@iowarp/clio-coder 0.3.9 → 0.4.1

package/dist/{chunk-S4COXYBG.js → chunk-IG7BCQBA.js}

@@ -3,14 +3,14 @@ import {
   artifactDefaultPath,
   extractCommandCdTargets,
   extractCommandWriteTargets
-} from "./chunk-MV3K5QF2.js";
+} from "./chunk-GCSMB2KY.js";
 import {
   canonicalizeExistingPath
 } from "./chunk-ECH6PKUQ.js";
 import {
   ToolNames,
   isBuiltinToolName
-} from "./chunk-CGKSTWHD.js";
+} from "./chunk-K6BSR66V.js";
 import {
   init_esm_shims
 } from "./chunk-3R73A4XB.js";
@@ -98,6 +98,12 @@ function baseClassify(tool) {
     // local mirror. Neither touches the workspace, so it is never gated
     // behind a confirmation.
     case ToolNames.Ledger:
+    // panes focuses, opens, and closes terminal panes Clio itself created, in
+    // a pane host that lives outside the workspace. Nothing it does writes a
+    // file, runs a model-supplied command (its schema exposes presets only),
+    // or survives the session, so it is reversible, local, and never gated
+    // behind a confirmation.
+    case ToolNames.Panes:
       return "read";
     case ToolNames.Write:
     case ToolNames.Edit:
@@ -782,13 +788,24 @@ function parseChecks(value) {
   }
   return checks;
 }
+function citationWithinWorkspace(cwd, citedPath) {
+  const relative = path2.relative(cwd, citedPath);
+  if (relative === "") return true;
+  return !(relative === ".." || relative.startsWith(`..${path2.sep}`) || path2.isAbsolute(relative));
+}
+function directoryCitationDigest(cwd, citedPath) {
+  const relative = path2.relative(cwd, citedPath);
+  return createHash2("sha256").update(`directory:${relative === "" ? "." : relative}`, "utf8").digest("hex");
+}
 function validateScoutCitation(input, citation) {
   const cwd = path2.resolve(input.cwd);
   const citedPath = path2.resolve(cwd, citation.path);
-  const relative = path2.relative(cwd, citedPath);
-  if (relative === "" || relative.startsWith(`..${path2.sep}`) || relative === ".." || path2.isAbsolute(relative)) {
+  if (!citationWithinWorkspace(cwd, citedPath)) {
     return { ok: false, reason: `Scout citation path escapes the workspace: ${citation.path}` };
   }
+  if (input.filesystem.isDirectory?.(citedPath) === true) {
+    return { ok: true, evidence: { ...citation, contentDigest: directoryCitationDigest(cwd, citedPath) } };
+  }
   const content = input.filesystem.readFile(citedPath);
   if (content === null) return { ok: false, reason: `Scout citation cannot be read: ${citation.path}` };
   const lineCount = content.split(/\r\n|\r|\n/u).length;
@@ -844,14 +861,57 @@ function groundDegradedScout(contract, input, scout, degradedReason) {
 }
 function validateVerifier(contract, output) {
   const parsed = parseJson(output);
-  if (!parsed.ok) return failure(contract, "fail", parsed.reason);
+  if (!parsed.ok) return failure(contract, "fail", `Verifier result payload failed: ${parsed.reason}`);
   const value = parsed.value;
-  if (!hasOnlyKeys(value, ["verdict", "checks"]) || value.verdict !== "pass" && value.verdict !== "fail") {
-    return failure(contract, "fail", "Verifier result must carry pass or fail verdict and checks");
+  const unknown = Object.keys(value).filter((key) => key !== "verdict" && key !== "checks");
+  if (unknown.length > 0) {
+    return failure(
+      contract,
+      "fail",
+      `Verifier result field${unknown.length === 1 ? "" : "s"} ${unknown.join(", ")} ${unknown.length === 1 ? "is" : "are"} not legal; legal top-level fields are verdict and checks`
+    );
   }
-  const checks = parseChecks(value.checks);
-  if (checks === null || value.verdict === "pass" !== checks.every((check) => check.passed)) {
-    return failure(contract, "fail", "Verifier verdict must agree with every typed check");
+  if (value.verdict !== "pass" && value.verdict !== "fail") {
+    return failure(contract, "fail", 'Verifier field "verdict" must be one of: pass | fail');
+  }
+  if (!Array.isArray(value.checks) || value.checks.length === 0) {
+    return failure(
+      contract,
+      "fail",
+      'Verifier field "checks" must be a non-empty array of {name, passed, evidence}; each checks[].passed value must be one of: true | false'
+    );
+  }
+  const checks = [];
+  for (const [index, raw] of value.checks.entries()) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+      return failure(contract, "fail", `Verifier field "checks[${index}]" must be an object`);
+    }
+    const check = raw;
+    const checkUnknown = Object.keys(check).filter((key) => key !== "name" && key !== "passed" && key !== "evidence");
+    if (checkUnknown.length > 0) {
+      return failure(
+        contract,
+        "fail",
+        `Verifier field "checks[${index}].${checkUnknown[0]}" is not legal; legal check fields are name, passed, and evidence`
+      );
+    }
+    if (!string(check.name)) {
+      return failure(contract, "fail", `Verifier field "checks[${index}].name" must be a non-empty string`);
+    }
+    if (typeof check.passed !== "boolean") {
+      return failure(contract, "fail", `Verifier field "checks[${index}].passed" must be one of: true | false`);
+    }
+    if (!string(check.evidence)) {
+      return failure(contract, "fail", `Verifier field "checks[${index}].evidence" must be a non-empty string`);
+    }
+    checks.push({ name: check.name, passed: check.passed, evidence: check.evidence });
+  }
+  if (value.verdict === "pass" !== checks.every((check) => check.passed)) {
+    return failure(
+      contract,
+      "fail",
+      'Verifier field "verdict" must agree with every checks[].passed value; verdict legal values are pass | fail and checks[].passed legal values are true | false'
+    );
   }
   const verifier = { verdict: value.verdict, checks };
   return success(contract, value.verdict, verifier, { verifier });
@@ -944,38 +1004,80 @@ function resultContractAuthorship(contract, output) {
 }
 function validateDebugger(contract, output) {
   const parsed = parseJson(output);
-  if (!parsed.ok) return failure(contract, "unmeasured", parsed.reason);
+  if (!parsed.ok) return failure(contract, "unmeasured", `Debugger result payload failed: ${parsed.reason}`);
   const value = parsed.value;
-  if (!hasOnlyKeys(value, ["diagnosis", "reproduction", "evidence"]) || !string(value.diagnosis) || value.reproduction !== "reproduced" && value.reproduction !== "not-reproduced" && value.reproduction !== "unknown" || !Array.isArray(value.evidence) || value.evidence.some((entry) => !string(entry))) {
+  const unknown = Object.keys(value).filter(
+    (key) => key !== "diagnosis" && key !== "reproduction" && key !== "evidence"
+  );
+  if (unknown.length > 0) {
     return failure(
       contract,
       "unmeasured",
-      "Debugger result must carry diagnosis, reproduction status, and evidence without a verdict"
+      `Debugger result field${unknown.length === 1 ? "" : "s"} ${unknown.join(", ")} ${unknown.length === 1 ? "is" : "are"} not legal; legal top-level fields are diagnosis, reproduction, and evidence`
     );
   }
+  if (!string(value.diagnosis)) {
+    return failure(contract, "unmeasured", 'Debugger field "diagnosis" must be a non-empty string');
+  }
+  if (value.reproduction !== "reproduced" && value.reproduction !== "not-reproduced" && value.reproduction !== "unknown") {
+    return failure(
+      contract,
+      "unmeasured",
+      'Debugger field "reproduction" must be one of: reproduced | not-reproduced | unknown'
+    );
+  }
+  if (!Array.isArray(value.evidence)) {
+    return failure(contract, "unmeasured", 'Debugger field "evidence" must be an array of strings');
+  }
+  const malformedEvidence = value.evidence.findIndex((entry) => !string(entry));
+  if (malformedEvidence >= 0) {
+    return failure(contract, "unmeasured", `Debugger field "evidence[${malformedEvidence}]" must be a non-empty string`);
+  }
   return success(contract, "unmeasured", value);
 }
 function validateResearch(contract, output, networkAllowed) {
   const parsed = parseJson(output);
-  if (!parsed.ok) return failure(contract, "unmeasured", parsed.reason);
+  if (!parsed.ok) return failure(contract, "unmeasured", `Research result payload failed: ${parsed.reason}`);
   const value = parsed.value;
-  if (!hasOnlyKeys(value, ["source", "findings"]) || value.source !== "local" && value.source !== "external" || !Array.isArray(value.findings)) {
+  const unknown = Object.keys(value).filter((key) => key !== "source" && key !== "findings");
+  if (unknown.length > 0) {
     return failure(
       contract,
       "unmeasured",
-      "Research result must distinguish local or external sources and carry findings"
+      `Research result field${unknown.length === 1 ? "" : "s"} ${unknown.join(", ")} ${unknown.length === 1 ? "is" : "are"} not legal; legal top-level fields are source and findings`
     );
   }
+  if (value.source !== "local" && value.source !== "external") {
+    return failure(contract, "unmeasured", 'Research field "source" must be one of: local | external');
+  }
+  if (!Array.isArray(value.findings)) {
+    return failure(contract, "unmeasured", 'Research field "findings" must be an array of {claim, evidence} objects');
+  }
   if (value.source === "external" && !networkAllowed) {
-    return failure(contract, "unmeasured", "external research requires an allowed network posture");
+    return failure(
+      contract,
+      "unmeasured",
+      'Research field "source" is external but the run has no allowed network posture; legal values are local | external, and use local for workspace-only evidence'
+    );
   }
-  for (const finding of value.findings) {
+  for (const [index, finding] of value.findings.entries()) {
     if (finding === null || typeof finding !== "object" || Array.isArray(finding)) {
-      return failure(contract, "unmeasured", "Research findings must be objects");
+      return failure(contract, "unmeasured", `Research field "findings[${index}]" must be an object`);
     }
     const record = finding;
-    if (!hasOnlyKeys(record, ["claim", "evidence"]) || !string(record.claim) || !string(record.evidence)) {
-      return failure(contract, "unmeasured", "Research findings must carry claim and evidence");
+    const findingUnknown = Object.keys(record).filter((key) => key !== "claim" && key !== "evidence");
+    if (findingUnknown.length > 0) {
+      return failure(
+        contract,
+        "unmeasured",
+        `Research field "findings[${index}].${findingUnknown[0]}" is not legal; legal finding fields are claim and evidence`
+      );
+    }
+    if (!string(record.claim)) {
+      return failure(contract, "unmeasured", `Research field "findings[${index}].claim" must be a non-empty string`);
+    }
+    if (!string(record.evidence)) {
+      return failure(contract, "unmeasured", `Research field "findings[${index}].evidence" must be a non-empty string`);
     }
   }
   return success(contract, "unmeasured", value);
@@ -1166,15 +1268,15 @@ function resultContractShape(contract) {
     case "scout-report":
       return '{"findings":[{"claim":"what you observed","path":"src/file.ts","line":1}],"needsSplit":false,"proposedSubtasks":[]} or {"findings":[],"needsSplit":true,"proposedSubtasks":[{"id":"inspect","task":"Inspect the boundary","dependencies":[],"expectedResultContract":"scout-report","requestedAuthority":"read-only"}]} or, if you cannot produce a citation you are sure of, at least {"findings":[{"claim":"what you observed"}]}, which is accepted as an ungrounded lead rather than losing the run';
     case "verifier-report":
-      return '{"verdict":"pass","checks":[{"name":"npm run typecheck","passed":true,"evidence":"exit 0"}]}';
+      return 'one of {"verdict":"pass","checks":[{"name":"npm run typecheck","passed":true,"evidence":"exit 0"}]} or {"verdict":"fail","checks":[{"name":"npm run typecheck","passed":false,"evidence":"exit 1"}]}; verdict legal values are pass | fail and checks[].passed legal values are true | false';
     case "council-report":
       return '{"members":[{"label":"alpha","runId":"run-1","round":1,"answer":"..."}],"synthesis":{"kind":"none"}}';
     case "council-ballot":
       return COUNCIL_BALLOT_SHAPE;
     case "debugger-report":
-      return '{"diagnosis":"...","reproduction":"reproduced","evidence":["..."]}';
+      return 'one of {"diagnosis":"...","reproduction":"reproduced","evidence":["..."]}, {"diagnosis":"...","reproduction":"not-reproduced","evidence":["..."]}, or {"diagnosis":"...","reproduction":"unknown","evidence":["..."]}; reproduction legal values are reproduced | not-reproduced | unknown';
     case "research-report":
-      return '{"source":"local","findings":[{"claim":"...","evidence":"..."}]}';
+      return 'one of {"source":"local","findings":[{"claim":"...","evidence":"..."}]} or {"source":"external","findings":[{"claim":"...","evidence":"..."}]}; source legal values are local | external';
     case "mutation-report":
       return '{"mutatedPaths":["src/file.ts"],"validations":[{"name":"npm test","passed":true,"evidence":"exit 0"}],"commitMessage":"optional: the commit message for this change","summary":"optional: one line"}';
     case "provenance-report":
@@ -1285,78 +1387,6 @@ function parseWorkerResultContract(value, sourcePath) {
   return parseContract(value, sourcePath, [...RECIPE_DECLARABLE_KINDS, ...COORDINATOR_AUTHORED_KINDS]);
 }
 
-// src/core/path-boundary.ts
-init_esm_shims();
-import path3 from "node:path";
-var PATH_BOUNDARY_MAX_ENTRIES = 32;
-var PathBoundaryError = class extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.name = "PathBoundaryError";
-    this.code = code;
-  }
-};
-var GLOB_CHARACTERS = /[*?[\]{}]/u;
-function normalizePathBoundaryEntry(entry) {
-  const raw = entry.trim();
-  if (raw.length === 0) throw new PathBoundaryError("empty", "write boundary: entry must be a non-empty path");
-  if (raw.includes("\\")) {
-    throw new PathBoundaryError("separator", `write boundary: entry '${entry}' must use '/' separators`);
-  }
-  if (GLOB_CHARACTERS.test(raw)) {
-    throw new PathBoundaryError("glob", `write boundary: entry '${entry}' looks like a glob, which v1 does not support`);
-  }
-  if (raw.startsWith("/") || /^[A-Za-z]:/u.test(raw)) {
-    throw new PathBoundaryError("absolute", `write boundary: entry '${entry}' must be repository-relative, not absolute`);
-  }
-  const subtree = raw.endsWith("/");
-  const segments = raw.split("/").filter((segment) => segment.length > 0);
-  if (segments.length === 0) {
-    throw new PathBoundaryError("empty", `write boundary: entry '${entry}' must name a path inside the repository`);
-  }
-  for (const segment of segments) {
-    if (segment === "..") {
-      throw new PathBoundaryError("parent", `write boundary: entry '${entry}' must not contain '..'`);
-    }
-    if (segment === ".") {
-      throw new PathBoundaryError("dot", `write boundary: entry '${entry}' must not contain '.' segments`);
-    }
-  }
-  const joined = segments.join("/");
-  return subtree ? `${joined}/` : joined;
-}
-function normalizePathBoundary(entries) {
-  if (entries.length > PATH_BOUNDARY_MAX_ENTRIES) {
-    throw new Error(`write boundary: at most ${PATH_BOUNDARY_MAX_ENTRIES} entries may be declared`);
-  }
-  return [...new Set(entries.map(normalizePathBoundaryEntry))].sort();
-}
-function toPosixBoundaryPath(value) {
-  return value.split("\\").join("/");
-}
-function isDirectoryPathBoundary(entry) {
-  return toPosixBoundaryPath(entry).endsWith("/");
-}
-function asDirectoryPathBoundary(entry) {
-  const normalized = toPosixBoundaryPath(entry);
-  return normalized.endsWith("/") ? normalized : `${normalized}/`;
-}
-function resolvePathBoundary(cwd, entry) {
-  const directory = isDirectoryPathBoundary(entry);
-  const withoutMarker = directory ? entry.slice(0, -1) : entry;
-  const resolved = toPosixBoundaryPath(path3.resolve(cwd, withoutMarker));
-  return directory ? asDirectoryPathBoundary(resolved) : resolved;
-}
-function pathBoundaryEntryCovers(outer, inner) {
-  const normalizedOuter = toPosixBoundaryPath(outer);
-  const normalizedInner = toPosixBoundaryPath(inner);
-  return normalizedOuter.endsWith("/") ? normalizedInner.startsWith(normalizedOuter) : !normalizedInner.endsWith("/") && normalizedInner === normalizedOuter;
-}
-function pathBoundaryCovers(boundary, candidate) {
-  return boundary.some((entry) => pathBoundaryEntryCovers(entry, candidate));
-}
-
 export {
   parseJsonObjectPayload,
   classify,
@@ -1384,16 +1414,9 @@ export {
   validateResultContract,
   validateRecipeResult,
   RESULT_CONTRACT_REPAIR_LIMIT,
+  resultContractShape,
   resultContractRepairMessages,
   parseResultContract,
-  parseWorkerResultContract,
-  PATH_BOUNDARY_MAX_ENTRIES,
-  PathBoundaryError,
-  normalizePathBoundaryEntry,
-  normalizePathBoundary,
-  asDirectoryPathBoundary,
-  resolvePathBoundary,
-  pathBoundaryEntryCovers,
-  pathBoundaryCovers
+  parseWorkerResultContract
 };
-//# sourceMappingURL=chunk-S4COXYBG.js.map
+//# sourceMappingURL=chunk-IG7BCQBA.js.map

package/dist/{chunk-N3PBVRTZ.js → chunk-IXJT6DCX.js}

@@ -1,25 +1,27 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   loadProjectVerifierCatalog
-} from "./chunk-A2NJGIB3.js";
+} from "./chunk-VN3SHNBN.js";
 import {
-  classify,
   pathBoundaryCovers,
   resolvePathBoundary
-} from "./chunk-S4COXYBG.js";
+} from "./chunk-HHV2GANA.js";
+import {
+  classify
+} from "./chunk-IG7BCQBA.js";
 import {
   artifactDefaultPath,
   extractCommandDeleteTargets,
   extractCommandWriteTargets,
   inlineShellScript,
   tokenizeShellLike
-} from "./chunk-MV3K5QF2.js";
+} from "./chunk-GCSMB2KY.js";
 import {
   canonicalizeExistingPath
 } from "./chunk-ECH6PKUQ.js";
 import {
   ToolNames
-} from "./chunk-CGKSTWHD.js";
+} from "./chunk-K6BSR66V.js";
 import {
   foreignAgentDirs
 } from "./chunk-IHXBNWMM.js";
@@ -31,7 +33,7 @@ import {
 } from "./chunk-APJ265NV.js";
 import {
   clioConfigDir
-} from "./chunk-BNAZZHFG.js";
+} from "./chunk-BYP5D4HI.js";
 import {
   __toESM,
   init_esm_shims
@@ -1338,4 +1340,4 @@ export {
   WRITE_ROOT_REFUSED_TOOLS,
   createSafetyPolicyEngine
 };
-//# sourceMappingURL=chunk-N3PBVRTZ.js.map
+//# sourceMappingURL=chunk-IXJT6DCX.js.map