@iowarp/clio-coder 0.4.1 → 0.4.3

package/dist/{chunk-SCYB3HA4.js → chunk-W6RRQCPQ.js}

@@ -2,12 +2,12 @@ import { createRequire as __clioCreateRequire } from "node:module"; const requir
 import {
   canonicalJson,
   sha256
-} from "./chunk-6NJQITNH.js";
+} from "./chunk-IWT4SF4R.js";
 import {
   addResponseModelIdObservationCount,
   emptyResponseModelIdObservationCounts,
   responseModelIdObservationFromRecord
-} from "./chunk-TVH4ONAM.js";
+} from "./chunk-JKKCYP3C.js";
 import {
   uncachedPrefillTokens
 } from "./chunk-3DPEIQKN.js";
@@ -17,16 +17,16 @@ import {
 import {
   ceilChars,
   extractReasoningTokens
-} from "./chunk-CWVRRIEI.js";
+} from "./chunk-NZMNUPZZ.js";
 import {
   settingsPath
-} from "./chunk-EIMVLWB3.js";
+} from "./chunk-GHS5EBTQ.js";
 import {
   expandConfigPath
 } from "./chunk-336NSSKI.js";
 import {
   isEngineContextOverflow
-} from "./chunk-VXMFAE2W.js";
+} from "./chunk-YPC6ZR5L.js";
 import {
   init_esm_shims
 } from "./chunk-3R73A4XB.js";
@@ -154,6 +154,50 @@ function extractMessage(err) {
   return "";
 }
 
+// src/interactive/prompt-cache-identity.ts
+init_esm_shims();
+function attachedToolSchemasFromState(tools) {
+  const schemas = [];
+  for (const tool of tools) {
+    if (!tool || typeof tool !== "object" || Array.isArray(tool)) continue;
+    const record = tool;
+    schemas.push({
+      name: typeof record.name === "string" ? record.name : "",
+      description: typeof record.description === "string" ? record.description : "",
+      parameters: record.parameters ?? null
+    });
+  }
+  return schemas;
+}
+function attachedToolSchemaBytes(schemas) {
+  try {
+    const bytes = JSON.stringify(schemas);
+    if (bytes === void 0) throw new Error("JSON.stringify returned undefined");
+    return bytes;
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    throw new Error(`attached tool schemas are not JSON-serializable: ${reason}`, { cause: err });
+  }
+}
+function mainPromptCacheIdentity(input) {
+  return sha256(
+    canonicalJson({
+      version: 2,
+      targetId: input.targetId,
+      runtimeId: input.runtimeId,
+      wireModelId: input.wireModelId,
+      autonomy: input.autonomy,
+      sessionId: input.sessionId,
+      cwd: input.cwd,
+      workingContextPaths: [...input.workingContextPaths].sort((a, b) => a.localeCompare(b)),
+      contextWindowSource: input.contextWindowSource,
+      promptInputEpoch: input.promptInputEpoch,
+      sessionInputs: input.sessionInputs,
+      attachedToolSchemaBytes: attachedToolSchemaBytes(input.attachedToolSchemas)
+    })
+  );
+}
+
 // src/interactive/chat-loop-messages.ts
 function notConfiguredNotice() {
   return [
@@ -272,18 +316,7 @@ function pendingSkillRequestPreamble(requests) {
   ].join("\n");
 }
 function toolSignatureFromState(tools) {
-  const schemas = [];
-  for (const tool of tools) {
-    if (!tool || typeof tool !== "object" || Array.isArray(tool)) continue;
-    const record = tool;
-    schemas.push({
-      name: typeof record.name === "string" ? record.name : "",
-      description: typeof record.description === "string" ? record.description : "",
-      parameters: record.parameters ?? null
-    });
-  }
-  schemas.sort((a, b) => a.name.localeCompare(b.name));
-  return sha256(canonicalJson(schemas));
+  return sha256(attachedToolSchemaBytes(attachedToolSchemasFromState(tools)));
 }
 function fallbackIdentityPrompt() {
   return [
@@ -393,7 +426,16 @@ function assistantSessionPayload(message, failure) {
   if (Array.isArray(raw.content)) payload.content = raw.content;
   if (thinking.length > 0) payload.thinking = thinking;
   payload.responseModelIdObservation = responseModelIdObservationFromRecord(raw, "not-observed");
-  for (const key of ["usage", "api", "provider", "model", "responseModel", "responseId", "diagnostics"]) {
+  for (const key of [
+    "usage",
+    "api",
+    "provider",
+    "model",
+    "responseModel",
+    "responseId",
+    "gatewayRouting",
+    "diagnostics"
+  ]) {
     if (raw[key] !== void 0) payload[key] = raw[key];
   }
   if (failure && !isSelfExplainingAbort({ stopReason: raw.stopReason, errorMessage: raw.errorMessage, text })) {
@@ -1117,6 +1159,8 @@ async function expandInlineFileReferencesAsync(input, options = {}) {
 
 export {
   toContextOverflowError,
+  attachedToolSchemasFromState,
+  mainPromptCacheIdentity,
   notConfiguredNotice,
   extractText,
   extractUserText,
@@ -1150,4 +1194,4 @@ export {
   readFileArgsAsync,
   expandInlineFileReferencesAsync
 };
-//# sourceMappingURL=chunk-SCYB3HA4.js.map
+//# sourceMappingURL=chunk-W6RRQCPQ.js.map

package/dist/{chunk-2NM363SV.js → chunk-WBKFA554.js}

@@ -2,25 +2,25 @@ import { createRequire as __clioCreateRequire } from "node:module"; const requir
 import {
   readStrictLayeredSettings,
   updateLayeredSettings
-} from "./chunk-VKRH2TCS.js";
+} from "./chunk-4WR7VSYB.js";
+import {
+  assertAgentIdNamespace
+} from "./chunk-DR52UMZW.js";
 import {
   resolveShutdownHookBudgetMs,
   runWithBudget,
   writeShutdownNotice
-} from "./chunk-6FN3E6KX.js";
+} from "./chunk-4O6MANBS.js";
 import {
-  assertAgentIdNamespace
-} from "./chunk-DR52UMZW.js";
+  formatSettingsFailure,
+  settingsPath
+} from "./chunk-GHS5EBTQ.js";
 import {
   getSharedBus
 } from "./chunk-PMZVFWSR.js";
 import {
   BusChannels
-} from "./chunk-HLW2MRKE.js";
-import {
-  formatSettingsFailure,
-  settingsPath
-} from "./chunk-EIMVLWB3.js";
+} from "./chunk-F4EKGO4N.js";
 import {
   setGitCommitAttributionEnabled
 } from "./chunk-JIEGK6UF.js";
@@ -377,4 +377,4 @@ export {
   ConfigDomainModule,
   createConfigDomainModule
 };
-//# sourceMappingURL=chunk-2NM363SV.js.map
+//# sourceMappingURL=chunk-WBKFA554.js.map

package/dist/{chunk-R32CLGZ6.js → chunk-WCXUNS7U.js}

@@ -4,26 +4,26 @@ import {
   loadProjectRules,
   renderOperatorProfile,
   selectActiveRules
-} from "./chunk-C537JADH.js";
+} from "./chunk-KK4JZPBQ.js";
 import {
   loadFragments
-} from "./chunk-3QSOM6PA.js";
+} from "./chunk-Y3CBHOR6.js";
 import {
   compile,
   compileWorker
-} from "./chunk-XKA2ICR3.js";
+} from "./chunk-AF4YM7Z4.js";
 import {
   sha256
-} from "./chunk-6NJQITNH.js";
+} from "./chunk-IWT4SF4R.js";
 import {
   classifyProjectPreload
 } from "./chunk-JVCV3ICN.js";
 import {
   isUserVisibleAgent
-} from "./chunk-IG7BCQBA.js";
+} from "./chunk-B4OAX3SI.js";
 import {
   BusChannels
-} from "./chunk-HLW2MRKE.js";
+} from "./chunk-F4EKGO4N.js";
 import {
   init_esm_shims
 } from "./chunk-3R73A4XB.js";
@@ -33,11 +33,10 @@ init_esm_shims();
 var DEFAULT_DISPATCH_AGENT_ID = "coder";
 var OPERATOR_ONLY_SHADOW_AGENT_IDS = /* @__PURE__ */ new Set(["oracle"]);
 var FLEET_PROMPT_PURPOSE_MAX_CHARS = 64;
-var FLEET_DELEGATION_RULE = "Delegate when the task has two or more independent file-scoped subtasks, or any broad exploration. You keep synthesis and validation; a single narrow change stays with you.";
 var FLEET_HANDOFF_RULE = "A file you assigned to a worker is not yours to edit while its dispatch is pending or after it succeeds; if you already changed it, say so in your report.";
 var FLEET_REFUSAL_DISCLOSURE = "When admission refuses a dispatch, report the refusal and the reason it gave; never substitute another agent without saying why.";
 var FLEET_ANTI_CHURN_RULE = "A dispatch with the same target files and the same goal as one you already ran is a repeat however differently you word it: read that run's receipt, or run the check yourself, instead of dispatching again.";
-var FLEET_SPECIALIST_ROUTING = "Pick by job: receipts, diffs, or telemetry -> provenance; external docs -> researcher; broad recon -> scout; tests -> tester; gates or review -> verifier.";
+var FLEET_SPECIALIST_ROUTING = "Pick by job: supplied URLs, standards, or papers -> researcher; current ecosystems or an open-world second opinion -> world-knowledge; repository recon -> scout; receipts -> provenance; tests -> tester; gates -> verifier.";
 function fleetPromptPurpose(description) {
   const trimmed = description.trim().replace(/\s+/gu, " ");
   if (trimmed.length === 0) return "";
@@ -62,11 +61,14 @@ function renderFleetPromptSection(input) {
   if (publicSpecs.length === 0 && shadowSpecs.length === 0) return "";
   const lines = [
     "# Fleet",
-    FLEET_DELEGATION_RULE,
     FLEET_HANDOFF_RULE,
     FLEET_ANTI_CHURN_RULE,
     FLEET_REFUSAL_DISCLOSURE,
-    `Workers you reach with \`dispatch\`, by \`agent\` id (default ${DEFAULT_DISPATCH_AGENT_ID}). Capability class is what a worker may do: a read-only worker cannot edit.`,
+    // `agent:"auto"` baselines by task shape and can still land on a worker
+    // whose capability class is wrong for the job, so a pinned id is the
+    // reliable path; said here, next to the ids, rather than in the Tool
+    // Contract.
+    `Workers you reach with \`dispatch\` by \`agent\` id (default ${DEFAULT_DISPATCH_AGENT_ID}); agent:"auto" is a fallback, not a router. Capability class is what a worker may do: a read-only worker cannot edit.`,
     FLEET_SPECIALIST_ROUTING
   ];
   if (publicSpecs.length > 0) {
@@ -191,6 +193,9 @@ var CLIO_REPO_AWARENESS_ID = "context.clio-repo-awareness";
 var WORKSPACE_ROOT_ID = "context.workspace-root";
 function createPromptsBundle(context, options = {}) {
   let table = null;
+  let fragmentEpoch = 0;
+  let sessionSourceEpoch = 0;
+  const sessionSourceSnapshots = /* @__PURE__ */ new Map();
   const suppressContextFiles = options.noContextFiles === true;
   function config() {
     return context.getContract("config");
@@ -208,6 +213,7 @@ function createPromptsBundle(context, options = {}) {
   function reload() {
     try {
       table = loadFragments();
+      fragmentEpoch += 1;
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       process.stderr.write(`[clio-coder:prompts] reload failed: ${msg}
@@ -220,7 +226,39 @@ function createPromptsBundle(context, options = {}) {
     }
     return false;
   }
+  function sessionSourceKey(sessionId, cwd) {
+    return `${sessionId}\0${cwd}`;
+  }
+  function captureSessionSourceSnapshot(cwd) {
+    let projectContext = null;
+    if (!suppressContextFiles) {
+      projectContext = contextDomain()?.renderPromptContext(cwd) ?? null;
+      for (const warning of projectContext?.warnings ?? []) process.stderr.write(`${warning}
+`);
+    }
+    return {
+      projectContext,
+      customization: captureCustomizationSources(cwd),
+      workspaceRoot: workspaceRootFragment(cwd),
+      clioRepoAwareness: clioRepoAwarenessFragments(cwd)
+    };
+  }
+  function sessionSourceSnapshot(sessionId, cwd) {
+    const key = sessionSourceKey(sessionId, cwd);
+    const existing = sessionSourceSnapshots.get(key);
+    if (existing) return existing;
+    const captured = captureSessionSourceSnapshot(cwd);
+    sessionSourceSnapshots.set(key, captured);
+    return captured;
+  }
+  function invalidateSessionSources() {
+    sessionSourceSnapshots.clear();
+    sessionSourceEpoch += 1;
+  }
   const contract = {
+    inputEpoch() {
+      return `${fragmentEpoch}:${agentsDomain()?.revision() ?? 0}:${sessionSourceEpoch}`;
+    },
     async compileSessionPrompt(input) {
       if (!table) throw new Error("prompts domain not started");
       if (table.byId.size === 0) {
@@ -230,11 +268,12 @@ function createPromptsBundle(context, options = {}) {
       const settings = configContract?.get();
       const safety = input.autonomy ?? settings?.safety.autonomy ?? "auto-edit";
       const cwd = input.cwd ?? process.cwd();
+      const sources = sessionSourceSnapshot(input.sessionId, cwd);
       let contextFiles = "";
       let projectPreload = null;
       let projectHandbookFiles = [];
       if (!suppressContextFiles) {
-        const projectContext = contextDomain()?.renderPromptContext(cwd);
+        const projectContext = sources.projectContext;
         contextFiles = projectContext ? selectProjectContext(projectContext, input.sessionInputs.providerSupportsTools ?? null) : "";
         if (projectContext) {
           projectPreload = classifyProjectPreload({
@@ -243,8 +282,6 @@ function createPromptsBundle(context, options = {}) {
           });
           projectHandbookFiles = projectContext.handbookFiles;
         }
-        for (const warning of projectContext?.warnings ?? []) process.stderr.write(`${warning}
-`);
       }
       const roster = fleetRoster();
       const sessionInputs = {
@@ -258,9 +295,9 @@ function createPromptsBundle(context, options = {}) {
         safety: `safety.${safety}`,
         sessionInputs,
         additionalFragments: [
-          ...workspaceRootFragment(cwd),
-          ...clioRepoAwarenessFragments(cwd),
-          ...customizationFragments(cwd, input.workingContextPaths ?? []).fragments
+          ...sources.workspaceRoot,
+          ...sources.clioRepoAwareness,
+          ...renderCustomizationFragments(sources.customization, cwd, input.workingContextPaths ?? []).fragments
         ]
       });
       return { ...compiled, projectPreload, projectHandbookFiles };
@@ -286,10 +323,12 @@ function createPromptsBundle(context, options = {}) {
     reload
   };
   let unsubscribeHotReload = null;
+  let unsubscribeExtensionsReload = null;
   const extension = {
     async start() {
       try {
         table = loadFragments();
+        fragmentEpoch += 1;
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         process.stderr.write(`[clio-coder:prompts] initial load failed: ${msg}
@@ -297,26 +336,49 @@ function createPromptsBundle(context, options = {}) {
         table = { byId: /* @__PURE__ */ new Map(), rootDir: "" };
       }
       unsubscribeHotReload = context.bus.on(BusChannels.ConfigHotReload, (payload) => {
+        invalidateSessionSources();
         const diff = payload?.diff;
         const paths = diff?.hotReload ?? [];
         if (!diffTouchesFragments(paths)) return;
         reload();
       });
+      unsubscribeExtensionsReload = context.bus.on(BusChannels.ExtensionsReloaded, (payload) => {
+        if (payload?.changed !== true) return;
+        reload();
+      });
     },
     async stop() {
       unsubscribeHotReload?.();
       unsubscribeHotReload = null;
+      unsubscribeExtensionsReload?.();
+      unsubscribeExtensionsReload = null;
+      sessionSourceSnapshots.clear();
     }
   };
   return { extension, contract };
 }
 function customizationFragments(cwd, workingContextPaths) {
+  return renderCustomizationFragments(captureCustomizationSources(cwd), cwd, workingContextPaths);
+}
+function captureCustomizationSources(cwd) {
+  let rules = [];
+  let operatorProfile = null;
+  try {
+    rules = loadProjectRules(cwd).rules;
+  } catch {
+  }
+  try {
+    operatorProfile = loadOperatorProfile(cwd);
+  } catch {
+  }
+  return { rules, operatorProfile };
+}
+function renderCustomizationFragments(sources, cwd, workingContextPaths) {
   const fragments = [];
   let activeRuleIds = [];
   let operatorProfileApplied = false;
   try {
-    const loaded = loadProjectRules(cwd);
-    const active = selectActiveRules(loaded.rules, normalizeWorkingContextPaths(cwd, workingContextPaths));
+    const active = selectActiveRules(sources.rules, normalizeWorkingContextPaths(cwd, workingContextPaths));
     if (active.length > 0) {
       const body = ["# Project rules", ...active.map((rule) => rule.body)].join("\n\n");
       fragments.push({
@@ -331,8 +393,7 @@ function customizationFragments(cwd, workingContextPaths) {
   } catch {
   }
   try {
-    const profile = loadOperatorProfile(cwd);
-    const rendered = renderOperatorProfile(profile.profile);
+    const rendered = renderOperatorProfile(sources.operatorProfile?.profile ?? {});
     if (rendered.text.length > 0) {
       fragments.push({
         id: "context.operator-profile",
@@ -659,4 +720,4 @@ export {
   createPromptsDomainModule,
   SchedulingDomainModule
 };
-//# sourceMappingURL=chunk-R32CLGZ6.js.map
+//# sourceMappingURL=chunk-WCXUNS7U.js.map

package/dist/{chunk-GPPB3JBE.js → chunk-WRBAGUNF.js}

@@ -2,10 +2,10 @@ import { createRequire as __clioCreateRequire } from "node:module"; const requir
 import {
   parseJsonObjectPayload,
   parseVerifierResult
-} from "./chunk-IG7BCQBA.js";
+} from "./chunk-B4OAX3SI.js";
 import {
   atomicWrite
-} from "./chunk-MQXIVJ35.js";
+} from "./chunk-HAXOFFRH.js";
 import {
   clioStateDir
 } from "./chunk-BYP5D4HI.js";
@@ -685,4 +685,4 @@ export {
   readGateDecisionArtifacts,
   readGateDecisionArtifactsForRunIds
 };
-//# sourceMappingURL=chunk-GPPB3JBE.js.map
+//# sourceMappingURL=chunk-WRBAGUNF.js.map

package/dist/{chunk-IXJT6DCX.js → chunk-XIVNBFZS.js}

@@ -1,21 +1,25 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   loadProjectVerifierCatalog
-} from "./chunk-VN3SHNBN.js";
+} from "./chunk-7DICMOS6.js";
 import {
   pathBoundaryCovers,
   resolvePathBoundary
 } from "./chunk-HHV2GANA.js";
 import {
   classify
-} from "./chunk-IG7BCQBA.js";
+} from "./chunk-B4OAX3SI.js";
 import {
-  artifactDefaultPath,
+  extractCommandCdTargets,
   extractCommandDeleteTargets,
   extractCommandWriteTargets,
   inlineShellScript,
-  tokenizeShellLike
-} from "./chunk-GCSMB2KY.js";
+  invokesClioSkillMutation,
+  scanShellLike
+} from "./chunk-I7ZPNEJM.js";
+import {
+  artifactDefaultPath
+} from "./chunk-GYV6VZOC.js";
 import {
   canonicalizeExistingPath
 } from "./chunk-ECH6PKUQ.js";
@@ -24,7 +28,7 @@ import {
 } from "./chunk-K6BSR66V.js";
 import {
   foreignAgentDirs
-} from "./chunk-IHXBNWMM.js";
+} from "./chunk-KXDSS5WJ.js";
 import {
   resolvePackageRoot
 } from "./chunk-IWHMRKLL.js";
@@ -48,7 +52,7 @@ function isSameOrDescendant(candidatePath, policyPath) {
   const candidate = path.resolve(candidatePath);
   const policy = path.resolve(policyPath);
   const relative = path.relative(policy, candidate);
-  return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
 }
 function expandTilde(rawPath) {
   if (rawPath === "~") return homedir();
@@ -145,7 +149,7 @@ function normalizeSeparators(value) {
 // src/domains/safety/policy-engine.ts
 init_esm_shims();
 import { createHash as createHash2 } from "node:crypto";
-import path3 from "node:path";
+import path4 from "node:path";
 
 // src/domains/safety/default-path-policy.ts
 init_esm_shims();
@@ -730,6 +734,42 @@ function getCachedDefaultRulePacks() {
   return cachedPacks;
 }
 
+// src/domains/safety/skill-authority.ts
+init_esm_shims();
+import { homedir as homedir2 } from "node:os";
+import path3 from "node:path";
+function activeClioSkillRoots(cwd) {
+  return [path3.join(cwd, ".clio-coder", "skills"), path3.join(clioConfigDir(), "skills")];
+}
+function skillMutationReason(roots, targets, cwd, command) {
+  const workingDirs = [cwd];
+  if (command !== null) {
+    for (const destination of extractCommandCdTargets(command)) {
+      workingDirs.push(path3.resolve(workingDirs.at(-1) ?? cwd, expandHome(destination)));
+    }
+  }
+  for (const target of targets) {
+    if (target.operation === "read") continue;
+    for (const directory of workingDirs) {
+      const lexical = path3.resolve(directory, expandHome(target.path));
+      const resolved = canonicalizeExistingPath(lexical);
+      for (const root of roots) {
+        for (const boundary of [root, canonicalizeExistingPath(root)]) {
+          for (const candidate of [lexical, resolved]) {
+            if (isSameOrDescendant(candidate, boundary) || target.operation === "delete" && isSameOrDescendant(boundary, candidate)) {
+              return `active skill tree ${root} is operator-owned; draft changes outside active skill roots and ask the operator to install or update them`;
+            }
+          }
+        }
+      }
+    }
+  }
+  return null;
+}
+function expandHome(value) {
+  return value === "~" ? homedir2() : value.startsWith("~/") ? path3.join(homedir2(), value.slice(2)) : value;
+}
+
 // src/domains/safety/policy-engine.ts
 var BUILTIN_ALLOWLIST = [
   { id: "builtin:pwd", re: /^pwd$/ },
@@ -771,17 +811,18 @@ function evaluateWriteRoots(roots, writeRootCwd, call) {
   if (roots.length === 0) return null;
   const target = writeRootTargetPath(call);
   if (target === null) return null;
-  const resolved = path3.resolve(writeRootCwd, target);
+  const resolved = path4.resolve(writeRootCwd, target);
   if (pathBoundaryCovers(roots, resolved)) return null;
   return `write target '${target}' resolves to '${resolved}', which is outside the permitted write roots for this run: ${roots.join(", ")}`;
 }
 function createSafetyPolicyEngine(options = {}) {
-  const cwd = canonicalizeExistingPath(path3.resolve(options.cwd ?? process.cwd()));
-  const writeRootCwd = path3.resolve(options.cwd ?? process.cwd());
+  const cwd = canonicalizeExistingPath(path4.resolve(options.cwd ?? process.cwd()));
+  const writeRootCwd = path4.resolve(options.cwd ?? process.cwd());
   const writeRoots = (options.writeRoots ?? []).map((root) => resolvePathBoundary(writeRootCwd, root));
+  const skillRoots = activeClioSkillRoots(cwd);
   const packs = options.rulePacks ?? getCachedDefaultRulePacks();
   const projectPolicy = options.projectPolicy ?? loadProjectSafetyPolicy(cwd);
-  const projectPolicyRoot = projectPolicy.path === null ? cwd : path3.dirname(path3.dirname(canonicalizeExistingPath(projectPolicy.path)));
+  const projectPolicyRoot = projectPolicy.path === null ? cwd : path4.dirname(path4.dirname(canonicalizeExistingPath(projectPolicy.path)));
   const pathPolicyInput = projectPolicy.disableDefaultPathPolicy ? projectPolicy.pathPolicy : mergePathPolicyInputs(DEFAULT_DAMAGE_CONTROL_PATH_POLICY, projectPolicy.pathPolicy);
   const expandedDefaults = projectPolicy.disableDefaultPathPolicy ? pathPolicyInput : mergePathPolicyInputs(pathPolicyInput, { zeroAccessPaths: clioCredentialStorePaths() });
   const pathPolicy = compilePathPolicy(expandedDefaults, projectPolicyRoot);
@@ -843,6 +884,21 @@ function createSafetyPolicyEngine(options = {}) {
         if (projectPolicy.path !== null) blockInput.projectPolicyPath = projectPolicy.path;
         return blockDecision(base, blockInput);
       }
+      const mutationCommand = call.tool === ToolNames.Bash ? command : catalogCommand;
+      const skillReason = mutationCommand !== null && invokesClioSkillMutation(mutationCommand) ? "skill installation and updates require the operator CLI or an explicit operator install choice; draft outside active skill roots" : skillMutationReason(
+        skillRoots,
+        pathPolicyTargets(catalogCommand === null ? call : { tool: ToolNames.Bash, args: { command: catalogCommand } }),
+        callCwd,
+        mutationCommand
+      );
+      if (skillReason !== null) {
+        return blockDecision(base, {
+          ruleId: "skill-authority",
+          reasonCode: "skill-authority",
+          reasons: [skillReason],
+          policySource: "builtin-classifier"
+        });
+      }
       const pathBlock = evaluateProjectPathPolicy(pathPolicy, call, callCwd);
       if (pathBlock !== null) {
         const blockInput = {
@@ -940,7 +996,7 @@ function createSafetyPolicyEngine(options = {}) {
 }
 function clioCredentialStorePaths() {
   try {
-    return [path3.join(clioConfigDir(), "credentials.yaml")];
+    return [path4.join(clioConfigDir(), "credentials.yaml")];
   } catch {
     return [];
   }
@@ -962,10 +1018,10 @@ function stripQuotes(token) {
 }
 function bashPathTokenCandidates(command) {
   const candidates = [];
-  for (const token of tokenizeShellLike(command)) {
+  for (const scanned of scanShellLike(command)) {
+    if (scanned.operator) continue;
+    const token = scanned.value;
     if (token.length === 0) continue;
-    if (token === ";" || token === "&&" || token === "||" || token === "|" || token === ">" || token === ">>") continue;
-    if (token === "<" || token === "<<") continue;
     if (/\s/.test(token)) continue;
     if (token.startsWith("-") && !token.includes("/") && !token.includes("=")) continue;
     candidates.push(token);
@@ -1205,29 +1261,28 @@ function effectiveClassification(classification, match) {
 }
 function matchingProjectCommand(policy, command, cwd) {
   if (!policy.valid || policy.path === null) return null;
-  const policyRoot = path3.dirname(path3.dirname(policy.path));
+  const policyRoot = path4.dirname(path4.dirname(policy.path));
   for (const entry of policy.commands) {
     if (entry.command !== command) continue;
     if (entry.shellOperators === "deny" && hasShellOperators(command)) continue;
-    const allowedCwd = entry.cwd !== void 0 ? path3.resolve(policyRoot, entry.cwd) : policyRoot;
+    const allowedCwd = entry.cwd !== void 0 ? path4.resolve(policyRoot, entry.cwd) : policyRoot;
     if (!isUnderOrSame(cwd, allowedCwd)) continue;
     return entry;
   }
   return null;
 }
-var CHAIN_BREAKING_TOKENS = /* @__PURE__ */ new Set([";", "|", "||", ">", ">>", "<", "<<"]);
 var CHAIN_MAX_SEGMENTS = 6;
 function recognizeCommandChain(command, callCwd, workspaceRoot, policy) {
   const segments = [];
   let current = [];
-  for (const token of tokenizeShellLike(command)) {
-    if (token === "&&") {
+  for (const token of scanShellLike(command)) {
+    if (token.operator && token.value === "&&") {
       segments.push(current);
       current = [];
       continue;
     }
-    if (CHAIN_BREAKING_TOKENS.has(token)) return null;
-    current.push(token);
+    if (token.operator) return null;
+    current.push(token.value);
   }
   segments.push(current);
   if (segments.length < 2 || segments.length > CHAIN_MAX_SEGMENTS) return null;
@@ -1238,7 +1293,7 @@ function recognizeCommandChain(command, callCwd, workspaceRoot, policy) {
     if (segment[0] === "cd") {
       if (segment.length !== 2) return null;
       const target = segment[1] ?? "";
-      if (target.startsWith("~") || !isUnderOrSame(path3.resolve(callCwd, target), workspaceRoot)) return null;
+      if (target.startsWith("~") || !isUnderOrSame(path4.resolve(callCwd, target), workspaceRoot)) return null;
       ruleIds.push("builtin:cd-workspace");
       continue;
     }
@@ -1265,11 +1320,11 @@ function hasShellOperators(command) {
   return hasSequencingOperators(command) || hasCommandSubstitution(command);
 }
 function isUnderOrSame(child, parent) {
-  const rel = path3.relative(
-    canonicalizeExistingPath(path3.resolve(parent)),
-    canonicalizeExistingPath(path3.resolve(child))
+  const rel = path4.relative(
+    canonicalizeExistingPath(path4.resolve(parent)),
+    canonicalizeExistingPath(path4.resolve(child))
   );
-  return rel === "" || !rel.startsWith("..") && !path3.isAbsolute(rel);
+  return rel === "" || !rel.startsWith("..") && !path4.isAbsolute(rel);
 }
 function commandArg(args) {
   return typeof args?.command === "string" ? args.command : null;
@@ -1280,7 +1335,7 @@ function pathArg(args) {
   return typeof candidate === "string" && candidate.length > 0 ? candidate : null;
 }
 function cwdArg(args, fallback) {
-  const resolved = typeof args?.cwd === "string" && args.cwd.length > 0 ? path3.resolve(fallback, args.cwd) : fallback;
+  const resolved = typeof args?.cwd === "string" && args.cwd.length > 0 ? path4.resolve(fallback, args.cwd) : fallback;
   return canonicalizeExistingPath(resolved);
 }
 var CONTENT_BEARING_TOOLS = /* @__PURE__ */ new Set([ToolNames.Write, ToolNames.Edit, ToolNames.Artifact]);
@@ -1340,4 +1395,4 @@ export {
   WRITE_ROOT_REFUSED_TOOLS,
   createSafetyPolicyEngine
 };
-//# sourceMappingURL=chunk-IXJT6DCX.js.map
+//# sourceMappingURL=chunk-XIVNBFZS.js.map