@iowarp/clio-coder 0.4.3 → 0.4.5

package/dist/{chunk-LCGCVYZ4.js → chunk-LQTKDAUO.js}

@@ -1,7 +1,7 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/core/toml.ts
 init_esm_shims();
@@ -54,4 +54,4 @@ export {
   tomlTableAt,
   createTomlFileReader
 };
-//# sourceMappingURL=chunk-LCGCVYZ4.js.map
+//# sourceMappingURL=chunk-LQTKDAUO.js.map

package/dist/{chunk-JIEGK6UF.js → chunk-LTR5QCLS.js}

@@ -1,13 +1,13 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   AI_AGENT_NAME
-} from "./chunk-6EJMN2Y3.js";
+} from "./chunk-ZTNFYMIO.js";
 import {
   clioStateDir
-} from "./chunk-BYP5D4HI.js";
+} from "./chunk-CTTI7G3T.js";
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/core/git-commit-attribution.ts
 init_esm_shims();
@@ -34,6 +34,9 @@ var CLIO_COMMIT_TRAILERS = {
   reviewed: `Reviewed-by: ${CLIO_COMMIT_IDENTITY}`,
   coAuthored: `Co-authored-by: ${CLIO_COMMIT_IDENTITY}`
 };
+var CLIO_DECISION_TRAILER_KEY = "Clio-Decision";
+var CLIO_DECISION_TRAILER_CAP = 32;
+var DECISION_REF_PATTERN = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,127}\/[a-z0-9]+(?:[_-][a-z0-9]+)*$/u;
 var TRAILER_LINE = /^([A-Za-z0-9][A-Za-z0-9-]*):[ \t]+(.+)$/u;
 var SHA256 = /^[0-9a-f]{64}$/u;
 function normalizedTrailer(line) {
@@ -45,7 +48,18 @@ var KNOWN_CLIO_TRAILERS = new Set(
   Object.values(CLIO_COMMIT_TRAILERS).map((line) => normalizedTrailer(line)).filter((line) => line !== null)
 );
 function isClioTrailer(key) {
-  return KNOWN_CLIO_TRAILERS.has(key) || key.startsWith("clio-evidence:receipt-v20/sha256:");
+  return KNOWN_CLIO_TRAILERS.has(key) || key.startsWith("clio-evidence:receipt-v20/sha256:") || key.startsWith(`${CLIO_DECISION_TRAILER_KEY.toLowerCase()}:`);
+}
+function decisionTrailerRefs(decisions) {
+  if (decisions === void 0) return [];
+  const refs = /* @__PURE__ */ new Set();
+  for (const ref of decisions) {
+    if (typeof ref === "string" && DECISION_REF_PATTERN.test(ref)) refs.add(ref);
+  }
+  return [...refs].sort().slice(0, CLIO_DECISION_TRAILER_CAP);
+}
+function decisionTrailer(ref) {
+  return `${CLIO_DECISION_TRAILER_KEY}: ${ref}`;
 }
 function trailerBlockStart(lines) {
   if (lines.length < 2) return null;
@@ -92,6 +106,7 @@ function attributeCommitMessage(originalMessage, evidence, enabled = true) {
   if (evidence.materiallyAuthored === true) desired.push(CLIO_COMMIT_TRAILERS.coAuthored);
   const receipt = receiptTrailer(evidence.receipt);
   if (receipt !== null) desired.push(receipt);
+  for (const ref of decisionTrailerRefs(evidence.decisions)) desired.push(decisionTrailer(ref));
   const existing = new Set(
     (blockStart === null ? [] : retained.slice(blockStart)).map((line) => normalizedTrailer(line)).filter((line) => line !== null)
   );
@@ -112,9 +127,10 @@ function attributeCommitMessage(originalMessage, evidence, enabled = true) {
 var CLIO_GIT_COMMITS_ENABLED_ENV = "CLIO_CODER_GIT_COMMITS_ENABLED";
 var ASSISTED_ENV = "CLIO_CODER_COMMIT_ASSISTED";
 var AUTHORED_ENV = "CLIO_CODER_COMMIT_AUTHORED";
+var DECISIONS_ENV = "CLIO_CODER_COMMIT_DECISIONS";
 var CONFIG_BASE_COUNT_ENV = "CLIO_CODER_GIT_CONFIG_BASE_COUNT";
 var DEFAULT_HOOKS_EQUIVALENT_ENV = "CLIO_CODER_GIT_DEFAULT_HOOKS_EQUIVALENT";
-var MANAGED_HOOK_VERSION = 2;
+var MANAGED_HOOK_VERSION = 3;
 var DIAGNOSTIC_MAX_CHARS = 300;
 var COUNT = /^(?:0|[1-9][0-9]*)$/u;
 var reportedDiagnostics = /* @__PURE__ */ new Set();
@@ -122,7 +138,24 @@ var PROBE_CACHE_TTL_MS = 1e4;
 var PROBE_CACHE_MAX_ENTRIES = 32;
 var probeCache = /* @__PURE__ */ new Map();
 var installedHooksDirectory = null;
-var PER_SPAWN_ENV_NAMES = [ASSISTED_ENV, AUTHORED_ENV, CONFIG_BASE_COUNT_ENV, DEFAULT_HOOKS_EQUIVALENT_ENV];
+var PER_SPAWN_ENV_NAMES = [
+  ASSISTED_ENV,
+  AUTHORED_ENV,
+  DECISIONS_ENV,
+  CONFIG_BASE_COUNT_ENV,
+  DEFAULT_HOOKS_EQUIVALENT_ENV
+];
+var decisionRefsProvider = null;
+function setCommitDecisionRefsProvider(provider) {
+  decisionRefsProvider = provider;
+}
+function providedDecisionRefs() {
+  try {
+    return decisionRefsProvider?.() ?? [];
+  } catch {
+    return [];
+  }
+}
 function reportCommitAttributionDiagnostic(diagnostic) {
   if (diagnostic === null || reportedDiagnostics.has(diagnostic)) return;
   reportedDiagnostics.add(diagnostic);
@@ -279,6 +312,14 @@ if [ "$${ASSISTED_ENV}" = '1' ] || [ "$${AUTHORED_ENV}" = '1' ]; then
   append_trailer '${CLIO_COMMIT_TRAILERS.assisted}'
 fi
 if [ "$${AUTHORED_ENV}" = '1' ]; then append_trailer '${CLIO_COMMIT_TRAILERS.coAuthored}'; fi
+# Decision refs are validated again here: only <id>/<key> shapes become
+# trailers, so a stray value cannot inject a second line into the message.
+for decision_ref in $${DECISIONS_ENV}; do
+  case "$decision_ref" in
+    *[!A-Za-z0-9:._/-]* | */*/* | /* | */ | *-*-) continue ;;
+    */*) append_trailer "${CLIO_DECISION_TRAILER_KEY}: $decision_ref" ;;
+  esac
+done
 exit 0
 `;
 function installManagedHook(directory, name) {
@@ -358,6 +399,8 @@ function withManagedGitCommitAttributionEnvironment(source, options = {}) {
   const evidence = options.evidence ?? { materiallyAssisted: true, materiallyAuthored: true };
   env[ASSISTED_ENV] = evidence.materiallyAssisted === true ? "1" : "0";
   env[AUTHORED_ENV] = evidence.materiallyAuthored === true ? "1" : "0";
+  const decisions = decisionTrailerRefs(evidence.decisions ?? providedDecisionRefs());
+  if (decisions.length > 0) env[DECISIONS_ENV] = decisions.join(" ");
   const countRaw = env.GIT_CONFIG_COUNT;
   const count = countRaw === void 0 ? 0 : COUNT.test(countRaw) ? Number(countRaw) : Number.NaN;
   if (!Number.isSafeInteger(count) || count > 1024) {
@@ -394,9 +437,10 @@ function withManagedGitCommitAttributionEnvironment(source, options = {}) {
 
 export {
   attributeCommitMessage,
+  setCommitDecisionRefsProvider,
   reportCommitAttributionDiagnostic,
   setGitCommitAttributionEnabled,
   gitCommitAttributionEnabled,
   withManagedGitCommitAttributionEnvironment
 };
-//# sourceMappingURL=chunk-JIEGK6UF.js.map
+//# sourceMappingURL=chunk-LTR5QCLS.js.map

package/dist/chunk-LUL5Z66S.js

@@ -0,0 +1,221 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  extractCommandCdTargets,
+  extractCommandWriteTargets
+} from "./chunk-M6TAYK66.js";
+import {
+  canonicalizeExistingPath
+} from "./chunk-KQ6IDQIB.js";
+import {
+  artifactDefaultPath
+} from "./chunk-NTTS3O53.js";
+import {
+  ToolNames
+} from "./chunk-EHOSNVVM.js";
+import {
+  init_esm_shims
+} from "./chunk-ECBHH7LU.js";
+
+// src/domains/safety/action-classifier.ts
+init_esm_shims();
+import path from "node:path";
+var GIT_DESTRUCTIVE_PATTERNS = [
+  { name: "git-push-force-long", re: /\bgit\s+push\s+--force\b/i },
+  { name: "git-push-force-short", re: /\bgit\s+push\s+-f\b/i },
+  { name: "git-reset-hard", re: /\bgit\s+reset\s+--hard\b/i },
+  { name: "git-clean-fd", re: /\bgit\s+clean\s+-fd?\b/i },
+  { name: "git-checkout-dot", re: /\bgit\s+checkout\s+--\s+\./i },
+  { name: "git-branch-D", re: /\bgit\s+branch\s+-D\b/i },
+  { name: "git-restore-source", re: /\bgit\s+restore\s+--source\b/i }
+];
+var SYSTEM_MODIFY_PATTERNS = [
+  { name: "sudo-or-doas", re: /\b(sudo|doas)\b/i },
+  // allow rm -rf /tmp/... and /var/tmp/... but flag everything else rooted at /
+  { name: "rm-rf-root", re: /\brm\s+-rf?\s+\/(?!(tmp|var\/tmp)(?:\/|\s|$))/i },
+  { name: "apt-install", re: /\bapt(-get)?\s+(install|remove|purge)/i },
+  { name: "brew-install", re: /\bbrew\s+(install|uninstall|reinstall)/i },
+  { name: "npm-install-global", re: /\bnpm\s+install\s+-g\b/i },
+  { name: "pip-install", re: /\bpip\s+install\b/i },
+  { name: "systemctl", re: /\bsystemctl\s+/i },
+  { name: "chmod-root", re: /\bchmod\s+[0-7]{3,4}\s+\//i },
+  { name: "chown", re: /\bchown\s+/i }
+];
+var SYSTEM_WRITE_ROOT_PREFIXES = ["/etc", "/usr", "/var", "/bin", "/sbin", "/run"];
+var SYSTEM_WRITE_EXEMPT_PREFIXES = ["/var/tmp", "/var/folders"];
+function isUnderPrefix(abs, prefix) {
+  return abs === prefix || abs.startsWith(`${prefix}/`);
+}
+function baseClassify(tool) {
+  switch (tool) {
+    case ToolNames.Evidence:
+    case ToolNames.Read:
+    case ToolNames.Grep:
+    case ToolNames.Find:
+    case ToolNames.Ls:
+    case ToolNames.WebFetch:
+    case ToolNames.Git:
+    case ToolNames.CodeNav:
+    case ToolNames.Context:
+    case ToolNames.Monitor:
+    case ToolNames.AskUser:
+    case ToolNames.CredentialPresent:
+    // tasks pick mutates only Clio-owned session-ledger and project-local
+    // .clio-coder runtime state, never source-workspace files. By intentional
+    // policy it stays read class and ungated; the tool itself still requires
+    // a durable operator task id before it can mutate either store.
+    case ToolNames.Tasks:
+    // ledger posts a typed contribution to a coordination board and reads a
+    // local mirror. Neither touches the workspace, so it is never gated
+    // behind a confirmation.
+    case ToolNames.Ledger:
+    // panes focuses, opens, and closes terminal panes Clio itself created, in
+    // a pane host that lives outside the workspace. Nothing it does writes a
+    // file, runs a model-supplied command (its schema exposes presets only),
+    // or survives the session, so it is reversible, local, and never gated
+    // behind a confirmation.
+    case ToolNames.Panes:
+    // limitation appends a typed receipt to the session ledger and touches
+    // nothing else, so it is never gated behind a confirmation.
+    case ToolNames.Limitation:
+    // decide appends the model's own design decision to the session
+    // decision board. One ledger append, no workspace effect, never gated.
+    case ToolNames.Decide:
+      return "read";
+    case ToolNames.Write:
+    case ToolNames.Edit:
+    case ToolNames.Artifact:
+      return "write";
+    case ToolNames.Bash:
+    case ToolNames.Verify:
+      return "execute";
+    case ToolNames.Dispatch:
+    case ToolNames.Steer:
+      return "dispatch";
+    default:
+      return null;
+  }
+}
+function scanStringOf(args) {
+  if (!args) return "";
+  const parts = [];
+  for (const value of Object.values(args)) {
+    if (value == null) continue;
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+      parts.push(String(value));
+    } else {
+      try {
+        parts.push(JSON.stringify(value));
+      } catch {
+      }
+    }
+  }
+  return parts.join(" ");
+}
+function matchFirst(patterns, haystack) {
+  for (const p of patterns) {
+    if (p.re.test(haystack)) return p;
+  }
+  return null;
+}
+function resolveCandidate(p, baseCwd) {
+  if (p.startsWith("~")) return p;
+  const base = canonicalizeExistingPath(path.resolve(baseCwd ?? process.cwd()));
+  const resolved = path.isAbsolute(p) ? path.resolve(p) : path.resolve(base, p);
+  return canonicalizeExistingPath(resolved);
+}
+function isInsideCwd(abs) {
+  const cwd = canonicalizeExistingPath(path.resolve(process.cwd()));
+  const candidate = canonicalizeExistingPath(abs);
+  const rel = path.relative(cwd, candidate);
+  return rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+function writePathClass(pathArg, baseCwd) {
+  if (pathArg.startsWith("~")) {
+    return { cls: "system_modify", reason: `write-path-home-escape: ${pathArg}` };
+  }
+  const abs = resolveCandidate(pathArg, baseCwd);
+  const exempt = SYSTEM_WRITE_EXEMPT_PREFIXES.some((prefix) => isUnderPrefix(abs, prefix));
+  if (!exempt) {
+    for (const prefix of SYSTEM_WRITE_ROOT_PREFIXES) {
+      if (isUnderPrefix(abs, prefix)) {
+        return { cls: "system_modify", reason: `write-path-system-root: ${prefix}` };
+      }
+    }
+  }
+  if (!isInsideCwd(abs)) {
+    return { cls: "system_modify", reason: `write-path-outside-cwd: ${abs}` };
+  }
+  return { cls: "write" };
+}
+function extractWritePath(tool, args) {
+  const candidate = args?.path ?? args?.file_path ?? args?.filePath;
+  if (typeof candidate === "string" && candidate.length > 0) return candidate;
+  return tool === ToolNames.Artifact ? artifactDefaultPath(args?.kind) : null;
+}
+function webFetchIsOutward(args) {
+  const method = typeof args?.method === "string" && args.method.length > 0 ? args.method.toUpperCase() : "GET";
+  return method !== "GET" && method !== "HEAD" || args?.body !== void 0;
+}
+function classify(call) {
+  if (call.tool === ToolNames.WebFetch && webFetchIsOutward(call.args)) {
+    return { actionClass: "write", reasons: ["web-fetch:outward"] };
+  }
+  const base = baseClassify(call.tool);
+  if (base === null) {
+    return { actionClass: "unknown", reasons: [`unknown tool: ${call.tool}`] };
+  }
+  const reasons = [];
+  if (call.tool === ToolNames.Bash) {
+    const scan = scanStringOf(call.args);
+    const gitHit = matchFirst(GIT_DESTRUCTIVE_PATTERNS, scan);
+    if (gitHit) {
+      return { actionClass: "git_destructive", reasons: [`pattern:${gitHit.name}`] };
+    }
+    const sysHit = matchFirst(SYSTEM_MODIFY_PATTERNS, scan);
+    if (sysHit) {
+      return { actionClass: "system_modify", reasons: [`pattern:${sysHit.name}`] };
+    }
+    const command = typeof call.args?.command === "string" ? call.args.command : null;
+    const argCwd = typeof call.args?.cwd === "string" && call.args.cwd.length > 0 ? call.args.cwd : void 0;
+    if (command !== null) {
+      const targetReasons = [];
+      for (const target of extractCommandWriteTargets(command)) {
+        const decision = writePathClass(target, argCwd);
+        if (decision.cls === "system_modify") {
+          targetReasons.push(decision.reason ?? `bash-write-target: ${target}`);
+        }
+      }
+      for (const target of extractCommandCdTargets(command)) {
+        if (target.startsWith("~")) {
+          targetReasons.push(`bash-cd-home-escape: ${target}`);
+          continue;
+        }
+        const abs = resolveCandidate(target, argCwd);
+        if (!isInsideCwd(abs)) {
+          targetReasons.push(`bash-cd-outside-workspace: ${abs}`);
+        }
+      }
+      if (targetReasons.length > 0) {
+        return { actionClass: "system_modify", reasons: targetReasons };
+      }
+    }
+    return { actionClass: "execute", reasons };
+  }
+  if (base === "write") {
+    const pathArg = extractWritePath(call.tool, call.args);
+    if (pathArg) {
+      const decision = writePathClass(pathArg);
+      if (decision.cls === "system_modify") {
+        return { actionClass: "system_modify", reasons: decision.reason ? [decision.reason] : [] };
+      }
+    }
+    return { actionClass: "write", reasons };
+  }
+  return { actionClass: base, reasons };
+}
+
+export {
+  webFetchIsOutward,
+  classify
+};
+//# sourceMappingURL=chunk-LUL5Z66S.js.map