@iowarp/clio-coder 0.3.3 → 0.3.6

package/dist/{chunk-PAJK6MAQ.js → chunk-LYF7OHWH.js}

@@ -1,7 +1,7 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   assertAgentIdNamespace
-} from "./chunk-OC7FIQPC.js";
+} from "./chunk-R46L2BIR.js";
 import {
   parseFrontmatter
 } from "./chunk-QKMUKYO7.js";
@@ -21,7 +21,7 @@ import {
 import {
   createSafetyPolicyEngine,
   parseResultContract
-} from "./chunk-STBPMHSX.js";
+} from "./chunk-EKY57CSP.js";
 import {
   assertAgentSpecPolicy,
   classify,
@@ -33,7 +33,7 @@ import {
   isAgentProjectContextTier,
   isShadowAgent,
   normalizeAgentSpec
-} from "./chunk-5UUP6MWO.js";
+} from "./chunk-AOCYTWAV.js";
 import {
   clioConfigDir,
   clioStateDir,
@@ -42,7 +42,7 @@ import {
 import {
   BusChannels,
   isRunAbortedPayload
-} from "./chunk-OQ33BKR3.js";
+} from "./chunk-G7MUEIGA.js";
 import {
   resolvePackageRoot
 } from "./chunk-IWHMRKLL.js";
@@ -65,20 +65,16 @@ import path2 from "node:path";
 // src/domains/agents/recipe.ts
 init_esm_shims();
 import path from "node:path";
-var AGENT_BUDGET_KEYS = ["toolCalls", "readReserve", "synthesis"];
-function parseAgentBudget(value, sourcePath) {
-  if (value === void 0) return void 0;
-  const prefix = `agent budget: ${sourcePath}: budget`;
+var AGENT_BUDGET_KEYS = ["toolCalls", "readReserve", "synthesis", "maximum"];
+function parseAgentBudgetPhase(value, prefix, relationTarget) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     throw new Error(`${prefix} must be a non-null YAML object`);
   }
   const record = value;
   for (const key of Object.keys(record)) {
-    if (!AGENT_BUDGET_KEYS.includes(key)) {
-      throw new Error(`${prefix}.${key} is unknown`);
-    }
+    if (key !== "toolCalls" && key !== "readReserve") throw new Error(`${prefix}.${key} is unknown`);
   }
-  for (const key of AGENT_BUDGET_KEYS) {
+  for (const key of ["toolCalls", "readReserve"]) {
     if (!Object.hasOwn(record, key)) throw new Error(`${prefix}.${key} is required`);
   }
   const toolCalls = record.toolCalls;
@@ -91,10 +87,41 @@ function parseAgentBudget(value, sourcePath) {
     throw new Error(`${prefix}.readReserve must be a finite safe integer`);
   }
   if (readReserve < 0) throw new Error(`${prefix}.readReserve must be greater than or equal to 0`);
-  if (readReserve >= toolCalls) throw new Error(`${prefix}.readReserve must be less than budget.toolCalls`);
+  if (readReserve >= toolCalls) throw new Error(`${prefix}.readReserve must be less than ${relationTarget}`);
+  return { toolCalls, readReserve };
+}
+function parseAgentBudget(value, sourcePath) {
+  if (value === void 0) return void 0;
+  const prefix = `agent budget: ${sourcePath}: budget`;
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${prefix} must be a non-null YAML object`);
+  }
+  const record = value;
+  for (const key of Object.keys(record)) {
+    if (!AGENT_BUDGET_KEYS.includes(key)) {
+      throw new Error(`${prefix}.${key} is unknown`);
+    }
+  }
+  for (const key of ["toolCalls", "readReserve", "synthesis"]) {
+    if (!Object.hasOwn(record, key)) throw new Error(`${prefix}.${key} is required`);
+  }
+  const phase = parseAgentBudgetPhase(
+    { toolCalls: record.toolCalls, readReserve: record.readReserve },
+    prefix,
+    "budget.toolCalls"
+  );
   const synthesis = record.synthesis;
   if (typeof synthesis !== "boolean") throw new Error(`${prefix}.synthesis must be a boolean`);
-  return { toolCalls, readReserve, synthesis };
+  const maximum = record.maximum === void 0 ? void 0 : parseAgentBudgetPhase(record.maximum, `${prefix}.maximum`, "budget.maximum.toolCalls");
+  if (maximum !== void 0) {
+    if (maximum.toolCalls < phase.toolCalls) {
+      throw new Error(`${prefix}.maximum.toolCalls must be greater than or equal to budget.toolCalls`);
+    }
+    if (maximum.readReserve < phase.readReserve) {
+      throw new Error(`${prefix}.maximum.readReserve must be greater than or equal to budget.readReserve`);
+    }
+  }
+  return { ...phase, synthesis, ...maximum === void 0 ? {} : { maximum } };
 }
 function recipeIdFromPath(absPath, rootDir) {
   const resolvedRoot = path.resolve(rootDir);
@@ -1036,4 +1063,4 @@ export {
   AgentsDomainModule,
   SafetyDomainModule
 };
-//# sourceMappingURL=chunk-PAJK6MAQ.js.map
+//# sourceMappingURL=chunk-LYF7OHWH.js.map

package/dist/{chunk-POHLU5DW.js → chunk-M6L6IDJG.js}

@@ -3,7 +3,7 @@ import {
   createSlicer,
   isIndexablePath,
   languageForPath
-} from "./chunk-VJWL6YS5.js";
+} from "./chunk-UUVG37B4.js";
 import {
   CODEWIKI_VERSION
 } from "./chunk-LBMZMYH2.js";
@@ -11,7 +11,7 @@ import {
   WORKSPACE_EXCLUDED_DIRS,
   enumerateWorkspaceFilesAsync,
   filterWorkspaceFileCandidates
-} from "./chunk-EKMEHE4H.js";
+} from "./chunk-33YXPOE3.js";
 import {
   classifyCHeaderLanguage,
   isAmbiguousHeaderPath
@@ -1183,4 +1183,4 @@ export {
   updateCodewikiPaths,
   syncCodewiki
 };
-//# sourceMappingURL=chunk-POHLU5DW.js.map
+//# sourceMappingURL=chunk-M6L6IDJG.js.map

package/dist/{chunk-5UUP6MWO.js → chunk-MV3K5QF2.js}

@@ -1,26 +1,17 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   isVerificationScriptName
-} from "./chunk-7MNJORFF.js";
+} from "./chunk-UL3WSD3F.js";
 import {
   canonicalizeExistingPath
 } from "./chunk-ECH6PKUQ.js";
 import {
-  ToolNames,
-  isBuiltinToolName
+  ToolNames
 } from "./chunk-CGKSTWHD.js";
 import {
   init_esm_shims
 } from "./chunk-3R73A4XB.js";
 
-// src/domains/agents/spec.ts
-init_esm_shims();
-import { createHash } from "node:crypto";
-
-// src/domains/safety/action-classifier.ts
-init_esm_shims();
-import path2 from "node:path";
-
 // src/core/artifact-paths.ts
 init_esm_shims();
 var CLIO_PROJECT_DIR = ".clio-coder";
@@ -756,415 +747,6 @@ function compareStrings(left, right) {
   return 0;
 }
 
-// src/domains/safety/action-classifier.ts
-var GIT_DESTRUCTIVE_PATTERNS = [
-  { name: "git-push-force-long", re: /\bgit\s+push\s+--force\b/i },
-  { name: "git-push-force-short", re: /\bgit\s+push\s+-f\b/i },
-  { name: "git-reset-hard", re: /\bgit\s+reset\s+--hard\b/i },
-  { name: "git-clean-fd", re: /\bgit\s+clean\s+-fd?\b/i },
-  { name: "git-checkout-dot", re: /\bgit\s+checkout\s+--\s+\./i },
-  { name: "git-branch-D", re: /\bgit\s+branch\s+-D\b/i },
-  { name: "git-restore-source", re: /\bgit\s+restore\s+--source\b/i }
-];
-var SYSTEM_MODIFY_PATTERNS = [
-  { name: "sudo-or-doas", re: /\b(sudo|doas)\b/i },
-  // allow rm -rf /tmp/... and /var/tmp/... but flag everything else rooted at /
-  { name: "rm-rf-root", re: /\brm\s+-rf?\s+\/(?!(tmp|var\/tmp)(?:\/|\s|$))/i },
-  { name: "apt-install", re: /\bapt(-get)?\s+(install|remove|purge)/i },
-  { name: "brew-install", re: /\bbrew\s+(install|uninstall|reinstall)/i },
-  { name: "npm-install-global", re: /\bnpm\s+install\s+-g\b/i },
-  { name: "pip-install", re: /\bpip\s+install\b/i },
-  { name: "systemctl", re: /\bsystemctl\s+/i },
-  { name: "chmod-root", re: /\bchmod\s+[0-7]{3,4}\s+\//i },
-  { name: "chown", re: /\bchown\s+/i }
-];
-var SYSTEM_WRITE_ROOT_PREFIXES = ["/etc", "/usr", "/var", "/bin", "/sbin", "/run"];
-var SYSTEM_WRITE_EXEMPT_PREFIXES = ["/var/tmp", "/var/folders"];
-function isUnderPrefix(abs, prefix) {
-  return abs === prefix || abs.startsWith(`${prefix}/`);
-}
-function baseClassify(tool) {
-  switch (tool) {
-    case ToolNames.Read:
-    case ToolNames.Grep:
-    case ToolNames.Find:
-    case ToolNames.Ls:
-    case ToolNames.WebFetch:
-    case ToolNames.Git:
-    case ToolNames.CodeNav:
-    case ToolNames.Context:
-    case ToolNames.Monitor:
-    case ToolNames.AskUser:
-    case ToolNames.CredentialPresent:
-    // tasks pick mutates only Clio-owned session-ledger and project-local
-    // .clio-coder runtime state, never source-workspace files. By intentional
-    // policy it stays read class and ungated; the tool itself still requires
-    // a durable operator task id before it can mutate either store.
-    case ToolNames.Tasks:
-    // ledger posts a typed contribution to a coordination board and reads a
-    // local mirror. Neither touches the workspace, so it is never gated
-    // behind a confirmation.
-    case ToolNames.Ledger:
-      return "read";
-    case ToolNames.Write:
-    case ToolNames.Edit:
-    case ToolNames.Artifact:
-      return "write";
-    case ToolNames.Bash:
-    case ToolNames.Verify:
-      return "execute";
-    case ToolNames.Dispatch:
-    case ToolNames.Steer:
-      return "dispatch";
-    default:
-      return null;
-  }
-}
-function scanStringOf(args) {
-  if (!args) return "";
-  const parts = [];
-  for (const value of Object.values(args)) {
-    if (value == null) continue;
-    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
-      parts.push(String(value));
-    } else {
-      try {
-        parts.push(JSON.stringify(value));
-      } catch {
-      }
-    }
-  }
-  return parts.join(" ");
-}
-function matchFirst(patterns, haystack) {
-  for (const p of patterns) {
-    if (p.re.test(haystack)) return p;
-  }
-  return null;
-}
-function resolveCandidate(p, baseCwd) {
-  if (p.startsWith("~")) return p;
-  const base = canonicalizeExistingPath(path2.resolve(baseCwd ?? process.cwd()));
-  const resolved = path2.isAbsolute(p) ? path2.resolve(p) : path2.resolve(base, p);
-  return canonicalizeExistingPath(resolved);
-}
-function isInsideCwd(abs) {
-  const cwd = canonicalizeExistingPath(path2.resolve(process.cwd()));
-  const candidate = canonicalizeExistingPath(abs);
-  const rel = path2.relative(cwd, candidate);
-  return rel === "" || !rel.startsWith("..") && !path2.isAbsolute(rel);
-}
-function writePathClass(pathArg, baseCwd) {
-  if (pathArg.startsWith("~")) {
-    return { cls: "system_modify", reason: `write-path-home-escape: ${pathArg}` };
-  }
-  const abs = resolveCandidate(pathArg, baseCwd);
-  const exempt = SYSTEM_WRITE_EXEMPT_PREFIXES.some((prefix) => isUnderPrefix(abs, prefix));
-  if (!exempt) {
-    for (const prefix of SYSTEM_WRITE_ROOT_PREFIXES) {
-      if (isUnderPrefix(abs, prefix)) {
-        return { cls: "system_modify", reason: `write-path-system-root: ${prefix}` };
-      }
-    }
-  }
-  if (!isInsideCwd(abs)) {
-    return { cls: "system_modify", reason: `write-path-outside-cwd: ${abs}` };
-  }
-  return { cls: "write" };
-}
-function extractWritePath(tool, args) {
-  const candidate = args?.path ?? args?.file_path ?? args?.filePath;
-  if (typeof candidate === "string" && candidate.length > 0) return candidate;
-  return tool === ToolNames.Artifact ? artifactDefaultPath(args?.kind) : null;
-}
-function classify(call) {
-  const base = baseClassify(call.tool);
-  if (base === null) {
-    return { actionClass: "unknown", reasons: [`unknown tool: ${call.tool}`] };
-  }
-  const reasons = [];
-  if (call.tool === ToolNames.Bash) {
-    const scan = scanStringOf(call.args);
-    const gitHit = matchFirst(GIT_DESTRUCTIVE_PATTERNS, scan);
-    if (gitHit) {
-      return { actionClass: "git_destructive", reasons: [`pattern:${gitHit.name}`] };
-    }
-    const sysHit = matchFirst(SYSTEM_MODIFY_PATTERNS, scan);
-    if (sysHit) {
-      return { actionClass: "system_modify", reasons: [`pattern:${sysHit.name}`] };
-    }
-    const command = typeof call.args?.command === "string" ? call.args.command : null;
-    const argCwd = typeof call.args?.cwd === "string" && call.args.cwd.length > 0 ? call.args.cwd : void 0;
-    if (command !== null) {
-      const targetReasons = [];
-      for (const target of extractCommandWriteTargets(command)) {
-        const decision = writePathClass(target, argCwd);
-        if (decision.cls === "system_modify") {
-          targetReasons.push(decision.reason ?? `bash-write-target: ${target}`);
-        }
-      }
-      for (const target of extractCommandCdTargets(command)) {
-        if (target.startsWith("~")) {
-          targetReasons.push(`bash-cd-home-escape: ${target}`);
-          continue;
-        }
-        const abs = resolveCandidate(target, argCwd);
-        if (!isInsideCwd(abs)) {
-          targetReasons.push(`bash-cd-outside-workspace: ${abs}`);
-        }
-      }
-      if (targetReasons.length > 0) {
-        return { actionClass: "system_modify", reasons: targetReasons };
-      }
-    }
-    return { actionClass: "execute", reasons };
-  }
-  if (base === "write") {
-    const pathArg = extractWritePath(call.tool, call.args);
-    if (pathArg) {
-      const decision = writePathClass(pathArg);
-      if (decision.cls === "system_modify") {
-        return { actionClass: "system_modify", reasons: decision.reason ? [decision.reason] : [] };
-      }
-    }
-    return { actionClass: "write", reasons };
-  }
-  return { actionClass: base, reasons };
-}
-
-// src/domains/agents/spec.ts
-var AGENT_AUTOMATION_AUTHORITIES = ["read-only", "verification", "artifact-write", "workspace-edit"];
-var AGENT_PRODUCTS = ["orientation"];
-var AGENT_CATEGORIES = [
-  "explore",
-  "plan",
-  "research",
-  "implement",
-  "quality",
-  "science",
-  "evolution",
-  "operations",
-  "internal"
-];
-var AGENT_CAPABILITY_CLASSES = [
-  "read-only",
-  "artifact-write",
-  "workspace-edit",
-  "verification",
-  "orchestration",
-  "internal"
-];
-var AGENT_LATENCY_CLASSES = ["fast", "balanced", "deep"];
-var AGENT_AUDIENCES = ["base", "shadow", "custom", "internal"];
-var AGENT_PROJECT_CONTEXT_TIERS = ["none", "bounded"];
-function includes(values, value) {
-  return typeof value === "string" && values.includes(value);
-}
-function isAgentCategory(value) {
-  return includes(AGENT_CATEGORIES, value);
-}
-function isAgentCapabilityClass(value) {
-  return includes(AGENT_CAPABILITY_CLASSES, value);
-}
-function isAgentLatencyClass(value) {
-  return includes(AGENT_LATENCY_CLASSES, value);
-}
-function isAgentAudience(value) {
-  return includes(AGENT_AUDIENCES, value);
-}
-function isAgentProjectContextTier(value) {
-  return includes(AGENT_PROJECT_CONTEXT_TIERS, value);
-}
-function isAgentProduct(value) {
-  return includes(AGENT_PRODUCTS, value);
-}
-function actionClassesForTools(tools) {
-  const actions = /* @__PURE__ */ new Set();
-  for (const tool of tools) actions.add(classify({ tool }).actionClass);
-  return actions;
-}
-function normalizeTools(recipe) {
-  const seen = /* @__PURE__ */ new Set();
-  const tools = [];
-  for (const tool of recipe.tools) {
-    if (typeof tool !== "string" || tool.trim().length === 0) {
-      throw new Error(`agent recipe '${recipe.id}' declares an invalid tool name`);
-    }
-    if (seen.has(tool)) continue;
-    seen.add(tool);
-    tools.push(isBuiltinToolName(tool) ? tool : tool);
-  }
-  return tools;
-}
-function asToolName(tool) {
-  return isBuiltinToolName(tool) ? tool : tool;
-}
-function normalizeToolRequirements(recipe, tools) {
-  if (!recipe.toolRequirements) {
-    throw new Error(`agent recipe '${recipe.id}' must declare tools.required and tools.optional`);
-  }
-  const declared = new Set(tools);
-  const required = recipe.toolRequirements.required.map((requirement, index) => {
-    if (typeof requirement === "string") return asToolName(requirement);
-    if (!Array.isArray(requirement.anyOf) || requirement.anyOf.length === 0) {
-      throw new Error(`agent recipe '${recipe.id}' tools.required[${index}].anyOf must be non-empty`);
-    }
-    return { anyOf: requirement.anyOf.map(asToolName) };
-  });
-  const optional = recipe.toolRequirements.optional.map(asToolName);
-  const mentioned = required.flatMap(
-    (requirement) => typeof requirement === "string" ? [requirement] : requirement.anyOf
-  );
-  for (const tool of [...mentioned, ...optional]) {
-    if (!declared.has(tool)) throw new Error(`agent recipe '${recipe.id}' requirement '${tool}' is not declared`);
-  }
-  if ((/* @__PURE__ */ new Set([...mentioned, ...optional])).size !== mentioned.length + optional.length) {
-    throw new Error(`agent recipe '${recipe.id}' contains duplicate tool requirements`);
-  }
-  if ((/* @__PURE__ */ new Set([...mentioned, ...optional])).size !== tools.length) {
-    throw new Error(`agent recipe '${recipe.id}' has declared tools without required/optional semantics`);
-  }
-  return { required, optional };
-}
-function resolveAgentToolCompatibility(spec, effectiveTools, options) {
-  const available = new Set(effectiveTools);
-  const missingRequired = [];
-  for (const requirement of spec.toolRequirements.required) {
-    if (typeof requirement === "string") {
-      if (!available.has(requirement)) missingRequired.push(requirement);
-      continue;
-    }
-    if (!requirement.anyOf.some((tool) => available.has(tool))) {
-      missingRequired.push(`anyOf(${requirement.anyOf.join("|")})`);
-    }
-  }
-  if (available.has(ToolNames.Dispatch) && !options.mediatesDispatch) {
-    missingRequired.push("dispatch(runtime mediation unavailable)");
-  }
-  return {
-    compatible: missingRequired.length === 0,
-    missingRequired,
-    lostOptional: spec.toolRequirements.optional.filter((tool) => !available.has(tool))
-  };
-}
-function normalizeAgentSpec(recipe) {
-  const tools = normalizeTools(recipe);
-  const toolRequirements = normalizeToolRequirements(recipe, tools);
-  return {
-    version: recipe.version,
-    id: recipe.id,
-    name: recipe.name,
-    description: recipe.description,
-    source: recipe.source,
-    filepath: recipe.filepath,
-    tools,
-    toolRequirements,
-    category: recipe.category,
-    capabilityClass: recipe.capabilityClass,
-    latencyClass: recipe.latencyClass,
-    projectContextTier: recipe.projectContextTier,
-    audience: recipe.audience,
-    tags: recipe.tags,
-    skills: recipe.skills,
-    resultContract: recipe.resultContract,
-    ...recipe.product !== void 0 ? { product: recipe.product } : {},
-    budget: recipe.budget,
-    body: recipe.body
-  };
-}
-function agentSpecFingerprint(spec) {
-  const requirement = (entry) => typeof entry === "string" ? entry : `anyOf(${[...entry.anyOf].sort().join("|")})`;
-  const payload = JSON.stringify({
-    id: spec.id,
-    tools: [...spec.tools].sort(),
-    required: spec.toolRequirements.required.map(requirement).sort(),
-    optional: [...spec.toolRequirements.optional].sort(),
-    capabilityClass: spec.capabilityClass,
-    latencyClass: spec.latencyClass,
-    projectContextTier: spec.projectContextTier,
-    audience: spec.audience,
-    skills: [...spec.skills].sort(),
-    resultContract: spec.resultContract,
-    budget: spec.budget,
-    body: createHash("sha256").update(spec.body, "utf8").digest("hex")
-  });
-  return createHash("sha256").update(payload, "utf8").digest("hex");
-}
-function isUserVisibleAgent(spec) {
-  return spec.audience === "base" || spec.audience === "custom";
-}
-function isShadowAgent(spec) {
-  return spec.audience === "shadow" || spec.audience === "internal";
-}
-function agentSpecPolicyErrors(spec) {
-  const errors = [];
-  const actions = actionClassesForTools(spec.tools);
-  const requiredGroups = spec.toolRequirements.required.map(
-    (requirement) => typeof requirement === "string" ? [requirement] : requirement.anyOf
-  );
-  const requiresTool = (tool) => requiredGroups.some((group) => group.length > 0 && group.every((candidate) => candidate === tool));
-  const requiresMutation = requiredGroups.some(
-    (group) => group.length > 0 && group.every((tool) => tool === ToolNames.Write || tool === ToolNames.Edit)
-  );
-  if (spec.capabilityClass === "workspace-edit" && (!requiresTool(ToolNames.Read) || !requiresMutation)) {
-    errors.push(`workspace-edit agent '${spec.id}' must require read and write|edit`);
-  }
-  if (spec.capabilityClass === "verification" && !requiresTool(ToolNames.Verify)) {
-    errors.push(`verification agent '${spec.id}' must require verify`);
-  }
-  if (spec.capabilityClass === "artifact-write" && !requiresTool(ToolNames.Artifact)) {
-    errors.push(`artifact-write agent '${spec.id}' must require artifact`);
-  }
-  if (spec.skills.length > 0 && !requiresTool(ToolNames.Context)) {
-    errors.push(`agent '${spec.id}' must require context for bound skills`);
-  }
-  if (spec.capabilityClass === "orchestration" && spec.tools.includes(ToolNames.Dispatch) && !requiresTool(ToolNames.Dispatch)) {
-    errors.push(`orchestration agent '${spec.id}' must require dispatch when it is declared`);
-  }
-  const toolList = spec.tools.join(", ");
-  if (spec.capabilityClass === "read-only") {
-    for (const action of actions) {
-      if (action !== "read") errors.push(`read-only agent '${spec.id}' requests ${action} tools (${toolList})`);
-    }
-  }
-  if (spec.capabilityClass === "artifact-write") {
-    for (const tool of spec.tools) {
-      const action = classify({ tool }).actionClass;
-      if (action === "execute" || action === "dispatch" || action === "system_modify" || action === "git_destructive") {
-        errors.push(`artifact-write agent '${spec.id}' requests ${action} tool '${tool}'`);
-      }
-      if (action === "write" && tool !== ToolNames.Artifact) {
-        errors.push(`artifact-write agent '${spec.id}' can only write terminal artifacts; got '${tool}'`);
-      }
-    }
-  }
-  if (spec.capabilityClass === "verification") {
-    for (const tool of spec.tools) {
-      const action = classify({ tool }).actionClass;
-      if (action === "write" || action === "dispatch" || action === "system_modify" || action === "git_destructive") {
-        errors.push(`verification agent '${spec.id}' must not request ${action} tool '${tool}'`);
-      }
-      if (tool === ToolNames.Bash)
-        errors.push(`verification agent '${spec.id}' must use typed validation tools, not bash`);
-    }
-  }
-  if (spec.capabilityClass !== "orchestration" && spec.tools.includes(ToolNames.Dispatch)) {
-    errors.push(`agent '${spec.id}' exposes dispatch without orchestration capability`);
-  }
-  if (spec.tools.includes(ToolNames.AskUser)) {
-    errors.push(`agent '${spec.id}' exposes ask_user, which is only available to the orchestrator`);
-  }
-  if (spec.skills.length > 0 && !spec.tools.includes(ToolNames.Context)) {
-    errors.push(`agent '${spec.id}' declares skills but does not expose context`);
-  }
-  return errors;
-}
-function assertAgentSpecPolicy(spec) {
-  const errors = agentSpecPolicyErrors(spec);
-  if (errors.length > 0) throw new Error(`agent policy violation:
-${errors.map((error) => `- ${error}`).join("\n")}`);
-}
-
 export {
   CLIO_PROJECT_DIR,
   CLIO_ARTIFACT_DIR,
@@ -1175,21 +757,8 @@ export {
   detectValidationCommand,
   extractCommandWriteTargets,
   inlineShellScript,
+  extractCommandCdTargets,
   extractCommandDeleteTargets,
-  tokenizeShellLike,
-  classify,
-  AGENT_AUTOMATION_AUTHORITIES,
-  isAgentCategory,
-  isAgentCapabilityClass,
-  isAgentLatencyClass,
-  isAgentAudience,
-  isAgentProjectContextTier,
-  isAgentProduct,
-  resolveAgentToolCompatibility,
-  normalizeAgentSpec,
-  agentSpecFingerprint,
-  isUserVisibleAgent,
-  isShadowAgent,
-  assertAgentSpecPolicy
+  tokenizeShellLike
 };
-//# sourceMappingURL=chunk-5UUP6MWO.js.map
+//# sourceMappingURL=chunk-MV3K5QF2.js.map

package/dist/{chunk-X4RCMKVQ.js → chunk-NDINPTJ4.js}

@@ -2,7 +2,7 @@ import { createRequire as __clioCreateRequire } from "node:module"; const requir
 import {
   computeFingerprint,
   computeFingerprintAsync
-} from "./chunk-VJWL6YS5.js";
+} from "./chunk-UUVG37B4.js";
 import {
   require_dist
 } from "./chunk-APJ265NV.js";
@@ -638,4 +638,4 @@ export {
   wikiStaleness,
   wikiStalenessAsync
 };
-//# sourceMappingURL=chunk-X4RCMKVQ.js.map
+//# sourceMappingURL=chunk-NDINPTJ4.js.map

package/dist/{chunk-TZK7PACC.js → chunk-NILBFAPG.js}

@@ -1,7 +1,7 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   VERIFICATION_SCRIPT_FAMILY_HINT
-} from "./chunk-7MNJORFF.js";
+} from "./chunk-UL3WSD3F.js";
 import {
   truncateUtf8
 } from "./chunk-6XLNIQDB.js";
@@ -16,7 +16,7 @@ import {
   SAFE_EXEC_DEFAULT_TIMEOUT_MS,
   combineSafeOutput,
   runCommandVector
-} from "./chunk-VPAYEGVX.js";
+} from "./chunk-VEZEGCGW.js";
 import {
   StringEnum
 } from "./chunk-FCSXB6T2.js";
@@ -41,20 +41,24 @@ function prepareVerifyArguments(args) {
 }
 var verifyToolSurface = {
   name: ToolNames.Verify,
-  description: 'Run a declared verification check: no arguments lists checks, check=<package.json script> runs it, check="frontend" with path validates an HTML/CSS/JS artifact.',
+  description: 'Run a declared verification check: no arguments lists package scripts and .clio-coder/verifiers.yaml entries, check=<id> runs one, and check="frontend" with path validates an HTML/CSS/JS artifact.',
   parameters: typebox_exports.Object({
     check: typebox_exports.Optional(
       typebox_exports.String({
-        description: `Declared script name (${VERIFICATION_SCRIPT_FAMILY_HINT}) or "frontend". Omit to list available checks.`
+        description: `Declared project check ID, package script (${VERIFICATION_SCRIPT_FAMILY_HINT}), or "frontend". Omit to list available checks.`
       })
     ),
     path: typebox_exports.Optional(typebox_exports.String({ description: "check=frontend: artifact file under the workspace root." })),
-    args: typebox_exports.Optional(typebox_exports.Array(typebox_exports.String(), { description: "Extra arguments passed after --." })),
+    args: typebox_exports.Optional(
+      typebox_exports.Array(typebox_exports.String(), { description: "Package scripts only: extra arguments passed after --." })
+    ),
     browser: typebox_exports.Optional(
       StringEnum(BROWSER_MODES, { description: "check=frontend: headless browser mode (default auto)." })
     ),
-    cwd: typebox_exports.Optional(typebox_exports.String({ description: "Working directory." })),
-    timeout_ms: typebox_exports.Optional(typebox_exports.Number({ description: "Timeout in ms (default 120000)." })),
+    cwd: typebox_exports.Optional(typebox_exports.String({ description: "Package-script working directory; ignored by project checks." })),
+    timeout_ms: typebox_exports.Optional(
+      typebox_exports.Number({ description: "Package/frontend timeout in ms; project checks use their declared timeoutMs." })
+    ),
     max_output_bytes: typebox_exports.Optional(typebox_exports.Number({ description: "Output cap in bytes (default 600000)." }))
   }),
   baseActionClass: "execute",
@@ -77,9 +81,11 @@ function maxOutputArg(args) {
 function resultDetails(result) {
   return {
     command: [result.file, ...result.args].join(" "),
+    argv: [result.file, ...result.args],
     cwd: result.cwd,
     exitCode: result.exitCode,
     durationMs: result.durationMs,
+    aborted: result.aborted,
     timedOut: result.timedOut,
     outputCapped: result.outputCapped
   };
@@ -171,4 +177,4 @@ export {
   prepareVerifyArguments,
   verifyToolSurface
 };
-//# sourceMappingURL=chunk-TZK7PACC.js.map
+//# sourceMappingURL=chunk-NILBFAPG.js.map