@iowarp/clio-coder 0.3.2 → 0.3.4

package/dist/{chunk-STBPMHSX.js → chunk-7RXG6QRZ.js}

@@ -1,18 +1,24 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   AGENT_AUTOMATION_AUTHORITIES,
+  classify
+} from "./chunk-AOCYTWAV.js";
+import {
   artifactDefaultPath,
-  classify,
   detectValidationCommand,
   extractCommandDeleteTargets,
   extractCommandWriteTargets,
   inlineShellScript,
   tokenizeShellLike,
   toolMutationPaths
-} from "./chunk-5UUP6MWO.js";
+} from "./chunk-MV3K5QF2.js";
+import {
+  loadProjectVerifierCatalog
+} from "./chunk-FYYLNIL5.js";
 import {
+  isProjectVerifierCheckId,
   isVerificationScriptName
-} from "./chunk-7MNJORFF.js";
+} from "./chunk-UL3WSD3F.js";
 import {
   canonicalizeExistingPath
 } from "./chunk-ECH6PKUQ.js";
@@ -974,8 +980,9 @@ function typedValidationSummary(toolName, payload) {
       const path5 = typeof args?.path === "string" && args.path.trim().length > 0 ? args.path.trim() : "artifact";
       return `verify frontend ${path5}`;
     }
-    if (!isVerificationScriptName(check)) return null;
-    return `npm run ${check}`;
+    if (isVerificationScriptName(check)) return `npm run ${check}`;
+    if (isProjectVerifierCheckId(check)) return `verify ${check}`;
+    return null;
   }
   return null;
 }
@@ -1156,7 +1163,7 @@ function autonomyAskRejection(level, tool, actionClass, exposure = DEFAULT_AUTON
       // and models otherwise stall retrying denied bash for checks or
       // directory listings.
       ...actionClass === "execute" ? [
-        'A declared package.json check runs without approval through the verify tool: verify(check="<script>").',
+        'A declared package or project-catalog check runs without approval through the verify tool: verify(check="<id>").',
         "Read-only inspection runs without approval through the ls, read, grep, and find tools."
       ] : []
     ]
@@ -1326,6 +1333,14 @@ var DEFAULT_DAMAGE_CONTROL_PATH_POLICY = {
     "*.dump"
   ],
   readOnlyPaths: [
+    // Clio's own operator-authority files in the project. `safety.yaml` is the
+    // policy that gates the model's tools, and `verifiers.yaml` is an argv
+    // catalog that verify() executes; a model that can author either one can
+    // widen its own permissions in two tool calls. Both are authored by the
+    // operator through the CLI (`clio-coder verifiers author` lands nothing
+    // before `--yes`), so model-side writes and deletes are refused.
+    ".clio-coder/safety.yaml",
+    ".clio-coder/verifiers.yaml",
     "/etc/",
     "/usr/",
     "/bin/",
@@ -1914,7 +1929,9 @@ function createSafetyPolicyEngine(options = {}) {
       const rawClassification = classify(call);
       const command = commandArg(call.args);
       const callCwd = cwdArg(call.args, cwd);
-      const scan = damageControlScan(call);
+      const catalogCheck = resolveVerifyCatalogCheck(call, cwd);
+      const catalogCommand = catalogCheck === null ? null : catalogCheck.command.join(" ");
+      const scan = catalogCommand ?? damageControlScan(call);
       const hit = scan ? matchSourcedRule(scan, sourcedRules) : null;
       const classification = effectiveClassification(rawClassification, hit?.match);
       const base = baseDecision(call, classification, callCwd, posture, command);
@@ -1971,8 +1988,9 @@ function createSafetyPolicyEngine(options = {}) {
         if (projectPolicy.path !== null) blockInput.projectPolicyPath = projectPolicy.path;
         return blockDecision(base, blockInput);
       }
-      if (call.tool === ToolNames.Bash && command !== null) {
-        const secretRead = evaluateBashZeroAccessRead(zeroAccessPolicy, command, callCwd);
+      const scannedCommand = call.tool === ToolNames.Bash ? command : catalogCommand;
+      if (scannedCommand !== null) {
+        const secretRead = evaluateBashZeroAccessRead(zeroAccessPolicy, scannedCommand, callCwd);
         if (secretRead !== null) {
           const blockInput = {
             ruleId: "secret_path_bash",
@@ -2027,7 +2045,15 @@ function createSafetyPolicyEngine(options = {}) {
       };
       if (hit?.match.ruleId !== void 0) allowInput.ruleId = hit.match.ruleId;
       if (hit?.match !== void 0) allowInput.match = hit.match;
-      if (classification.actionClass === "execute") allowInput.execRecognition = "recognized";
+      if (classification.actionClass === "execute") {
+        allowInput.execRecognition = catalogCheck === null ? "recognized" : "unrecognized";
+        if (catalogCheck !== null) {
+          allowInput.reasons = [
+            ...allowInput.reasons,
+            `project verifier '${catalogCheck.id}' runs declared argv: ${catalogCommand ?? ""}`
+          ];
+        }
+      }
       return allowDecision(base, allowInput);
     },
     metadata() {
@@ -2396,6 +2422,20 @@ function damageControlScan(call) {
   const pathArg2 = call.args?.path;
   return typeof pathArg2 === "string" ? pathArg2 : "";
 }
+function resolveVerifyCatalogCheck(call, workspaceRoot) {
+  if (call.tool !== ToolNames.Verify) return null;
+  const check = call.args?.check;
+  if (typeof check !== "string") return null;
+  const id = check.trim();
+  if (id.length === 0 || id === "frontend") return null;
+  try {
+    const catalog = loadProjectVerifierCatalog(workspaceRoot);
+    if (!catalog.ok || catalog.source === null) return null;
+    return catalog.source.checks.find((candidate) => candidate.id === id) ?? null;
+  } catch {
+    return null;
+  }
+}
 function serializeArgs(args) {
   if (!args) return "";
   const parts = [];
@@ -2453,4 +2493,4 @@ export {
   WRITE_ROOT_REFUSED_TOOLS,
   createSafetyPolicyEngine
 };
-//# sourceMappingURL=chunk-STBPMHSX.js.map
+//# sourceMappingURL=chunk-7RXG6QRZ.js.map

package/dist/{chunk-77VKQEHF.js → chunk-A2GZF7DC.js}

@@ -7,10 +7,10 @@ import {
   fingerprintNativeRuntime,
   interopProposals,
   renderProposalEntry
-} from "./chunk-2EHAIA3X.js";
+} from "./chunk-RD5U66HV.js";
 import {
   initializeClioHome
-} from "./chunk-BMEMKKIT.js";
+} from "./chunk-KOHPCX4K.js";
 import {
   createDelayedManualCodeInput,
   promptOAuthSelection
@@ -44,13 +44,13 @@ import {
   probeCapabilitiesForModel,
   registerBuiltinRuntimes,
   supportGroupLabel
-} from "./chunk-LZSJBIVT.js";
+} from "./chunk-QWU7ZBO7.js";
 import {
   readSettings,
   removeTargetFromSettings,
   settingsPath,
   updateSettings
-} from "./chunk-A3CYT5EX.js";
+} from "./chunk-AD2SYQYC.js";
 import {
   openAuthStorage,
   registerClioOAuthProviders,
@@ -1489,4 +1489,4 @@ export {
   runTargetRename,
   runConfigureCommand
 };
-//# sourceMappingURL=chunk-77VKQEHF.js.map
+//# sourceMappingURL=chunk-A2GZF7DC.js.map

package/dist/{chunk-A3CYT5EX.js → chunk-AD2SYQYC.js}

@@ -5,7 +5,7 @@ import {
   ACTIVE_ROUTING_ROLES,
   DEFAULT_SETTINGS,
   THINKING_LEVELS
-} from "./chunk-ZDOOVTXZ.js";
+} from "./chunk-4OC57DA6.js";
 import {
   MAX_TIMER_DELAY_MS
 } from "./chunk-FQ4SKYE4.js";
@@ -783,6 +783,7 @@ var TOP_LEVEL_KEYS = [
   "delegation",
   "keybindings",
   "compaction",
+  "context",
   "retry",
   "guardrails"
 ];
@@ -1182,6 +1183,58 @@ function validateSettings(raw) {
       }
     }
   }
+  if ("context" in raw) {
+    if (!isPlainObject(raw.context)) {
+      issues.add("context", `expected a map, got ${describe(raw.context)}`);
+    } else {
+      issues.unknownKeys("context", raw.context, ["workingSet"]);
+      if ("workingSet" in raw.context) {
+        if (!isPlainObject(raw.context.workingSet)) {
+          issues.add("context.workingSet", `expected a map, got ${describe(raw.context.workingSet)}`);
+        } else {
+          const workingSet = raw.context.workingSet;
+          issues.unknownKeys("context.workingSet", workingSet, [
+            "enabled",
+            "policy",
+            "target",
+            "protectLastTurns",
+            "minEvictableTokens"
+          ]);
+          if ("enabled" in workingSet) {
+            const v = expectBoolean(issues, "context.workingSet.enabled", workingSet.enabled);
+            if (v !== void 0) settings.context.workingSet.enabled = v;
+          }
+          if ("policy" in workingSet) {
+            const v = expectEnum(issues, "context.workingSet.policy", workingSet.policy, [
+              "age-horizon",
+              "structural-v1"
+            ]);
+            if (v !== void 0) settings.context.workingSet.policy = v;
+          }
+          if ("target" in workingSet) {
+            const v = expectNumber(issues, "context.workingSet.target", workingSet.target);
+            if (v !== void 0 && (v <= 0 || v >= 1)) {
+              issues.add("context.workingSet.target", `expected a number > 0 and < 1, got ${v}`);
+            } else if (v !== void 0) {
+              settings.context.workingSet.target = v;
+            }
+          }
+          if ("protectLastTurns" in workingSet) {
+            const v = expectInteger(issues, "context.workingSet.protectLastTurns", workingSet.protectLastTurns, {
+              min: 1
+            });
+            if (v !== void 0) settings.context.workingSet.protectLastTurns = v;
+          }
+          if ("minEvictableTokens" in workingSet) {
+            const v = expectInteger(issues, "context.workingSet.minEvictableTokens", workingSet.minEvictableTokens, {
+              min: 0
+            });
+            if (v !== void 0) settings.context.workingSet.minEvictableTokens = v;
+          }
+        }
+      }
+    }
+  }
   if ("retry" in raw) {
     if (!isPlainObject(raw.retry)) {
       issues.add("retry", `expected a map, got ${describe(raw.retry)}`);
@@ -1390,4 +1443,4 @@ export {
   removeFleetProfileFromSettings,
   bindAgentProfileInSettings
 };
-//# sourceMappingURL=chunk-A3CYT5EX.js.map
+//# sourceMappingURL=chunk-AD2SYQYC.js.map

package/dist/chunk-AOCYTWAV.js

@@ -0,0 +1,449 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  artifactDefaultPath,
+  extractCommandCdTargets,
+  extractCommandWriteTargets
+} from "./chunk-MV3K5QF2.js";
+import {
+  canonicalizeExistingPath
+} from "./chunk-ECH6PKUQ.js";
+import {
+  ToolNames,
+  isBuiltinToolName
+} from "./chunk-CGKSTWHD.js";
+import {
+  init_esm_shims
+} from "./chunk-3R73A4XB.js";
+
+// src/domains/agents/spec.ts
+init_esm_shims();
+import { createHash } from "node:crypto";
+
+// src/domains/safety/action-classifier.ts
+init_esm_shims();
+import path from "node:path";
+var GIT_DESTRUCTIVE_PATTERNS = [
+  { name: "git-push-force-long", re: /\bgit\s+push\s+--force\b/i },
+  { name: "git-push-force-short", re: /\bgit\s+push\s+-f\b/i },
+  { name: "git-reset-hard", re: /\bgit\s+reset\s+--hard\b/i },
+  { name: "git-clean-fd", re: /\bgit\s+clean\s+-fd?\b/i },
+  { name: "git-checkout-dot", re: /\bgit\s+checkout\s+--\s+\./i },
+  { name: "git-branch-D", re: /\bgit\s+branch\s+-D\b/i },
+  { name: "git-restore-source", re: /\bgit\s+restore\s+--source\b/i }
+];
+var SYSTEM_MODIFY_PATTERNS = [
+  { name: "sudo-or-doas", re: /\b(sudo|doas)\b/i },
+  // allow rm -rf /tmp/... and /var/tmp/... but flag everything else rooted at /
+  { name: "rm-rf-root", re: /\brm\s+-rf?\s+\/(?!(tmp|var\/tmp)(?:\/|\s|$))/i },
+  { name: "apt-install", re: /\bapt(-get)?\s+(install|remove|purge)/i },
+  { name: "brew-install", re: /\bbrew\s+(install|uninstall|reinstall)/i },
+  { name: "npm-install-global", re: /\bnpm\s+install\s+-g\b/i },
+  { name: "pip-install", re: /\bpip\s+install\b/i },
+  { name: "systemctl", re: /\bsystemctl\s+/i },
+  { name: "chmod-root", re: /\bchmod\s+[0-7]{3,4}\s+\//i },
+  { name: "chown", re: /\bchown\s+/i }
+];
+var SYSTEM_WRITE_ROOT_PREFIXES = ["/etc", "/usr", "/var", "/bin", "/sbin", "/run"];
+var SYSTEM_WRITE_EXEMPT_PREFIXES = ["/var/tmp", "/var/folders"];
+function isUnderPrefix(abs, prefix) {
+  return abs === prefix || abs.startsWith(`${prefix}/`);
+}
+function baseClassify(tool) {
+  switch (tool) {
+    case ToolNames.Read:
+    case ToolNames.Grep:
+    case ToolNames.Find:
+    case ToolNames.Ls:
+    case ToolNames.WebFetch:
+    case ToolNames.Git:
+    case ToolNames.CodeNav:
+    case ToolNames.Context:
+    case ToolNames.Monitor:
+    case ToolNames.AskUser:
+    case ToolNames.CredentialPresent:
+    // tasks pick mutates only Clio-owned session-ledger and project-local
+    // .clio-coder runtime state, never source-workspace files. By intentional
+    // policy it stays read class and ungated; the tool itself still requires
+    // a durable operator task id before it can mutate either store.
+    case ToolNames.Tasks:
+    // ledger posts a typed contribution to a coordination board and reads a
+    // local mirror. Neither touches the workspace, so it is never gated
+    // behind a confirmation.
+    case ToolNames.Ledger:
+      return "read";
+    case ToolNames.Write:
+    case ToolNames.Edit:
+    case ToolNames.Artifact:
+      return "write";
+    case ToolNames.Bash:
+    case ToolNames.Verify:
+      return "execute";
+    case ToolNames.Dispatch:
+    case ToolNames.Steer:
+      return "dispatch";
+    default:
+      return null;
+  }
+}
+function scanStringOf(args) {
+  if (!args) return "";
+  const parts = [];
+  for (const value of Object.values(args)) {
+    if (value == null) continue;
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+      parts.push(String(value));
+    } else {
+      try {
+        parts.push(JSON.stringify(value));
+      } catch {
+      }
+    }
+  }
+  return parts.join(" ");
+}
+function matchFirst(patterns, haystack) {
+  for (const p of patterns) {
+    if (p.re.test(haystack)) return p;
+  }
+  return null;
+}
+function resolveCandidate(p, baseCwd) {
+  if (p.startsWith("~")) return p;
+  const base = canonicalizeExistingPath(path.resolve(baseCwd ?? process.cwd()));
+  const resolved = path.isAbsolute(p) ? path.resolve(p) : path.resolve(base, p);
+  return canonicalizeExistingPath(resolved);
+}
+function isInsideCwd(abs) {
+  const cwd = canonicalizeExistingPath(path.resolve(process.cwd()));
+  const candidate = canonicalizeExistingPath(abs);
+  const rel = path.relative(cwd, candidate);
+  return rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+function writePathClass(pathArg, baseCwd) {
+  if (pathArg.startsWith("~")) {
+    return { cls: "system_modify", reason: `write-path-home-escape: ${pathArg}` };
+  }
+  const abs = resolveCandidate(pathArg, baseCwd);
+  const exempt = SYSTEM_WRITE_EXEMPT_PREFIXES.some((prefix) => isUnderPrefix(abs, prefix));
+  if (!exempt) {
+    for (const prefix of SYSTEM_WRITE_ROOT_PREFIXES) {
+      if (isUnderPrefix(abs, prefix)) {
+        return { cls: "system_modify", reason: `write-path-system-root: ${prefix}` };
+      }
+    }
+  }
+  if (!isInsideCwd(abs)) {
+    return { cls: "system_modify", reason: `write-path-outside-cwd: ${abs}` };
+  }
+  return { cls: "write" };
+}
+function extractWritePath(tool, args) {
+  const candidate = args?.path ?? args?.file_path ?? args?.filePath;
+  if (typeof candidate === "string" && candidate.length > 0) return candidate;
+  return tool === ToolNames.Artifact ? artifactDefaultPath(args?.kind) : null;
+}
+function classify(call) {
+  const base = baseClassify(call.tool);
+  if (base === null) {
+    return { actionClass: "unknown", reasons: [`unknown tool: ${call.tool}`] };
+  }
+  const reasons = [];
+  if (call.tool === ToolNames.Bash) {
+    const scan = scanStringOf(call.args);
+    const gitHit = matchFirst(GIT_DESTRUCTIVE_PATTERNS, scan);
+    if (gitHit) {
+      return { actionClass: "git_destructive", reasons: [`pattern:${gitHit.name}`] };
+    }
+    const sysHit = matchFirst(SYSTEM_MODIFY_PATTERNS, scan);
+    if (sysHit) {
+      return { actionClass: "system_modify", reasons: [`pattern:${sysHit.name}`] };
+    }
+    const command = typeof call.args?.command === "string" ? call.args.command : null;
+    const argCwd = typeof call.args?.cwd === "string" && call.args.cwd.length > 0 ? call.args.cwd : void 0;
+    if (command !== null) {
+      const targetReasons = [];
+      for (const target of extractCommandWriteTargets(command)) {
+        const decision = writePathClass(target, argCwd);
+        if (decision.cls === "system_modify") {
+          targetReasons.push(decision.reason ?? `bash-write-target: ${target}`);
+        }
+      }
+      for (const target of extractCommandCdTargets(command)) {
+        if (target.startsWith("~")) {
+          targetReasons.push(`bash-cd-home-escape: ${target}`);
+          continue;
+        }
+        const abs = resolveCandidate(target, argCwd);
+        if (!isInsideCwd(abs)) {
+          targetReasons.push(`bash-cd-outside-workspace: ${abs}`);
+        }
+      }
+      if (targetReasons.length > 0) {
+        return { actionClass: "system_modify", reasons: targetReasons };
+      }
+    }
+    return { actionClass: "execute", reasons };
+  }
+  if (base === "write") {
+    const pathArg = extractWritePath(call.tool, call.args);
+    if (pathArg) {
+      const decision = writePathClass(pathArg);
+      if (decision.cls === "system_modify") {
+        return { actionClass: "system_modify", reasons: decision.reason ? [decision.reason] : [] };
+      }
+    }
+    return { actionClass: "write", reasons };
+  }
+  return { actionClass: base, reasons };
+}
+
+// src/domains/agents/spec.ts
+var AGENT_AUTOMATION_AUTHORITIES = ["read-only", "verification", "artifact-write", "workspace-edit"];
+var AGENT_PRODUCTS = ["orientation"];
+var AGENT_CATEGORIES = [
+  "explore",
+  "plan",
+  "research",
+  "implement",
+  "quality",
+  "science",
+  "evolution",
+  "operations",
+  "internal"
+];
+var AGENT_CAPABILITY_CLASSES = [
+  "read-only",
+  "artifact-write",
+  "workspace-edit",
+  "verification",
+  "orchestration",
+  "internal"
+];
+var AGENT_LATENCY_CLASSES = ["fast", "balanced", "deep"];
+var AGENT_AUDIENCES = ["base", "shadow", "custom", "internal"];
+var AGENT_PROJECT_CONTEXT_TIERS = ["none", "bounded"];
+function includes(values, value) {
+  return typeof value === "string" && values.includes(value);
+}
+function isAgentCategory(value) {
+  return includes(AGENT_CATEGORIES, value);
+}
+function isAgentCapabilityClass(value) {
+  return includes(AGENT_CAPABILITY_CLASSES, value);
+}
+function isAgentLatencyClass(value) {
+  return includes(AGENT_LATENCY_CLASSES, value);
+}
+function isAgentAudience(value) {
+  return includes(AGENT_AUDIENCES, value);
+}
+function isAgentProjectContextTier(value) {
+  return includes(AGENT_PROJECT_CONTEXT_TIERS, value);
+}
+function isAgentProduct(value) {
+  return includes(AGENT_PRODUCTS, value);
+}
+function actionClassesForTools(tools) {
+  const actions = /* @__PURE__ */ new Set();
+  for (const tool of tools) actions.add(classify({ tool }).actionClass);
+  return actions;
+}
+function normalizeTools(recipe) {
+  const seen = /* @__PURE__ */ new Set();
+  const tools = [];
+  for (const tool of recipe.tools) {
+    if (typeof tool !== "string" || tool.trim().length === 0) {
+      throw new Error(`agent recipe '${recipe.id}' declares an invalid tool name`);
+    }
+    if (seen.has(tool)) continue;
+    seen.add(tool);
+    tools.push(isBuiltinToolName(tool) ? tool : tool);
+  }
+  return tools;
+}
+function asToolName(tool) {
+  return isBuiltinToolName(tool) ? tool : tool;
+}
+function normalizeToolRequirements(recipe, tools) {
+  if (!recipe.toolRequirements) {
+    throw new Error(`agent recipe '${recipe.id}' must declare tools.required and tools.optional`);
+  }
+  const declared = new Set(tools);
+  const required = recipe.toolRequirements.required.map((requirement, index) => {
+    if (typeof requirement === "string") return asToolName(requirement);
+    if (!Array.isArray(requirement.anyOf) || requirement.anyOf.length === 0) {
+      throw new Error(`agent recipe '${recipe.id}' tools.required[${index}].anyOf must be non-empty`);
+    }
+    return { anyOf: requirement.anyOf.map(asToolName) };
+  });
+  const optional = recipe.toolRequirements.optional.map(asToolName);
+  const mentioned = required.flatMap(
+    (requirement) => typeof requirement === "string" ? [requirement] : requirement.anyOf
+  );
+  for (const tool of [...mentioned, ...optional]) {
+    if (!declared.has(tool)) throw new Error(`agent recipe '${recipe.id}' requirement '${tool}' is not declared`);
+  }
+  if ((/* @__PURE__ */ new Set([...mentioned, ...optional])).size !== mentioned.length + optional.length) {
+    throw new Error(`agent recipe '${recipe.id}' contains duplicate tool requirements`);
+  }
+  if ((/* @__PURE__ */ new Set([...mentioned, ...optional])).size !== tools.length) {
+    throw new Error(`agent recipe '${recipe.id}' has declared tools without required/optional semantics`);
+  }
+  return { required, optional };
+}
+function resolveAgentToolCompatibility(spec, effectiveTools, options) {
+  const available = new Set(effectiveTools);
+  const missingRequired = [];
+  for (const requirement of spec.toolRequirements.required) {
+    if (typeof requirement === "string") {
+      if (!available.has(requirement)) missingRequired.push(requirement);
+      continue;
+    }
+    if (!requirement.anyOf.some((tool) => available.has(tool))) {
+      missingRequired.push(`anyOf(${requirement.anyOf.join("|")})`);
+    }
+  }
+  if (available.has(ToolNames.Dispatch) && !options.mediatesDispatch) {
+    missingRequired.push("dispatch(runtime mediation unavailable)");
+  }
+  return {
+    compatible: missingRequired.length === 0,
+    missingRequired,
+    lostOptional: spec.toolRequirements.optional.filter((tool) => !available.has(tool))
+  };
+}
+function normalizeAgentSpec(recipe) {
+  const tools = normalizeTools(recipe);
+  const toolRequirements = normalizeToolRequirements(recipe, tools);
+  return {
+    version: recipe.version,
+    id: recipe.id,
+    name: recipe.name,
+    description: recipe.description,
+    source: recipe.source,
+    filepath: recipe.filepath,
+    tools,
+    toolRequirements,
+    category: recipe.category,
+    capabilityClass: recipe.capabilityClass,
+    latencyClass: recipe.latencyClass,
+    projectContextTier: recipe.projectContextTier,
+    audience: recipe.audience,
+    tags: recipe.tags,
+    skills: recipe.skills,
+    resultContract: recipe.resultContract,
+    ...recipe.product !== void 0 ? { product: recipe.product } : {},
+    budget: recipe.budget,
+    body: recipe.body
+  };
+}
+function agentSpecFingerprint(spec) {
+  const requirement = (entry) => typeof entry === "string" ? entry : `anyOf(${[...entry.anyOf].sort().join("|")})`;
+  const payload = JSON.stringify({
+    id: spec.id,
+    tools: [...spec.tools].sort(),
+    required: spec.toolRequirements.required.map(requirement).sort(),
+    optional: [...spec.toolRequirements.optional].sort(),
+    capabilityClass: spec.capabilityClass,
+    latencyClass: spec.latencyClass,
+    projectContextTier: spec.projectContextTier,
+    audience: spec.audience,
+    skills: [...spec.skills].sort(),
+    resultContract: spec.resultContract,
+    budget: spec.budget,
+    body: createHash("sha256").update(spec.body, "utf8").digest("hex")
+  });
+  return createHash("sha256").update(payload, "utf8").digest("hex");
+}
+function isUserVisibleAgent(spec) {
+  return spec.audience === "base" || spec.audience === "custom";
+}
+function isShadowAgent(spec) {
+  return spec.audience === "shadow" || spec.audience === "internal";
+}
+function agentSpecPolicyErrors(spec) {
+  const errors = [];
+  const actions = actionClassesForTools(spec.tools);
+  const requiredGroups = spec.toolRequirements.required.map(
+    (requirement) => typeof requirement === "string" ? [requirement] : requirement.anyOf
+  );
+  const requiresTool = (tool) => requiredGroups.some((group) => group.length > 0 && group.every((candidate) => candidate === tool));
+  const requiresMutation = requiredGroups.some(
+    (group) => group.length > 0 && group.every((tool) => tool === ToolNames.Write || tool === ToolNames.Edit)
+  );
+  if (spec.capabilityClass === "workspace-edit" && (!requiresTool(ToolNames.Read) || !requiresMutation)) {
+    errors.push(`workspace-edit agent '${spec.id}' must require read and write|edit`);
+  }
+  if (spec.capabilityClass === "verification" && !requiresTool(ToolNames.Verify)) {
+    errors.push(`verification agent '${spec.id}' must require verify`);
+  }
+  if (spec.capabilityClass === "artifact-write" && !requiresTool(ToolNames.Artifact)) {
+    errors.push(`artifact-write agent '${spec.id}' must require artifact`);
+  }
+  if (spec.skills.length > 0 && !requiresTool(ToolNames.Context)) {
+    errors.push(`agent '${spec.id}' must require context for bound skills`);
+  }
+  if (spec.capabilityClass === "orchestration" && spec.tools.includes(ToolNames.Dispatch) && !requiresTool(ToolNames.Dispatch)) {
+    errors.push(`orchestration agent '${spec.id}' must require dispatch when it is declared`);
+  }
+  const toolList = spec.tools.join(", ");
+  if (spec.capabilityClass === "read-only") {
+    for (const action of actions) {
+      if (action !== "read") errors.push(`read-only agent '${spec.id}' requests ${action} tools (${toolList})`);
+    }
+  }
+  if (spec.capabilityClass === "artifact-write") {
+    for (const tool of spec.tools) {
+      const action = classify({ tool }).actionClass;
+      if (action === "execute" || action === "dispatch" || action === "system_modify" || action === "git_destructive") {
+        errors.push(`artifact-write agent '${spec.id}' requests ${action} tool '${tool}'`);
+      }
+      if (action === "write" && tool !== ToolNames.Artifact) {
+        errors.push(`artifact-write agent '${spec.id}' can only write terminal artifacts; got '${tool}'`);
+      }
+    }
+  }
+  if (spec.capabilityClass === "verification") {
+    for (const tool of spec.tools) {
+      const action = classify({ tool }).actionClass;
+      if (action === "write" || action === "dispatch" || action === "system_modify" || action === "git_destructive") {
+        errors.push(`verification agent '${spec.id}' must not request ${action} tool '${tool}'`);
+      }
+      if (tool === ToolNames.Bash)
+        errors.push(`verification agent '${spec.id}' must use typed validation tools, not bash`);
+    }
+  }
+  if (spec.capabilityClass !== "orchestration" && spec.tools.includes(ToolNames.Dispatch)) {
+    errors.push(`agent '${spec.id}' exposes dispatch without orchestration capability`);
+  }
+  if (spec.tools.includes(ToolNames.AskUser)) {
+    errors.push(`agent '${spec.id}' exposes ask_user, which is only available to the orchestrator`);
+  }
+  if (spec.skills.length > 0 && !spec.tools.includes(ToolNames.Context)) {
+    errors.push(`agent '${spec.id}' declares skills but does not expose context`);
+  }
+  return errors;
+}
+function assertAgentSpecPolicy(spec) {
+  const errors = agentSpecPolicyErrors(spec);
+  if (errors.length > 0) throw new Error(`agent policy violation:
+${errors.map((error) => `- ${error}`).join("\n")}`);
+}
+
+export {
+  classify,
+  AGENT_AUTOMATION_AUTHORITIES,
+  isAgentCategory,
+  isAgentCapabilityClass,
+  isAgentLatencyClass,
+  isAgentAudience,
+  isAgentProjectContextTier,
+  isAgentProduct,
+  resolveAgentToolCompatibility,
+  normalizeAgentSpec,
+  agentSpecFingerprint,
+  isUserVisibleAgent,
+  isShadowAgent,
+  assertAgentSpecPolicy
+};
+//# sourceMappingURL=chunk-AOCYTWAV.js.map