@iowarp/clio-coder 0.4.2 → 0.4.3

package/dist/{chunk-ZGNYYXQ6.js → chunk-WRBAGUNF.js}

@@ -2,10 +2,10 @@ import { createRequire as __clioCreateRequire } from "node:module"; const requir
 import {
   parseJsonObjectPayload,
   parseVerifierResult
-} from "./chunk-PGF63K6I.js";
+} from "./chunk-B4OAX3SI.js";
 import {
   atomicWrite
-} from "./chunk-MQXIVJ35.js";
+} from "./chunk-HAXOFFRH.js";
 import {
   clioStateDir
 } from "./chunk-BYP5D4HI.js";
@@ -685,4 +685,4 @@ export {
   readGateDecisionArtifacts,
   readGateDecisionArtifactsForRunIds
 };
-//# sourceMappingURL=chunk-ZGNYYXQ6.js.map
+//# sourceMappingURL=chunk-WRBAGUNF.js.map

package/dist/{chunk-FVDGR2ZL.js → chunk-XIVNBFZS.js}

@@ -1,21 +1,25 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   loadProjectVerifierCatalog
-} from "./chunk-VN3SHNBN.js";
+} from "./chunk-7DICMOS6.js";
 import {
   pathBoundaryCovers,
   resolvePathBoundary
 } from "./chunk-HHV2GANA.js";
 import {
   classify
-} from "./chunk-PGF63K6I.js";
+} from "./chunk-B4OAX3SI.js";
 import {
-  artifactDefaultPath,
+  extractCommandCdTargets,
   extractCommandDeleteTargets,
   extractCommandWriteTargets,
   inlineShellScript,
-  tokenizeShellLike
-} from "./chunk-IKOZFYBN.js";
+  invokesClioSkillMutation,
+  scanShellLike
+} from "./chunk-I7ZPNEJM.js";
+import {
+  artifactDefaultPath
+} from "./chunk-GYV6VZOC.js";
 import {
   canonicalizeExistingPath
 } from "./chunk-ECH6PKUQ.js";
@@ -24,7 +28,7 @@ import {
 } from "./chunk-K6BSR66V.js";
 import {
   foreignAgentDirs
-} from "./chunk-IHXBNWMM.js";
+} from "./chunk-KXDSS5WJ.js";
 import {
   resolvePackageRoot
 } from "./chunk-IWHMRKLL.js";
@@ -48,7 +52,7 @@ function isSameOrDescendant(candidatePath, policyPath) {
   const candidate = path.resolve(candidatePath);
   const policy = path.resolve(policyPath);
   const relative = path.relative(policy, candidate);
-  return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
 }
 function expandTilde(rawPath) {
   if (rawPath === "~") return homedir();
@@ -145,7 +149,7 @@ function normalizeSeparators(value) {
 // src/domains/safety/policy-engine.ts
 init_esm_shims();
 import { createHash as createHash2 } from "node:crypto";
-import path3 from "node:path";
+import path4 from "node:path";
 
 // src/domains/safety/default-path-policy.ts
 init_esm_shims();
@@ -730,6 +734,42 @@ function getCachedDefaultRulePacks() {
   return cachedPacks;
 }
 
+// src/domains/safety/skill-authority.ts
+init_esm_shims();
+import { homedir as homedir2 } from "node:os";
+import path3 from "node:path";
+function activeClioSkillRoots(cwd) {
+  return [path3.join(cwd, ".clio-coder", "skills"), path3.join(clioConfigDir(), "skills")];
+}
+function skillMutationReason(roots, targets, cwd, command) {
+  const workingDirs = [cwd];
+  if (command !== null) {
+    for (const destination of extractCommandCdTargets(command)) {
+      workingDirs.push(path3.resolve(workingDirs.at(-1) ?? cwd, expandHome(destination)));
+    }
+  }
+  for (const target of targets) {
+    if (target.operation === "read") continue;
+    for (const directory of workingDirs) {
+      const lexical = path3.resolve(directory, expandHome(target.path));
+      const resolved = canonicalizeExistingPath(lexical);
+      for (const root of roots) {
+        for (const boundary of [root, canonicalizeExistingPath(root)]) {
+          for (const candidate of [lexical, resolved]) {
+            if (isSameOrDescendant(candidate, boundary) || target.operation === "delete" && isSameOrDescendant(boundary, candidate)) {
+              return `active skill tree ${root} is operator-owned; draft changes outside active skill roots and ask the operator to install or update them`;
+            }
+          }
+        }
+      }
+    }
+  }
+  return null;
+}
+function expandHome(value) {
+  return value === "~" ? homedir2() : value.startsWith("~/") ? path3.join(homedir2(), value.slice(2)) : value;
+}
+
 // src/domains/safety/policy-engine.ts
 var BUILTIN_ALLOWLIST = [
   { id: "builtin:pwd", re: /^pwd$/ },
@@ -771,17 +811,18 @@ function evaluateWriteRoots(roots, writeRootCwd, call) {
   if (roots.length === 0) return null;
   const target = writeRootTargetPath(call);
   if (target === null) return null;
-  const resolved = path3.resolve(writeRootCwd, target);
+  const resolved = path4.resolve(writeRootCwd, target);
   if (pathBoundaryCovers(roots, resolved)) return null;
   return `write target '${target}' resolves to '${resolved}', which is outside the permitted write roots for this run: ${roots.join(", ")}`;
 }
 function createSafetyPolicyEngine(options = {}) {
-  const cwd = canonicalizeExistingPath(path3.resolve(options.cwd ?? process.cwd()));
-  const writeRootCwd = path3.resolve(options.cwd ?? process.cwd());
+  const cwd = canonicalizeExistingPath(path4.resolve(options.cwd ?? process.cwd()));
+  const writeRootCwd = path4.resolve(options.cwd ?? process.cwd());
   const writeRoots = (options.writeRoots ?? []).map((root) => resolvePathBoundary(writeRootCwd, root));
+  const skillRoots = activeClioSkillRoots(cwd);
   const packs = options.rulePacks ?? getCachedDefaultRulePacks();
   const projectPolicy = options.projectPolicy ?? loadProjectSafetyPolicy(cwd);
-  const projectPolicyRoot = projectPolicy.path === null ? cwd : path3.dirname(path3.dirname(canonicalizeExistingPath(projectPolicy.path)));
+  const projectPolicyRoot = projectPolicy.path === null ? cwd : path4.dirname(path4.dirname(canonicalizeExistingPath(projectPolicy.path)));
   const pathPolicyInput = projectPolicy.disableDefaultPathPolicy ? projectPolicy.pathPolicy : mergePathPolicyInputs(DEFAULT_DAMAGE_CONTROL_PATH_POLICY, projectPolicy.pathPolicy);
   const expandedDefaults = projectPolicy.disableDefaultPathPolicy ? pathPolicyInput : mergePathPolicyInputs(pathPolicyInput, { zeroAccessPaths: clioCredentialStorePaths() });
   const pathPolicy = compilePathPolicy(expandedDefaults, projectPolicyRoot);
@@ -843,6 +884,21 @@ function createSafetyPolicyEngine(options = {}) {
         if (projectPolicy.path !== null) blockInput.projectPolicyPath = projectPolicy.path;
         return blockDecision(base, blockInput);
       }
+      const mutationCommand = call.tool === ToolNames.Bash ? command : catalogCommand;
+      const skillReason = mutationCommand !== null && invokesClioSkillMutation(mutationCommand) ? "skill installation and updates require the operator CLI or an explicit operator install choice; draft outside active skill roots" : skillMutationReason(
+        skillRoots,
+        pathPolicyTargets(catalogCommand === null ? call : { tool: ToolNames.Bash, args: { command: catalogCommand } }),
+        callCwd,
+        mutationCommand
+      );
+      if (skillReason !== null) {
+        return blockDecision(base, {
+          ruleId: "skill-authority",
+          reasonCode: "skill-authority",
+          reasons: [skillReason],
+          policySource: "builtin-classifier"
+        });
+      }
       const pathBlock = evaluateProjectPathPolicy(pathPolicy, call, callCwd);
       if (pathBlock !== null) {
         const blockInput = {
@@ -940,7 +996,7 @@ function createSafetyPolicyEngine(options = {}) {
 }
 function clioCredentialStorePaths() {
   try {
-    return [path3.join(clioConfigDir(), "credentials.yaml")];
+    return [path4.join(clioConfigDir(), "credentials.yaml")];
   } catch {
     return [];
   }
@@ -962,10 +1018,10 @@ function stripQuotes(token) {
 }
 function bashPathTokenCandidates(command) {
   const candidates = [];
-  for (const token of tokenizeShellLike(command)) {
+  for (const scanned of scanShellLike(command)) {
+    if (scanned.operator) continue;
+    const token = scanned.value;
     if (token.length === 0) continue;
-    if (token === ";" || token === "&&" || token === "||" || token === "|" || token === ">" || token === ">>") continue;
-    if (token === "<" || token === "<<") continue;
     if (/\s/.test(token)) continue;
     if (token.startsWith("-") && !token.includes("/") && !token.includes("=")) continue;
     candidates.push(token);
@@ -1205,29 +1261,28 @@ function effectiveClassification(classification, match) {
 }
 function matchingProjectCommand(policy, command, cwd) {
   if (!policy.valid || policy.path === null) return null;
-  const policyRoot = path3.dirname(path3.dirname(policy.path));
+  const policyRoot = path4.dirname(path4.dirname(policy.path));
   for (const entry of policy.commands) {
     if (entry.command !== command) continue;
     if (entry.shellOperators === "deny" && hasShellOperators(command)) continue;
-    const allowedCwd = entry.cwd !== void 0 ? path3.resolve(policyRoot, entry.cwd) : policyRoot;
+    const allowedCwd = entry.cwd !== void 0 ? path4.resolve(policyRoot, entry.cwd) : policyRoot;
     if (!isUnderOrSame(cwd, allowedCwd)) continue;
     return entry;
   }
   return null;
 }
-var CHAIN_BREAKING_TOKENS = /* @__PURE__ */ new Set([";", "|", "||", ">", ">>", "<", "<<"]);
 var CHAIN_MAX_SEGMENTS = 6;
 function recognizeCommandChain(command, callCwd, workspaceRoot, policy) {
   const segments = [];
   let current = [];
-  for (const token of tokenizeShellLike(command)) {
-    if (token === "&&") {
+  for (const token of scanShellLike(command)) {
+    if (token.operator && token.value === "&&") {
       segments.push(current);
       current = [];
       continue;
     }
-    if (CHAIN_BREAKING_TOKENS.has(token)) return null;
-    current.push(token);
+    if (token.operator) return null;
+    current.push(token.value);
   }
   segments.push(current);
   if (segments.length < 2 || segments.length > CHAIN_MAX_SEGMENTS) return null;
@@ -1238,7 +1293,7 @@ function recognizeCommandChain(command, callCwd, workspaceRoot, policy) {
     if (segment[0] === "cd") {
       if (segment.length !== 2) return null;
       const target = segment[1] ?? "";
-      if (target.startsWith("~") || !isUnderOrSame(path3.resolve(callCwd, target), workspaceRoot)) return null;
+      if (target.startsWith("~") || !isUnderOrSame(path4.resolve(callCwd, target), workspaceRoot)) return null;
       ruleIds.push("builtin:cd-workspace");
       continue;
     }
@@ -1265,11 +1320,11 @@ function hasShellOperators(command) {
   return hasSequencingOperators(command) || hasCommandSubstitution(command);
 }
 function isUnderOrSame(child, parent) {
-  const rel = path3.relative(
-    canonicalizeExistingPath(path3.resolve(parent)),
-    canonicalizeExistingPath(path3.resolve(child))
+  const rel = path4.relative(
+    canonicalizeExistingPath(path4.resolve(parent)),
+    canonicalizeExistingPath(path4.resolve(child))
   );
-  return rel === "" || !rel.startsWith("..") && !path3.isAbsolute(rel);
+  return rel === "" || !rel.startsWith("..") && !path4.isAbsolute(rel);
 }
 function commandArg(args) {
   return typeof args?.command === "string" ? args.command : null;
@@ -1280,7 +1335,7 @@ function pathArg(args) {
   return typeof candidate === "string" && candidate.length > 0 ? candidate : null;
 }
 function cwdArg(args, fallback) {
-  const resolved = typeof args?.cwd === "string" && args.cwd.length > 0 ? path3.resolve(fallback, args.cwd) : fallback;
+  const resolved = typeof args?.cwd === "string" && args.cwd.length > 0 ? path4.resolve(fallback, args.cwd) : fallback;
   return canonicalizeExistingPath(resolved);
 }
 var CONTENT_BEARING_TOOLS = /* @__PURE__ */ new Set([ToolNames.Write, ToolNames.Edit, ToolNames.Artifact]);
@@ -1340,4 +1395,4 @@ export {
   WRITE_ROOT_REFUSED_TOOLS,
   createSafetyPolicyEngine
 };
-//# sourceMappingURL=chunk-FVDGR2ZL.js.map
+//# sourceMappingURL=chunk-XIVNBFZS.js.map