@iowarp/clio-coder 0.4.6 → 0.4.8

package/dist/chunk-RAUOKUZV.js

@@ -0,0 +1,1572 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  projectSurfaceTrust,
+  safetySurfaceTrustHash,
+  workspaceTrustDirectory
+} from "./chunk-X6FLVUM5.js";
+import {
+  loadProjectVerifierCatalog
+} from "./chunk-5C2OQHLR.js";
+import {
+  foreignAgentDirs
+} from "./chunk-5EQO5NWP.js";
+import {
+  classify
+} from "./chunk-YXFKLMX2.js";
+import {
+  extractCommandCdTargets,
+  extractCommandDeleteTargets,
+  extractCommandWriteTargets,
+  inlineShellScript,
+  invokesClioSkillMutation,
+  scanShellLike
+} from "./chunk-E2NSPYLC.js";
+import {
+  pathBoundaryCovers,
+  resolvePathBoundary
+} from "./chunk-R2P2U3ZS.js";
+import {
+  artifactDefaultPath
+} from "./chunk-NTTS3O53.js";
+import {
+  canonicalizeExistingPath
+} from "./chunk-KQ6IDQIB.js";
+import {
+  ToolNames
+} from "./chunk-WLHX3MM5.js";
+import {
+  require_dist
+} from "./chunk-B5GGDIHT.js";
+import {
+  clioConfigDir
+} from "./chunk-CTTI7G3T.js";
+import {
+  resolvePackageRoot
+} from "./chunk-E3LEPLQ2.js";
+import {
+  __toESM,
+  init_esm_shims
+} from "./chunk-ECBHH7LU.js";
+
+// src/domains/safety/path-policy.ts
+init_esm_shims();
+import { homedir } from "node:os";
+import path from "node:path";
+var ORDERED_KINDS = ["zeroAccessPaths", "readOnlyPaths", "noWritePaths", "noDeletePaths"];
+function isSameOrDescendant(candidatePath, policyPath) {
+  const candidate = path.resolve(candidatePath);
+  const policy = path.resolve(policyPath);
+  const relative = path.relative(policy, candidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+function expandTilde(rawPath) {
+  if (rawPath === "~") return homedir();
+  if (rawPath.startsWith("~/")) return path.join(homedir(), rawPath.slice(2));
+  return rawPath;
+}
+function normalizePolicyEntry(rawPath, root) {
+  const expanded = expandTilde(rawPath.trim());
+  const resolved = path.isAbsolute(expanded) ? path.resolve(expanded) : path.resolve(root, expanded);
+  return canonicalizeExistingPath(resolved);
+}
+function blocksOperation(kind, operation) {
+  if (kind === "zeroAccessPaths") return true;
+  if (kind === "readOnlyPaths" || kind === "noWritePaths") return operation === "write" || operation === "delete";
+  return operation === "delete";
+}
+function compilePathPolicy(input, root = process.cwd()) {
+  const resolvedRoot = canonicalizeExistingPath(path.resolve(root));
+  const entries = [];
+  const diagnostics = [];
+  for (const kind of ORDERED_KINDS) {
+    for (const rawPath of input[kind] ?? []) {
+      const trimmed = rawPath.trim();
+      if (trimmed.length === 0) {
+        diagnostics.push(`${kind}: path must not be empty`);
+        continue;
+      }
+      const entry = { kind, path: normalizePolicyEntry(trimmed, resolvedRoot), source: trimmed };
+      const pattern = compilePathPattern(trimmed, resolvedRoot);
+      if (pattern !== null) entry.pattern = pattern;
+      entries.push(entry);
+    }
+  }
+  return {
+    root: resolvedRoot,
+    entries: entries.sort((a, b) => a.kind.localeCompare(b.kind) || a.path.localeCompare(b.path)),
+    diagnostics
+  };
+}
+function evaluatePathPolicy(policy, operation, targetPath, cwd = policy.root) {
+  const expanded = expandTilde(targetPath);
+  const lexicalTarget = path.isAbsolute(expanded) ? path.resolve(expanded) : path.resolve(cwd, expanded);
+  const resolvedTarget = canonicalizeExistingPath(lexicalTarget);
+  const normalizedResolvedTarget = normalizeSeparators(resolvedTarget);
+  const normalizedRelativeTarget = normalizeSeparators(path.relative(policy.root, resolvedTarget));
+  const normalizedRawTarget = normalizeSeparators(targetPath);
+  for (const entry of policy.entries) {
+    if (!blocksOperation(entry.kind, operation)) continue;
+    if (!matchesEntry(entry, resolvedTarget, normalizedResolvedTarget, normalizedRelativeTarget, normalizedRawTarget))
+      continue;
+    return {
+      kind: "block",
+      reasonCode: `path-policy:${entry.kind}`,
+      reason: `${operation} denied by ${entry.kind} entry ${entry.source}`,
+      matchedPath: entry.path,
+      policyKind: entry.kind
+    };
+  }
+  return { kind: "allow" };
+}
+function matchesEntry(entry, resolvedTarget, normalizedResolvedTarget, normalizedRelativeTarget, normalizedRawTarget) {
+  if (isSameOrDescendant(resolvedTarget, entry.path)) return true;
+  if (entry.pattern === void 0) return false;
+  return entry.pattern.test(normalizedResolvedTarget) || entry.pattern.test(normalizedRelativeTarget) || entry.pattern.test(normalizedRawTarget);
+}
+function compilePathPattern(rawPath, root) {
+  if (!rawPath.includes("*")) return null;
+  const expanded = expandTilde(rawPath.trim());
+  const source = path.isAbsolute(expanded) ? expanded : path.join(root, expanded);
+  const normalized = normalizeSeparators(canonicalizePatternSource(source));
+  const relative = normalizeSeparators(path.isAbsolute(expanded) ? expanded : expanded);
+  const absolutePattern = segmentPattern(normalized);
+  const relativePattern = segmentPattern(relative);
+  return new RegExp(`(?:${absolutePattern})|(?:${relativePattern})`);
+}
+function canonicalizePatternSource(patternPath) {
+  const wildcardIndex = patternPath.indexOf("*");
+  if (wildcardIndex === -1) return canonicalizeExistingPath(patternPath);
+  const fixedPrefix = patternPath.slice(0, wildcardIndex);
+  const separatorIndex = fixedPrefix.lastIndexOf(path.sep);
+  if (separatorIndex === -1) return patternPath;
+  const prefix = patternPath.slice(0, separatorIndex + 1);
+  const suffix = patternPath.slice(separatorIndex + 1);
+  return path.join(canonicalizeExistingPath(prefix), suffix);
+}
+function segmentPattern(rawPath) {
+  const escaped = rawPath.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("[^/]*");
+  return `(?:^|/)${escaped}(?:$|/)`;
+}
+function normalizeSeparators(value) {
+  return value.split(path.sep).join("/");
+}
+
+// src/domains/safety/policy-engine.ts
+init_esm_shims();
+import { createHash as createHash2 } from "node:crypto";
+import { readFileSync as readFileSync3 } from "node:fs";
+import path4 from "node:path";
+
+// src/domains/safety/default-path-policy.ts
+init_esm_shims();
+var DEFAULT_DAMAGE_CONTROL_PATH_POLICY = {
+  zeroAccessPaths: [
+    ".env",
+    ".env.local",
+    ".env.development",
+    ".env.production",
+    ".env.staging",
+    ".env.test",
+    ".env.*.local",
+    "*.env",
+    "~/.ssh/",
+    "~/.gnupg/",
+    "~/.aws/",
+    "~/.config/gcloud/",
+    "*-credentials.json",
+    "*serviceAccount*.json",
+    "*service-account*.json",
+    "~/.azure/",
+    "~/.kube/",
+    "kubeconfig",
+    "*-secret.yaml",
+    "secrets.yaml",
+    "~/.docker/",
+    "*.pem",
+    "*.key",
+    "*.p12",
+    "*.pfx",
+    "*.tfstate",
+    "*.tfstate.backup",
+    ".terraform/",
+    ".vercel/",
+    ".netlify/",
+    "firebase-adminsdk*.json",
+    "serviceAccountKey.json",
+    ".supabase/",
+    "~/.netrc",
+    "~/.npmrc",
+    "~/.pypirc",
+    "~/.git-credentials",
+    ".git-credentials",
+    // Remote URLs in the repo git config can embed access tokens, and .git
+    // is hidden from grep/find but not from direct reads without this entry.
+    ".git/config",
+    // Clio's own provider secret store. The literal covers a repo-level file
+    // of the same name on purpose; the expanded clioConfigDir() form is
+    // appended at policy construction (policy-engine.ts), since this static
+    // list cannot call config helpers.
+    "credentials.yaml",
+    "dump.sql",
+    "backup.sql",
+    "*.dump"
+  ],
+  readOnlyPaths: [
+    // Clio's own operator-authority files in the project. `safety.yaml` is the
+    // policy that gates the model's tools, and `verifiers.yaml` is an argv
+    // catalog that verify() executes; a model that can author either one can
+    // widen its own permissions in two tool calls. Both are authored by the
+    // operator through the CLI (`clio-coder verifiers author` lands nothing
+    // before `--yes`), so model-side writes and deletes are refused.
+    // Skills also refuse model-side writes and deletes; installs go through `clio-coder library install`.
+    ".clio-coder/safety.yaml",
+    ".clio-coder/verifiers.yaml",
+    ".clio-coder/skills/",
+    ".clio-coder/plugins/",
+    ".clio-coder/extensions/",
+    "/etc/",
+    "/usr/",
+    "/bin/",
+    "/sbin/",
+    "/boot/",
+    "/root/",
+    "~/.bash_history",
+    "~/.zsh_history",
+    "~/.node_repl_history",
+    "~/.bashrc",
+    "~/.zshrc",
+    "~/.profile",
+    "~/.bash_profile",
+    "*.min.js",
+    "*.min.css",
+    "*.bundle.js",
+    "*.chunk.js",
+    "dist/",
+    "build/",
+    ".next/",
+    ".nuxt/",
+    ".output/",
+    "node_modules/",
+    "__pycache__/",
+    ".venv/",
+    "venv/",
+    "target/"
+  ],
+  // Another agent's own configuration. Clio reads these roots for skills,
+  // prompts, and rule prose and has no reason to author them, so the guard is
+  // on writes and not only on deletes.
+  noWritePaths: [...foreignAgentDirs()],
+  noDeletePaths: [
+    "~/.claude/",
+    "CLAUDE.md",
+    "LICENSE",
+    "LICENSE.*",
+    "COPYING",
+    "COPYING.*",
+    "NOTICE",
+    "PATENTS",
+    "README.md",
+    "README.*"
+  ]
+};
+function mergePathPolicyInputs(base, override) {
+  return {
+    zeroAccessPaths: [...base.zeroAccessPaths ?? [], ...override.zeroAccessPaths ?? []],
+    readOnlyPaths: [...base.readOnlyPaths ?? [], ...override.readOnlyPaths ?? []],
+    noWritePaths: [...base.noWritePaths ?? [], ...override.noWritePaths ?? []],
+    noDeletePaths: [...base.noDeletePaths ?? [], ...override.noDeletePaths ?? []]
+  };
+}
+var OPERATOR_PATH_POLICY = {
+  zeroAccessPaths: DEFAULT_DAMAGE_CONTROL_PATH_POLICY.zeroAccessPaths?.filter((entry) => entry.startsWith("~/")) ?? [],
+  readOnlyPaths: DEFAULT_DAMAGE_CONTROL_PATH_POLICY.readOnlyPaths?.filter(
+    (entry) => entry.startsWith("~/") || entry.startsWith("/") || entry.startsWith(".clio-coder/")
+  ) ?? [],
+  noWritePaths: DEFAULT_DAMAGE_CONTROL_PATH_POLICY.noWritePaths ?? [],
+  noDeletePaths: DEFAULT_DAMAGE_CONTROL_PATH_POLICY.noDeletePaths?.filter((entry) => entry.startsWith("~/")) ?? []
+};
+
+// src/domains/safety/project-policy.ts
+init_esm_shims();
+var import_yaml = __toESM(require_dist(), 1);
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import path2 from "node:path";
+var POLICY_RELATIVE_PATH = path2.join(".clio-coder", "safety.yaml");
+var ACTION_CLASSES = /* @__PURE__ */ new Set([
+  "read",
+  "write",
+  "execute",
+  "dispatch",
+  "system_modify",
+  "git_destructive",
+  "unknown"
+]);
+var PATH_POLICY_KEYS = ["zeroAccessPaths", "readOnlyPaths", "noWritePaths", "noDeletePaths"];
+var ROOT_KEYS = /* @__PURE__ */ new Set(["version", "commands", "tasks", "disableDefaultPathPolicy", ...PATH_POLICY_KEYS]);
+var COMMAND_KEYS = /* @__PURE__ */ new Set([
+  "id",
+  "command",
+  "cwd",
+  "timeoutMs",
+  "maxOutputBytes",
+  "actionClass",
+  "shellOperators",
+  "env",
+  "requireConfirmation",
+  "rationale",
+  "owner",
+  "comment"
+]);
+var ENV_KEYS = /* @__PURE__ */ new Set(["mode", "allow"]);
+var ID_RE = /^[a-zA-Z0-9][a-zA-Z0-9_.:-]*$/;
+function projectSafetyPolicyPath(cwd = process.cwd()) {
+  let cursor = path2.resolve(cwd);
+  while (true) {
+    const candidate = path2.join(cursor, POLICY_RELATIVE_PATH);
+    if (existsSync(candidate)) return candidate;
+    const parent = path2.dirname(cursor);
+    if (parent === cursor) return null;
+    cursor = parent;
+  }
+}
+function loadProjectSafetyPolicy(cwd = process.cwd()) {
+  let policyPath = projectSafetyPolicyPath(cwd);
+  if (policyPath === null) {
+    return {
+      path: null,
+      hash: null,
+      valid: true,
+      errors: [],
+      commands: [],
+      pathPolicy: {},
+      disableDefaultPathPolicy: false
+    };
+  }
+  let raw;
+  try {
+    policyPath = realpathSync(policyPath);
+    raw = readFileSync(policyPath, "utf8");
+  } catch (err) {
+    return {
+      path: policyPath,
+      hash: null,
+      valid: false,
+      errors: [`cannot read project safety policy: ${err instanceof Error ? err.message : String(err)}`],
+      commands: [],
+      pathPolicy: {},
+      disableDefaultPathPolicy: false
+    };
+  }
+  const hash = sha256(raw);
+  try {
+    const parsed = (0, import_yaml.parse)(raw);
+    return validateProjectSafetyPolicy(parsed, policyPath, hash);
+  } catch (err) {
+    return {
+      path: policyPath,
+      hash,
+      valid: false,
+      errors: [`cannot parse project safety policy: ${err instanceof Error ? err.message : String(err)}`],
+      commands: [],
+      pathPolicy: {},
+      disableDefaultPathPolicy: false
+    };
+  }
+}
+function validateProjectSafetyPolicy(value, policyPath, hash) {
+  const errors = [];
+  const commands = [];
+  if (!isPlainRecord(value)) {
+    return {
+      path: policyPath,
+      hash,
+      valid: false,
+      errors: ["policy root must be a mapping"],
+      commands: [],
+      pathPolicy: {},
+      disableDefaultPathPolicy: false
+    };
+  }
+  for (const key of Object.keys(value)) {
+    if (!ROOT_KEYS.has(key)) errors.push(`unknown root key '${key}'`);
+  }
+  if (value.version !== 1) errors.push("version must be 1");
+  appendCommandPolicies(commands, errors, value.commands, "commands");
+  appendCommandPolicies(commands, errors, value.tasks, "tasks");
+  const pathPolicy = parsePathPolicy(value, errors);
+  const disableDefaultPathPolicy = value.disableDefaultPathPolicy === void 0 ? false : booleanField(value, "disableDefaultPathPolicy", "policy", errors);
+  const ids = /* @__PURE__ */ new Set();
+  for (const command of commands) {
+    if (ids.has(command.id)) errors.push(`duplicate command id '${command.id}'`);
+    ids.add(command.id);
+  }
+  return {
+    path: policyPath,
+    hash,
+    valid: errors.length === 0,
+    errors,
+    commands: errors.length === 0 ? commands : [],
+    pathPolicy: errors.length === 0 ? pathPolicy : {},
+    disableDefaultPathPolicy: errors.length === 0 ? disableDefaultPathPolicy : false
+  };
+}
+function parsePathPolicy(value, errors) {
+  const out = {};
+  for (const key of PATH_POLICY_KEYS) {
+    const parsed = parsePathList(value[key], key, errors);
+    if (parsed !== void 0) out[key] = parsed;
+  }
+  return out;
+}
+function parsePathList(value, key, errors) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) {
+    errors.push(`${key} must be an array`);
+    return void 0;
+  }
+  const out = [];
+  for (let index = 0; index < value.length; index += 1) {
+    const item = value[index];
+    const label = `${key}[${index}]`;
+    if (typeof item !== "string" || item.trim().length === 0) {
+      errors.push(`${label} must be a non-empty string`);
+      continue;
+    }
+    const trimmed = item.trim();
+    if (path2.isAbsolute(trimmed)) {
+      errors.push(`${label} must be relative to the policy root`);
+      continue;
+    }
+    const normalized = path2.normalize(trimmed);
+    const segments = normalized.split(path2.sep).filter((segment) => segment.length > 0);
+    if (segments.some((segment) => segment === "..")) {
+      errors.push(`${label} must not escape the policy root with '..'`);
+      continue;
+    }
+    out.push(trimmed);
+  }
+  return out;
+}
+function appendCommandPolicies(out, errors, value, field) {
+  if (value === void 0) return;
+  if (!Array.isArray(value)) {
+    errors.push(`${field} must be an array`);
+    return;
+  }
+  for (let index = 0; index < value.length; index += 1) {
+    const parsed = parseCommandPolicy(value[index], `${field}[${index}]`);
+    if (parsed.errors.length > 0) {
+      errors.push(...parsed.errors);
+      continue;
+    }
+    if (parsed.command !== void 0) out.push(parsed.command);
+  }
+}
+function parseCommandPolicy(value, label) {
+  const errors = [];
+  if (!isPlainRecord(value)) return { errors: [`${label} must be a mapping`] };
+  for (const key of Object.keys(value)) {
+    if (!COMMAND_KEYS.has(key)) errors.push(`${label}: unknown key '${key}'`);
+  }
+  const id = stringField(value, "id", label, errors);
+  const command = stringField(value, "command", label, errors);
+  const cwd = optionalStringField(value, "cwd", label, errors);
+  const timeoutMs = optionalPositiveInt(value, "timeoutMs", label, errors);
+  const maxOutputBytes = optionalPositiveInt(value, "maxOutputBytes", label, errors);
+  const actionClass = parseActionClass(value.actionClass, label, errors);
+  const shellOperators = parseShellOperators(value.shellOperators, label, errors);
+  const env = parseEnvPolicy(value.env, label, errors);
+  const requireConfirmation = value.requireConfirmation === void 0 ? false : booleanField(value, "requireConfirmation", label, errors);
+  const rationale = optionalStringField(value, "rationale", label, errors);
+  const owner = optionalStringField(value, "owner", label, errors);
+  const comment = optionalStringField(value, "comment", label, errors);
+  if (id && !ID_RE.test(id)) errors.push(`${label}.id must match ${ID_RE}`);
+  if (command && command.trim().length === 0) errors.push(`${label}.command must not be empty`);
+  if (cwd !== void 0) {
+    if (path2.isAbsolute(cwd)) {
+      errors.push(`${label}.cwd must be relative to the policy root`);
+    } else {
+      const normalized = path2.normalize(cwd);
+      const segments = normalized.split(path2.sep).filter((segment) => segment.length > 0);
+      if (segments.some((segment) => segment === "..")) {
+        errors.push(`${label}.cwd must not escape the policy root with '..'`);
+      }
+    }
+  }
+  if (errors.length > 0 || id === void 0 || command === void 0 || actionClass === void 0 || env === void 0) {
+    return { errors };
+  }
+  const parsed = {
+    id,
+    command,
+    actionClass,
+    shellOperators,
+    env,
+    requireConfirmation
+  };
+  if (cwd !== void 0) parsed.cwd = cwd;
+  if (timeoutMs !== void 0) parsed.timeoutMs = timeoutMs;
+  if (maxOutputBytes !== void 0) parsed.maxOutputBytes = maxOutputBytes;
+  if (rationale !== void 0) parsed.rationale = rationale;
+  if (owner !== void 0) parsed.owner = owner;
+  if (comment !== void 0) parsed.comment = comment;
+  return { command: parsed, errors: [] };
+}
+function parseActionClass(value, label, errors) {
+  if (typeof value !== "string") {
+    errors.push(`${label}.actionClass must be a string`);
+    return void 0;
+  }
+  if (!ACTION_CLASSES.has(value)) {
+    errors.push(`${label}.actionClass is not supported: ${value}`);
+    return void 0;
+  }
+  return value;
+}
+function parseShellOperators(value, label, errors) {
+  if (value === void 0) return "deny";
+  if (value === "deny" || value === "allow") return value;
+  errors.push(`${label}.shellOperators must be 'deny' or 'allow'`);
+  return "deny";
+}
+function parseEnvPolicy(value, label, errors) {
+  if (value === void 0) return { mode: "none", allow: [] };
+  if (!isPlainRecord(value)) {
+    errors.push(`${label}.env must be a mapping`);
+    return void 0;
+  }
+  for (const key of Object.keys(value)) {
+    if (!ENV_KEYS.has(key)) errors.push(`${label}.env: unknown key '${key}'`);
+  }
+  const mode = value.mode;
+  if (mode !== "none" && mode !== "allowlist") {
+    errors.push(`${label}.env.mode must be 'none' or 'allowlist'`);
+    return void 0;
+  }
+  const allow = value.allow;
+  if (allow === void 0) return { mode, allow: [] };
+  if (!Array.isArray(allow) || allow.some((entry) => typeof entry !== "string" || entry.length === 0)) {
+    errors.push(`${label}.env.allow must be an array of non-empty strings`);
+    return void 0;
+  }
+  if (mode === "none" && allow.length > 0) {
+    errors.push(`${label}.env.allow requires env.mode='allowlist'`);
+    return void 0;
+  }
+  return { mode, allow: [...allow] };
+}
+function stringField(record, key, label, errors) {
+  const value = record[key];
+  if (typeof value !== "string" || value.length === 0) {
+    errors.push(`${label}.${key} must be a non-empty string`);
+    return void 0;
+  }
+  return value;
+}
+function optionalStringField(record, key, label, errors) {
+  const value = record[key];
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || value.length === 0) {
+    errors.push(`${label}.${key} must be a non-empty string when present`);
+    return void 0;
+  }
+  return value;
+}
+function optionalPositiveInt(record, key, label, errors) {
+  const value = record[key];
+  if (value === void 0) return void 0;
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) {
+    errors.push(`${label}.${key} must be a positive integer`);
+    return void 0;
+  }
+  return value;
+}
+function booleanField(record, key, label, errors) {
+  const value = record[key];
+  if (typeof value === "boolean") return value;
+  errors.push(`${label}.${key} must be a boolean`);
+  return false;
+}
+function isPlainRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function sha256(raw) {
+  return createHash("sha256").update(raw, "utf8").digest("hex");
+}
+
+// src/domains/safety/rejection-feedback.ts
+init_esm_shims();
+var HARD_BLOCK_CLASSES = ["git_destructive"];
+function buildShort(ctx) {
+  const postureSuffix = ctx.posture ? ` in ${ctx.posture}` : "";
+  return `${ctx.tool} blocked: ${ctx.actionClass}${postureSuffix}`;
+}
+function buildDetail(ctx) {
+  const lines = [`Clio refused to run ${ctx.tool}.`];
+  for (const reason of ctx.reasons) {
+    lines.push(`- ${reason}`);
+  }
+  if (ctx.ruleId) {
+    lines.push(`rule: ${ctx.ruleId}`);
+  }
+  return lines.join("\n");
+}
+function buildHints(ctx) {
+  const hints = [];
+  const hardBlock = HARD_BLOCK_CLASSES.includes(ctx.actionClass) || ctx.ruleId !== void 0;
+  if (hardBlock) {
+    hints.push("This is a hard block; confirmation cannot override it.");
+    return hints;
+  }
+  if (ctx.actionClass === "system_modify") {
+    hints.push("Operator confirmation is required for this action.");
+  }
+  return hints;
+}
+function formatRejection(ctx) {
+  return {
+    short: buildShort(ctx),
+    detail: buildDetail(ctx),
+    hints: buildHints(ctx)
+  };
+}
+var MODEL_REJECTION_PIVOT = "Do not retry this action through another tool unless a hint above names one; pivot or report the blocker.";
+var MODEL_REJECTION_MAX_LINES = 16;
+var MODEL_REJECTION_MAX_LINE_CHARS = 300;
+function formatModelRejection(reason, rejection) {
+  const lines = [];
+  const seen = /* @__PURE__ */ new Set();
+  const push = (line) => {
+    const bounded = line.length > MODEL_REJECTION_MAX_LINE_CHARS ? `${line.slice(0, MODEL_REJECTION_MAX_LINE_CHARS)}\u2026` : line;
+    const trimmed = bounded.trim();
+    if (trimmed.length === 0) return;
+    const normalized = trimmed.replace(/^-\s+/, "");
+    if (seen.has(normalized) || normalized === MODEL_REJECTION_PIVOT) return;
+    seen.add(normalized);
+    lines.push(trimmed);
+  };
+  for (const line of reason.split("\n")) push(line);
+  if (rejection) {
+    for (const line of rejection.detail.split("\n")) push(line);
+    for (const hint of rejection.hints) push(hint);
+  }
+  const bodyBudget = MODEL_REJECTION_MAX_LINES - 1;
+  const body = lines.length > bodyBudget ? [...lines.slice(0, bodyBudget - 1), "(further detail elided)"] : lines;
+  return [...body, MODEL_REJECTION_PIVOT].join("\n");
+}
+
+// src/domains/safety/rule-pack-loader.ts
+init_esm_shims();
+var import_yaml2 = __toESM(require_dist(), 1);
+import { readFileSync as readFileSync2 } from "node:fs";
+import { join } from "node:path";
+
+// src/domains/safety/rule-compiler.ts
+init_esm_shims();
+function asString(value, ruleId, field) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`damage-control rule '${ruleId}': expected string for ${field}`);
+  }
+  return value;
+}
+function compileDamageControlRule(raw, index) {
+  if (typeof raw.id !== "string" || raw.id.length === 0) {
+    throw new Error(`damage-control rule at index ${index}: missing or non-string 'id'`);
+  }
+  const id = raw.id;
+  const description = asString(raw.description, id, "description");
+  const patternString = asString(raw.pattern, id, "pattern");
+  const klass = asString(raw.class, id, "class");
+  if (typeof raw.block !== "boolean") {
+    throw new Error(`damage-control rule '${id}': expected boolean for block`);
+  }
+  if (raw.ask !== void 0 && typeof raw.ask !== "boolean") {
+    throw new Error(`damage-control rule '${id}': expected boolean for ask`);
+  }
+  let pattern;
+  try {
+    pattern = new RegExp(patternString, "i");
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(`damage-control rule '${id}': invalid pattern: ${msg}`);
+  }
+  return {
+    id,
+    description,
+    pattern,
+    class: klass,
+    block: raw.block,
+    ...raw.ask !== void 0 ? { ask: raw.ask } : {}
+  };
+}
+
+// src/domains/safety/rule-pack-loader.ts
+function compilePackRules(rawRules, packId) {
+  if (rawRules === void 0 || rawRules === null) return [];
+  if (!Array.isArray(rawRules)) {
+    throw new Error(`damage-control pack '${packId}': expected array at 'rules'`);
+  }
+  return rawRules.map((rule, index) => compileDamageControlRule(rule, index));
+}
+function emptyRuleset(version) {
+  return { version, rules: [] };
+}
+function loadRulePacks(yamlPath) {
+  const raw = readFileSync2(yamlPath, "utf8");
+  const parsed = (0, import_yaml2.parse)(raw);
+  if (!parsed || typeof parsed !== "object") {
+    throw new Error(`damage-control rules at ${yamlPath}: expected mapping at document root`);
+  }
+  const version = typeof parsed.version === "number" ? parsed.version : 0;
+  if (version === 1) {
+    const baseRules = compilePackRules(parsed.rules, "base");
+    return {
+      base: { version: 1, rules: baseRules }
+    };
+  }
+  if (version !== 2) {
+    throw new Error(`damage-control rules at ${yamlPath}: unsupported version ${String(parsed.version)}`);
+  }
+  if (!Array.isArray(parsed.packs)) {
+    throw new Error(`damage-control rules at ${yamlPath}: expected array at 'packs'`);
+  }
+  const out = {
+    base: emptyRuleset(2)
+  };
+  for (const rawPack of parsed.packs) {
+    const packId = rawPack.id;
+    if (packId !== "base") {
+      throw new Error(`damage-control rules at ${yamlPath}: unknown pack id ${String(packId)}`);
+    }
+    const rules = compilePackRules(rawPack.rules, packId);
+    out[packId] = { version: 2, rules };
+  }
+  return out;
+}
+function loadDefaultRulePacks() {
+  return loadRulePacks(join(resolvePackageRoot(), "damage-control-rules.yaml"));
+}
+var cachedPacks = null;
+function getCachedDefaultRulePacks() {
+  if (cachedPacks === null) cachedPacks = loadDefaultRulePacks();
+  return cachedPacks;
+}
+
+// src/domains/safety/skill-authority.ts
+init_esm_shims();
+import { homedir as homedir2 } from "node:os";
+import path3 from "node:path";
+function activeClioSkillRoots(cwd) {
+  return ["skills", "plugins", "extensions"].flatMap((kind) => [
+    path3.join(cwd, ".clio-coder", kind),
+    path3.join(clioConfigDir(), kind)
+  ]);
+}
+function skillMutationReason(roots, targets, cwd, command) {
+  const workingDirs = [cwd];
+  if (command !== null) {
+    for (const destination of extractCommandCdTargets(command)) {
+      workingDirs.push(path3.resolve(workingDirs.at(-1) ?? cwd, expandHome(destination)));
+    }
+  }
+  for (const target of targets) {
+    if (target.operation === "read") continue;
+    for (const directory of workingDirs) {
+      const lexical = path3.resolve(directory, expandHome(target.path));
+      const resolved = canonicalizeExistingPath(lexical);
+      for (const root of roots) {
+        for (const boundary of [root, canonicalizeExistingPath(root)]) {
+          for (const candidate of [lexical, resolved]) {
+            if (isSameOrDescendant(candidate, boundary) || target.operation === "delete" && isSameOrDescendant(boundary, candidate)) {
+              return `active resource tree ${root} is operator-owned; draft changes outside installed resource roots and use the operator install or update interface`;
+            }
+          }
+        }
+      }
+    }
+  }
+  return null;
+}
+function expandHome(value) {
+  return value === "~" ? homedir2() : value.startsWith("~/") ? path3.join(homedir2(), value.slice(2)) : value;
+}
+
+// src/domains/safety/workspace-trust.ts
+init_esm_shims();
+function gateProjectSafetyPolicy(workspaceRoot, policy) {
+  if (policy.path === null) return policy;
+  const trustVerdict = policy.hash === null ? "untrusted" : projectSurfaceTrust(workspaceRoot, "safety", safetySurfaceTrustHash(policy.path, policy.hash));
+  if (trustVerdict === "trusted") return { ...policy, trustVerdict };
+  return {
+    ...policy,
+    trustVerdict,
+    // This is the admitted empty policy, whose execution defaults are valid.
+    // Unapproved parse failures retain diagnostics below but cannot acquire the
+    // authority to block execution. An approved malformed policy stays invalid.
+    valid: true,
+    commands: [],
+    pathPolicy: {},
+    disableDefaultPathPolicy: false,
+    errors: [
+      ...policy.errors,
+      `${policy.path} is ${trustVerdict}; project safety ignored. Review with clio-coder config trust safety.`
+    ]
+  };
+}
+
+// src/domains/safety/policy-engine.ts
+var BUILTIN_ALLOWLIST = [
+  { id: "builtin:pwd", re: /^pwd$/ },
+  { id: "builtin:ls", re: /^ls(?:\s+(-[A-Za-z0-9]+|\.[/\w.-]*|[/\w.-]+))*$/ },
+  { id: "builtin:git-status", re: /^git\s+status(?:\s+--short|\s+--branch|\s+-sb)*$/ },
+  { id: "builtin:git-diff", re: /^git\s+diff(?:\s+--cached|\s+--stat|\s+--name-only|\s+--\s+[\w./-]+)*$/ },
+  { id: "builtin:git-log", re: /^git\s+log\s+--oneline(?:\s+-n\s+[1-9]\d{0,2})?(?:\s+--\s+[\w./-]+)?$/ }
+];
+var PROJECT_SCRIPT_COMMANDS = [
+  { id: "builtin:npm-test", re: /^npm\s+(?:test|run\s+test)(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
+  { id: "builtin:npm-lint", re: /^npm\s+run\s+lint(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
+  { id: "builtin:npm-build", re: /^npm\s+run\s+build(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
+  { id: "builtin:npm-typecheck", re: /^npm\s+run\s+typecheck(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
+  { id: "builtin:npm-ci-script", re: /^npm\s+run\s+ci(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
+  { id: "builtin:pytest", re: /^pytest(?:\s+[\w=./:-]+)*$/ },
+  { id: "builtin:python-pytest", re: /^python(?:3(?:\.\d+)?)?\s+-m\s+pytest(?:\s+[\w=./:-]+)*$/ },
+  { id: "builtin:cargo-test", re: /^cargo\s+test(?:\s+[\w=./:-]+)*$/ },
+  { id: "builtin:go-test", re: /^go\s+test(?:\s+[\w=./:-]+)*$/ },
+  { id: "builtin:make-test", re: /^make\s+test(?:\s+[\w=./:-]+)*$/ }
+];
+var BASH_RECOGNIZED_FORM_HINT = "Recognized forms run without asking: one command per bash call, or a && chain whose every step is recognized, with cwd passed as the cwd argument instead of a leading cd.";
+var EXECUTION_TOOLS = /* @__PURE__ */ new Set([ToolNames.Bash, ToolNames.Verify]);
+var WRITE_ROOT_REFUSED_TOOLS = /* @__PURE__ */ new Set([
+  ToolNames.Bash,
+  ToolNames.Verify,
+  ToolNames.Dispatch
+]);
+var WRITE_ROOT_TOOLS = /* @__PURE__ */ new Set([ToolNames.Write, ToolNames.Edit, ToolNames.Artifact]);
+function writeRootTargetPath(call) {
+  if (!WRITE_ROOT_TOOLS.has(call.tool)) return null;
+  const target = pathArg(call.args);
+  if (target !== null) return target;
+  if (call.tool === ToolNames.Artifact) return artifactDefaultPath(call.args?.kind);
+  return null;
+}
+function isWriteConfinementEscape(call, actionClass) {
+  if (WRITE_ROOT_REFUSED_TOOLS.has(call.tool)) return true;
+  return actionClass === "execute" || actionClass === "dispatch";
+}
+function evaluateWriteRoots(roots, writeRootCwd, call) {
+  if (roots.length === 0) return null;
+  const target = writeRootTargetPath(call);
+  if (target === null) return null;
+  const resolved = path4.resolve(writeRootCwd, target);
+  if (pathBoundaryCovers(roots, resolved)) return null;
+  return `write target '${target}' resolves to '${resolved}', which is outside the permitted write roots for this run: ${roots.join(", ")}`;
+}
+function createSafetyPolicyEngine(options = {}) {
+  const cwd = canonicalizeExistingPath(path4.resolve(options.cwd ?? process.cwd()));
+  const writeRootCwd = path4.resolve(options.cwd ?? process.cwd());
+  const writeRoots = (options.writeRoots ?? []).map((root) => resolvePathBoundary(writeRootCwd, root));
+  const skillRoots = activeClioSkillRoots(cwd);
+  const packs = options.rulePacks ?? getCachedDefaultRulePacks();
+  const projectPolicy = options.projectPolicy ?? gateProjectSafetyPolicy(cwd, loadProjectSafetyPolicy(cwd));
+  const projectPolicyRoot = projectPolicy.path === null ? cwd : path4.dirname(path4.dirname(path4.resolve(projectPolicy.path)));
+  const pathPolicyInput = projectPolicy.disableDefaultPathPolicy ? projectPolicy.pathPolicy : mergePathPolicyInputs(DEFAULT_DAMAGE_CONTROL_PATH_POLICY, projectPolicy.pathPolicy);
+  const expandedDefaults = mergePathPolicyInputs(mergePathPolicyInputs(pathPolicyInput, OPERATOR_PATH_POLICY), {
+    zeroAccessPaths: clioCredentialStorePaths(),
+    readOnlyPaths: [...clioSkillsRootPaths(), path4.join(clioConfigDir(), "settings.yaml"), workspaceTrustDirectory()]
+  });
+  const pathPolicy = compilePathPolicy(expandedDefaults, projectPolicyRoot);
+  const zeroAccessPolicy = {
+    root: pathPolicy.root,
+    entries: pathPolicy.entries.filter((entry) => entry.kind === "zeroAccessPaths"),
+    diagnostics: []
+  };
+  const sourcedRules = packs.base.rules.map((rule) => ({ rule, source: "damage-control:base" }));
+  return {
+    evaluate(call, posture) {
+      const rawClassification = classify(call);
+      const command = commandArg(call.args);
+      const callCwd = cwdArg(call.args, cwd);
+      const catalogCheck = resolveVerifyCatalogCheck(call, cwd);
+      const catalogCommand = catalogCheck === null ? null : catalogCheck.command.join(" ");
+      const scan = catalogCommand ?? damageControlScan(call);
+      const hit = scan ? matchSourcedRule(scan, sourcedRules) : null;
+      const classification = effectiveClassification(rawClassification, hit?.match);
+      const base = baseDecision(call, classification, callCwd, posture, command);
+      const writeRootReason = evaluateWriteRoots(writeRoots, writeRootCwd, call);
+      if (writeRootReason !== null) {
+        return blockDecision(base, {
+          ruleId: "write-root",
+          reasonCode: "write-root",
+          reasons: [writeRootReason],
+          policySource: "builtin-classifier"
+        });
+      }
+      if (writeRoots.length > 0 && isWriteConfinementEscape(call, classification.actionClass)) {
+        return blockDecision(base, {
+          ruleId: "write-root",
+          reasonCode: "write-root",
+          reasons: [
+            `tool '${call.tool}' (${classification.actionClass}) can mutate the filesystem outside the permitted write roots and is blocked under write-root confinement`
+          ],
+          policySource: "builtin-classifier"
+        });
+      }
+      const askRule = hit?.match.ask === true && hit.match.block !== true;
+      if (!askRule && (classification.actionClass === "git_destructive" || hit?.match.actionClass === "git_destructive" || hit?.match.block === true)) {
+        const blockInput = {
+          reasonCode: hit ? `damage-control:${hit.match.ruleId}` : "classification:git_destructive",
+          reasons: [...classification.reasons, ...hit ? [hit.match.reason] : []],
+          policySource: hit?.source ?? "damage-control:base"
+        };
+        if (hit?.match.ruleId !== void 0) blockInput.ruleId = hit.match.ruleId;
+        if (hit?.match !== void 0) blockInput.match = hit.match;
+        return blockDecision(base, blockInput);
+      }
+      if (!projectPolicy.valid && EXECUTION_TOOLS.has(call.tool)) {
+        const blockInput = {
+          ruleId: "project-policy-invalid",
+          reasonCode: "project-policy-invalid",
+          reasons: [`project safety policy is invalid and execution fails closed: ${projectPolicy.errors.join("; ")}`],
+          policySource: "project-policy-invalid"
+        };
+        if (projectPolicy.hash !== null) blockInput.policyHash = projectPolicy.hash;
+        if (projectPolicy.path !== null) blockInput.projectPolicyPath = projectPolicy.path;
+        return blockDecision(base, blockInput);
+      }
+      const mutationCommand = call.tool === ToolNames.Bash ? command : catalogCommand;
+      if (mutationCommand !== null && invokesTrustMutation(mutationCommand)) {
+        return blockDecision(base, {
+          reasonCode: "trust-authority",
+          ruleId: "trust-authority",
+          reasons: ["workspace trust grants require the operator CLI"],
+          policySource: "builtin-classifier"
+        });
+      }
+      if (skillMutationReason(
+        [path4.join(clioConfigDir(), "settings.yaml"), workspaceTrustDirectory()],
+        pathPolicyTargets(catalogCommand === null ? call : { tool: ToolNames.Bash, args: { command: catalogCommand } }),
+        callCwd,
+        mutationCommand
+      ) !== null) {
+        return blockDecision(base, {
+          reasonCode: "path-policy:readOnlyPaths",
+          ruleId: "path-policy:readOnlyPaths",
+          reasons: ["Clio settings and workspace trust records are operator-owned and cannot be mutated by tools"],
+          policySource: "builtin-classifier"
+        });
+      }
+      const skillReason = mutationCommand !== null && invokesClioSkillMutation(mutationCommand) ? "resource installation and lifecycle changes require the operator CLI or an explicit operator install choice; draft outside installed resource roots" : skillMutationReason(
+        skillRoots,
+        pathPolicyTargets(catalogCommand === null ? call : { tool: ToolNames.Bash, args: { command: catalogCommand } }),
+        callCwd,
+        mutationCommand
+      );
+      if (skillReason !== null) {
+        return blockDecision(base, {
+          ruleId: "skill-authority",
+          reasonCode: "skill-authority",
+          reasons: [skillReason],
+          policySource: "builtin-classifier"
+        });
+      }
+      const pathBlock = evaluateProjectPathPolicy(pathPolicy, call, callCwd);
+      if (pathBlock !== null) {
+        const blockInput = {
+          ruleId: pathBlock.reasonCode,
+          reasonCode: pathBlock.reasonCode,
+          reasons: [pathBlock.reason],
+          policySource: "project-policy"
+        };
+        if (projectPolicy.hash !== null) blockInput.policyHash = projectPolicy.hash;
+        if (projectPolicy.path !== null) blockInput.projectPolicyPath = projectPolicy.path;
+        return blockDecision(base, blockInput);
+      }
+      const scannedCommand = call.tool === ToolNames.Bash ? command : catalogCommand;
+      if (scannedCommand !== null) {
+        const secretRead = evaluateBashZeroAccessRead(zeroAccessPolicy, scannedCommand, callCwd);
+        if (secretRead !== null) {
+          const blockInput = {
+            ruleId: "secret_path_bash",
+            reasonCode: "secret_path_bash",
+            reasons: [
+              `bash read of zero-access path blocked: '${secretRead.token}' matches ${secretRead.entrySource}. Check presence with exit codes only (grep -sq "^NAME=" <file>); have the user supply values through their own terminal (read -s), never through chat or command output.`
+            ],
+            policySource: "project-policy"
+          };
+          if (projectPolicy.hash !== null) blockInput.policyHash = projectPolicy.hash;
+          if (projectPolicy.path !== null) blockInput.projectPolicyPath = projectPolicy.path;
+          return blockDecision(base, blockInput);
+        }
+      }
+      if (askRule && hit !== null && posture !== "confirmed") {
+        return askDecision(base, {
+          ruleId: hit.match.ruleId,
+          reasonCode: `damage-control:${hit.match.ruleId}`,
+          reasons: [...classification.reasons, hit.match.reason, "damage-control rule requires confirmation"],
+          policySource: hit.source,
+          match: hit.match
+        });
+      }
+      if (askRule && hit !== null && posture === "confirmed") {
+        return allowDecision(base, {
+          ruleId: hit.match.ruleId,
+          reasonCode: `damage-control:${hit.match.ruleId}`,
+          reasons: [...classification.reasons, hit.match.reason, "damage-control rule confirmed by operator"],
+          policySource: hit.source,
+          match: hit.match
+        });
+      }
+      if (classification.actionClass === "system_modify") {
+        const input = {
+          ruleId: "system-modify-confirm",
+          reasonCode: "system-modify-confirm",
+          reasons: [...classification.reasons, "system-level changes require one-shot confirmation at every autonomy level"],
+          policySource: "builtin-classifier"
+        };
+        return posture === "confirmed" ? allowDecision(base, input) : askDecision(base, input);
+      }
+      const packageCommand = call.tool === ToolNames.Verify && catalogCheck === null && typeof call.args?.check === "string" && call.args.check !== "frontend" ? `npm run ${call.args.check}` : null;
+      if ((call.tool === ToolNames.Bash || catalogCheck !== null || packageCommand !== null) && classification.actionClass === "execute") {
+        const bash = evaluateBashPolicy(
+          catalogCheck?.command ?? packageCommand ?? command ?? "",
+          catalogCheck === null ? callCwd : path4.resolve(cwd, catalogCheck.cwd),
+          cwd,
+          posture,
+          projectPolicy
+        );
+        if ((catalogCheck !== null || packageCommand !== null) && bash.kind === "allow" && bash.execRecognition !== "recognized" && posture !== "confirmed") {
+          return askDecision(base, {
+            ...bash,
+            reasonCode: "project-verifier-confirm",
+            reasons: [
+              ...bash.reasons,
+              `Repository verifier requires confirmation or an approved safety declaration: ${catalogCommand ?? packageCommand}`
+            ]
+          });
+        }
+        if (bash.kind === "block") return blockDecision(base, bash);
+        if (bash.kind === "ask") return askDecision(base, bash);
+        return allowDecision(base, bash);
+      }
+      const allowInput = {
+        reasonCode: "allowed",
+        reasons: classification.reasons,
+        policySource: hit?.source ?? "none"
+      };
+      if (hit?.match.ruleId !== void 0) allowInput.ruleId = hit.match.ruleId;
+      if (hit?.match !== void 0) allowInput.match = hit.match;
+      if (classification.actionClass === "execute") allowInput.execRecognition = "recognized";
+      return allowDecision(base, allowInput);
+    },
+    metadata() {
+      return {
+        version: 1,
+        rulePackHash: rulePackHash(packs),
+        rulePackVersion: packs.base.version,
+        activeRuleIds: sourcedRules.map((entry) => entry.rule.id),
+        projectPolicyPath: projectPolicy.path,
+        projectPolicyHash: projectPolicy.hash,
+        projectPolicyValid: projectPolicy.valid,
+        projectPolicyErrors: [...projectPolicy.errors, ...pathPolicy.diagnostics],
+        disableDefaultPathPolicy: projectPolicy.disableDefaultPathPolicy,
+        workspaceTrustVerdict: projectPolicy.trustVerdict ?? "trusted",
+        cwd
+      };
+    }
+  };
+}
+function clioCredentialStorePaths() {
+  try {
+    return [path4.join(clioConfigDir(), "credentials.yaml")];
+  } catch {
+    return [];
+  }
+}
+function clioSkillsRootPaths() {
+  try {
+    return [path4.join(clioConfigDir(), "skills")];
+  } catch {
+    return [];
+  }
+}
+var SAFE_PRESENCE_RE = /^\s*grep\s+(?:-(?:q|sq|qs)\s+)('[^']*'|"[^"]*"|\S+)\s+\S+\s*$/;
+function isSafePresenceCheck(command) {
+  const match = SAFE_PRESENCE_RE.exec(command);
+  if (!match || match[1] === void 0) return false;
+  const pattern = stripQuotes(match[1]);
+  return /^\^[A-Za-z_][A-Za-z0-9_]*=/.test(pattern);
+}
+function stripQuotes(token) {
+  if (token.length >= 2) {
+    const first = token[0];
+    const last = token[token.length - 1];
+    if (first === '"' && last === '"' || first === "'" && last === "'") return token.slice(1, -1);
+  }
+  return token;
+}
+function bashPathTokenCandidates(command) {
+  const candidates = [];
+  for (const scanned of scanShellLike(command)) {
+    if (scanned.operator) continue;
+    const token = scanned.value;
+    if (token.length === 0) continue;
+    if (/\s/.test(token)) continue;
+    if (token.startsWith("-") && !token.includes("/") && !token.includes("=")) continue;
+    candidates.push(token);
+    const eq = token.indexOf("=");
+    if (eq > 0 && eq < token.length - 1) candidates.push(token.slice(eq + 1));
+  }
+  return candidates;
+}
+function evaluateBashZeroAccessRead(zeroAccessPolicy, command, callCwd) {
+  if (zeroAccessPolicy.entries.length === 0) return null;
+  if (isSafePresenceCheck(command)) return null;
+  for (const token of bashPathTokenCandidates(command)) {
+    const decision = evaluatePathPolicy(zeroAccessPolicy, "read", token, callCwd);
+    if (decision.kind === "block") {
+      return { token, entrySource: `zeroAccessPaths entry ${decision.matchedPath}` };
+    }
+  }
+  return null;
+}
+function evaluateProjectPathPolicy(policy, call, callCwd) {
+  if (policy.entries.length === 0) return null;
+  for (const target of pathPolicyTargets(call)) {
+    const decision = evaluatePathPolicy(policy, target.operation, target.path, callCwd);
+    if (decision.kind === "block") return decision;
+  }
+  return null;
+}
+function pathPolicyTargets(call) {
+  const args = call.args;
+  switch (call.tool) {
+    case ToolNames.Read:
+    case ToolNames.Ls:
+    case ToolNames.Grep:
+    case ToolNames.Find: {
+      const target = pathArg(args) ?? ".";
+      return [{ operation: "read", path: target }];
+    }
+    case ToolNames.Write:
+    case ToolNames.Edit: {
+      const target = pathArg(args);
+      return target === null ? [] : [{ operation: "write", path: target }];
+    }
+    case ToolNames.Artifact:
+      return [{ operation: "write", path: pathArg(args) ?? artifactDefaultPath(args?.kind) }];
+    case ToolNames.CredentialPresent:
+      return [];
+    case ToolNames.Bash: {
+      const command = commandArg(args);
+      if (command === null) return [];
+      return [
+        ...extractCommandWriteTargets(command).map((target) => ({ operation: "write", path: target })),
+        ...extractCommandDeleteTargets(command).map((target) => ({ operation: "delete", path: target }))
+      ];
+    }
+    default:
+      return [];
+  }
+}
+function evaluateBashPolicy(input, callCwd, workspaceRoot, posture, policy) {
+  if (typeof input !== "string" && !input.every((arg) => /^[\w=./:-]+$/u.test(arg))) {
+    return {
+      kind: posture === "confirmed" ? "allow" : "ask",
+      ruleId: "verify-unrecognized-argv",
+      reasonCode: "verify-unrecognized-argv",
+      reasons: ["project verifier argv is outside the bare-word no-prompt command set"],
+      policySource: "builtin-command-allowlist",
+      execRecognition: "unrecognized"
+    };
+  }
+  const command = typeof input === "string" ? input : input.join(" ");
+  if (command.trim().length === 0) {
+    return {
+      kind: "block",
+      ruleId: "bash-empty-command",
+      reasonCode: "bash-empty-command",
+      reasons: ["bash command must not be empty"],
+      policySource: "builtin-command-allowlist"
+    };
+  }
+  if (typeof input === "string" && (/\$(?:[A-Za-z_{0-9@*#?!-])/.test(command) || /(?:^|[\s;&|])(?:python[\d.]*|node|ruby|perl|php|lua)\s+(?:[^\n]*?\s)?-[ce]\b/.test(command)) && posture !== "confirmed") {
+    return {
+      kind: "ask",
+      reasonCode: "bash-hidden-content",
+      ruleId: "bash-hidden-content",
+      reasons: ["shell variables or interpreter source hide paths from the safety scan and require one-shot confirmation"],
+      policySource: "builtin-command-allowlist",
+      execRecognition: "unrecognized"
+    };
+  }
+  const projectMatch = matchingProjectCommand(policy, command, callCwd);
+  if (projectMatch) {
+    const base = {
+      ruleId: projectMatch.id,
+      reasonCode: `project-policy:${projectMatch.id}`,
+      reasons: [`allowed by project safety policy command '${projectMatch.id}'`],
+      policySource: "project-policy",
+      execRecognition: "recognized"
+    };
+    if (policy.hash !== null) base.policyHash = policy.hash;
+    if (policy.path !== null) base.projectPolicyPath = policy.path;
+    if (projectMatch.requireConfirmation && posture !== "confirmed") {
+      return {
+        ...base,
+        kind: "ask",
+        reasons: [...base.reasons, "project policy requires confirmation"]
+      };
+    }
+    return { ...base, kind: "allow" };
+  }
+  if (!isUnderOrSame(callCwd, workspaceRoot)) {
+    return {
+      kind: "block",
+      ruleId: "bash-cwd-escape",
+      reasonCode: "bash-cwd-escape",
+      reasons: [
+        `bash cwd '${callCwd}' escapes workspace root '${workspaceRoot}'; use a typed tool or a project policy entry with explicit cwd`
+      ],
+      policySource: "builtin-command-allowlist"
+    };
+  }
+  const recognitionCommand = inlineShellScript(command) ?? command;
+  if (hasCommandSubstitution(recognitionCommand) && posture !== "confirmed") {
+    return {
+      kind: "ask",
+      ruleId: "bash-command-substitution",
+      reasonCode: "bash-command-substitution",
+      reasons: ["command substitution hides the executed content from the safety net and requires one-shot confirmation"],
+      policySource: "builtin-command-allowlist",
+      execRecognition: "unrecognized"
+    };
+  }
+  if (PROJECT_SCRIPT_COMMANDS.some((entry) => entry.re.test(recognitionCommand))) {
+    return {
+      kind: posture === "confirmed" ? "allow" : "ask",
+      reasonCode: "project-script-confirm",
+      ruleId: "project-script-confirm",
+      reasons: [
+        "Repository-authored code requires one-shot confirmation or an operator-approved safety command declaration.",
+        projectScriptPreview(recognitionCommand, callCwd)
+      ],
+      policySource: "builtin-command-allowlist",
+      execRecognition: "unrecognized"
+    };
+  }
+  const chain = recognizeCommandChain(recognitionCommand, callCwd, workspaceRoot, policy);
+  if (chain !== null) {
+    const chainReasons = [`every step of the && chain is recognized: ${chain.ruleIds.join(", ")}`];
+    if (chain.requiresConfirmation) {
+      for (const segment of recognitionCommand.split("&&").map((part) => part.trim())) {
+        if (PROJECT_SCRIPT_COMMANDS.some((entry) => entry.re.test(segment)))
+          chainReasons.push(projectScriptPreview(segment, callCwd));
+      }
+    }
+    if (chain.requiresConfirmation && posture !== "confirmed") {
+      return {
+        kind: "ask",
+        ruleId: "bash-recognized-chain",
+        reasonCode: "bash-recognized-chain",
+        reasons: [...chainReasons, "repository code or project policy requires confirmation for one step"],
+        policySource: "builtin-command-allowlist",
+        execRecognition: "recognized"
+      };
+    }
+    return {
+      kind: "allow",
+      ruleId: "bash-recognized-chain",
+      reasonCode: "bash-recognized-chain",
+      reasons: chainReasons,
+      policySource: "builtin-command-allowlist",
+      execRecognition: "recognized"
+    };
+  }
+  if (hasSequencingOperators(command)) {
+    const scriptSegments = recognitionCommand.split(/&&|\|\||[;|\n]/).map((part) => part.trim()).filter((part) => PROJECT_SCRIPT_COMMANDS.some((entry) => entry.re.test(part)));
+    if (scriptSegments.length > 0 && posture !== "confirmed") {
+      return {
+        kind: "ask",
+        ruleId: "project-script-confirm",
+        reasonCode: "project-script-confirm",
+        reasons: [
+          "Repository scripts in compound commands require one-shot confirmation",
+          ...scriptSegments.map((part) => projectScriptPreview(part, callCwd))
+        ],
+        policySource: "builtin-command-allowlist",
+        execRecognition: "unrecognized"
+      };
+    }
+    return {
+      kind: "allow",
+      ruleId: "bash-shell-operators",
+      reasonCode: "bash-shell-operators",
+      reasons: [
+        "shell operators defeat per-command recognition; the autonomy level decides admission",
+        BASH_RECOGNIZED_FORM_HINT
+      ],
+      policySource: "builtin-command-allowlist",
+      execRecognition: "unrecognized"
+    };
+  }
+  for (const entry of BUILTIN_ALLOWLIST) {
+    if (entry.re.test(recognitionCommand)) {
+      return {
+        kind: "allow",
+        ruleId: entry.id,
+        reasonCode: entry.id,
+        reasons: [`matched built-in no-prompt command allowlist '${entry.id}'`],
+        policySource: "builtin-command-allowlist",
+        execRecognition: "recognized"
+      };
+    }
+  }
+  return {
+    kind: "allow",
+    ruleId: "bash-unrecognized",
+    reasonCode: "bash-unrecognized",
+    reasons: [
+      "bash command is outside the no-prompt set; the autonomy level decides admission",
+      BASH_RECOGNIZED_FORM_HINT
+    ],
+    policySource: "builtin-command-allowlist",
+    execRecognition: "unrecognized"
+  };
+}
+function baseDecision(call, classification, cwd, posture, command) {
+  const out = {
+    classification,
+    tool: call.tool,
+    actionClass: classification.actionClass,
+    cwd
+  };
+  if (posture !== void 0) out.posture = posture;
+  if (command !== null) out.command = command;
+  return out;
+}
+function allowDecision(base, input) {
+  return { ...base, ...input, kind: "allow" };
+}
+function askDecision(base, input) {
+  const rejectionInput = {
+    tool: base.tool,
+    actionClass: base.classification.actionClass,
+    reasons: input.reasons
+  };
+  if (base.posture !== void 0) rejectionInput.posture = base.posture;
+  if (input.ruleId !== void 0) rejectionInput.ruleId = input.ruleId;
+  const rejection = formatRejection(rejectionInput);
+  return { ...base, ...input, kind: "ask", rejection };
+}
+function blockDecision(base, input) {
+  const rejectionInput = {
+    tool: base.tool,
+    actionClass: base.classification.actionClass,
+    reasons: input.reasons
+  };
+  if (base.posture !== void 0) rejectionInput.posture = base.posture;
+  if (input.ruleId !== void 0) rejectionInput.ruleId = input.ruleId;
+  const rejection = formatRejection(rejectionInput);
+  return { ...base, ...input, kind: "block", rejection };
+}
+function matchSourcedRule(commandString, rules) {
+  for (const entry of rules) {
+    if (entry.rule.pattern.test(commandString)) {
+      const match = {
+        ruleId: entry.rule.id,
+        reason: `matched ${entry.rule.id}: ${entry.rule.description}`,
+        actionClass: entry.rule.class,
+        block: entry.rule.block
+      };
+      if (entry.rule.ask !== void 0) match.ask = entry.rule.ask;
+      return { match, source: entry.source };
+    }
+  }
+  return null;
+}
+var ACTION_CLASSES2 = /* @__PURE__ */ new Set([
+  "read",
+  "write",
+  "execute",
+  "system_modify",
+  "git_destructive",
+  "dispatch"
+]);
+function effectiveClassification(classification, match) {
+  if (!match || !ACTION_CLASSES2.has(match.actionClass)) return classification;
+  const actionClass = match.actionClass;
+  if (actionClass === classification.actionClass) return classification;
+  return {
+    actionClass,
+    reasons: [...classification.reasons, `damage-control:${match.ruleId}`]
+  };
+}
+function matchingProjectCommand(policy, command, cwd) {
+  if (!policy.valid || policy.path === null) return null;
+  const policyRoot = path4.dirname(path4.dirname(policy.path));
+  for (const entry of policy.commands) {
+    if (entry.command !== command) continue;
+    if (entry.shellOperators === "deny" && hasShellOperators(command)) continue;
+    const allowedCwd = entry.cwd !== void 0 ? path4.resolve(policyRoot, entry.cwd) : policyRoot;
+    if (!isUnderOrSame(cwd, allowedCwd)) continue;
+    return entry;
+  }
+  return null;
+}
+var CHAIN_MAX_SEGMENTS = 6;
+function recognizeCommandChain(command, callCwd, workspaceRoot, policy) {
+  const segments = [];
+  let current = [];
+  for (const token of scanShellLike(command)) {
+    if (token.operator && token.value === "&&") {
+      segments.push(current);
+      current = [];
+      continue;
+    }
+    if (token.operator) return null;
+    current.push(token.value);
+  }
+  segments.push(current);
+  if (segments.length < 2 || segments.length > CHAIN_MAX_SEGMENTS) return null;
+  const ruleIds = [];
+  let requiresConfirmation = false;
+  for (const segment of segments) {
+    if (segment.length === 0) return null;
+    if (segment[0] === "cd") {
+      if (segment.length !== 2) return null;
+      const target = segment[1] ?? "";
+      if (target.startsWith("~") || !isUnderOrSame(path4.resolve(callCwd, target), workspaceRoot)) return null;
+      ruleIds.push("builtin:cd-workspace");
+      continue;
+    }
+    const rendered = segment.join(" ");
+    const projectMatch = matchingProjectCommand(policy, rendered, callCwd);
+    if (projectMatch) {
+      ruleIds.push(projectMatch.id);
+      if (projectMatch.requireConfirmation) requiresConfirmation = true;
+      continue;
+    }
+    if (PROJECT_SCRIPT_COMMANDS.some((entry) => entry.re.test(rendered))) {
+      ruleIds.push("project-script-confirm");
+      requiresConfirmation = true;
+      continue;
+    }
+    const builtin = BUILTIN_ALLOWLIST.find((entry) => entry.re.test(rendered));
+    if (builtin === void 0) return null;
+    ruleIds.push(builtin.id);
+  }
+  return { ruleIds, requiresConfirmation };
+}
+function hasSequencingOperators(command) {
+  return /(\|\||&&|;|\||>>?|<|\n|\r)/.test(command);
+}
+function hasCommandSubstitution(command) {
+  return /(`|\$\()/.test(command);
+}
+function hasShellOperators(command) {
+  return hasSequencingOperators(command) || hasCommandSubstitution(command);
+}
+function isUnderOrSame(child, parent) {
+  const rel = path4.relative(
+    canonicalizeExistingPath(path4.resolve(parent)),
+    canonicalizeExistingPath(path4.resolve(child))
+  );
+  return rel === "" || !rel.startsWith("..") && !path4.isAbsolute(rel);
+}
+function commandArg(args) {
+  return typeof args?.command === "string" ? args.command : null;
+}
+function pathArg(args) {
+  if (!args) return null;
+  const candidate = args.path ?? args.file_path ?? args.filePath;
+  return typeof candidate === "string" && candidate.length > 0 ? candidate : null;
+}
+function cwdArg(args, fallback) {
+  const resolved = typeof args?.cwd === "string" && args.cwd.length > 0 ? path4.resolve(fallback, args.cwd) : fallback;
+  return canonicalizeExistingPath(resolved);
+}
+var CONTENT_BEARING_TOOLS = /* @__PURE__ */ new Set([
+  ToolNames.Write,
+  ToolNames.Edit,
+  ToolNames.Artifact,
+  ToolNames.Dispatch,
+  ToolNames.Tasks
+]);
+function damageControlScan(call) {
+  if (!CONTENT_BEARING_TOOLS.has(call.tool)) return serializeArgs(call.args);
+  const pathArg2 = call.args?.path;
+  return typeof pathArg2 === "string" ? pathArg2 : "";
+}
+function resolveVerifyCatalogCheck(call, workspaceRoot) {
+  if (call.tool !== ToolNames.Verify) return null;
+  const check = call.args?.check;
+  if (typeof check !== "string") return null;
+  const id = check.trim();
+  if (id.length === 0 || id === "frontend") return null;
+  try {
+    const catalog = loadProjectVerifierCatalog(workspaceRoot);
+    if (!catalog.ok || catalog.source === null) return null;
+    return catalog.source.checks.find((candidate) => candidate.id === id) ?? null;
+  } catch {
+    return null;
+  }
+}
+function serializeArgs(args) {
+  if (!args) return "";
+  const parts = [];
+  for (const v of Object.values(args)) {
+    if (v == null) continue;
+    if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") parts.push(String(v));
+    else {
+      try {
+        parts.push(JSON.stringify(v));
+      } catch {
+      }
+    }
+  }
+  return parts.join(" ");
+}
+function rulePackHash(packs) {
+  const payload = {
+    base: packPayload(packs.base.rules)
+  };
+  return createHash2("sha256").update(JSON.stringify(payload), "utf8").digest("hex");
+}
+function packPayload(rules) {
+  return rules.map((rule) => ({
+    id: rule.id,
+    description: rule.description,
+    pattern: rule.pattern.source,
+    class: rule.class,
+    block: rule.block,
+    ...rule.ask !== void 0 ? { ask: rule.ask } : {}
+  }));
+}
+function invokesTrustMutation(command) {
+  const words = scanShellLike(command).filter((token) => !token.operator).map((token) => token.value);
+  return words.some((word, index) => word === "config" && words[index + 1] === "trust") || /\bconfig\s+trust\b/.test(inlineShellScript(command) ?? "");
+}
+function projectScriptPreview(command, cwd) {
+  const match = /^npm\s+(?:run\s+)?([\w:-]+)/.exec(command);
+  if (match) {
+    try {
+      const manifest = JSON.parse(readFileSync3(path4.join(cwd, "package.json"), "utf8"));
+      const name = match[1] ?? "test";
+      const scripts = [`pre${name}`, name, `post${name}`].flatMap(
+        (key) => typeof manifest.scripts?.[key] === "string" ? [`${key}: ${manifest.scripts[key]}`] : []
+      );
+      return `package.json scripts (repository data): ${scripts.join("; ") || "no script resolved"}`;
+    } catch {
+      return "package.json script body could not be resolved; repository code will execute.";
+    }
+  }
+  return `Repository command: ${command}. Its test/build files and dependencies execute with the child process permissions.`;
+}
+
+export {
+  formatModelRejection,
+  WRITE_ROOT_REFUSED_TOOLS,
+  createSafetyPolicyEngine
+};
+//# sourceMappingURL=chunk-RAUOKUZV.js.map