@iowarp/clio-coder 0.4.4 → 0.4.6

package/dist/{chunk-6QOTUPRG.js → chunk-I2K2NCZQ.js}

@@ -4,20 +4,25 @@ import {
   extractCommandDeleteTargets,
   extractCommandWriteTargets,
   toolMutationPaths
-} from "./chunk-NXYCB2VD.js";
+} from "./chunk-M6TAYK66.js";
 import {
   PROJECT_VERIFIER_CATALOG_RELATIVE_PATH
-} from "./chunk-DXKJURES.js";
+} from "./chunk-PZN2LQY6.js";
+import {
+  asDirectoryPathBoundary,
+  pathBoundaryEntryCovers,
+  resolvePathBoundary
+} from "./chunk-R2P2U3ZS.js";
 import {
   isProjectVerifierCheckId,
   isVerificationScriptName
-} from "./chunk-UL3WSD3F.js";
+} from "./chunk-M4KFUXS7.js";
 import {
   ToolNames
-} from "./chunk-4NSRCOYP.js";
+} from "./chunk-EHOSNVVM.js";
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/domains/safety/finish-contract.ts
 init_esm_shims();
@@ -134,7 +139,7 @@ function mutatingReceipts(recent) {
   for (const entry of recent) {
     const bashMutation = bashExecutionMutationPaths(entry);
     if (bashMutation !== null) {
-      for (const path of bashMutation) pushPath(paths, seen, path);
+      for (const path2 of bashMutation) pushPath(paths, seen, path2);
       continue;
     }
     const call = mutatingToolCall(entry);
@@ -146,7 +151,7 @@ function mutatingReceipts(recent) {
     if (resultId !== null) {
       const candidate = mutationCalls.get(resultId);
       if (candidate !== void 0) {
-        for (const path of candidate.paths) pushPath(paths, seen, path);
+        for (const path2 of candidate.paths) pushPath(paths, seen, path2);
       }
     }
   }
@@ -181,10 +186,10 @@ function bashExecutionMutationPaths(entry) {
   if (record.cancelled === true || record.exitCode !== 0) return null;
   return [...extractCommandWriteTargets(record.command), ...extractCommandDeleteTargets(record.command)];
 }
-function pushPath(paths, seen, path) {
-  if (path.length === 0 || seen.has(path)) return;
-  seen.add(path);
-  paths.push(path);
+function pushPath(paths, seen, path2) {
+  if (path2.length === 0 || seen.has(path2)) return;
+  seen.add(path2);
+  paths.push(path2);
 }
 function collectValidationEvidence(recent, acceptanceChecks, workspaceRoot) {
   const evidence = [];
@@ -328,8 +333,8 @@ function typedValidationSummary(toolName, payload) {
   if (toolName === "verify") {
     const check = typeof args?.check === "string" ? args.check.trim() : "";
     if (check === "frontend") {
-      const path = typeof args?.path === "string" && args.path.trim().length > 0 ? args.path.trim() : "artifact";
-      return `verify frontend ${path}`;
+      const path2 = typeof args?.path === "string" && args.path.trim().length > 0 ? args.path.trim() : "artifact";
+      return `verify frontend ${path2}`;
     }
     if (isVerificationScriptName(check)) return `npm run ${check}`;
     if (isProjectVerifierCheckId(check)) return `verify ${check}`;
@@ -414,11 +419,11 @@ function protectedArtifactEvidence(entry) {
   const record = asRecord(entry);
   if (record?.kind !== "protectedArtifact" || record.action !== "protect") return null;
   const artifact = asRecord(record.artifact);
-  const path = typeof artifact?.path === "string" && artifact.path.trim().length > 0 ? artifact.path.trim() : null;
-  if (path === null) return null;
+  const path2 = typeof artifact?.path === "string" && artifact.path.trim().length > 0 ? artifact.path.trim() : null;
+  if (path2 === null) return null;
   const evidence = {
     kind: "protected_artifact",
-    summary: `protected artifact recorded: ${path}`
+    summary: `protected artifact recorded: ${path2}`
   };
   const turnId = turnIdOf(entry);
   if (turnId !== null) evidence.turnId = turnId;
@@ -599,13 +604,56 @@ function observe(state, key, now) {
   return [newState, { looping, key, count }];
 }
 
+// src/domains/safety/scope.ts
+init_esm_shims();
+import path from "node:path";
+function normalizeRoot(root) {
+  return resolvePathBoundary(process.cwd(), root);
+}
+function isSubset(worker, orchestrator) {
+  for (const action of worker.allowedActions) {
+    if (!orchestrator.allowedActions.has(action)) return false;
+  }
+  for (const root of worker.allowedWriteRoots) {
+    const covered = orchestrator.allowedWriteRoots.some(
+      (outer) => pathBoundaryEntryCovers(normalizeRoot(outer), normalizeRoot(root))
+    );
+    if (!covered) return false;
+  }
+  if (worker.allowNetwork && !orchestrator.allowNetwork) return false;
+  if (worker.allowDispatch && !orchestrator.allowDispatch) return false;
+  return true;
+}
+var READONLY_SCOPE = {
+  allowedActions: /* @__PURE__ */ new Set(["read"]),
+  allowedWriteRoots: [],
+  allowNetwork: true,
+  allowDispatch: false
+};
+var WORKSPACE_SCOPE = {
+  allowedActions: /* @__PURE__ */ new Set(["read", "write", "execute", "dispatch"]),
+  allowedWriteRoots: [asDirectoryPathBoundary(path.resolve(process.cwd()))],
+  allowNetwork: true,
+  allowDispatch: true
+};
+var CONFIRMED_SCOPE = {
+  allowedActions: /* @__PURE__ */ new Set(["read", "write", "execute", "dispatch", "system_modify"]),
+  allowedWriteRoots: [asDirectoryPathBoundary(path.resolve(process.cwd()))],
+  allowNetwork: true,
+  allowDispatch: true
+};
+
 export {
   createLoopState,
   hashToolCall,
   observe,
+  isSubset,
+  READONLY_SCOPE,
+  WORKSPACE_SCOPE,
+  CONFIRMED_SCOPE,
   DEFAULT_RECENT_ENTRY_LIMIT,
   assessFinishContract,
   recentEntries,
   typedValidationSummary
 };
-//# sourceMappingURL=chunk-6QOTUPRG.js.map
+//# sourceMappingURL=chunk-I2K2NCZQ.js.map

package/dist/{chunk-SZAA6XDG.js → chunk-IFDRAD6F.js}

@@ -1,7 +1,7 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/entry/extension-hook-sources.ts
 init_esm_shims();
@@ -27,4 +27,4 @@ function capturedHookSourcesFor(snapshot) {
 export {
   capturedHookSourcesFor
 };
-//# sourceMappingURL=chunk-SZAA6XDG.js.map
+//# sourceMappingURL=chunk-IFDRAD6F.js.map

package/dist/{chunk-I2DWJ4GM.js → chunk-IGLVVNEG.js}

@@ -1,13 +1,16 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  resultContractOutputBytes
+} from "./chunk-OQM5IVJY.js";
 import {
   decisionRef
-} from "./chunk-54X7T7DK.js";
+} from "./chunk-KAFMW7WM.js";
 import {
   truncateUtf8
-} from "./chunk-6XLNIQDB.js";
+} from "./chunk-MYI32N4R.js";
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/domains/dispatch/event-pump.ts
 init_esm_shims();
@@ -89,6 +92,9 @@ function startDispatchEventPump(source, fold, options = {}) {
 }
 var WORKER_OUTPUT_MAX_BYTES = 8192;
 var WORKER_OUTPUT_TRUNCATION_MARKER = "\n[worker output truncated]";
+function workerOutputCaptureBytes(contract) {
+  return Math.max(WORKER_OUTPUT_MAX_BYTES, resultContractOutputBytes(contract) ?? 0);
+}
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -114,12 +120,13 @@ function durableAssistantTextFromEvent(event) {
   if (event.message.role !== "assistant" || !isDurableAssistantMessage(event.message)) return "";
   return assistantTextFromContent(event.message.content);
 }
-function boundedOutput(state, text) {
+function boundedOutput(state, text, maxBytes) {
   const bytes = Buffer.byteLength(text, "utf8");
-  const bounded = truncateUtf8(text, WORKER_OUTPUT_MAX_BYTES, WORKER_OUTPUT_TRUNCATION_MARKER);
+  const bounded = truncateUtf8(text, maxBytes, WORKER_OUTPUT_TRUNCATION_MARKER);
   return { state, text: bounded, bytes, truncated: bounded !== text };
 }
-function createWorkerOutputCapture() {
+function createWorkerOutputCapture(options = {}) {
+  const maxBytes = Math.max(WORKER_OUTPUT_MAX_BYTES, Math.floor(options.maxBytes ?? WORKER_OUTPUT_MAX_BYTES));
   let finalText = null;
   let partialText = "";
   let partialBytes = 0;
@@ -144,14 +151,14 @@ function createWorkerOutputCapture() {
       const delta = assistantEvent.delta;
       if (typeof delta !== "string" || delta.length === 0) return;
       partialBytes += Buffer.byteLength(delta, "utf8");
-      if (partialStored < WORKER_OUTPUT_MAX_BYTES) {
+      if (partialStored < maxBytes) {
         partialText += delta;
         partialStored += Buffer.byteLength(delta, "utf8");
       }
     },
     snapshot() {
       if (partialBytes > 0 && partialText.trim().length > 0) {
-        const bounded = truncateUtf8(partialText.trim(), WORKER_OUTPUT_MAX_BYTES, WORKER_OUTPUT_TRUNCATION_MARKER);
+        const bounded = truncateUtf8(partialText.trim(), maxBytes, WORKER_OUTPUT_TRUNCATION_MARKER);
         return {
           state: "partial",
           text: bounded,
@@ -159,7 +166,7 @@ function createWorkerOutputCapture() {
           truncated: bounded !== partialText.trim() || partialBytes > partialStored
         };
       }
-      if (finalText !== null) return boundedOutput("final", finalText);
+      if (finalText !== null) return boundedOutput("final", finalText, maxBytes);
       return void 0;
     }
   };
@@ -272,6 +279,40 @@ function createDecisionBoardStore(deps = {}) {
     deps.appendEntry(entry);
     dirty = true;
   };
+  const revise = (interviewId, key, revisionSource, correction) => {
+    syncToSession();
+    const interview = interviews.find((candidate) => candidate.interviewId === interviewId);
+    if (!interview) throw new Error(`decision board: interview ${interviewId} was not found on the active branch`);
+    const selected = interview.decisions.find((decision) => decision.key === key);
+    if (!selected) throw new Error(`decision board: decision ${key} was not found in interview ${interviewId}`);
+    const revisedAt = (deps.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
+    const normalizedCorrection = correction?.trim();
+    const entries = deps.readEntries?.() ?? [];
+    const parentTurnId = deps.getActiveLeafTurnId?.() ?? activeLeafFromEntries(entries);
+    if (!parentTurnId) throw new Error("decision board: no active branch leaf is available for the revision");
+    const revision = {
+      kind: "decisionLedger",
+      parentTurnId,
+      ...interview.origin !== void 0 ? { origin: interview.origin } : {},
+      interviewId: interview.interviewId,
+      interviewStatus: interview.interviewStatus,
+      startedAt: interview.startedAt,
+      endedAt: interview.endedAt,
+      roundCount: interview.roundCount,
+      ...interview.summary ? { summary: interview.summary } : {},
+      ...interview.transcriptPath ? { transcriptPath: interview.transcriptPath } : {},
+      ...interview.exposure ? { exposure: interview.exposure } : {},
+      decisions: interview.decisions.map((decision) => {
+        if (decision.key !== selected.key) return { ...decision };
+        const next = { ...decision, status: "superseded", revisedAt, revisionSource };
+        if (normalizedCorrection) next.correction = normalizedCorrection;
+        else delete next.correction;
+        return next;
+      })
+    };
+    append(revision);
+    return revision;
+  };
   const store = {
     snapshot() {
       syncToSession();
@@ -297,7 +338,7 @@ function createDecisionBoardStore(deps = {}) {
         superseded = { interviewId: interview.interviewId, key: prior.key };
         break;
       }
-      if (superseded !== null) store.supersede(superseded.interviewId, superseded.key, input.rationale);
+      if (superseded !== null) revise(superseded.interviewId, superseded.key, "agent", input.rationale);
       const now = (deps.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
       const entries = deps.readEntries?.() ?? [];
       const parentTurnId = deps.getActiveLeafTurnId?.() ?? activeLeafFromEntries(entries);
@@ -329,37 +370,7 @@ function createDecisionBoardStore(deps = {}) {
       return { entry, superseded };
     },
     supersede(interviewId, key, correction) {
-      syncToSession();
-      const interview = interviews.find((candidate) => candidate.interviewId === interviewId);
-      if (!interview) throw new Error(`decision board: interview ${interviewId} was not found on the active branch`);
-      const selected = interview.decisions.find((decision) => decision.key === key);
-      if (!selected) throw new Error(`decision board: decision ${key} was not found in interview ${interviewId}`);
-      const revisedAt = (deps.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
-      const normalizedCorrection = correction?.trim();
-      const entries = deps.readEntries?.() ?? [];
-      const parentTurnId = deps.getActiveLeafTurnId?.() ?? activeLeafFromEntries(entries);
-      if (!parentTurnId) throw new Error("decision board: no active branch leaf is available for the revision");
-      const revision = {
-        kind: "decisionLedger",
-        parentTurnId,
-        interviewId: interview.interviewId,
-        interviewStatus: interview.interviewStatus,
-        startedAt: interview.startedAt,
-        endedAt: interview.endedAt,
-        roundCount: interview.roundCount,
-        ...interview.summary ? { summary: interview.summary } : {},
-        ...interview.transcriptPath ? { transcriptPath: interview.transcriptPath } : {},
-        ...interview.exposure ? { exposure: interview.exposure } : {},
-        decisions: interview.decisions.map((decision) => {
-          if (decision.key !== selected.key) return { ...decision };
-          const next = { ...decision, status: "superseded", revisedAt };
-          if (normalizedCorrection) next.correction = normalizedCorrection;
-          else delete next.correction;
-          return next;
-        })
-      };
-      append(revision);
-      return revision;
+      return revise(interviewId, key, "operator", correction);
     },
     invalidate() {
       dirty = true;
@@ -379,6 +390,7 @@ export {
   EVENT_TEE_LIMIT,
   startDispatchEventPump,
   WORKER_OUTPUT_MAX_BYTES,
+  workerOutputCaptureBytes,
   durableAssistantTextFromEvent,
   createWorkerOutputCapture,
   AdmissionCanceledError,
@@ -387,4 +399,4 @@ export {
   createDecisionBoardStore,
   decisionRationale
 };
-//# sourceMappingURL=chunk-I2DWJ4GM.js.map
+//# sourceMappingURL=chunk-IGLVVNEG.js.map