@iowarp/clio-coder 0.3.7 → 0.3.9

package/dist/{chunk-4DWFMQDR.js → chunk-HJB5IUKP.js}

@@ -4,14 +4,12 @@ import {
   tomlTableAt
 } from "./chunk-LCGCVYZ4.js";
 import {
+  loadFragments,
   renderCodewikiDigest
-} from "./chunk-5WIGXA4T.js";
+} from "./chunk-47CMYGET.js";
 import {
   loadMemoryRecordsSync
-} from "./chunk-6M7VS3J3.js";
-import {
-  sha256
-} from "./chunk-UUANF5CR.js";
+} from "./chunk-5T7RBWN2.js";
 import {
   WIKI_INDEX,
   WIKI_PLAN_FILE,
@@ -46,14 +44,14 @@ import {
   readClioState,
   statePath,
   writeClioState
-} from "./chunk-MVVUPGPW.js";
+} from "./chunk-MXHC5QYU.js";
+import {
+  classifyProjectPreload
+} from "./chunk-JVCV3ICN.js";
 import {
   compileGlobRegex,
   normalizeGlobInput
 } from "./chunk-VG7TBQIY.js";
-import {
-  detectProjectType
-} from "./chunk-XAKHZX5N.js";
 import {
   computeFingerprintCached,
   isStale
@@ -62,15 +60,21 @@ import {
   codewikiPath,
   readCodewiki
 } from "./chunk-LBMZMYH2.js";
+import {
+  detectProjectType
+} from "./chunk-XAKHZX5N.js";
 import {
   enumerateWorkspaceFiles
 } from "./chunk-33YXPOE3.js";
+import {
+  ceilChars
+} from "./chunk-AEYBF3TB.js";
 import {
   INTEROP_AGENT_KINDS
 } from "./chunk-IHXBNWMM.js";
 import {
-  ceilChars
-} from "./chunk-GEYXPTRF.js";
+  BusChannels
+} from "./chunk-RKRLDWD3.js";
 import {
   require_dist
 } from "./chunk-APJ265NV.js";
@@ -78,15 +82,6 @@ import {
   clioDataDir,
   resolveClioDirs
 } from "./chunk-BNAZZHFG.js";
-import {
-  BusChannels
-} from "./chunk-OB5HIGJY.js";
-import {
-  classifyProjectPreload
-} from "./chunk-JVCV3ICN.js";
-import {
-  resolvePackageRoot
-} from "./chunk-IWHMRKLL.js";
 import {
   __toESM,
   init_esm_shims
@@ -162,7 +157,7 @@ var SECRET_LINE_PATTERNS = [
   /\bxox[baprs]-[A-Za-z0-9-]{20,}\b/,
   /\bAIza[0-9A-Za-z_-]{20,}\b/
 ];
-function sha2562(text) {
+function sha256(text) {
   return createHash("sha256").update(text).digest("hex");
 }
 function normalizeText(text) {
@@ -239,8 +234,8 @@ function discoverCandidateSpecs(cwd, home, includeGlobal) {
   const specs = [];
   const seen = /* @__PURE__ */ new Set();
   let order = 0;
-  const add = (path2, scope, provider, kind) => {
-    const abs = resolve(path2);
+  const add = (path, scope, provider, kind) => {
+    const abs = resolve(path);
     if (seen.has(abs)) return;
     seen.add(abs);
     const scopedDir = scope === "project" && kind === "instructions" ? relative(cwd, dirname(abs)) : "";
@@ -512,7 +507,7 @@ function rejectedCandidate(spec, displayPath2, reason, evidence) {
     kind: spec.kind,
     ...spec.directoryScope ? { directoryScope: spec.directoryScope } : {},
     reason,
-    fingerprintSha256: sha2562(`rejected\0${reason}\0${evidence}`)
+    fingerprintSha256: sha256(`rejected\0${reason}\0${evidence}`)
   };
 }
 function statEvidence(stat) {
@@ -561,7 +556,7 @@ function readCandidate(spec, cwd, home) {
     kindLabel: KIND_LABELS[spec.kind],
     ...spec.directoryScope ? { directoryScope: spec.directoryScope } : {},
     content,
-    contentSha256: sha2562(content),
+    contentSha256: sha256(content),
     byteLength: Buffer.byteLength(content, "utf8"),
     itemCount: rules.length,
     order: spec.order
@@ -625,7 +620,7 @@ function scanAgentConfigs(options) {
         kind: result.kind,
         ...result.directoryScope ? { directoryScope: result.directoryScope } : {},
         reason: "aggregate source byte budget exceeded",
-        fingerprintSha256: sha2562(`rejected\0aggregate source byte budget exceeded\0${result.contentSha256}`)
+        fingerprintSha256: sha256(`rejected\0aggregate source byte budget exceeded\0${result.contentSha256}`)
       });
       continue;
     }
@@ -651,8 +646,8 @@ function scanAgentConfigs(options) {
   };
 }
 function renderSourceList(paths) {
-  if (paths.length <= 3) return paths.map((path2) => `\`${path2}\``).join(", ");
-  return `${paths.slice(0, 3).map((path2) => `\`${path2}\``).join(", ")} +${paths.length - 3} more`;
+  if (paths.length <= 3) return paths.map((path) => `\`${path}\``).join(", ");
+  return `${paths.slice(0, 3).map((path) => `\`${path}\``).join(", ")} +${paths.length - 3} more`;
 }
 function quoteShort(text) {
   const cleaned = text.replace(/\s+/g, " ").trim();
@@ -1945,7 +1940,7 @@ function countStatusLines(status) {
   return status.split("\n").map((line) => line.trim()).filter(Boolean).length;
 }
 function basenameList(paths) {
-  const names = paths.map((path2) => parse(path2).base).sort((a, b) => a.localeCompare(b));
+  const names = paths.map((path) => parse(path).base).sort((a, b) => a.localeCompare(b));
   if (names.length === 0) return "";
   if (names.length <= 3) return names.join(", ");
   return `${names.slice(0, 3).join(", ")} +${names.length - 3}`;
@@ -2187,7 +2182,7 @@ function codewikiEntryPoints(codewiki, limit = 6) {
     if (!("toFileId" in edge)) continue;
     inDegree.set(edge.toFileId, (inDegree.get(edge.toFileId) ?? 0) + 1);
   }
-  const ranked = [...inDegree.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).map(([fileId]) => fileById.get(fileId)?.path).filter((path2) => typeof path2 === "string").filter((path2) => !tagged.includes(path2));
+  const ranked = [...inDegree.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).map(([fileId]) => fileById.get(fileId)?.path).filter((path) => typeof path === "string").filter((path) => !tagged.includes(path));
   return [...tagged, ...ranked].slice(0, limit);
 }
 async function runBootstrap(input = {}) {
@@ -2537,12 +2532,12 @@ function readProfileBlob(value, issues) {
   }
   return profile;
 }
-function readProfileFile(path2, issues) {
-  if (!existsSync6(path2)) return { profile: {}, present: false };
+function readProfileFile(path, issues) {
+  if (!existsSync6(path)) return { profile: {}, present: false };
   try {
-    return { profile: readProfileBlob((0, import_yaml2.parse)(readFileSync5(path2, "utf8")), issues), present: true };
+    return { profile: readProfileBlob((0, import_yaml2.parse)(readFileSync5(path, "utf8")), issues), present: true };
   } catch (err) {
-    issues.push(`${path2}: invalid YAML: ${err instanceof Error ? err.message : String(err)}`);
+    issues.push(`${path}: invalid YAML: ${err instanceof Error ? err.message : String(err)}`);
     return { profile: {}, present: false };
   }
 }
@@ -2729,12 +2724,60 @@ function ruleMatchesAnyPath(rule, workingPaths) {
     } catch {
       continue;
     }
-    for (const path2 of workingPaths) {
-      if (regex.test(normalizeGlobInput(path2))) return true;
+    for (const path of workingPaths) {
+      const normalized = normalizeGlobInput(path);
+      if (regex.test(normalized)) return true;
+      if (normalized.endsWith("/") && globMatchesInsideDirectory(regex, pattern, normalized)) return true;
     }
   }
   return false;
 }
+function materializedGlobVariants(pattern) {
+  let variants = [""];
+  const normalized = normalizeGlobInput(pattern);
+  for (let index = 0; index < normalized.length; index += 1) {
+    const character = normalized[index];
+    if (character === void 0) break;
+    if (character === "*" && normalized[index + 1] === "*" && normalized[index + 2] === "/") {
+      variants = variants.flatMap((prefix) => [prefix, `${prefix}x/`]).slice(0, 64);
+      index += 2;
+      continue;
+    }
+    if (character === "*" && normalized[index + 1] === "*") {
+      variants = variants.map((prefix) => `${prefix}x`);
+      index += 1;
+      continue;
+    }
+    if (character === "*" || character === "?") {
+      variants = variants.map((prefix) => `${prefix}x`);
+      continue;
+    }
+    if (character === "[") {
+      const end = normalized.indexOf("]", index + 1);
+      const selected = end === -1 ? "x" : normalized[index + 1] ?? "x";
+      variants = variants.map((prefix) => `${prefix}${selected}`);
+      index = end === -1 ? index : end;
+      continue;
+    }
+    variants = variants.map((prefix) => `${prefix}${character}`);
+  }
+  return variants;
+}
+function globMatchesInsideDirectory(regex, pattern, directory) {
+  const candidates = /* @__PURE__ */ new Set([`${directory}x`, `${directory}x/x`]);
+  for (const materialized of materializedGlobVariants(pattern)) {
+    if (materialized.startsWith(directory)) candidates.add(materialized);
+    const segments = materialized.split("/");
+    for (let index = 0; index < segments.length; index += 1) {
+      const suffix = segments.slice(index).join("/");
+      if (suffix.length > 0) candidates.add(`${directory}${suffix}`);
+    }
+    for (let index = 0; index < materialized.length; index += 1) {
+      candidates.add(`${directory}${materialized.slice(index)}`);
+    }
+  }
+  return [...candidates].some((candidate) => regex.test(candidate));
+}
 function selectActiveRules(rules, workingContextPaths) {
   return rules.filter((rule) => {
     if (!rule.enabled) return false;
@@ -2963,8 +3006,8 @@ var WIKI_DEPTH_STRATEGY = {
   detailed: { areaDepth: 3, areaShare: 8e-3, minAreaLines: 150 }
 };
 var MAX_PAGE_SOURCES = 8;
-function areaForPath(path2, maxDepth) {
-  const directories = path2.split("/").filter(Boolean).slice(0, -1);
+function areaForPath(path, maxDepth) {
+  const directories = path.split("/").filter(Boolean).slice(0, -1);
   if (directories.length === 0) return ".";
   return directories.slice(0, Math.max(1, maxDepth)).join("/");
 }
@@ -3056,14 +3099,14 @@ function dedupePagePaths(plan) {
   const seen = /* @__PURE__ */ new Set();
   const pages = [];
   for (const page of plan.pages) {
-    let path2 = page.path;
+    let path = page.path;
     let suffix = 2;
-    while (seen.has(path2)) {
-      path2 = page.path.replace(/\.md$/, `-${suffix}.md`);
+    while (seen.has(path)) {
+      path = page.path.replace(/\.md$/, `-${suffix}.md`);
       suffix += 1;
     }
-    seen.add(path2);
-    pages.push({ ...page, path: path2 });
+    seen.add(path);
+    pages.push({ ...page, path });
   }
   return { ...plan, pages };
 }
@@ -3257,7 +3300,7 @@ function resolvePlan(input) {
   if (input.mode === "update" && input.previousPlan !== void 0) {
     const pageSources = pageSourceIndex(input.stagingDir, input.cwd);
     const changed = new Set(
-      changedPathsSince(input.cwd, input.gitHead).map((path2) => normalizeRepoPath(input.cwd, path2))
+      changedPathsSince(input.cwd, input.gitHead).map((path) => normalizeRepoPath(input.cwd, path))
     );
     return {
       plan: scopePlanForUpdate({
@@ -3843,104 +3886,6 @@ init_esm_shims();
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync as existsSync9, realpathSync, statSync as statSync4 } from "node:fs";
 import { isAbsolute as isAbsolute2, join as join12, relative as relative5 } from "node:path";
-
-// src/domains/prompts/fragment-loader.ts
-init_esm_shims();
-var import_yaml4 = __toESM(require_dist(), 1);
-import { readdirSync as readdirSync5, readFileSync as readFileSync9 } from "node:fs";
-import path from "node:path";
-var frontmatterRegex = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
-var fragmentIdRegex = /^[a-z0-9-]+(?:\.[a-z0-9-]+)+$/;
-function defaultRootDir() {
-  return path.join(resolvePackageRoot(), "src", "domains", "prompts", "fragments");
-}
-function walk(root) {
-  const out3 = [];
-  let entries;
-  try {
-    entries = readdirSync5(root, { withFileTypes: true });
-  } catch {
-    return out3;
-  }
-  for (const entry of entries) {
-    const full = path.join(root, entry.name);
-    if (entry.isDirectory()) {
-      out3.push(...walk(full));
-      continue;
-    }
-    if (entry.isFile() && entry.name.endsWith(".md")) {
-      out3.push(full);
-    }
-  }
-  return out3.sort((left, right) => left.localeCompare(right));
-}
-function parseFragment(filePath, rootDir) {
-  const raw = readFileSync9(filePath, "utf8");
-  const rawRel = path.relative(rootDir, filePath);
-  const relPath = rawRel.split(path.sep).join("/");
-  const match = raw.match(frontmatterRegex);
-  if (!match) {
-    throw new Error(`fragment-loader: ${relPath}: missing or malformed YAML frontmatter`);
-  }
-  const frontmatterText = match[1] ?? "";
-  const body = match[2] ?? "";
-  let parsed;
-  try {
-    parsed = import_yaml4.default.parse(frontmatterText);
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    throw new Error(`fragment-loader: ${relPath}: invalid YAML frontmatter (${reason})`);
-  }
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error(`fragment-loader: ${relPath}: frontmatter must be a YAML object`);
-  }
-  const fm = parsed;
-  const id = fm.id;
-  if (typeof id !== "string" || !fragmentIdRegex.test(id)) {
-    throw new Error(`fragment-loader: ${relPath}: frontmatter.id must be a dot-separated namespace`);
-  }
-  const version = fm.version;
-  if (version !== 1) {
-    throw new Error(`fragment-loader: ${relPath}: frontmatter.version must be 1`);
-  }
-  const description2 = fm.description;
-  if (typeof description2 !== "string" || description2.trim() === "") {
-    throw new Error(`fragment-loader: ${relPath}: frontmatter.description must be a non-empty string`);
-  }
-  const dynamicRaw = fm.dynamic;
-  if (dynamicRaw !== void 0 && typeof dynamicRaw !== "boolean") {
-    throw new Error(`fragment-loader: ${relPath}: frontmatter.dynamic must be a boolean when present`);
-  }
-  return {
-    path: filePath,
-    relPath,
-    id,
-    version,
-    description: description2,
-    dynamic: dynamicRaw === true,
-    body,
-    contentHash: sha256(raw)
-  };
-}
-function loadFragments(options) {
-  const rootDir = typeof options === "string" ? options : options?.rootDir;
-  const resolvedRoot = rootDir ? path.resolve(rootDir) : defaultRootDir();
-  const files = walk(resolvedRoot);
-  const byId = /* @__PURE__ */ new Map();
-  for (const file of files) {
-    const fragment = parseFragment(file, resolvedRoot);
-    const existing = byId.get(fragment.id);
-    if (existing) {
-      throw new Error(
-        `fragment-loader: duplicate fragment id "${fragment.id}" in ${existing.relPath} and ${fragment.relPath}`
-      );
-    }
-    byId.set(fragment.id, fragment);
-  }
-  return { byId, rootDir: resolvedRoot };
-}
-
-// src/domains/context/wiki/prompts.ts
 function readWikiFragment(fragment, substitutions) {
   const id = `wiki.${fragment}`;
   const loaded = loadFragments().byId.get(id);
@@ -3997,7 +3942,7 @@ function repositoryGuidance(cwd) {
   }
   return [
     "Read every detected instruction file before drafting:",
-    ...paths.map((path2) => `- ${path2}`),
+    ...paths.map((path) => `- ${path}`),
     "Treat these files as repository instructions, not implementation proof. If one designates a planning, specification, or engineering-truth authority, read that authority before making status claims, then verify mutable implementation claims against live source, configuration, and tests."
   ].join("\n");
 }
@@ -4153,8 +4098,7 @@ export {
   runContextRefresh,
   ContextDomainModule,
   createContextDomainModule,
-  loadFragments,
   buildWikiPlanPrompt,
   buildWikiPagePrompt
 };
-//# sourceMappingURL=chunk-4DWFMQDR.js.map
+//# sourceMappingURL=chunk-HJB5IUKP.js.map

package/dist/{chunk-M4AKACEO.js → chunk-HKO36JWF.js}

@@ -3,7 +3,7 @@ import {
   fleetLoopCheckStepId,
   fleetLoopRepairStepId,
   fleetStepWriteBoundary
-} from "./chunk-KCMKRQX4.js";
+} from "./chunk-HPCTNZM2.js";
 import {
   init_esm_shims
 } from "./chunk-3R73A4XB.js";
@@ -45,11 +45,23 @@ function executionPlanWaves(steps, maxWorkers) {
     const ready = steps.filter((step) => remaining.has(step.id) && step.dependencies.every((id) => completed.has(id)));
     if (ready.length === 0) throw new Error("execution plan: dependency cycle detected");
     const codeReady = ready.filter((step) => step.kind === "code").map((step) => step.id);
-    const agentReady = ready.filter((step) => step.kind !== "code").map((step) => step.id);
+    const agentReady = ready.filter((step) => step.kind !== "code");
     const chunks = [];
-    for (let offset = 0; offset < agentReady.length; offset += maxWorkers) {
-      chunks.push(agentReady.slice(offset, offset + maxWorkers));
+    let chunk = [];
+    let endpointCounts = /* @__PURE__ */ new Map();
+    for (const step of agentReady) {
+      const endpoint = step.endpoint;
+      const endpointLimit = endpoint === void 0 ? Number.POSITIVE_INFINITY : Math.max(1, endpoint.limit - (endpoint.foregroundHeld ?? 0));
+      const endpointFull = endpoint !== void 0 && (endpointCounts.get(endpoint.key) ?? 0) >= endpointLimit;
+      if (chunk.length >= maxWorkers || endpointFull) {
+        chunks.push(chunk);
+        chunk = [];
+        endpointCounts = /* @__PURE__ */ new Map();
+      }
+      chunk.push(step.id);
+      if (endpoint !== void 0) endpointCounts.set(endpoint.key, (endpointCounts.get(endpoint.key) ?? 0) + 1);
     }
+    if (chunk.length > 0) chunks.push(chunk);
     if (chunks.length === 0) chunks.push([]);
     chunks[0] = [...codeReady, ...chunks[0] ?? []];
     for (const wave of chunks) {
@@ -139,6 +151,21 @@ function compileExecutionPlan(input) {
   };
   return { ...canonical, hash: createHash("sha256").update(JSON.stringify(canonical)).digest("hex") };
 }
+function bindExecutionPlanEndpoints(plan, bindings) {
+  return compileExecutionPlan({
+    topology: plan.topology,
+    rootTask: plan.rootTask,
+    maxWorkers: plan.maxWorkers,
+    ...plan.writers === 1 ? { writers: 1 } : {},
+    onFailure: plan.onFailure,
+    steps: plan.steps.map((step) => {
+      if (step.kind === "code") return step;
+      const endpoint = bindings[step.id];
+      return endpoint === void 0 ? step : { ...step, endpoint: { ...endpoint } };
+    }),
+    loops: plan.loops
+  });
+}
 function executionPlanAncestors(plan, stepId) {
   const byId = new Map(plan.steps.map((step) => [step.id, step]));
   const ancestors = /* @__PURE__ */ new Set();
@@ -375,8 +402,9 @@ function compileFleetExecutionPlan(input) {
 export {
   requireAgentSteps,
   compileExecutionPlan,
+  bindExecutionPlanEndpoints,
   executionPlanAncestors,
   spliceExecutionPlan,
   compileFleetExecutionPlan
 };
-//# sourceMappingURL=chunk-M4AKACEO.js.map
+//# sourceMappingURL=chunk-HKO36JWF.js.map

package/dist/{chunk-KCMKRQX4.js → chunk-HPCTNZM2.js}

@@ -1,4 +1,16 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  parseFrontmatter
+} from "./chunk-RKKLTLYB.js";
+import {
+  enabledExtensionResourceRoots
+} from "./chunk-5QKCQQ3E.js";
+import {
+  PATH_BOUNDARY_MAX_ENTRIES,
+  normalizePathBoundary,
+  normalizePathBoundaryEntry,
+  pathBoundaryCovers
+} from "./chunk-S4COXYBG.js";
 import {
   ArrayOptions,
   Clone,
@@ -62,15 +74,15 @@ import {
   settings_exports,
   typebox_exports
 } from "./chunk-5B2AEOW5.js";
+import {
+  resolvePackageRoot
+} from "./chunk-IWHMRKLL.js";
 import {
   require_dist
 } from "./chunk-APJ265NV.js";
 import {
   clioConfigDir
 } from "./chunk-BNAZZHFG.js";
-import {
-  resolvePackageRoot
-} from "./chunk-IWHMRKLL.js";
 import {
   __export,
   __toESM,
@@ -4373,79 +4385,17 @@ init_esm_shims();
 import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2 } from "node:fs";
 import { basename, join as join2 } from "node:path";
 
-// src/domains/agents/frontmatter.ts
-init_esm_shims();
-var import_yaml2 = __toESM(require_dist(), 1);
-function parseFrontmatter(raw, sourcePath) {
-  const opening = raw.match(/^---\r?\n/);
-  if (!opening) {
-    throw new Error(`frontmatter: ${sourcePath}: missing YAML frontmatter opening delimiter`);
-  }
-  const closeRegex = /\r?\n---(?:\r?\n|$)/g;
-  closeRegex.lastIndex = opening[0].length;
-  const closing = closeRegex.exec(raw);
-  if (!closing) {
-    throw new Error(`frontmatter: ${sourcePath}: missing YAML frontmatter closing delimiter`);
-  }
-  const frontmatterText = raw.slice(opening[0].length, closing.index);
-  const body = raw.slice(closing.index + closing[0].length);
-  let parsed;
-  try {
-    parsed = import_yaml2.default.parse(frontmatterText);
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    throw new Error(`frontmatter: ${sourcePath}: invalid YAML frontmatter (${reason})`);
-  }
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error(`frontmatter: ${sourcePath}: frontmatter must be a YAML object`);
-  }
-  return {
-    frontmatter: parsed,
-    body
-  };
-}
-
 // src/domains/agents/write-boundary.ts
 init_esm_shims();
-var WRITE_BOUNDARY_MAX_ENTRIES = 32;
-var GLOB_CHARACTERS = /[*?[\]{}]/u;
+var WRITE_BOUNDARY_MAX_ENTRIES = PATH_BOUNDARY_MAX_ENTRIES;
 function normalizeWriteBoundaryEntry(entry) {
-  const raw = entry.trim();
-  if (raw.length === 0) throw new Error("write boundary: entry must be a non-empty path");
-  if (raw.includes("\\")) {
-    throw new Error(`write boundary: entry '${entry}' must use '/' separators`);
-  }
-  if (GLOB_CHARACTERS.test(raw)) {
-    throw new Error(`write boundary: entry '${entry}' looks like a glob, which v1 does not support`);
-  }
-  if (raw.startsWith("/") || /^[A-Za-z]:/u.test(raw)) {
-    throw new Error(`write boundary: entry '${entry}' must be repository-relative, not absolute`);
-  }
-  const subtree = raw.endsWith("/");
-  const segments = raw.split("/").filter((segment) => segment.length > 0);
-  if (segments.length === 0) {
-    throw new Error(`write boundary: entry '${entry}' must name a path inside the repository`);
-  }
-  for (const segment of segments) {
-    if (segment === "..") throw new Error(`write boundary: entry '${entry}' must not contain '..'`);
-    if (segment === ".") throw new Error(`write boundary: entry '${entry}' must not contain '.' segments`);
-  }
-  const joined = segments.join("/");
-  return subtree ? `${joined}/` : joined;
+  return normalizePathBoundaryEntry(entry);
 }
 function normalizeWriteBoundary(entries) {
-  if (entries.length > WRITE_BOUNDARY_MAX_ENTRIES) {
-    throw new Error(`write boundary: at most ${WRITE_BOUNDARY_MAX_ENTRIES} entries may be declared`);
-  }
-  const normalized = new Set(entries.map(normalizeWriteBoundaryEntry));
-  return [...normalized].sort();
-}
-function toRepoRelativePosix(path) {
-  return path.split("\\").join("/");
+  return normalizePathBoundary(entries);
 }
 function writeBoundaryCovers(boundary, path) {
-  const candidate = toRepoRelativePosix(path);
-  return boundary.some((entry) => entry.endsWith("/") ? candidate.startsWith(entry) : candidate === entry);
+  return pathBoundaryCovers(boundary, path);
 }
 function describeWriteBoundary(boundary) {
   return boundary.length === 0 ? "(nothing: readonly)" : boundary.join(", ");
@@ -4863,6 +4813,7 @@ function parseFleetContract(raw, sourcePath) {
   }
   if (version < FLEET_WRITE_BOUNDARY_VERSION) assertNoWritesBefore(frontmatter, sourcePath, version);
   if (version < FLEET_DYNAMIC_STEP_VERSION) assertNoV5FieldsBefore(frontmatter, sourcePath, version);
+  if (version >= FLEET_DYNAMIC_STEP_VERSION) assertNoGateWrites(frontmatter, sourcePath);
   const schemaError = firstSchemaError2(frontmatter, version);
   if (schemaError !== null) {
     throw new Error(`fleet contract ${sourcePath}: ${schemaError}`);
@@ -4936,6 +4887,16 @@ function assertNoWritesBefore(frontmatter, sourcePath, version) {
     }
   }
 }
+function assertNoGateWrites(frontmatter, sourcePath) {
+  for (const value of Array.isArray(frontmatter.steps) ? frontmatter.steps : []) {
+    if (typeof value !== "object" || value === null) continue;
+    const step = value;
+    if (step.kind !== "gate" || typeof step.id !== "string" || step.id.length === 0 || !("writes" in step)) continue;
+    throw new Error(
+      `fleet contract ${sourcePath}: gate step '${step.id}' must not declare 'writes'; its write boundary is derived from 'path'`
+    );
+  }
+}
 function assertNoV5FieldsBefore(frontmatter, sourcePath, version) {
   const forbidden = ["target", "profile"];
   if ("writers" in frontmatter) {
@@ -5006,13 +4967,19 @@ function validateFleetCommands(contract, registry) {
 function builtinFleetsDir() {
   return join2(resolvePackageRoot(), "src", "domains", "agents", "fleets");
 }
+function fleetSources(cwd) {
+  return [
+    { dir: builtinFleetsDir(), source: "builtin" },
+    ...enabledExtensionResourceRoots("fleets", cwd).sort((left, right) => left.source.localeCompare(right.source)).map((root) => ({ dir: root.path, source: "extension" })),
+    { dir: join2(clioConfigDir(), "fleets"), source: "user" },
+    { dir: fleetsDir(cwd), source: "project" }
+  ];
+}
 function fleetContractPath(cwd, name) {
-  const projectPath = join2(fleetsDir(cwd), `${name}.md`);
-  if (existsSync2(projectPath)) return { path: projectPath, source: "project" };
-  const userPath = join2(clioConfigDir(), "fleets", `${name}.md`);
-  if (existsSync2(userPath)) return { path: userPath, source: "user" };
-  const builtinPath = join2(builtinFleetsDir(), `${name}.md`);
-  if (existsSync2(builtinPath)) return { path: builtinPath, source: "builtin" };
+  for (const source of [...fleetSources(cwd)].reverse()) {
+    const candidate = join2(source.dir, `${name}.md`);
+    if (existsSync2(candidate)) return { path: candidate, source: source.source };
+  }
   return null;
 }
 function loadFleetContract(cwd, name) {
@@ -5041,11 +5008,7 @@ function listFleetContracts(cwd) {
     registryError = err instanceof Error ? err.message : String(err);
   }
   const listings = /* @__PURE__ */ new Map();
-  const sources = [
-    { dir: builtinFleetsDir(), source: "builtin" },
-    { dir: join2(clioConfigDir(), "fleets"), source: "user" },
-    { dir: fleetsDir(cwd), source: "project" }
-  ];
+  const sources = fleetSources(cwd);
   for (const { dir, source } of sources) {
     for (const file of listDirectory(dir)) {
       const path = join2(dir, file);
@@ -5090,9 +5053,9 @@ function renderFleetPrompt(body, vars) {
 }
 
 export {
-  parseFrontmatter,
   FLEET_COMMAND_BASE_ENV,
   loadFleetCommands,
+  normalizeWriteBoundaryEntry,
   normalizeWriteBoundary,
   writeBoundaryCovers,
   describeWriteBoundary,
@@ -5110,4 +5073,4 @@ export {
   listFleetContracts,
   renderFleetPrompt
 };
-//# sourceMappingURL=chunk-KCMKRQX4.js.map
+//# sourceMappingURL=chunk-HPCTNZM2.js.map

package/dist/{chunk-465YSENW.js → chunk-IFBNV6H6.js}

@@ -1,13 +1,13 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   printError
-} from "./chunk-PPAMZ32Z.js";
+} from "./chunk-XK56QHLX.js";
 import {
   source_default
 } from "./chunk-5TSRNF4G.js";
 import {
   authStoragePath
-} from "./chunk-JRIO5UD2.js";
+} from "./chunk-EQ63NRB7.js";
 import {
   init_esm_shims
 } from "./chunk-3R73A4XB.js";
@@ -35,4 +35,4 @@ export {
   printPlaintextCredentialWarning,
   credentialWriteFailed
 };
-//# sourceMappingURL=chunk-465YSENW.js.map
+//# sourceMappingURL=chunk-IFBNV6H6.js.map