fixedPrefix = patternPath.slice(0, wildcardIndex);
+  const separatorIndex = fixedPrefix.lastIndexOf(path2.sep);
+  if (separatorIndex === -1) return patternPath;
+  const prefix = patternPath.slice(0, separatorIndex + 1);
+  const suffix = patternPath.slice(separatorIndex + 1);
+  return path2.join(canonicalizeExistingPath(prefix), suffix);
+}
+function segmentPattern(rawPath) {
+  const escaped = rawPath.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("[^/]*");
+  return `(?:^|/)${escaped}(?:$|/)`;
+}
+function normalizeSeparators(value) {
+  return value.split(path2.sep).join("/");
+}
+
+// src/domains/safety/policy-engine.ts
+import { createHash as createHash3 } from "node:crypto";
+import path4 from "node:path";
+
+// src/domains/safety/default-path-policy.ts
+var DEFAULT_DAMAGE_CONTROL_PATH_POLICY = {
+  zeroAccessPaths: [
+    ".env",
+    ".env.local",
+    ".env.development",
+    ".env.production",
+    ".env.staging",
+    ".env.test",
+    ".env.*.local",
+    "*.env",
+    "~/.ssh/",
+    "~/.gnupg/",
+    "~/.aws/",
+    "~/.config/gcloud/",
+    "*-credentials.json",
+    "*serviceAccount*.json",
+    "*service-account*.json",
+    "~/.azure/",
+    "~/.kube/",
+    "kubeconfig",
+    "*-secret.yaml",
+    "secrets.yaml",
+    "~/.docker/",
+    "*.pem",
+    "*.key",
+    "*.p12",
+    "*.pfx",
+    "*.tfstate",
+    "*.tfstate.backup",
+    ".terraform/",
+    ".vercel/",
+    ".netlify/",
+    "firebase-adminsdk*.json",
+    "serviceAccountKey.json",
+    ".supabase/",
+    "~/.netrc",
+    "~/.npmrc",
+    "~/.pypirc",
+    "~/.git-credentials",
+    ".git-credentials",
+    // Remote URLs in the repo git config can embed access tokens, and .git
+    // is hidden from grep/find but not from direct reads without this entry.
+    ".git/config",
+    // Clio's own provider secret store. The literal covers a repo-level file
+    // of the same name on purpose; the expanded clioConfigDir() form is
+    // appended at policy construction (policy-engine.ts), since this static
+    // list cannot call config helpers.
+    "credentials.yaml",
+    "dump.sql",
+    "backup.sql",
+    "*.dump"
+  ],
+  readOnlyPaths: [
+    "/etc/",
+    "/usr/",
+    "/bin/",
+    "/sbin/",
+    "/boot/",
+    "/root/",
+    "~/.bash_history",
+    "~/.zsh_history",
+    "~/.node_repl_history",
+    "~/.bashrc",
+    "~/.zshrc",
+    "~/.profile",
+    "~/.bash_profile",
+    "*.min.js",
+    "*.min.css",
+    "*.bundle.js",
+    "*.chunk.js",
+    "dist/",
+    "build/",
+    ".next/",
+    ".nuxt/",
+    ".output/",
+    "node_modules/",
+    "__pycache__/",
+    ".venv/",
+    "venv/",
+    "target/"
+  ],
+  noDeletePaths: [
+    "~/.claude/",
+    "CLAUDE.md",
+    "LICENSE",
+    "LICENSE.*",
+    "COPYING",
+    "COPYING.*",
+    "NOTICE",
+    "PATENTS",
+    "README.md",
+    "README.*"
+  ]
+};
+function mergePathPolicyInputs(base, override) {
+  return {
+    zeroAccessPaths: [...base.zeroAccessPaths ?? [], ...override.zeroAccessPaths ?? []],
+    readOnlyPaths: [...base.readOnlyPaths ?? [], ...override.readOnlyPaths ?? []],
+    noDeletePaths: [...base.noDeletePaths ?? [], ...override.noDeletePaths ?? []]
+  };
+}
+
+// src/domains/safety/project-policy.ts
+import { createHash as createHash2 } from "node:crypto";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
+import path3 from "node:path";
+import { parse as parseYaml } from "yaml";
+var POLICY_RELATIVE_PATH = path3.join(".clio-coder", "safety.yaml");
+var ACTION_CLASSES = /* @__PURE__ */ new Set([
+  "read",
+  "write",
+  "execute",
+  "dispatch",
+  "system_modify",
+  "git_destructive",
+  "unknown"
+]);
+var PATH_POLICY_KEYS = ["zeroAccessPaths", "readOnlyPaths", "noDeletePaths"];
+var ROOT_KEYS = /* @__PURE__ */ new Set(["version", "commands", "tasks", "disableDefaultPathPolicy", ...PATH_POLICY_KEYS]);
+var COMMAND_KEYS = /* @__PURE__ */ new Set([
+  "id",
+  "command",
+  "cwd",
+  "timeoutMs",
+  "maxOutputBytes",
+  "actionClass",
+  "shellOperators",
+  "env",
+  "requireConfirmation",
+  "rationale",
+  "owner",
+  "comment"
+]);
+var ENV_KEYS = /* @__PURE__ */ new Set(["mode", "allow"]);
+var ID_RE = /^[a-zA-Z0-9][a-zA-Z0-9_.:-]*$/;
+function projectSafetyPolicyPath(cwd = process.cwd()) {
+  let cursor = path3.resolve(cwd);
+  while (true) {
+    const candidate = path3.join(cursor, POLICY_RELATIVE_PATH);
+    if (existsSync3(candidate)) return candidate;
+    const parent = path3.dirname(cursor);
+    if (parent === cursor) return null;
+    cursor = parent;
+  }
+}
+function loadProjectSafetyPolicy(cwd = process.cwd()) {
+  const policyPath = projectSafetyPolicyPath(cwd);
+  if (policyPath === null) {
+    return {
+      path: null,
+      hash: null,
+      valid: true,
+      errors: [],
+      commands: [],
+      pathPolicy: {},
+      disableDefaultPathPolicy: false
+    };
+  }
+  let raw;
+  try {
+    raw = readFileSync3(policyPath, "utf8");
+  } catch (err) {
+    return {
+      path: policyPath,
+      hash: null,
+      valid: false,
+      errors: [`cannot read project safety policy: ${err instanceof Error ? err.message : String(err)}`],
+      commands: [],
+      pathPolicy: {},
+      disableDefaultPathPolicy: false
+    };
+  }
+  const hash = sha256(raw);
+  try {
+    const parsed = parseYaml(raw);
+    return validateProjectSafetyPolicy(parsed, policyPath, hash);
+  } catch (err) {
+    return {
+      path: policyPath,
+      hash,
+      valid: false,
+      errors: [`cannot parse project safety policy: ${err instanceof Error ? err.message : String(err)}`],
+      commands: [],
+      pathPolicy: {},
+      disableDefaultPathPolicy: false
+    };
+  }
+}
+function validateProjectSafetyPolicy(value, policyPath, hash) {
+  const errors = [];
+  const commands = [];
+  if (!isPlainRecord(value)) {
+    return {
+      path: policyPath,
+      hash,
+      valid: false,
+      errors: ["policy root must be a mapping"],
+      commands: [],
+      pathPolicy: {},
+      disableDefaultPathPolicy: false
+    };
+  }
+  for (const key of Object.keys(value)) {
+    if (!ROOT_KEYS.has(key)) errors.push(`unknown root key '${key}'`);
+  }
+  if (value.version !== 1) errors.push("version must be 1");
+  appendCommandPolicies(commands, errors, value.commands, "commands");
+  appendCommandPolicies(commands, errors, value.tasks, "tasks");
+  const pathPolicy = parsePathPolicy(value, errors);
+  const disableDefaultPathPolicy = value.disableDefaultPathPolicy === void 0 ? false : booleanField(value, "disableDefaultPathPolicy", "policy", errors);
+  const ids = /* @__PURE__ */ new Set();
+  for (const command of commands) {
+    if (ids.has(command.id)) errors.push(`duplicate command id '${command.id}'`);
+    ids.add(command.id);
+  }
+  return {
+    path: policyPath,
+    hash,
+    valid: errors.length === 0,
+    errors,
+    commands: errors.length === 0 ? commands : [],
+    pathPolicy: errors.length === 0 ? pathPolicy : {},
+    disableDefaultPathPolicy: errors.length === 0 ? disableDefaultPathPolicy : false
+  };
+}
+function parsePathPolicy(value, errors) {
+  const out = {};
+  for (const key of PATH_POLICY_KEYS) {
+    const parsed = parsePathList(value[key], key, errors);
+    if (parsed !== void 0) out[key] = parsed;
+  }
+  return out;
+}
+function parsePathList(value, key, errors) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) {
+    errors.push(`${key} must be an array`);
+    return void 0;
+  }
+  const out = [];
+  for (let index = 0; index < value.length; index += 1) {
+    const item = value[index];
+    const label = `${key}[${index}]`;
+    if (typeof item !== "string" || item.trim().length === 0) {
+      errors.push(`${label} must be a non-empty string`);
+      continue;
+    }
+    const trimmed = item.trim();
+    if (path3.isAbsolute(trimmed)) {
+      errors.push(`${label} must be relative to the policy root`);
+      continue;
+    }
+    const normalized = path3.normalize(trimmed);
+    const segments = normalized.split(path3.sep).filter((segment) => segment.length > 0);
+    if (segments.some((segment) => segment === "..")) {
+      errors.push(`${label} must not escape the policy root with '..'`);
+      continue;
+    }
+    out.push(trimmed);
+  }
+  return out;
+}
+function appendCommandPolicies(out, errors, value, field) {
+  if (value === void 0) return;
+  if (!Array.isArray(value)) {
+    errors.push(`${field} must be an array`);
+    return;
+  }
+  for (let index = 0; index < value.length; index += 1) {
+    const parsed = parseCommandPolicy(value[index], `${field}[${index}]`);
+    if (parsed.errors.length > 0) {
+      errors.push(...parsed.errors);
+      continue;
+    }
+    if (parsed.command !== void 0) out.push(parsed.command);
+  }
+}
+function parseCommandPolicy(value, label) {
+  const errors = [];
+  if (!isPlainRecord(value)) return { errors: [`${label} must be a mapping`] };
+  for (const key of Object.keys(value)) {
+    if (!COMMAND_KEYS.has(key)) errors.push(`${label}: unknown key '${key}'`);
+  }
+  const id = stringField(value, "id", label, errors);
+  const command = stringField(value, "command", label, errors);
+  const cwd = optionalStringField(value, "cwd", label, errors);
+  const timeoutMs = optionalPositiveInt(value, "timeoutMs", label, errors);
+  const maxOutputBytes = optionalPositiveInt(value, "maxOutputBytes", label, errors);
+  const actionClass = parseActionClass(value.actionClass, label, errors);
+  const shellOperators = parseShellOperators(value.shellOperators, label, errors);
+  const env = parseEnvPolicy(value.env, label, errors);
+  const requireConfirmation = value.requireConfirmation === void 0 ? false : booleanField(value, "requireConfirmation", label, errors);
+  const rationale = optionalStringField(value, "rationale", label, errors);
+  const owner = optionalStringField(value, "owner", label, errors);
+  const comment = optionalStringField(value, "comment", label, errors);
+  if (id && !ID_RE.test(id)) errors.push(`${label}.id must match ${ID_RE}`);
+  if (command && command.trim().length === 0) errors.push(`${label}.command must not be empty`);
+  if (cwd !== void 0) {
+    if (path3.isAbsolute(cwd)) {
+      errors.push(`${label}.cwd must be relative to the policy root`);
+    } else {
+      const normalized = path3.normalize(cwd);
+      const segments = normalized.split(path3.sep).filter((segment) => segment.length > 0);
+      if (segments.some((segment) => segment === "..")) {
+        errors.push(`${label}.cwd must not escape the policy root with '..'`);
+      }
+    }
+  }
+  if (errors.length > 0 || id === void 0 || command === void 0 || actionClass === void 0 || env === void 0) {
+    return { errors };
+  }
+  const parsed = {
+    id,
+    command,
+    actionClass,
+    shellOperators,
+    env,
+    requireConfirmation
+  };
+  if (cwd !== void 0) parsed.cwd = cwd;
+  if (timeoutMs !== void 0) parsed.timeoutMs = timeoutMs;
+  if (maxOutputBytes !== void 0) parsed.maxOutputBytes = maxOutputBytes;
+  if (rationale !== void 0) parsed.rationale = rationale;
+  if (owner !== void 0) parsed.owner = owner;
+  if (comment !== void 0) parsed.comment = comment;
+  return { command: parsed, errors: [] };
+}
+function parseActionClass(value, label, errors) {
+  if (typeof value !== "string") {
+    errors.push(`${label}.actionClass must be a string`);
+    return void 0;
+  }
+  if (!ACTION_CLASSES.has(value)) {
+    errors.push(`${label}.actionClass is not supported: ${value}`);
+    return void 0;
+  }
+  return value;
+}
+function parseShellOperators(value, label, errors) {
+  if (value === void 0) return "deny";
+  if (value === "deny" || value === "allow") return value;
+  errors.push(`${label}.shellOperators must be 'deny' or 'allow'`);
+  return "deny";
+}
+function parseEnvPolicy(value, label, errors) {
+  if (value === void 0) return { mode: "none", allow: [] };
+  if (!isPlainRecord(value)) {
+    errors.push(`${label}.env must be a mapping`);
+    return void 0;
+  }
+  for (const key of Object.keys(value)) {
+    if (!ENV_KEYS.has(key)) errors.push(`${label}.env: unknown key '${key}'`);
+  }
+  const mode = value.mode;
+  if (mode !== "none" && mode !== "allowlist") {
+    errors.push(`${label}.env.mode must be 'none' or 'allowlist'`);
+    return void 0;
+  }
+  const allow = value.allow;
+  if (allow === void 0) return { mode, allow: [] };
+  if (!Array.isArray(allow) || allow.some((entry) => typeof entry !== "string" || entry.length === 0)) {
+    errors.push(`${label}.env.allow must be an array of non-empty strings`);
+    return void 0;
+  }
+  if (mode === "none" && allow.length > 0) {
+    errors.push(`${label}.env.allow requires env.mode='allowlist'`);
+    return void 0;
+  }
+  return { mode, allow: [...allow] };
+}
+function stringField(record, key, label, errors) {
+  const value = record[key];
+  if (typeof value !== "string" || value.length === 0) {
+    errors.push(`${label}.${key} must be a non-empty string`);
+    return void 0;
+  }
+  return value;
+}
+function optionalStringField(record, key, label, errors) {
+  const value = record[key];
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || value.length === 0) {
+    errors.push(`${label}.${key} must be a non-empty string when present`);
+    return void 0;
+  }
+  return value;
+}
+function optionalPositiveInt(record, key, label, errors) {
+  const value = record[key];
+  if (value === void 0) return void 0;
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) {
+    errors.push(`${label}.${key} must be a positive integer`);
+    return void 0;
+  }
+  return value;
+}
+function booleanField(record, key, label, errors) {
+  const value = record[key];
+  if (typeof value === "boolean") return value;
+  errors.push(`${label}.${key} must be a boolean`);
+  return false;
+}
+function isPlainRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function sha256(raw) {
+  return createHash2("sha256").update(raw, "utf8").digest("hex");
+}
+
+// src/domains/safety/rejection-feedback.ts
+var HARD_BLOCK_CLASSES = ["git_destructive"];
+function buildShort(ctx) {
+  const postureSuffix = ctx.posture ? ` in ${ctx.posture}` : "";
+  return `${ctx.tool} blocked: ${ctx.actionClass}${postureSuffix}`;
+}
+function buildDetail(ctx) {
+  const lines = [`Clio refused to run ${ctx.tool}.`];
+  for (const reason of ctx.reasons) {
+    lines.push(`- ${reason}`);
+  }
+  if (ctx.ruleId) {
+    lines.push(`rule: ${ctx.ruleId}`);
+  }
+  return lines.join("\n");
+}
+function buildHints(ctx) {
+  const hints = [];
+  const hardBlock = HARD_BLOCK_CLASSES.includes(ctx.actionClass) || ctx.ruleId !== void 0;
+  if (hardBlock) {
+    hints.push("This is a hard block; confirmation cannot override it.");
+    return hints;
+  }
+  if (ctx.actionClass === "system_modify") {
+    hints.push("Operator confirmation is required for this action.");
+  }
+  return hints;
+}
+function formatRejection(ctx) {
+  return {
+    short: buildShort(ctx),
+    detail: buildDetail(ctx),
+    hints: buildHints(ctx)
+  };
+}
+var MODEL_REJECTION_PIVOT = "Do not retry this action through another tool unless a hint above names one; pivot or report the blocker.";
+var MODEL_REJECTION_MAX_LINES = 16;
+var MODEL_REJECTION_MAX_LINE_CHARS = 300;
+function formatModelRejection(reason, rejection) {
+  const lines = [];
+  const seen = /* @__PURE__ */ new Set();
+  const push = (line) => {
+    const bounded = line.length > MODEL_REJECTION_MAX_LINE_CHARS ? `${line.slice(0, MODEL_REJECTION_MAX_LINE_CHARS)}\u2026` : line;
+    const trimmed = bounded.trim();
+    if (trimmed.length === 0) return;
+    const normalized = trimmed.replace(/^-\s+/, "");
+    if (seen.has(normalized) || normalized === MODEL_REJECTION_PIVOT) return;
+    seen.add(normalized);
+    lines.push(trimmed);
+  };
+  for (const line of reason.split("\n")) push(line);
+  if (rejection) {
+    for (const line of rejection.detail.split("\n")) push(line);
+    for (const hint of rejection.hints) push(hint);
+  }
+  const bodyBudget = MODEL_REJECTION_MAX_LINES - 1;
+  const body = lines.length > bodyBudget ? [...lines.slice(0, bodyBudget - 1), "(further detail elided)"] : lines;
+  return [...body, MODEL_REJECTION_PIVOT].join("\n");
+}
+
+// src/domains/safety/rule-pack-loader.ts
+import { readFileSync as readFileSync4 } from "node:fs";
+import { join as join3 } from "node:path";
+import { parse as parseYaml2 } from "yaml";
+
+// src/domains/safety/rule-compiler.ts
+function asString(value, ruleId, field) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`damage-control rule '${ruleId}': expected string for ${field}`);
+  }
+  return value;
+}
+function compileDamageControlRule(raw, index) {
+  if (typeof raw.id !== "string" || raw.id.length === 0) {
+    throw new Error(`damage-control rule at index ${index}: missing or non-string 'id'`);
+  }
+  const id = raw.id;
+  const description = asString(raw.description, id, "description");
+  const patternString = asString(raw.pattern, id, "pattern");
+  const klass = asString(raw.class, id, "class");
+  if (typeof raw.block !== "boolean") {
+    throw new Error(`damage-control rule '${id}': expected boolean for block`);
+  }
+  if (raw.ask !== void 0 && typeof raw.ask !== "boolean") {
+    throw new Error(`damage-control rule '${id}': expected boolean for ask`);
+  }
+  let pattern;
+  try {
+    pattern = new RegExp(patternString, "i");
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(`damage-control rule '${id}': invalid pattern: ${msg}`);
+  }
+  return {
+    id,
+    description,
+    pattern,
+    class: klass,
+    block: raw.block,
+    ...raw.ask !== void 0 ? { ask: raw.ask } : {}
+  };
+}
+
+// src/domains/safety/rule-pack-loader.ts
+function compilePackRules(rawRules, packId) {
+  if (rawRules === void 0 || rawRules === null) return [];
+  if (!Array.isArray(rawRules)) {
+    throw new Error(`damage-control pack '${packId}': expected array at 'rules'`);
+  }
+  return rawRules.map((rule, index) => compileDamageControlRule(rule, index));
+}
+function emptyRuleset(version) {
+  return { version, rules: [] };
+}
+function loadRulePacks(yamlPath) {
+  const raw = readFileSync4(yamlPath, "utf8");
+  const parsed = parseYaml2(raw);
+  if (!parsed || typeof parsed !== "object") {
+    throw new Error(`damage-control rules at ${yamlPath}: expected mapping at document root`);
+  }
+  const version = typeof parsed.version === "number" ? parsed.version : 0;
+  if (version === 1) {
+    const baseRules = compilePackRules(parsed.rules, "base");
+    return {
+      base: { version: 1, rules: baseRules }
+    };
+  }
+  if (version !== 2) {
+    throw new Error(`damage-control rules at ${yamlPath}: unsupported version ${String(parsed.version)}`);
+  }
+  if (!Array.isArray(parsed.packs)) {
+    throw new Error(`damage-control rules at ${yamlPath}: expected array at 'packs'`);
+  }
+  const out = {
+    base: emptyRuleset(2)
+  };
+  for (const rawPack of parsed.packs) {
+    const packId = rawPack.id;
+    if (packId !== "base") {
+      throw new Error(`damage-control rules at ${yamlPath}: unknown pack id ${String(packId)}`);
+    }
+    const rules = compilePackRules(rawPack.rules, packId);
+    out[packId] = { version: 2, rules };
+  }
+  return out;
+}
+function loadDefaultRulePacks() {
+  return loadRulePacks(join3(resolvePackageRoot(), "damage-control-rules.yaml"));
+}
+var cachedPacks = null;
+function getCachedDefaultRulePacks() {
+  if (cachedPacks === null) cachedPacks = loadDefaultRulePacks();
+  return cachedPacks;
+}
+
+// src/domains/safety/policy-engine.ts
+var BUILTIN_ALLOWLIST = [
+  { id: "builtin:pwd", re: /^pwd$/ },
+  { id: "builtin:ls", re: /^ls(?:\s+(-[A-Za-z0-9]+|\.[/\w.-]*|[/\w.-]+))*$/ },
+  { id: "builtin:git-status", re: /^git\s+status(?:\s+--short|\s+--branch|\s+-sb)*$/ },
+  { id: "builtin:git-diff", re: /^git\s+diff(?:\s+--cached|\s+--stat|\s+--name-only|\s+--\s+[\w./-]+)*$/ },
+  { id: "builtin:git-log", re: /^git\s+log\s+--oneline(?:\s+-n\s+[1-9]\d{0,2})?(?:\s+--\s+[\w./-]+)?$/ },
+  { id: "builtin:npm-test", re: /^npm\s+(?:test|run\s+test)(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
+  { id: "builtin:npm-lint", re: /^npm\s+run\s+lint(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
+  { id: "builtin:npm-build", re: /^npm\s+run\s+build(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
+  { id: "builtin:npm-typecheck", re: /^npm\s+run\s+typecheck(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
+  { id: "builtin:npm-ci-script", re: /^npm\s+run\s+ci(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
+  { id: "builtin:pytest", re: /^pytest(?:\s+[\w=./:-]+)*$/ },
+  { id: "builtin:python-pytest", re: /^python(?:3(?:\.\d+)?)?\s+-m\s+pytest(?:\s+[\w=./:-]+)*$/ },
+  { id: "builtin:cargo-test", re: /^cargo\s+test(?:\s+[\w=./:-]+)*$/ },
+  { id: "builtin:go-test", re: /^go\s+test(?:\s+[\w=./:-]+)*$/ },
+  { id: "builtin:make-test", re: /^make\s+test(?:\s+[\w=./:-]+)*$/ }
+];
+var BASH_RECOGNIZED_FORM_HINT = "Recognized forms run without asking: one command per bash call, or a && chain whose every step is recognized, with cwd passed as the cwd argument instead of a leading cd.";
+var EXECUTION_TOOLS = /* @__PURE__ */ new Set([ToolNames.Bash, ToolNames.Verify]);
+var WRITE_ROOT_REFUSED_TOOLS = /* @__PURE__ */ new Set([
+  ToolNames.Bash,
+  ToolNames.Verify,
+  ToolNames.Dispatch
+]);
+var WRITE_ROOT_TOOLS = /* @__PURE__ */ new Set([ToolNames.Write, ToolNames.Edit, ToolNames.Artifact]);
+function writeRootTargetPath(call) {
+  if (!WRITE_ROOT_TOOLS.has(call.tool)) return null;
+  const target = pathArg(call.args);
+  if (target !== null) return target;
+  if (call.tool === ToolNames.Artifact) {
+    const kind = call.args?.kind;
+    return kind === "review" ? "REVIEW.md" : kind === "report" ? "REPORT.md" : "PLAN.md";
+  }
+  return null;
+}
+function isWriteConfinementEscape(call, actionClass) {
+  if (WRITE_ROOT_REFUSED_TOOLS.has(call.tool)) return true;
+  return actionClass === "execute" || actionClass === "dispatch";
+}
+function evaluateWriteRoots(roots, writeRootCwd, call) {
+  if (roots.length === 0) return null;
+  const target = writeRootTargetPath(call);
+  if (target === null) return null;
+  const resolved = path4.resolve(writeRootCwd, target);
+  for (const root of roots) {
+    if (resolved === root || resolved.startsWith(`${root}${path4.sep}`)) return null;
+  }
+  return `write target '${target}' resolves to '${resolved}', which is outside the permitted write roots for this run: ${roots.join(", ")}`;
+}
+function createSafetyPolicyEngine(options = {}) {
+  const cwd = canonicalizeExistingPath(path4.resolve(options.cwd ?? process.cwd()));
+  const writeRootCwd = path4.resolve(options.cwd ?? process.cwd());
+  const writeRoots = (options.writeRoots ?? []).map((root) => path4.resolve(root));
+  const packs = options.rulePacks ?? getCachedDefaultRulePacks();
+  const projectPolicy = options.projectPolicy ?? loadProjectSafetyPolicy(cwd);
+  const projectPolicyRoot = projectPolicy.path === null ? cwd : path4.dirname(path4.dirname(canonicalizeExistingPath(projectPolicy.path)));
+  const pathPolicyInput = projectPolicy.disableDefaultPathPolicy ? projectPolicy.pathPolicy : mergePathPolicyInputs(DEFAULT_DAMAGE_CONTROL_PATH_POLICY, projectPolicy.pathPolicy);
+  const expandedDefaults = projectPolicy.disableDefaultPathPolicy ? pathPolicyInput : mergePathPolicyInputs(pathPolicyInput, { zeroAccessPaths: clioCredentialStorePaths() });
+  const pathPolicy = compilePathPolicy(expandedDefaults, projectPolicyRoot);
+  const zeroAccessPolicy = {
+    root: pathPolicy.root,
+    entries: pathPolicy.entries.filter((entry) => entry.kind === "zeroAccessPaths"),
+    diagnostics: []
+  };
+  const sourcedRules = packs.base.rules.map((rule) => ({ rule, source: "damage-control:base" }));
+  return {
+    evaluate(call, posture) {
+      const rawClassification = classify(call);
+      const command = commandArg(call.args);
+      const callCwd = cwdArg(call.args, cwd);
+      const scan = damageControlScan(call);
+      const hit = scan ? matchSourcedRule(scan, sourcedRules) : null;
+      const classification = effectiveClassification(rawClassification, hit?.match);
+      const base = baseDecision(call, classification, callCwd, posture, command);
+      const writeRootReason = evaluateWriteRoots(writeRoots, writeRootCwd, call);
+      if (writeRootReason !== null) {
+        return blockDecision(base, {
+          ruleId: "write-root",
+          reasonCode: "write-root",
+          reasons: [writeRootReason],
+          policySource: "builtin-classifier"
+        });
+      }
+      if (writeRoots.length > 0 && isWriteConfinementEscape(call, classification.actionClass)) {
+        return blockDecision(base, {
+          ruleId: "write-root",
+          reasonCode: "write-root",
+          reasons: [
+            `tool '${call.tool}' (${classification.actionClass}) can mutate the filesystem outside the permitted write roots and is blocked under write-root confinement`
+          ],
+          policySource: "builtin-classifier"
+        });
+      }
+      const askRule = hit?.match.ask === true && hit.match.block !== true;
+      if (!askRule && (classification.actionClass === "git_destructive" || hit?.match.actionClass === "git_destructive" || hit?.match.block === true)) {
+        const blockInput = {
+          reasonCode: hit ? `damage-control:${hit.match.ruleId}` : "classification:git_destructive",
+          reasons: [...classification.reasons, ...hit ? [hit.match.reason] : []],
+          policySource: hit?.source ?? "damage-control:base"
+        };
+        if (hit?.match.ruleId !== void 0) blockInput.ruleId = hit.match.ruleId;
+        if (hit?.match !== void 0) blockInput.match = hit.match;
+        return blockDecision(base, blockInput);
+      }
+      if (!projectPolicy.valid && EXECUTION_TOOLS.has(call.tool)) {
+        const blockInput = {
+          ruleId: "project-policy-invalid",
+          reasonCode: "project-policy-invalid",
+          reasons: [`project safety policy is invalid and execution fails closed: ${projectPolicy.errors.join("; ")}`],
+          policySource: "project-policy-invalid"
+        };
+        if (projectPolicy.hash !== null) blockInput.policyHash = projectPolicy.hash;
+        if (projectPolicy.path !== null) blockInput.projectPolicyPath = projectPolicy.path;
+        return blockDecision(base, blockInput);
+      }
+      const pathBlock = evaluateProjectPathPolicy(pathPolicy, call, callCwd);
+      if (pathBlock !== null) {
+        const blockInput = {
+          ruleId: pathBlock.reasonCode,
+          reasonCode: pathBlock.reasonCode,
+          reasons: [pathBlock.reason],
+          policySource: "project-policy"
+        };
+        if (projectPolicy.hash !== null) blockInput.policyHash = projectPolicy.hash;
+        if (projectPolicy.path !== null) blockInput.projectPolicyPath = projectPolicy.path;
+        return blockDecision(base, blockInput);
+      }
+      if (call.tool === ToolNames.Bash && command !== null) {
+        const secretRead = evaluateBashZeroAccessRead(zeroAccessPolicy, command, callCwd);
+        if (secretRead !== null) {
+          const blockInput = {
+            ruleId: "secret_path_bash",
+            reasonCode: "secret_path_bash",
+            reasons: [
+              `bash read of zero-access path blocked: '${secretRead.token}' matches ${secretRead.entrySource}. Check presence with exit codes only (grep -sq "^NAME=" <file>); have the user supply values through their own terminal (read -s), never through chat or command output.`
+            ],
+            policySource: "project-policy"
+          };
+          if (projectPolicy.hash !== null) blockInput.policyHash = projectPolicy.hash;
+          if (projectPolicy.path !== null) blockInput.projectPolicyPath = projectPolicy.path;
+          return blockDecision(base, blockInput);
+        }
+      }
+      if (askRule && hit !== null && posture !== "confirmed") {
+        return askDecision(base, {
+          ruleId: hit.match.ruleId,
+          reasonCode: `damage-control:${hit.match.ruleId}`,
+          reasons: [...classification.reasons, hit.match.reason, "damage-control rule requires confirmation"],
+          policySource: hit.source,
+          match: hit.match
+        });
+      }
+      if (askRule && hit !== null && posture === "confirmed") {
+        return allowDecision(base, {
+          ruleId: hit.match.ruleId,
+          reasonCode: `damage-control:${hit.match.ruleId}`,
+          reasons: [...classification.reasons, hit.match.reason, "damage-control rule confirmed by operator"],
+          policySource: hit.source,
+          match: hit.match
+        });
+      }
+      if (classification.actionClass === "system_modify") {
+        const input = {
+          ruleId: "system-modify-confirm",
+          reasonCode: "system-modify-confirm",
+          reasons: [...classification.reasons, "system-level changes require one-shot confirmation at every autonomy level"],
+          policySource: "builtin-classifier"
+        };
+        return posture === "confirmed" ? allowDecision(base, input) : askDecision(base, input);
+      }
+      if (call.tool === ToolNames.Bash && classification.actionClass === "execute") {
+        const bash = evaluateBashPolicy(command ?? "", callCwd, cwd, posture, projectPolicy);
+        if (bash.kind === "block") return blockDecision(base, bash);
+        if (bash.kind === "ask") return askDecision(base, bash);
+        return allowDecision(base, bash);
+      }
+      const allowInput = {
+        reasonCode: "allowed",
+        reasons: classification.reasons,
+        policySource: hit?.source ?? "none"
+      };
+      if (hit?.match.ruleId !== void 0) allowInput.ruleId = hit.match.ruleId;
+      if (hit?.match !== void 0) allowInput.match = hit.match;
+      if (classification.actionClass === "execute") allowInput.execRecognition = "recognized";
+      return allowDecision(base, allowInput);
+    },
+    metadata() {
+      return {
+        version: 1,
+        rulePackHash: rulePackHash(packs),
+        rulePackVersion: packs.base.version,
+        activeRuleIds: sourcedRules.map((entry) => entry.rule.id),
+        projectPolicyPath: projectPolicy.path,
+        projectPolicyHash: projectPolicy.hash,
+        projectPolicyValid: projectPolicy.valid,
+        projectPolicyErrors: [...projectPolicy.errors, ...pathPolicy.diagnostics],
+        cwd
+      };
+    }
+  };
+}
+function clioCredentialStorePaths() {
+  try {
+    return [path4.join(clioConfigDir(), "credentials.yaml")];
+  } catch {
+    return [];
+  }
+}
+var SAFE_PRESENCE_RE = /^\s*grep\s+(?:-(?:q|sq|qs)\s+)('[^']*'|"[^"]*"|\S+)\s+\S+\s*$/;
+function isSafePresenceCheck(command) {
+  const match = SAFE_PRESENCE_RE.exec(command);
+  if (!match || match[1] === void 0) return false;
+  const pattern = stripQuotes(match[1]);
+  return /^\^[A-Za-z_][A-Za-z0-9_]*=/.test(pattern);
+}
+function stripQuotes(token) {
+  if (token.length >= 2) {
+    const first = token[0];
+    const last = token[token.length - 1];
+    if (first === '"' && last === '"' || first === "'" && last === "'") return token.slice(1, -1);
+  }
+  return token;
+}
+function bashPathTokenCandidates(command) {
+  const candidates = [];
+  for (const token of tokenizeShellLike(command)) {
+    if (token.length === 0) continue;
+    if (token === ";" || token === "&&" || token === "||" || token === "|" || token === ">" || token === ">>") continue;
+    if (token === "<" || token === "<<") continue;
+    if (/\s/.test(token)) continue;
+    if (token.startsWith("-") && !token.includes("/") && !token.includes("=")) continue;
+    candidates.push(token);
+    const eq = token.indexOf("=");
+    if (eq > 0 && eq < token.length - 1) candidates.push(token.slice(eq + 1));
+  }
+  return candidates;
+}
+function evaluateBashZeroAccessRead(zeroAccessPolicy, command, callCwd) {
+  if (zeroAccessPolicy.entries.length === 0) return null;
+  if (isSafePresenceCheck(command)) return null;
+  for (const token of bashPathTokenCandidates(command)) {
+    const decision = evaluatePathPolicy(zeroAccessPolicy, "read", token, callCwd);
+    if (decision.kind === "block") {
+      return { token, entrySource: `zeroAccessPaths entry ${decision.matchedPath}` };
+    }
+  }
+  return null;
+}
+function evaluateProjectPathPolicy(policy, call, callCwd) {
+  if (policy.entries.length === 0) return null;
+  for (const target of pathPolicyTargets(call)) {
+    const decision = evaluatePathPolicy(policy, target.operation, target.path, callCwd);
+    if (decision.kind === "block") return decision;
+  }
+  return null;
+}
+function pathPolicyTargets(call) {
+  const args = call.args;
+  switch (call.tool) {
+    case ToolNames.Read:
+    case ToolNames.Ls:
+    case ToolNames.Grep:
+    case ToolNames.Find: {
+      const target = pathArg(args) ?? ".";
+      return [{ operation: "read", path: target }];
+    }
+    case ToolNames.Write:
+    case ToolNames.Edit: {
+      const target = pathArg(args);
+      return target === null ? [] : [{ operation: "write", path: target }];
+    }
+    case ToolNames.Artifact: {
+      const fallback = args?.kind === "review" ? "REVIEW.md" : args?.kind === "report" ? "REPORT.md" : "PLAN.md";
+      return [{ operation: "write", path: pathArg(args) ?? fallback }];
+    }
+    case ToolNames.CredentialPresent:
+      return [];
+    case ToolNames.Bash: {
+      const command = commandArg(args);
+      if (command === null) return [];
+      return [
+        ...extractCommandWriteTargets(command).map((target) => ({ operation: "write", path: target })),
+        ...extractCommandDeleteTargets(command).map((target) => ({ operation: "delete", path: target }))
+      ];
+    }
+    default:
+      return [];
+  }
+}
+function evaluateBashPolicy(command, callCwd, workspaceRoot, posture, policy) {
+  if (command.trim().length === 0) {
+    return {
+      kind: "block",
+      ruleId: "bash-empty-command",
+      reasonCode: "bash-empty-command",
+      reasons: ["bash command must not be empty"],
+      policySource: "builtin-command-allowlist"
+    };
+  }
+  const projectMatch = matchingProjectCommand(policy, command, callCwd);
+  if (projectMatch) {
+    const base = {
+      ruleId: projectMatch.id,
+      reasonCode: `project-policy:${projectMatch.id}`,
+      reasons: [`allowed by project safety policy command '${projectMatch.id}'`],
+      policySource: "project-policy",
+      execRecognition: "recognized"
+    };
+    if (policy.hash !== null) base.policyHash = policy.hash;
+    if (policy.path !== null) base.projectPolicyPath = policy.path;
+    if (projectMatch.requireConfirmation && posture !== "confirmed") {
+      return {
+        ...base,
+        kind: "ask",
+        reasons: [...base.reasons, "project policy requires confirmation"]
+      };
+    }
+    return { ...base, kind: "allow" };
+  }
+  if (!isUnderOrSame(callCwd, workspaceRoot)) {
+    return {
+      kind: "block",
+      ruleId: "bash-cwd-escape",
+      reasonCode: "bash-cwd-escape",
+      reasons: [
+        `bash cwd '${callCwd}' escapes workspace root '${workspaceRoot}'; use a typed tool or a project policy entry with explicit cwd`
+      ],
+      policySource: "builtin-command-allowlist"
+    };
+  }
+  const recognitionCommand = inlineShellScript(command) ?? command;
+  if (hasCommandSubstitution(recognitionCommand) && posture !== "confirmed") {
+    return {
+      kind: "ask",
+      ruleId: "bash-command-substitution",
+      reasonCode: "bash-command-substitution",
+      reasons: ["command substitution hides the executed content from the safety net and requires one-shot confirmation"],
+      policySource: "builtin-command-allowlist",
+      execRecognition: "unrecognized"
+    };
+  }
+  const chain = recognizeCommandChain(recognitionCommand, callCwd, workspaceRoot, policy);
+  if (chain !== null) {
+    const chainReasons = [`every step of the && chain is recognized: ${chain.ruleIds.join(", ")}`];
+    if (chain.requiresConfirmation && posture !== "confirmed") {
+      return {
+        kind: "ask",
+        ruleId: "bash-recognized-chain",
+        reasonCode: "bash-recognized-chain",
+        reasons: [...chainReasons, "project policy requires confirmation for one step"],
+        policySource: "builtin-command-allowlist",
+        execRecognition: "recognized"
+      };
+    }
+    return {
+      kind: "allow",
+      ruleId: "bash-recognized-chain",
+      reasonCode: "bash-recognized-chain",
+      reasons: chainReasons,
+      policySource: "builtin-command-allowlist",
+      execRecognition: "recognized"
+    };
+  }
+  if (hasSequencingOperators(command)) {
+    return {
+      kind: "allow",
+      ruleId: "bash-shell-operators",
+      reasonCode: "bash-shell-operators",
+      reasons: [
+        "shell operators defeat per-command recognition; the autonomy level decides admission",
+        BASH_RECOGNIZED_FORM_HINT
+      ],
+      policySource: "builtin-command-allowlist",
+      execRecognition: "unrecognized"
+    };
+  }
+  for (const entry of BUILTIN_ALLOWLIST) {
+    if (entry.re.test(recognitionCommand)) {
+      return {
+        kind: "allow",
+        ruleId: entry.id,
+        reasonCode: entry.id,
+        reasons: [`matched built-in no-prompt command allowlist '${entry.id}'`],
+        policySource: "builtin-command-allowlist",
+        execRecognition: "recognized"
+      };
+    }
+  }
+  return {
+    kind: "allow",
+    ruleId: "bash-unrecognized",
+    reasonCode: "bash-unrecognized",
+    reasons: [
+      "bash command is outside the no-prompt set; the autonomy level decides admission",
+      BASH_RECOGNIZED_FORM_HINT
+    ],
+    policySource: "builtin-command-allowlist",
+    execRecognition: "unrecognized"
+  };
+}
+function baseDecision(call, classification, cwd, posture, command) {
+  const out = {
+    classification,
+    tool: call.tool,
+    actionClass: classification.actionClass,
+    cwd
+  };
+  if (posture !== void 0) out.posture = posture;
+  if (command !== null) out.command = command;
+  return out;
+}
+function allowDecision(base, input) {
+  return { ...base, ...input, kind: "allow" };
+}
+function askDecision(base, input) {
+  const rejectionInput = {
+    tool: base.tool,
+    actionClass: base.classification.actionClass,
+    reasons: input.reasons
+  };
+  if (base.posture !== void 0) rejectionInput.posture = base.posture;
+  if (input.ruleId !== void 0) rejectionInput.ruleId = input.ruleId;
+  const rejection = formatRejection(rejectionInput);
+  return { ...base, ...input, kind: "ask", rejection };
+}
+function blockDecision(base, input) {
+  const rejectionInput = {
+    tool: base.tool,
+    actionClass: base.classification.actionClass,
+    reasons: input.reasons
+  };
+  if (base.posture !== void 0) rejectionInput.posture = base.posture;
+  if (input.ruleId !== void 0) rejectionInput.ruleId = input.ruleId;
+  const rejection = formatRejection(rejectionInput);
+  return { ...base, ...input, kind: "block", rejection };
+}
+function matchSourcedRule(commandString, rules) {
+  for (const entry of rules) {
+    if (entry.rule.pattern.test(commandString)) {
+      const match = {
+        ruleId: entry.rule.id,
+        reason: `matched ${entry.rule.id}: ${entry.rule.description}`,
+        actionClass: entry.rule.class,
+        block: entry.rule.block
+      };
+      if (entry.rule.ask !== void 0) match.ask = entry.rule.ask;
+      return { match, source: entry.source };
+    }
+  }
+  return null;
+}
+var ACTION_CLASSES2 = /* @__PURE__ */ new Set([
+  "read",
+  "write",
+  "execute",
+  "system_modify",
+  "git_destructive",
+  "dispatch"
+]);
+function effectiveClassification(classification, match) {
+  if (!match || !ACTION_CLASSES2.has(match.actionClass)) return classification;
+  const actionClass = match.actionClass;
+  if (actionClass === classification.actionClass) return classification;
+  return {
+    actionClass,
+    reasons: [...classification.reasons, `damage-control:${match.ruleId}`]
+  };
+}
+function matchingProjectCommand(policy, command, cwd) {
+  if (!policy.valid || policy.path === null) return null;
+  const policyRoot = path4.dirname(path4.dirname(policy.path));
+  for (const entry of policy.commands) {
+    if (entry.command !== command) continue;
+    if (entry.shellOperators === "deny" && hasShellOperators(command)) continue;
+    const allowedCwd = entry.cwd !== void 0 ? path4.resolve(policyRoot, entry.cwd) : policyRoot;
+    if (!isUnderOrSame(cwd, allowedCwd)) continue;
+    return entry;
+  }
+  return null;
+}
+var CHAIN_BREAKING_TOKENS = /* @__PURE__ */ new Set([";", "|", "||", ">", ">>", "<", "<<"]);
+var CHAIN_MAX_SEGMENTS = 6;
+function recognizeCommandChain(command, callCwd, workspaceRoot, policy) {
+  const segments = [];
+  let current = [];
+  for (const token of tokenizeShellLike(command)) {
+    if (token === "&&") {
+      segments.push(current);
+      current = [];
+      continue;
+    }
+    if (CHAIN_BREAKING_TOKENS.has(token)) return null;
+    current.push(token);
+  }
+  segments.push(current);
+  if (segments.length < 2 || segments.length > CHAIN_MAX_SEGMENTS) return null;
+  const ruleIds = [];
+  let requiresConfirmation = false;
+  for (const segment of segments) {
+    if (segment.length === 0) return null;
+    if (segment[0] === "cd") {
+      if (segment.length !== 2) return null;
+      const target = segment[1] ?? "";
+      if (target.startsWith("~") || !isUnderOrSame(path4.resolve(callCwd, target), workspaceRoot)) return null;
+      ruleIds.push("builtin:cd-workspace");
+      continue;
+    }
+    const rendered = segment.join(" ");
+    const projectMatch = matchingProjectCommand(policy, rendered, callCwd);
+    if (projectMatch) {
+      ruleIds.push(projectMatch.id);
+      if (projectMatch.requireConfirmation) requiresConfirmation = true;
+      continue;
+    }
+    const builtin = BUILTIN_ALLOWLIST.find((entry) => entry.re.test(rendered));
+    if (builtin === void 0) return null;
+    ruleIds.push(builtin.id);
+  }
+  return { ruleIds, requiresConfirmation };
+}
+function hasSequencingOperators(command) {
+  return /(\|\||&&|;|\||>>?|<|\n|\r)/.test(command);
+}
+function hasCommandSubstitution(command) {
+  return /(`|\$\()/.test(command);
+}
+function hasShellOperators(command) {
+  return hasSequencingOperators(command) || hasCommandSubstitution(command);
+}
+function isUnderOrSame(child, parent) {
+  const rel = path4.relative(
+    canonicalizeExistingPath(path4.resolve(parent)),
+    canonicalizeExistingPath(path4.resolve(child))
+  );
+  return rel === "" || !rel.startsWith("..") && !path4.isAbsolute(rel);
+}
+function commandArg(args) {
+  return typeof args?.command === "string" ? args.command : null;
+}
+function pathArg(args) {
+  if (!args) return null;
+  const candidate = args.path ?? args.file_path ?? args.filePath;
+  return typeof candidate === "string" && candidate.length > 0 ? candidate : null;
+}
+function cwdArg(args, fallback) {
+  const resolved = typeof args?.cwd === "string" && args.cwd.length > 0 ? path4.resolve(fallback, args.cwd) : fallback;
+  return canonicalizeExistingPath(resolved);
+}
+var CONTENT_BEARING_TOOLS = /* @__PURE__ */ new Set([ToolNames.Write, ToolNames.Edit, ToolNames.Artifact]);
+function damageControlScan(call) {
+  if (!CONTENT_BEARING_TOOLS.has(call.tool)) return serializeArgs(call.args);
+  const pathArg2 = call.args?.path;
+  return typeof pathArg2 === "string" ? pathArg2 : "";
+}
+function serializeArgs(args) {
+  if (!args) return "";
+  const parts = [];
+  for (const v of Object.values(args)) {
+    if (v == null) continue;
+    if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") parts.push(String(v));
+    else {
+      try {
+        parts.push(JSON.stringify(v));
+      } catch {
+      }
+    }
+  }
+  return parts.join(" ");
+}
+function rulePackHash(packs) {
+  const payload = {
+    base: packPayload(packs.base.rules)
+  };
+  return createHash3("sha256").update(JSON.stringify(payload), "utf8").digest("hex");
+}
+function packPayload(rules) {
+  return rules.map((rule) => ({
+    id: rule.id,
+    description: rule.description,
+    pattern: rule.pattern.source,
+    class: rule.class,
+    block: rule.block,
+    ...rule.ask !== void 0 ? { ask: rule.ask } : {}
+  }));
+}
+
+// src/domains/safety/scope.ts
+import path5 from "node:path";
+function normalizeRoot(root) {
+  return path5.resolve(root);
+}
+function isUnder(child, parent) {
+  const c = normalizeRoot(child);
+  const p = normalizeRoot(parent);
+  if (c === p) return true;
+  const rel = path5.relative(p, c);
+  return rel !== "" && !rel.startsWith("..") && !path5.isAbsolute(rel);
+}
+function isSubset(worker, orchestrator) {
+  for (const action of worker.allowedActions) {
+    if (!orchestrator.allowedActions.has(action)) return false;
+  }
+  for (const root of worker.allowedWriteRoots) {
+    const covered = orchestrator.allowedWriteRoots.some((outer) => isUnder(root, outer));
+    if (!covered) return false;
+  }
+  if (worker.allowNetwork && !orchestrator.allowNetwork) return false;
+  if (worker.allowDispatch && !orchestrator.allowDispatch) return false;
+  return true;
+}
+var READONLY_SCOPE = {
+  allowedActions: /* @__PURE__ */ new Set(["read"]),
+  allowedWriteRoots: [],
+  allowNetwork: true,
+  allowDispatch: false
+};
+var WORKSPACE_SCOPE = {
+  allowedActions: /* @__PURE__ */ new Set(["read", "write", "execute", "dispatch"]),
+  allowedWriteRoots: [process.cwd()],
+  allowNetwork: true,
+  allowDispatch: true
+};
+var CONFIRMED_SCOPE = {
+  allowedActions: /* @__PURE__ */ new Set(["read", "write", "execute", "dispatch", "system_modify"]),
+  allowedWriteRoots: [process.cwd()],
+  allowNetwork: true,
+  allowDispatch: true
+};
+
+// src/domains/safety/finish-contract.ts
+var FINISH_CONTRACT_ADVISORY_MESSAGE = "[Clio Coder] finish-contract advisory: you changed files this turn without recording validation evidence or an explicit limitation. Run a verification command or state what could not be verified.";
+var DEFAULT_RECENT_ENTRY_LIMIT = 80;
+var LIMITATION_PATTERNS = [
+  /\b(?:blocked by|blocker|blockers|unable to|not able to|could not|couldn't|cannot|can't)\b/i,
+  /\b(?:did not|didn't|have not|haven't|has not|hasn't|was not able|wasn't able)\b/i,
+  /\b(?:not complete|incomplete)\b/i,
+  /\b(?:not|un)(?:\s|-)?(?:validated|verified|tested)\b/i,
+  /^\s*Tests\s*:\s*(?:not run|not executed|not available|failed|blocked|skipped)\b/im,
+  /^\s*Known gaps?\s*:\s*(?!\s*(?:none|no\b|n\/a|not applicable)\b).+/im,
+  /\bremaining(?:\s+\w+){0,3}\s+(?:work|issue|issues|gap|gaps|blocker|blockers)\b/i
+];
+function assessFinishContract(input) {
+  const assistantText = input.assistantText.trim();
+  const sessionEntries = input.sessionEntries ?? [];
+  const assistantTurnId = input.assistantTurnId ?? null;
+  const window = recentEntries(sessionEntries, assistantTurnId, input.recentEntryLimit ?? DEFAULT_RECENT_ENTRY_LIMIT);
+  const mutatedPaths = mutatingReceipts(window);
+  if (mutatedPaths.length === 0) {
+    return { kind: "ok", reason: "no_mutation", evidence: [], mutatedPaths };
+  }
+  const evidence = collectValidationEvidence(window);
+  if (evidence.length > 0) {
+    return { kind: "ok", reason: "validation_evidence", evidence, mutatedPaths };
+  }
+  if (hasExplicitLimitation(assistantText)) {
+    return { kind: "ok", reason: "explicit_limitation", evidence: [], mutatedPaths };
+  }
+  return {
+    kind: "engage",
+    reason: "unvalidated_mutation",
+    message: FINISH_CONTRACT_ADVISORY_MESSAGE,
+    evidence: [],
+    mutatedPaths
+  };
+}
+function hasExplicitLimitation(text) {
+  const normalized = text.trim();
+  if (normalized.length === 0) return false;
+  return LIMITATION_PATTERNS.some((pattern) => pattern.test(normalized));
+}
+function mutatingReceipts(recent) {
+  const mutationCalls = /* @__PURE__ */ new Map();
+  const paths = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of recent) {
+    const bashMutation = bashExecutionMutationPaths(entry);
+    if (bashMutation !== null) {
+      for (const path7 of bashMutation) pushPath(paths, seen, path7);
+      continue;
+    }
+    const call = mutatingToolCall(entry);
+    if (call !== null) {
+      mutationCalls.set(call.toolCallId, call);
+      continue;
+    }
+    const resultId = successfulToolResultId(entry);
+    if (resultId !== null) {
+      const candidate = mutationCalls.get(resultId);
+      if (candidate !== void 0) {
+        for (const path7 of candidate.paths) pushPath(paths, seen, path7);
+      }
+    }
+  }
+  return paths;
+}
+function mutationPathsForTool(toolName, args) {
+  if (toolName === ToolNames.Bash) {
+    const command = typeof args?.command === "string" ? args.command : null;
+    if (command === null) return [];
+    return [...extractCommandWriteTargets(command), ...extractCommandDeleteTargets(command)];
+  }
+  return toolMutationPaths(toolName, args);
+}
+function mutatingToolCall(entry) {
+  const record = asRecord(entry);
+  if (record?.kind !== "message" || record.role !== "tool_call") return null;
+  const payload = asRecord(record.payload);
+  if (payload === null) return null;
+  const toolName = stringFromFirst(payload, ["name", "toolName", "tool"]);
+  if (toolName === null) return null;
+  const args = asRecord(payload.args ?? payload.arguments ?? payload.input) ?? void 0;
+  const paths = mutationPathsForTool(toolName, args);
+  if (paths.length === 0) return null;
+  const toolCallId = stringFromFirst(payload, ["toolCallId", "tool_call_id", "id"]) ?? turnIdOf(entry);
+  if (toolCallId === null) return null;
+  return { toolCallId, paths };
+}
+function bashExecutionMutationPaths(entry) {
+  const record = asRecord(entry);
+  if (record?.kind !== "bashExecution") return null;
+  if (typeof record.command !== "string") return null;
+  if (record.cancelled === true || record.exitCode !== 0) return null;
+  return [...extractCommandWriteTargets(record.command), ...extractCommandDeleteTargets(record.command)];
+}
+function pushPath(paths, seen, path7) {
+  if (path7.length === 0 || seen.has(path7)) return;
+  seen.add(path7);
+  paths.push(path7);
+}
+function collectValidationEvidence(recent) {
+  const evidence = [];
+  const toolCalls = /* @__PURE__ */ new Map();
+  const dispatchCalls = /* @__PURE__ */ new Map();
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of recent) {
+    const protectedArtifact = protectedArtifactEvidence(entry);
+    if (protectedArtifact !== null) {
+      pushEvidence(evidence, seen, protectedArtifact);
+      continue;
+    }
+    const call = bashValidationCall(entry);
+    if (call !== null) {
+      toolCalls.set(call.toolCallId, call);
+      continue;
+    }
+    const typedValidationCall = validationToolCall(entry);
+    if (typedValidationCall !== null) {
+      toolCalls.set(typedValidationCall.toolCallId, typedValidationCall);
+      continue;
+    }
+    const dispatchCall = dispatchEvidenceCall(entry);
+    if (dispatchCall !== null) {
+      dispatchCalls.set(dispatchCall.toolCallId, dispatchCall);
+      continue;
+    }
+    const resultId = successfulToolResultId(entry);
+    if (resultId !== null) {
+      const dispatchCandidate = dispatchCalls.get(resultId);
+      const dispatchReceipt = dispatchReceiptEvidence(entry, dispatchCandidate);
+      if (dispatchReceipt !== null) {
+        pushEvidence(evidence, seen, dispatchReceipt);
+        continue;
+      }
+      const candidate = toolCalls.get(resultId);
+      if (candidate !== void 0) {
+        pushEvidence(evidence, seen, validationEvidence(candidate));
+      }
+      continue;
+    }
+    const bashExecution = bashExecutionEvidence(entry);
+    if (bashExecution !== null) pushEvidence(evidence, seen, bashExecution);
+  }
+  return evidence;
+}
+function recentEntries(entries, assistantTurnId, recentEntryLimit) {
+  const boundedLimit = Number.isFinite(recentEntryLimit) && recentEntryLimit > 0 ? Math.floor(recentEntryLimit) : DEFAULT_RECENT_ENTRY_LIMIT;
+  const assistantIndex = assistantTurnId === null ? -1 : entries.findIndex((entry) => turnIdOf(entry) === assistantTurnId);
+  const endExclusive = assistantIndex >= 0 ? assistantIndex : entries.length;
+  let startInclusive = Math.max(0, endExclusive - boundedLimit);
+  for (let index = endExclusive - 1; index >= startInclusive; index -= 1) {
+    if (isUserMessageEntry(entries[index])) {
+      startInclusive = index + 1;
+      break;
+    }
+  }
+  return entries.slice(startInclusive, endExclusive);
+}
+function bashValidationCall(entry) {
+  const record = asRecord(entry);
+  if (record?.kind !== "message" || record.role !== "tool_call") return null;
+  const payload = asRecord(record.payload);
+  if (payload === null) return null;
+  const toolName = stringFromFirst(payload, ["name", "toolName", "tool"]);
+  if (toolName !== "bash") return null;
+  const args = asRecord(payload.args ?? payload.arguments ?? payload.input);
+  const command = typeof args?.command === "string" ? args.command : null;
+  if (command === null) return null;
+  const detected = detectValidationCommand(command);
+  if (detected.kind !== "validation") return null;
+  const toolCallId = stringFromFirst(payload, ["toolCallId", "tool_call_id", "id"]) ?? turnIdOf(entry);
+  if (toolCallId === null) return null;
+  const candidate = {
+    toolCallId,
+    command: detected.matched
+  };
+  const turnId = turnIdOf(entry);
+  if (turnId !== null) candidate.turnId = turnId;
+  return candidate;
+}
+function dispatchEvidenceCall(entry) {
+  const record = asRecord(entry);
+  if (record?.kind !== "message" || record.role !== "tool_call") return null;
+  const payload = asRecord(record.payload);
+  if (payload === null) return null;
+  const toolName = stringFromFirst(payload, ["name", "toolName", "tool"]);
+  if (toolName !== "dispatch") return null;
+  const args = asRecord(payload.args ?? payload.arguments ?? payload.input);
+  const { agentId, task } = dispatchCallDescriptor(args);
+  const toolCallId = stringFromFirst(payload, ["toolCallId", "tool_call_id", "id"]) ?? turnIdOf(entry);
+  if (toolCallId === null) return null;
+  const candidate = {
+    toolCallId,
+    command: `agent=${agentId}${task.length > 0 ? ` task=${task}` : ""}`
+  };
+  const turnId = turnIdOf(entry);
+  if (turnId !== null) candidate.turnId = turnId;
+  return candidate;
+}
+function dispatchCallDescriptor(args) {
+  const defaultAgent = stringFromFirst(args ?? {}, ["agent", "agent_id", "agentId"]);
+  const tasks = Array.isArray(args?.tasks) ? args.tasks : null;
+  if (tasks !== null && tasks.length > 0) {
+    const first = tasks[0];
+    if (typeof first === "string") {
+      return { agentId: defaultAgent ?? "coder", task: first.trim() };
+    }
+    const firstRecord = asRecord(first);
+    const itemAgent = firstRecord === null ? null : stringFromFirst(firstRecord, ["agent", "agent_id", "agentId"]);
+    const itemTask = typeof firstRecord?.task === "string" ? firstRecord.task.trim() : "";
+    return { agentId: itemAgent ?? defaultAgent ?? "coder", task: itemTask };
+  }
+  const singleTask = typeof args?.task === "string" ? args.task.trim() : "";
+  return { agentId: defaultAgent ?? "coder", task: singleTask };
+}
+function validationToolCall(entry) {
+  const record = asRecord(entry);
+  if (record?.kind !== "message" || record.role !== "tool_call") return null;
+  const payload = asRecord(record.payload);
+  if (payload === null) return null;
+  const toolName = stringFromFirst(payload, ["name", "toolName", "tool"]);
+  if (toolName === null) return null;
+  const summary = typedValidationSummary(toolName, payload);
+  if (summary === null) return null;
+  const toolCallId = stringFromFirst(payload, ["toolCallId", "tool_call_id", "id"]) ?? turnIdOf(entry);
+  if (toolCallId === null) return null;
+  const candidate = {
+    toolCallId,
+    command: summary
+  };
+  const turnId = turnIdOf(entry);
+  if (turnId !== null) candidate.turnId = turnId;
+  return candidate;
+}
+function typedValidationSummary(toolName, payload) {
+  const args = asRecord(payload.args ?? payload.arguments ?? payload.input);
+  if (toolName === "verify") {
+    const check = typeof args?.check === "string" ? args.check.trim() : "";
+    if (check === "frontend") {
+      const path7 = typeof args?.path === "string" && args.path.trim().length > 0 ? args.path.trim() : "artifact";
+      return `verify frontend ${path7}`;
+    }
+    if (!isVerificationScriptName(check)) return null;
+    return `npm run ${check}`;
+  }
+  return null;
+}
+function successfulToolResultId(entry) {
+  const record = asRecord(entry);
+  if (record?.kind !== "message" || record.role !== "tool_result") return null;
+  const payload = asRecord(record.payload);
+  if (payload === null) return null;
+  if (payload.isError === true || payload.error === true) return null;
+  const result = asRecord(payload.result);
+  const details = asRecord(result?.details);
+  if (details?.kind === "error") return null;
+  return stringFromFirst(payload, ["toolCallId", "tool_call_id", "id"]);
+}
+function dispatchReceiptEvidence(entry, candidate) {
+  const record = asRecord(entry);
+  if (record?.kind !== "message" || record.role !== "tool_result") return null;
+  const payload = asRecord(record.payload);
+  if (payload === null) return null;
+  const toolName = stringFromFirst(payload, ["toolName", "name", "tool"]);
+  if (toolName !== null && toolName !== "dispatch") return null;
+  const result = asRecord(payload.result);
+  const details = asRecord(result?.details);
+  if (details === null) return null;
+  const summary = passedDispatchReceiptSummary(details, candidate);
+  if (summary === null) return null;
+  const evidence = {
+    kind: "dispatch_receipt",
+    summary
+  };
+  const turnId = candidate?.turnId ?? turnIdOf(entry);
+  if (turnId !== null && turnId !== void 0) evidence.turnId = turnId;
+  return evidence;
+}
+function passedDispatchReceiptSummary(details, candidate) {
+  if (Array.isArray(details.runs)) {
+    const runs = details.runs.map(asRecord);
+    if (runs.length === 0 || runs.some((run) => run === null || run.exitCode !== 0)) return null;
+    if (typeof details.failedCount === "number" && details.failedCount !== 0) return null;
+    const first = runs[0];
+    const runId = typeof first?.runId === "string" && first.runId.length > 0 ? first.runId : "unknown";
+    const agentId = dispatchReceiptAgentId(typeof first?.agentId === "string" ? first.agentId : void 0, candidate);
+    const extra = runs.length > 1 ? ` (+${runs.length - 1} more)` : "";
+    return `dispatch receipt passed: run ${runId} agent ${agentId}${extra}`;
+  }
+  if (details.exitCode === 0) {
+    const runId = typeof details.runId === "string" && details.runId.length > 0 ? details.runId : "unknown";
+    const agentId = dispatchReceiptAgentId(typeof details.agentId === "string" ? details.agentId : void 0, candidate);
+    return `dispatch receipt passed: run ${runId} agent ${agentId}`;
+  }
+  return null;
+}
+function dispatchReceiptAgentId(receiptAgentId, candidate) {
+  if (receiptAgentId !== void 0 && receiptAgentId.length > 0) return receiptAgentId;
+  return candidate?.command.match(/^agent=([^\s]+)/)?.[1] ?? "unknown";
+}
+function bashExecutionEvidence(entry) {
+  const record = asRecord(entry);
+  if (record?.kind !== "bashExecution") return null;
+  if (typeof record.command !== "string") return null;
+  if (record.cancelled === true) return null;
+  if (record.exitCode !== 0) return null;
+  const detected = detectValidationCommand(record.command);
+  if (detected.kind !== "validation") return null;
+  const evidence = {
+    kind: "validation_command",
+    summary: `validation command passed: ${detected.matched}`
+  };
+  const turnId = turnIdOf(entry);
+  if (turnId !== null) evidence.turnId = turnId;
+  return evidence;
+}
+function protectedArtifactEvidence(entry) {
+  const record = asRecord(entry);
+  if (record?.kind !== "protectedArtifact" || record.action !== "protect") return null;
+  const artifact = asRecord(record.artifact);
+  const path7 = typeof artifact?.path === "string" && artifact.path.trim().length > 0 ? artifact.path.trim() : null;
+  if (path7 === null) return null;
+  const evidence = {
+    kind: "protected_artifact",
+    summary: `protected artifact recorded: ${path7}`
+  };
+  const turnId = turnIdOf(entry);
+  if (turnId !== null) evidence.turnId = turnId;
+  return evidence;
+}
+function validationEvidence(candidate) {
+  const evidence = {
+    kind: "validation_command",
+    summary: `validation command passed: ${candidate.command}`
+  };
+  if (candidate.turnId !== void 0) evidence.turnId = candidate.turnId;
+  return evidence;
+}
+function pushEvidence(evidence, seen, item) {
+  const key = `${item.kind}\0${item.summary}\0${item.turnId ?? ""}`;
+  if (seen.has(key)) return;
+  seen.add(key);
+  evidence.push(item);
+}
+function isUserMessageEntry(entry) {
+  const record = asRecord(entry);
+  if (record?.kind !== "message" || record.role !== "user") return false;
+  const payload = asRecord(record.payload);
+  return payload?.synthetic !== true;
+}
+function turnIdOf(entry) {
+  const record = asRecord(entry);
+  return typeof record?.turnId === "string" ? record.turnId : null;
+}
+function stringFromFirst(record, keys) {
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === "string" && value.length > 0) return value;
+  }
+  return null;
+}
+function asRecord(value) {
+  return value !== null && typeof value === "object" ? value : null;
+}
+
+// src/domains/safety/rigor.ts
+import { existsSync as existsSync4 } from "node:fs";
+import path6 from "node:path";
+var VALIDATION_CONTRACT_FILES = [
+  path6.join(".clio-coder", "validation.yaml"),
+  path6.join(".clio-coder", "validation.yml"),
+  "validation.yaml",
+  "validation.yml",
+  "VALIDATION.md"
+];
+function resolveRigor(options) {
+  if (options.override === "high" || options.override === "normal") return options.override;
+  const cwd = options.cwd ?? process.cwd();
+  return hasValidationContract(cwd) ? "high" : "normal";
+}
+function parseRigorOverride(value) {
+  if (typeof value !== "string") return null;
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "high") return "high";
+  if (normalized === "normal") return "normal";
+  return null;
+}
+function hasValidationContract(cwd) {
+  try {
+    return VALIDATION_CONTRACT_FILES.some((relative) => existsSync4(path6.join(cwd, relative)));
+  } catch {
+    return false;
+  }
+}
+
+export {
+  parseFrontmatter,
+  resultContractSourceId,
+  parseVerifierResult,
+  resultContractAuthorship,
+  parseScoutResult,
+  validateResultContract,
+  validateRecipeResult,
+  RESULT_CONTRACT_REPAIR_LIMIT,
+  resultContractRepairMessage,
+  parseResultContract,
+  FLEET_COMMAND_BASE_ENV,
+  loadFleetCommands,
+  normalizeWriteBoundary,
+  writeBoundaryCovers,
+  describeWriteBoundary,
+  fleetLoopCheckStepId,
+  fleetLoopRepairStepId,
+  fleetStepWriteBoundary,
+  FLEET_COMMANDS_REPO_PATH,
+  FLEET_COMMANDS_REMEDY,
+  FleetCommandRegistryMissingError,
+  loadFleetContract,
+  listFleetContracts,
+  renderFleetPrompt,
+  AUTONOMY_LEVELS,
+  DEFAULT_AUTONOMY_LEVEL,
+  isAutonomyLevel,
+  mapAutonomy,
+  autonomyDenyRejection,
+  autonomyAskRejection,
+  createLoopState,
+  hashToolCall,
+  observe,
+  formatModelRejection,
+  WRITE_ROOT_REFUSED_TOOLS,
+  createSafetyPolicyEngine,
+  isSubset,
+  READONLY_SCOPE,
+  WORKSPACE_SCOPE,
+  CONFIRMED_SCOPE,
+  DEFAULT_RECENT_ENTRY_LIMIT,
+  assessFinishContract,
+  typedValidationSummary,
+  resolveRigor,
+  parseRigorOverride
+};
+//# sourceMappingURL=chunk-XV4ZJ6ZM.js.map