@iowarp/clio-coder 0.3.1 → 0.3.2

package/dist/chunk-HC4CLZ2Y.js

@@ -0,0 +1,68 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  withStateFileLock
+} from "./chunk-IKCO5N3L.js";
+import {
+  safeResourceWrite
+} from "./chunk-WEPFGWHJ.js";
+import {
+  init_esm_shims
+} from "./chunk-3R73A4XB.js";
+
+// src/domains/observability/evidence-index.ts
+init_esm_shims();
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+var MAX_EVIDENCE_INDEX_ROWS = 1e3;
+var EVIDENCE_INDEX_FILE = "evidence-index.json";
+var evidenceIndexWriteQueue = Promise.resolve();
+function indexPath(stateDir) {
+  return join(stateDir, EVIDENCE_INDEX_FILE);
+}
+function isEvidenceIndexRow(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const row = value;
+  return typeof row.runId === "string" && typeof row.evidenceId === "string" && Array.isArray(row.tags) && row.tags.every((tag) => typeof tag === "string") && typeof row.firstPassSuccess === "boolean" && typeof row.findingCount === "number" && typeof row.generatedAt === "string";
+}
+function readEvidenceIndex(stateDir) {
+  let raw;
+  try {
+    raw = readFileSync(indexPath(stateDir), "utf8");
+  } catch {
+    return [];
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(parsed)) return [];
+  return parsed.filter(isEvidenceIndexRow);
+}
+async function writeEvidenceIndexRow(stateDir, row) {
+  let bounded = [];
+  await withStateFileLock(indexPath(stateDir), () => {
+    const existing = readEvidenceIndex(stateDir).filter((entry) => entry.runId !== row.runId);
+    existing.push(row);
+    bounded = existing.length > MAX_EVIDENCE_INDEX_ROWS ? existing.slice(-MAX_EVIDENCE_INDEX_ROWS) : existing;
+    safeResourceWrite(indexPath(stateDir), `${JSON.stringify(bounded, null, 2)}
+`, { encoding: "utf8" });
+  });
+  return bounded;
+}
+async function writeEvidenceIndexRowQueued(stateDir, row) {
+  let written = [];
+  const write = evidenceIndexWriteQueue.then(async () => {
+    written = await writeEvidenceIndexRow(stateDir, row);
+  });
+  evidenceIndexWriteQueue = write.catch(() => void 0);
+  await write;
+  return written;
+}
+
+export {
+  readEvidenceIndex,
+  writeEvidenceIndexRowQueued
+};
+//# sourceMappingURL=chunk-HC4CLZ2Y.js.map

package/dist/{chunk-LU4TK2PR.js → chunk-HFSBBKSQ.js}

@@ -1,4 +1,8 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  createRedactionTally,
+  redactSecretsText
+} from "./chunk-4BJ5BYCE.js";
 import {
   processAlive,
   processBirthToken
@@ -14,58 +18,6 @@ import { mkdirSync } from "node:fs";
 import { createRequire } from "node:module";
 import { hostname } from "node:os";
 import { dirname, join } from "node:path";
-
-// src/domains/evidence/redact.ts
-init_esm_shims();
-function createRedactionTally() {
-  return { count: 0 };
-}
-var SECRET_PATTERNS = [
-  {
-    kind: "pem",
-    re: /-----BEGIN [A-Z0-9 ]*(?:PRIVATE KEY|PRIVATE KEY BLOCK)-----[\s\S]*?(?:-----END [A-Z0-9 ]*(?:PRIVATE KEY|PRIVATE KEY BLOCK)-----|$)/g
-  },
-  { kind: "aws-access-key", re: /\bAKIA[0-9A-Z]{16}\b/g },
-  { kind: "github-token", re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}\b/g },
-  { kind: "github-token", re: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g },
-  { kind: "sk-key", re: /\bsk-(?:[A-Za-z0-9_-]{2,20}-)?[A-Za-z0-9_-]{16,}\b/g },
-  { kind: "slack-token", re: /\bxox[bpars]-[A-Za-z0-9-]{8,}\b/g },
-  { kind: "google-api-key", re: /\bAIza[0-9A-Za-z_-]{30,}\b/g },
-  { kind: "jwt", re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}\b/g },
-  {
-    kind: "assignment",
-    // KEY=value / key: value / "api_key": "value" shapes where the key name
-    // is secret-flavored and the value is long enough to be a credential.
-    re: /\b((?:[A-Za-z0-9_-]*(?:api[_-]?key|apikey|secret|token|passwd|password|credential)[A-Za-z0-9_-]*)\s*["']?\s*[:=]\s*["']?)([^\s"'`;,&|<>]{8,})/gi
-  }
-];
-function redactSecretsText(text, tally) {
-  let out = text;
-  for (const pattern of SECRET_PATTERNS) {
-    out = out.replace(pattern.re, (...match) => {
-      tally.count += 1;
-      if (pattern.kind === "assignment") {
-        return `${String(match[1])}[redacted:${pattern.kind}]`;
-      }
-      return `[redacted:${pattern.kind}]`;
-    });
-  }
-  return out;
-}
-function redactSecretsDeep(value, tally) {
-  if (typeof value === "string") return redactSecretsText(value, tally);
-  if (Array.isArray(value)) return value.map((item) => redactSecretsDeep(item, tally));
-  if (value !== null && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype) {
-    const out = {};
-    for (const [key, item] of Object.entries(value)) {
-      out[key] = redactSecretsDeep(item, tally);
-    }
-    return out;
-  }
-  return value;
-}
-
-// src/domains/observability/trace-store.ts
 var TRACE_SCHEMA_VERSION = 1;
 var TRACE_DATABASE_FILE = "trace.sqlite";
 var TRACE_EVENT_POLL_LIMIT = 500;
@@ -1038,12 +990,9 @@ function finiteNonNegative(value) {
 }
 
 export {
-  createRedactionTally,
-  redactSecretsText,
-  redactSecretsDeep,
   TRACE_EVENT_POLL_LIMIT,
   traceDatabasePath,
   TraceReader,
   createDispatchTraceMirror
 };
-//# sourceMappingURL=chunk-LU4TK2PR.js.map
+//# sourceMappingURL=chunk-HFSBBKSQ.js.map

package/dist/{chunk-PIUMUEMV.js → chunk-HKIYEGME.js}

@@ -9,18 +9,22 @@ var BOOT_TRACE_ENV = "CLIO_CODER_TRACE_BOOT";
 function isBootTraceEnabled() {
   return process.env[BOOT_TRACE_ENV] === "1";
 }
+function formatBootTrace(phase, detail) {
+  if (!isBootTraceEnabled()) return null;
+  const suffix = detail !== void 0 && detail.length > 0 ? ` (${detail})` : "";
+  return `[clio:boot] +${performance.now().toFixed(1)}ms ${phase}${suffix}
+`;
+}
 function traceBoot(phase, detail) {
-  if (!isBootTraceEnabled()) return;
   try {
-    const elapsedMs = performance.now();
-    const suffix = detail !== void 0 && detail.length > 0 ? ` (${detail})` : "";
-    process.stderr.write(`[clio:boot] +${elapsedMs.toFixed(1)}ms ${phase}${suffix}
-`);
+    const line = formatBootTrace(phase, detail);
+    if (line) process.stderr.write(line);
   } catch {
   }
 }
 
 export {
+  formatBootTrace,
   traceBoot
 };
-//# sourceMappingURL=chunk-PIUMUEMV.js.map
+//# sourceMappingURL=chunk-HKIYEGME.js.map

package/dist/chunk-I4HZDVNP.js

@@ -0,0 +1,73 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  resolveClioDirs
+} from "./chunk-BNAZZHFG.js";
+import {
+  init_esm_shims
+} from "./chunk-3R73A4XB.js";
+
+// src/core/compile-cache.ts
+init_esm_shims();
+import { existsSync } from "node:fs";
+import { enableCompileCache } from "node:module";
+import { join } from "node:path";
+var INJECTED_COMPILE_CACHE_ENV = "CLIO_CODER_INJECTED_COMPILE_CACHE";
+function createCompileCache(enableFn = enableCompileCache, rootExists = existsSync) {
+  let settled;
+  return {
+    enable(env = process.env) {
+      if (settled !== void 0) return settled;
+      if (env.NODE_DISABLE_COMPILE_CACHE !== void 0) {
+        settled = null;
+        return settled;
+      }
+      try {
+        if (env.NODE_COMPILE_CACHE !== void 0) {
+          settled = enableFn().directory ?? null;
+          return settled;
+        }
+        const root = resolveClioDirs().cache;
+        if (!rootExists(root)) {
+          settled = null;
+          return settled;
+        }
+        settled = enableFn(join(root, "v8-compile-cache")).directory ?? null;
+      } catch {
+        settled = null;
+      }
+      return settled;
+    },
+    directory: () => settled ?? null
+  };
+}
+var processCompileCache = createCompileCache();
+function enableClioCompileCache(env) {
+  return processCompileCache.enable(env);
+}
+function workerCompileCacheEnvironment(env, directory) {
+  const operatorControlled = env.NODE_COMPILE_CACHE !== void 0 || env.NODE_DISABLE_COMPILE_CACHE !== void 0;
+  if (operatorControlled || directory === null) {
+    if (env[INJECTED_COMPILE_CACHE_ENV] === void 0) return env;
+    const cleaned = { ...env };
+    Reflect.deleteProperty(cleaned, INJECTED_COMPILE_CACHE_ENV);
+    return cleaned;
+  }
+  return { ...env, NODE_COMPILE_CACHE: directory, [INJECTED_COMPILE_CACHE_ENV]: directory };
+}
+function deleteInjectedCompileCacheFrom(env) {
+  const injected = env[INJECTED_COMPILE_CACHE_ENV];
+  if (injected === void 0) return;
+  if (env.NODE_COMPILE_CACHE === injected) {
+    Reflect.deleteProperty(env, "NODE_COMPILE_CACHE");
+  }
+  Reflect.deleteProperty(env, INJECTED_COMPILE_CACHE_ENV);
+}
+
+export {
+  INJECTED_COMPILE_CACHE_ENV,
+  createCompileCache,
+  enableClioCompileCache,
+  workerCompileCacheEnvironment,
+  deleteInjectedCompileCacheFrom
+};
+//# sourceMappingURL=chunk-I4HZDVNP.js.map

package/dist/{chunk-4QKXUHSR.js → chunk-IGLFWIYI.js}

@@ -2,19 +2,68 @@ import { createRequire as __clioCreateRequire } from "node:module"; const requir
 import {
   readStateInfo,
   runDoctor
-} from "./chunk-ASND7OZK.js";
+} from "./chunk-QTYWRVRA.js";
 import {
   getVersionInfo
 } from "./chunk-XPLRXC72.js";
+import {
+  readSettings,
+  settingsPath,
+  updateSettings
+} from "./chunk-A3CYT5EX.js";
+import {
+  authStoragePath,
+  openAuthStorage
+} from "./chunk-4VP4KH3K.js";
 import {
   init_esm_shims
 } from "./chunk-3R73A4XB.js";
 
 // src/domains/lifecycle/migrations/index.ts
 init_esm_shims();
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync as existsSync2, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-var REGISTRY = Object.freeze([]);
+
+// src/domains/lifecycle/migrations/2026-08-18-lmstudio-runtime-id.ts
+init_esm_shims();
+import { existsSync } from "node:fs";
+function normalizeLmStudioUrl(url) {
+  if (!url) return url;
+  if (url.startsWith("ws://")) return `http://${url.slice("ws://".length)}`;
+  if (url.startsWith("wss://")) return `https://${url.slice("wss://".length)}`;
+  return url;
+}
+var migration = {
+  id: "2026-08-18-lmstudio-runtime-id",
+  async up() {
+    let keepLegacyCredential = false;
+    if (existsSync(settingsPath())) {
+      const current = readSettings();
+      keepLegacyCredential = current.targets.some((target) => target.auth?.apiKeyRef === "lmstudio-native");
+      const needsSettingsRewrite = current.targets.some(
+        (target) => target.runtime === "lmstudio-native" || (target.runtime === "lmstudio" || target.runtime === "lmstudio-native") && normalizeLmStudioUrl(target.url) !== target.url
+      );
+      if (needsSettingsRewrite) {
+        updateSettings((settings) => {
+          for (const target of settings.targets) {
+            if (target.runtime !== "lmstudio-native" && target.runtime !== "lmstudio") continue;
+            target.runtime = "lmstudio";
+            const url = normalizeLmStudioUrl(target.url);
+            if (url !== void 0) target.url = url;
+          }
+        });
+      }
+    }
+    if (!existsSync(authStoragePath())) return;
+    const storage = openAuthStorage();
+    if (!storage.hasStored("lmstudio-native")) return;
+    storage.renameProvider("lmstudio-native", "lmstudio", { keepSource: keepLegacyCredential });
+  }
+};
+var lmstudio_runtime_id_default = migration;
+
+// src/domains/lifecycle/migrations/index.ts
+var REGISTRY = Object.freeze([lmstudio_runtime_id_default]);
 function listMigrations() {
   return REGISTRY;
 }
@@ -22,7 +71,7 @@ function manifestPath(stateDir) {
   return join(stateDir, "migrations.json");
 }
 function readManifest(path) {
-  if (!existsSync(path)) return { applied: [] };
+  if (!existsSync2(path)) return { applied: [] };
   try {
     const raw = readFileSync(path, "utf8");
     const parsed = JSON.parse(raw);
@@ -38,27 +87,40 @@ function writeManifest(path, manifest) {
   writeFileSync(path, `${JSON.stringify(manifest, null, 2)}
 `, { encoding: "utf8", mode: 420 });
 }
-async function runPending(stateDir) {
+async function runPending(stateDir, migrations = REGISTRY) {
   mkdirSync(stateDir, { recursive: true });
   const path = manifestPath(stateDir);
   const manifest = readManifest(path);
   const applied = new Set(manifest.applied);
   const newlyApplied = [];
-  for (const m of REGISTRY) {
+  for (const m of migrations) {
     if (applied.has(m.id)) continue;
     await m.up(stateDir);
     applied.add(m.id);
     newlyApplied.push(m.id);
+    writeManifest(path, { applied: [...applied] });
   }
   const allApplied = [...applied];
   writeManifest(path, { applied: allApplied });
   return {
     applied: newlyApplied,
     allApplied,
-    available: REGISTRY.map((m) => m.id)
+    available: migrations.map((m) => m.id)
   };
 }
 
+// src/domains/lifecycle/upgrade-notice.ts
+init_esm_shims();
+var KEYBOARD_FACING_CHANGES = Object.freeze({
+  "0.3.1": "/targets, /fleet, and /scoped-models now open inside /settings; the commit-crafting, create-pr, investigate-issue, and review-changes skills are retired in favour of file-ticket, fix-issue, and ship; artifact defaults write under .clio-coder/artifacts/."
+});
+function describeUpgradeNotice(transition) {
+  const changes = KEYBOARD_FACING_CHANGES[transition.to];
+  const head = `clio: upgraded ${transition.from} \u2192 ${transition.to}.`;
+  const tail = `Full notes: CHANGELOG.md, section ${transition.to}.`;
+  return changes === void 0 ? `${head} What changed is in CHANGELOG.md, section ${transition.to}.` : `${head} What changed at the keyboard: ${changes} ${tail}`;
+}
+
 // src/domains/lifecycle/index.ts
 init_esm_shims();
 
@@ -85,18 +147,6 @@ var LifecycleManifest = {
   dependsOn: ["config"]
 };
 
-// src/domains/lifecycle/upgrade-notice.ts
-init_esm_shims();
-var KEYBOARD_FACING_CHANGES = Object.freeze({
-  "0.3.1": "/targets, /fleet, and /scoped-models now open inside /settings; the commit-crafting, create-pr, investigate-issue, and review-changes skills are retired in favour of file-ticket, fix-issue, and ship; artifact defaults write under .clio-coder/artifacts/."
-});
-function describeUpgradeNotice(transition) {
-  const changes = KEYBOARD_FACING_CHANGES[transition.to];
-  const head = `clio: upgraded ${transition.from} \u2192 ${transition.to}.`;
-  const tail = `Full notes: CHANGELOG.md, section ${transition.to}.`;
-  return changes === void 0 ? `${head} What changed is in CHANGELOG.md, section ${transition.to}.` : `${head} What changed at the keyboard: ${changes} ${tail}`;
-}
-
 // src/domains/lifecycle/index.ts
 var LifecycleDomainModule = {
   manifest: LifecycleManifest,
@@ -108,4 +158,4 @@ export {
   describeUpgradeNotice,
   LifecycleDomainModule
 };
-//# sourceMappingURL=chunk-4QKXUHSR.js.map
+//# sourceMappingURL=chunk-IGLFWIYI.js.map

package/dist/chunk-IKCO5N3L.js

@@ -0,0 +1,162 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  processAlive,
+  processBirthToken
+} from "./chunk-3I7MS7N2.js";
+import {
+  init_esm_shims
+} from "./chunk-3R73A4XB.js";
+
+// src/core/state-file-lock.ts
+init_esm_shims();
+import { closeSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, utimesSync, writeSync } from "node:fs";
+import { hostname } from "node:os";
+import { dirname } from "node:path";
+import { setTimeout as sleep } from "node:timers/promises";
+var STALE_LOCK_MS = 3e4;
+var REFRESH_LOCK_MS = 5e3;
+var FILE_LOCK_ACQUIRE_TIMEOUT_MS = 2e4;
+function readLockOwner(lockPath) {
+  try {
+    const raw = readFileSync(lockPath, "utf8").trim();
+    const record = raw.startsWith("{") ? JSON.parse(raw) : { pid: Number.parseInt(raw, 10) };
+    const { host, pid, birthToken } = record;
+    if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0) return null;
+    return {
+      host: typeof host === "string" ? host : null,
+      pid,
+      birthToken: typeof birthToken === "string" ? birthToken : null
+    };
+  } catch {
+    return null;
+  }
+}
+function ownerIsAlive(owner) {
+  if (owner.host !== null && owner.host !== hostname()) return true;
+  if (!processAlive(owner.pid)) return false;
+  if (owner.birthToken === null) return true;
+  const current = processBirthToken(owner.pid);
+  return current === null || current === owner.birthToken;
+}
+function lockfileAgeMs(lockPath) {
+  try {
+    return Date.now() - statSync(lockPath).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+function tryAcquire(lockPath) {
+  try {
+    const fd = openSync(lockPath, "wx", 384);
+    try {
+      writeSync(
+        fd,
+        `${JSON.stringify({ host: hostname(), pid: process.pid, birthToken: processBirthToken(), at: (/* @__PURE__ */ new Date()).toISOString() })}
+`
+      );
+    } finally {
+      closeSync(fd);
+    }
+    return true;
+  } catch (err) {
+    if (err.code !== "EEXIST") throw err;
+  }
+  const owner = readLockOwner(lockPath);
+  const ageMs = lockfileAgeMs(lockPath);
+  const abandoned = owner !== null ? !ownerIsAlive(owner) : ageMs !== null && ageMs > STALE_LOCK_MS;
+  if (abandoned) {
+    try {
+      unlinkSync(lockPath);
+    } catch {
+    }
+  }
+  return false;
+}
+function timeoutError(lockPath, timeoutMs) {
+  return new Error(
+    `timed out after ${timeoutMs}ms waiting for ${lockPath} (owner pid=${readLockOwner(lockPath)?.pid ?? "?"}); delete it if no other clio process is running`
+  );
+}
+function backoffMs(attempt) {
+  return Math.min(100, 5 * 2 ** Math.min(attempt, 5));
+}
+function release(lockPath) {
+  const owner = readLockOwner(lockPath);
+  if (owner?.pid !== process.pid || owner.host !== null && owner.host !== hostname()) return;
+  try {
+    unlinkSync(lockPath);
+  } catch {
+  }
+}
+function startRefresh(lockPath) {
+  const timer = setInterval(() => {
+    const at = /* @__PURE__ */ new Date();
+    try {
+      utimesSync(lockPath, at, at);
+    } catch {
+    }
+  }, REFRESH_LOCK_MS);
+  timer.unref();
+  return () => clearInterval(timer);
+}
+function withStateFileLockSync(targetPath, fn, options = {}) {
+  const lockPath = `${targetPath}.lock`;
+  const timeoutMs = options.timeoutMs ?? FILE_LOCK_ACQUIRE_TIMEOUT_MS;
+  let held = false;
+  try {
+    options.signal?.throwIfAborted();
+    mkdirSync(dirname(lockPath), { recursive: true });
+    const deadlineMs = Date.now() + timeoutMs;
+    for (let attempt = 1; !tryAcquire(lockPath); attempt += 1) {
+      options.signal?.throwIfAborted();
+      if (Date.now() > deadlineMs) throw timeoutError(lockPath, timeoutMs);
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, backoffMs(attempt));
+    }
+    held = true;
+  } catch (err) {
+    options.signal?.throwIfAborted();
+    if (options.onAcquireFailure !== "run-unlocked") throw err;
+  }
+  try {
+    return fn();
+  } finally {
+    if (held) release(lockPath);
+  }
+}
+async function withStateFileLock(targetPath, fn, options = {}) {
+  const lockPath = `${targetPath}.lock`;
+  const timeoutMs = options.timeoutMs ?? FILE_LOCK_ACQUIRE_TIMEOUT_MS;
+  let held = false;
+  try {
+    options.signal?.throwIfAborted();
+    mkdirSync(dirname(lockPath), { recursive: true });
+    const deadlineMs = Date.now() + timeoutMs;
+    for (let attempt = 1; !tryAcquire(lockPath); attempt += 1) {
+      options.signal?.throwIfAborted();
+      if (Date.now() > deadlineMs) throw timeoutError(lockPath, timeoutMs);
+      const base = backoffMs(attempt);
+      const delayMs = base + Math.floor(Math.random() * base);
+      if (options.signal) await sleep(delayMs, void 0, { signal: options.signal });
+      else await sleep(delayMs);
+    }
+    held = true;
+    options.signal?.throwIfAborted();
+  } catch (err) {
+    options.signal?.throwIfAborted();
+    if (options.onAcquireFailure !== "run-unlocked") throw err;
+  }
+  const stopRefresh = held ? startRefresh(lockPath) : null;
+  try {
+    return await fn();
+  } finally {
+    stopRefresh?.();
+    if (held) release(lockPath);
+  }
+}
+
+export {
+  FILE_LOCK_ACQUIRE_TIMEOUT_MS,
+  withStateFileLockSync,
+  withStateFileLock
+};
+//# sourceMappingURL=chunk-IKCO5N3L.js.map

package/dist/chunk-IR4CFBFN.js

@@ -0,0 +1,56 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  init_esm_shims
+} from "./chunk-3R73A4XB.js";
+
+// src/domains/safety/scope.ts
+init_esm_shims();
+import path from "node:path";
+function normalizeRoot(root) {
+  return path.resolve(root);
+}
+function isUnder(child, parent) {
+  const c = normalizeRoot(child);
+  const p = normalizeRoot(parent);
+  if (c === p) return true;
+  const rel = path.relative(p, c);
+  return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+function isSubset(worker, orchestrator) {
+  for (const action of worker.allowedActions) {
+    if (!orchestrator.allowedActions.has(action)) return false;
+  }
+  for (const root of worker.allowedWriteRoots) {
+    const covered = orchestrator.allowedWriteRoots.some((outer) => isUnder(root, outer));
+    if (!covered) return false;
+  }
+  if (worker.allowNetwork && !orchestrator.allowNetwork) return false;
+  if (worker.allowDispatch && !orchestrator.allowDispatch) return false;
+  return true;
+}
+var READONLY_SCOPE = {
+  allowedActions: /* @__PURE__ */ new Set(["read"]),
+  allowedWriteRoots: [],
+  allowNetwork: true,
+  allowDispatch: false
+};
+var WORKSPACE_SCOPE = {
+  allowedActions: /* @__PURE__ */ new Set(["read", "write", "execute", "dispatch"]),
+  allowedWriteRoots: [process.cwd()],
+  allowNetwork: true,
+  allowDispatch: true
+};
+var CONFIRMED_SCOPE = {
+  allowedActions: /* @__PURE__ */ new Set(["read", "write", "execute", "dispatch", "system_modify"]),
+  allowedWriteRoots: [process.cwd()],
+  allowNetwork: true,
+  allowDispatch: true
+};
+
+export {
+  isSubset,
+  READONLY_SCOPE,
+  WORKSPACE_SCOPE,
+  CONFIRMED_SCOPE
+};
+//# sourceMappingURL=chunk-IR4CFBFN.js.map

package/dist/{chunk-PFEFKVGL.js → chunk-J5HN4RYU.js}

@@ -1,20 +1,22 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
-  TASK_MEMORY_CONTENT_MAX_CHARS,
-  TASK_MEMORY_DEFAULT_KNOWLEDGE_CAP,
-  TASK_MEMORY_DEFAULT_PROCEDURAL_CAP,
   inspectEvidence
-} from "./chunk-7SS2CTV2.js";
+} from "./chunk-6EJV5X2W.js";
 import {
   createRedactionTally,
   redactSecretsText
-} from "./chunk-LU4TK2PR.js";
+} from "./chunk-4BJ5BYCE.js";
+import {
+  TASK_MEMORY_CONTENT_MAX_CHARS,
+  TASK_MEMORY_DEFAULT_KNOWLEDGE_CAP,
+  TASK_MEMORY_DEFAULT_PROCEDURAL_CAP
+} from "./chunk-OAO4GE4M.js";
 import {
   canonicalizeExistingPath
-} from "./chunk-OLBBMFRD.js";
+} from "./chunk-ECH6PKUQ.js";
 import {
   ceilChars
-} from "./chunk-H6F6BYOH.js";
+} from "./chunk-LZSJBIVT.js";
 import {
   safeResourceWrite
 } from "./chunk-WEPFGWHJ.js";
@@ -693,9 +695,6 @@ function compareStrings2(a, b) {
   return a.localeCompare(b);
 }
 
-// src/domains/memory/index.ts
-init_esm_shims();
-
 // src/domains/memory/task-memory-handoff.ts
 init_esm_shims();
 import { existsSync, readdirSync, readFileSync as readFileSync2, statSync } from "node:fs";
@@ -908,6 +907,9 @@ function truncate(value) {
   return value.length <= TRACE_TEXT_MAX_CHARS ? value : `${value.slice(0, TRACE_TEXT_MAX_CHARS)}\u2026[truncated]`;
 }
 
+// src/domains/memory/index.ts
+init_esm_shims();
+
 export {
   memoryStorePath,
   loadMemoryRecords,
@@ -927,4 +929,4 @@ export {
   taskMemoryTracePath,
   createTaskMemoryTrace
 };
-//# sourceMappingURL=chunk-PFEFKVGL.js.map
+//# sourceMappingURL=chunk-J5HN4RYU.js.map

package/dist/{chunk-R5KLMSBV.js → chunk-J5Q24KAG.js}

@@ -2,7 +2,7 @@ import { createRequire as __clioCreateRequire } from "node:module"; const requir
 import {
   GUARDRAIL_ENV_VARS,
   resolveGuardrail
-} from "./chunk-NMOX6HFD.js";
+} from "./chunk-4ZG3XFUR.js";
 import {
   init_esm_shims
 } from "./chunk-3R73A4XB.js";
@@ -31,4 +31,4 @@ function armInternalDispatchDeadline(dispatch, runId, label, env = process.env,
 export {
   armInternalDispatchDeadline
 };
-//# sourceMappingURL=chunk-R5KLMSBV.js.map
+//# sourceMappingURL=chunk-J5Q24KAG.js.map