@iowarp/clio-coder 0.4.3 → 0.4.5

package/dist/{config-SVM5P5YI.js → config-Y2JDJ3JJ.js}

@@ -1,153 +1,163 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   capturedHookSourcesFor
-} from "./chunk-SZAA6XDG.js";
+} from "./chunk-IFDRAD6F.js";
 import {
   readLayeredSettings,
   settingsSourceFor
-} from "./chunk-4WR7VSYB.js";
+} from "./chunk-YYB3MC65.js";
 import {
+  defaultScopedResourceRoots
+} from "./chunk-U7H5WRG5.js";
+import "./chunk-5VTJP36Q.js";
+import {
+  loadMemoryRecordsSync,
   loadOperatorProfile,
   loadProjectClioMd,
   loadProjectRules,
+  memoryStorePath,
   renderOperatorProfile,
-  renderPromptContext
-} from "./chunk-KK4JZPBQ.js";
-import "./chunk-R6Q67RJH.js";
-import "./chunk-Y3CBHOR6.js";
-import {
-  loadMemoryRecordsSync,
-  memoryStorePath
-} from "./chunk-BEPZRGGU.js";
-import "./chunk-NDINPTJ4.js";
-import "./chunk-MXHC5QYU.js";
-import "./chunk-AF4YM7Z4.js";
-import "./chunk-B4VEBZKF.js";
-import "./chunk-E3TPLWFX.js";
-import "./chunk-WRBAGUNF.js";
-import "./chunk-IWT4SF4R.js";
-import "./chunk-JKKCYP3C.js";
-import "./chunk-FTMGRKEF.js";
-import "./chunk-XRZT5WY5.js";
-import "./chunk-RVG5JXAL.js";
-import "./chunk-VIA6RFQZ.js";
-import "./chunk-T56WDKA5.js";
-import "./chunk-W6GROXXM.js";
-import "./chunk-2VIKGWFZ.js";
-import "./chunk-RKKLTLYB.js";
-import "./chunk-6PTFB5VS.js";
-import "./chunk-TXOTCRLG.js";
-import "./chunk-LCGCVYZ4.js";
-import {
-  defaultScopedResourceRoots
-} from "./chunk-CE5AX47J.js";
-import "./chunk-3DPEIQKN.js";
+  renderPromptContext,
+  selectProjectPreload
+} from "./chunk-SDWNDICN.js";
+import "./chunk-PECBKCDK.js";
+import "./chunk-ODUTYZIU.js";
+import "./chunk-P5SC4DLJ.js";
+import "./chunk-GNQRWTMY.js";
+import "./chunk-ONRTXOZY.js";
+import "./chunk-WLMSOT73.js";
+import "./chunk-6CDNRHWH.js";
+import "./chunk-F34AR6O3.js";
+import "./chunk-U44YYLVV.js";
+import "./chunk-UQIVHSE4.js";
+import "./chunk-USZA7GWL.js";
+import "./chunk-LVFANMOH.js";
+import "./chunk-WTQGRBHV.js";
+import "./chunk-7WUZEB2M.js";
+import "./chunk-O5F25NIE.js";
+import "./chunk-5DDOTTG4.js";
+import "./chunk-YEJIG7LN.js";
+import "./chunk-CXQ37WJH.js";
+import "./chunk-HGSLRG33.js";
+import "./chunk-7YJWEF2L.js";
+import "./chunk-SD7SHNDW.js";
+import "./chunk-T52TPHYC.js";
+import "./chunk-QH3ZTUOA.js";
+import "./chunk-LQTKDAUO.js";
 import {
   extensionSnapshotFor
-} from "./chunk-7DRAWPTZ.js";
+} from "./chunk-22PQ4TX4.js";
 import {
   listInstalledExtensions
-} from "./chunk-5MEZN6CB.js";
-import "./chunk-PUVDKJ2Y.js";
-import {
-  classifyProjectPreload
-} from "./chunk-JVCV3ICN.js";
-import "./chunk-HVDIIIQW.js";
+} from "./chunk-DZK63TZJ.js";
+import "./chunk-DNHVRBH4.js";
 import {
   printError
-} from "./chunk-VPKWYKEY.js";
-import "./chunk-5TSRNF4G.js";
+} from "./chunk-3T4DXWP6.js";
 import {
   HOOK_RECEIPT_LOG_CAPACITY,
   loadUserHooks,
   readHookSources,
   readPersistedHookReceipts
-} from "./chunk-2UG5F4C5.js";
-import "./chunk-2WZ546HR.js";
-import "./chunk-VG7TBQIY.js";
-import "./chunk-PAJQJ7BS.js";
-import "./chunk-EKCHAPYA.js";
-import "./chunk-L47TF46W.js";
-import "./chunk-RSJ25QSL.js";
-import "./chunk-XIVNBFZS.js";
-import "./chunk-NEDJ26B5.js";
-import "./chunk-42FMPA75.js";
-import "./chunk-H7IXIC72.js";
-import "./chunk-7DICMOS6.js";
-import "./chunk-OQE5J4C6.js";
-import "./chunk-HHV2GANA.js";
-import "./chunk-B4OAX3SI.js";
-import "./chunk-I7ZPNEJM.js";
-import "./chunk-GYV6VZOC.js";
-import "./chunk-UL3WSD3F.js";
-import "./chunk-JDAY6FIL.js";
-import "./chunk-OZNBF4L3.js";
-import "./chunk-ECH6PKUQ.js";
-import "./chunk-6XLNIQDB.js";
-import "./chunk-5B2AEOW5.js";
-import "./chunk-VAVR4IJY.js";
-import "./chunk-JGRC33J2.js";
-import "./chunk-4BJ5BYCE.js";
-import "./chunk-K6BSR66V.js";
-import "./chunk-XPWWI35G.js";
-import "./chunk-CFGTUFWB.js";
+} from "./chunk-DRD2A54W.js";
+import "./chunk-TZ7MFRG4.js";
+import "./chunk-KF6GFW6O.js";
+import "./chunk-K2HL3GBL.js";
+import "./chunk-7HBHHVCK.js";
+import "./chunk-2GPGAE5W.js";
+import "./chunk-SL2RDHKO.js";
+import "./chunk-YGDMBK7O.js";
+import "./chunk-V552WL53.js";
+import "./chunk-RLTT5GVY.js";
+import "./chunk-KECNXMDE.js";
+import {
+  createSafetyPolicyEngine
+} from "./chunk-4SVIVOMC.js";
+import {
+  captureProjectSurface,
+  recordProjectSurfaceTrust,
+  revokeProjectSurfaceTrust
+} from "./chunk-NTK3WTHM.js";
+import "./chunk-WXA2CFJO.js";
+import "./chunk-CBSKDFWL.js";
+import "./chunk-LY4N4TTL.js";
+import "./chunk-OQM5IVJY.js";
+import "./chunk-LUL5Z66S.js";
+import "./chunk-M6TAYK66.js";
+import "./chunk-KQ6IDQIB.js";
+import "./chunk-L4N3DWNW.js";
+import "./chunk-WJIMKGD6.js";
+import "./chunk-MDU3C27C.js";
+import "./chunk-R2P2U3ZS.js";
+import "./chunk-NTTS3O53.js";
+import "./chunk-M4KFUXS7.js";
+import "./chunk-GH5ZR6JP.js";
+import "./chunk-VQD7NH7Z.js";
+import "./chunk-O3VV6IVK.js";
+import "./chunk-5ZMXGW7P.js";
+import "./chunk-B6UM3OZC.js";
+import "./chunk-MYI32N4R.js";
+import "./chunk-EHOSNVVM.js";
+import "./chunk-TEG3RYVZ.js";
+import "./chunk-MCJKEGHO.js";
 import {
   ceilChars
-} from "./chunk-NZMNUPZZ.js";
-import "./chunk-2JH2WHGE.js";
-import "./chunk-HAXOFFRH.js";
-import "./chunk-R346GLFC.js";
-import "./chunk-KXDSS5WJ.js";
-import "./chunk-GHS5EBTQ.js";
-import "./chunk-D7E7WCDF.js";
-import "./chunk-BTK3SSSK.js";
-import "./chunk-NMJXSHBJ.js";
-import "./chunk-PMZVFWSR.js";
-import "./chunk-F4EKGO4N.js";
-import "./chunk-BWH6N36D.js";
-import "./chunk-UUVG37B4.js";
-import "./chunk-LBMZMYH2.js";
-import "./chunk-XAKHZX5N.js";
-import "./chunk-33YXPOE3.js";
-import "./chunk-7CR24IG7.js";
-import "./chunk-XPLRXC72.js";
+} from "./chunk-77CZRFTE.js";
+import "./chunk-J2FYEQ5L.js";
+import "./chunk-FKIOX6DS.js";
+import "./chunk-DVNAPPXU.js";
+import "./chunk-5CY4Q6QI.js";
+import "./chunk-FQOOGXBH.js";
+import "./chunk-UHW5V7HC.js";
+import "./chunk-KMF54VH3.js";
+import "./chunk-5A6XR3RJ.js";
+import "./chunk-EFSEIZE6.js";
+import "./chunk-B5ZTR6KZ.js";
+import "./chunk-HL26ADLH.js";
+import "./chunk-VHKTOLEW.js";
+import "./chunk-KPRLAMP4.js";
+import "./chunk-W2RJEH6Q.js";
+import "./chunk-CVDAFGPW.js";
+import "./chunk-PPEZJWUG.js";
+import "./chunk-WDV62RKY.js";
+import "./chunk-GD55RTIW.js";
 import {
   resolvePackageRoot
-} from "./chunk-IWHMRKLL.js";
-import "./chunk-VW6DOEDG.js";
-import "./chunk-UXCU4E3T.js";
-import "./chunk-LL4KHSZI.js";
-import "./chunk-JSC3U7TI.js";
-import "./chunk-S66XZJOF.js";
-import "./chunk-JIEGK6UF.js";
-import "./chunk-EBY63B7G.js";
-import "./chunk-6EJMN2Y3.js";
-import "./chunk-LLDJM5XK.js";
-import "./chunk-ID64D7PE.js";
-import "./chunk-336NSSKI.js";
-import "./chunk-IKCO5N3L.js";
-import "./chunk-3I7MS7N2.js";
-import "./chunk-APJ265NV.js";
-import "./chunk-WEPFGWHJ.js";
-import "./chunk-NUGM5KR6.js";
-import "./chunk-5OIVVPHF.js";
-import "./chunk-YPC6ZR5L.js";
-import "./chunk-YXLYO42X.js";
-import "./chunk-2LEAKD4C.js";
+} from "./chunk-E3LEPLQ2.js";
+import "./chunk-ICO4TQ2F.js";
+import "./chunk-SE4ZKILO.js";
+import "./chunk-U2MSJ57E.js";
+import "./chunk-C27U2TYG.js";
+import "./chunk-GJ24ODAX.js";
+import "./chunk-LTR5QCLS.js";
+import "./chunk-6EXUUOSN.js";
+import "./chunk-ZTNFYMIO.js";
+import "./chunk-HHVJNVUJ.js";
+import "./chunk-HXHFDHB6.js";
+import "./chunk-VNBICSS2.js";
+import "./chunk-2QPI3TR3.js";
+import "./chunk-TK2BMCBZ.js";
+import "./chunk-B5GGDIHT.js";
+import "./chunk-ZZFWWYLX.js";
+import "./chunk-SRCEQKQS.js";
+import "./chunk-TN5FW4XY.js";
+import "./chunk-5CMARGPF.js";
+import "./chunk-DXVMLM3Z.js";
+import "./chunk-CKK25WN3.js";
 import {
   clioDataDir,
   clioStateDir
-} from "./chunk-BYP5D4HI.js";
+} from "./chunk-CTTI7G3T.js";
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/cli/config.ts
 init_esm_shims();
 
 // src/cli/config-inspect.ts
 init_esm_shims();
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { basename, join } from "node:path";
 function getByPath(root, dotted) {
   let current = root;
@@ -184,9 +194,9 @@ function inspectClioMd(cwd, graph) {
   if (loaded.files.length === 0) return;
   try {
     const promptContext = renderPromptContext(cwd);
-    const preload = classifyProjectPreload({ hasClioMd: promptContext.clioMd !== null, text: promptContext.text });
-    for (const [index, file] of loaded.files.entries()) {
-      const text = readFileSync(file.path, "utf8");
+    const preload = selectProjectPreload(promptContext, null).classification;
+    for (const [index, file] of promptContext.handbookSources.entries()) {
+      const text = file.source;
       graph.entries.push({
         category: "clio-md",
         id: basename(file.path),
@@ -194,15 +204,19 @@ function inspectClioMd(cwd, graph) {
         sourcePath: file.path,
         hash: shortHash(text),
         trust: "trusted",
-        precedence: loaded.files.length === 1 ? "single" : "layer",
+        precedence: promptContext.handbookSources.length === 1 ? "single" : "layer",
         reloadClass: "next-turn",
         contextCostTokens: ceilChars(text.length),
         detail: {
           layer: index + 1,
-          layers: loaded.files.length,
+          layers: promptContext.handbookSources.length,
           preload: preload.label,
           preloadChars: preload.chars,
           preloadLines: preload.lines,
+          preloadIncludedChars: preload.includedChars ?? 0,
+          preloadIncludedLines: preload.includedLines ?? 0,
+          preloadSourceIncludedChars: preload.sources?.[index]?.includedChars ?? 0,
+          preloadSourceHash: preload.sources?.[index]?.contentHash ?? "",
           ...preload.nearLimit ? { preloadNearLimit: true } : {}
         }
       });
@@ -413,6 +427,17 @@ function inspectResourceRoots(cwd, graph) {
 function inspectSafetyAndMemory(cwd, graph) {
   try {
     const layered = readLayeredSettings(cwd);
+    const metadata = createSafetyPolicyEngine({ cwd }).metadata();
+    graph.entries.push({
+      category: "safety",
+      id: "safety.policy",
+      scope: "effective",
+      reloadClass: "next-turn",
+      trust: metadata.workspaceTrustVerdict === "trusted" ? "trusted" : "untrusted",
+      precedence: "single",
+      ...metadata.projectPolicyPath === null ? {} : { sourcePath: metadata.projectPolicyPath },
+      detail: { ...metadata }
+    });
     graph.entries.push({
       category: "safety",
       id: "safety.autonomy",
@@ -456,8 +481,68 @@ function buildCustomizationGraph(cwd) {
   return graph;
 }
 
+// src/cli/config-trust.ts
+init_esm_shims();
+var SURFACES = ["safety", "hooks", "settings"];
+function runConfigTrustCommand(args, cwd = process.cwd()) {
+  const surface = args[0];
+  if (surface === void 0 || !SURFACES.includes(surface)) {
+    printError("usage: clio-coder config trust safety|hooks|settings [--json | --hash SHA256 | --revoke]");
+    return 2;
+  }
+  const rest = args.slice(1);
+  const preview = rest.length === 0 || rest.length === 1 && rest[0] === "--json";
+  const revoke = rest.length === 1 && rest[0] === "--revoke";
+  const approve = rest.length === 2 && rest[0] === "--hash" && /^[a-f0-9]{64}$/.test(rest[1] ?? "");
+  if (!preview && !revoke && !approve) {
+    printError("trust expects --json, --revoke, or --hash followed by the full reviewed SHA-256 digest");
+    return 2;
+  }
+  try {
+    if (revoke) {
+      revokeProjectSurfaceTrust(cwd, surface);
+      process.stdout.write(
+        `Project ${surface} trust revoked. Restart to reload settings and safety; project hooks stop before their next execution.
+`
+      );
+      return 0;
+    }
+    const snapshot = captureProjectSurface(cwd, surface);
+    if (preview) {
+      process.stdout.write(`${JSON.stringify(snapshot, null, 2)}
+`);
+      if (rest[0] !== "--json" && snapshot.contentHash !== null && snapshot.files.some((file) => file.text !== null)) {
+        process.stdout.write(
+          `Review the captured files above. Approve exactly these bytes with:
+clio-coder config trust ${surface} --hash ${snapshot.contentHash}
+`
+        );
+      }
+      return 0;
+    }
+    if (snapshot.contentHash === null || !snapshot.files.some((file) => file.text !== null)) {
+      printError(`no readable project ${surface} files to approve`);
+      return 1;
+    }
+    if (snapshot.contentHash !== rest[1]) {
+      printError(`project ${surface} changed since review; inspect it again before approving`);
+      return 1;
+    }
+    recordProjectSurfaceTrust(snapshot.workspaceRoot, surface, snapshot.contentHash);
+    process.stdout.write(
+      `Project ${surface} approved for ${snapshot.workspaceRoot} at ${snapshot.contentHash}. Restart to reload settings and safety; reload extensions to register newly approved hooks.
+`
+    );
+    return 0;
+  } catch (error) {
+    printError(error instanceof Error ? error.message : String(error));
+    return 1;
+  }
+}
+
 // src/cli/config.ts
 var HELP = `clio-coder config inspect [--json]
+clio-coder config trust safety|hooks|settings [--json | --hash SHA256 | --revoke]
 
 Print the effective-customization graph: what settings, context files, rules,
 skills, prompts, agents, fleets, extensions, safety, memory, hooks, and the operator
@@ -466,6 +551,10 @@ context cost. Read-only; nothing is created.
 
 This is the "why is Clio behaving this way" surface. Parse the --json form in
 scripts instead of the table.
+
+Trust previews show the captured project files and their digest. Approve only
+the reviewed digest with --hash, or remove a surface's approval with --revoke.
+Settings and safety reload on restart; project hooks also check trust before execution.
 `;
 function renderText(cwd) {
   const graph = buildCustomizationGraph(cwd);
@@ -490,6 +579,7 @@ function renderText(cwd) {
       const precedence = entry.precedence ? `, ${entry.precedence}` : "";
       out.push(`  ${entry.id}  [${entry.scope}${precedence}, reload:${entry.reloadClass}${hash}${cost}]`);
       if (entry.sourcePath) out.push(`    from ${entry.sourcePath}`);
+      if (entry.id === "safety.policy" && entry.detail !== void 0) out.push(`    ${JSON.stringify(entry.detail)}`);
     }
     out.push("");
   }
@@ -508,6 +598,7 @@ function runConfigCommand(args = []) {
   }
   const positional = args.filter((arg) => !arg.startsWith("-"));
   const sub = positional[0] ?? "inspect";
+  if (sub === "trust") return runConfigTrustCommand(args.slice(1));
   if (sub !== "inspect") {
     printError(`unknown config subcommand: ${sub}`);
     process.stderr.write(HELP);
@@ -526,4 +617,4 @@ function runConfigCommand(args = []) {
 export {
   runConfigCommand
 };
-//# sourceMappingURL=config-SVM5P5YI.js.map
+//# sourceMappingURL=config-Y2JDJ3JJ.js.map

package/dist/configure-SML6UBZ5.js

@@ -0,0 +1,55 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  runConfigureCommand,
+  runTargetRemove,
+  runTargetRename
+} from "./chunk-KYKNBD4Y.js";
+import "./chunk-QEQISF75.js";
+import "./chunk-6YA46L5A.js";
+import "./chunk-MC3JSVR6.js";
+import "./chunk-6SYEGZI3.js";
+import "./chunk-T53XI6I7.js";
+import "./chunk-ZIDFQJRB.js";
+import "./chunk-5VTJP36Q.js";
+import "./chunk-3T4DXWP6.js";
+import "./chunk-TEG3RYVZ.js";
+import "./chunk-MCJKEGHO.js";
+import "./chunk-77CZRFTE.js";
+import "./chunk-J2FYEQ5L.js";
+import "./chunk-FKIOX6DS.js";
+import "./chunk-DVNAPPXU.js";
+import "./chunk-5CY4Q6QI.js";
+import "./chunk-FQOOGXBH.js";
+import "./chunk-UHW5V7HC.js";
+import "./chunk-KMF54VH3.js";
+import "./chunk-B5ZTR6KZ.js";
+import "./chunk-HL26ADLH.js";
+import "./chunk-GD55RTIW.js";
+import "./chunk-E3LEPLQ2.js";
+import "./chunk-ICO4TQ2F.js";
+import "./chunk-SE4ZKILO.js";
+import "./chunk-U2MSJ57E.js";
+import "./chunk-C27U2TYG.js";
+import "./chunk-GJ24ODAX.js";
+import "./chunk-LTR5QCLS.js";
+import "./chunk-6EXUUOSN.js";
+import "./chunk-ZTNFYMIO.js";
+import "./chunk-HHVJNVUJ.js";
+import "./chunk-HXHFDHB6.js";
+import "./chunk-VNBICSS2.js";
+import "./chunk-2QPI3TR3.js";
+import "./chunk-TK2BMCBZ.js";
+import "./chunk-B5GGDIHT.js";
+import "./chunk-ZZFWWYLX.js";
+import "./chunk-SRCEQKQS.js";
+import "./chunk-TN5FW4XY.js";
+import "./chunk-5CMARGPF.js";
+import "./chunk-DXVMLM3Z.js";
+import "./chunk-CTTI7G3T.js";
+import "./chunk-ECBHH7LU.js";
+export {
+  runConfigureCommand,
+  runTargetRemove,
+  runTargetRename
+};
+//# sourceMappingURL=configure-SML6UBZ5.js.map