@jeger-ai/opengantry 3.7.0 → 3.8.0

package/dist/cli/lib/cage/cage-run.js

@@ -1,10 +1,14 @@
+import fs from "node:fs";
 import path from "node:path";
 import { getRepoRoot } from "../git/git.js";
 import { buildCageReport } from "./cage-report.js";
 import { resolveCageChanges } from "./cage-revert.js";
 import { buildCagePlan } from "./cage-rules.js";
-import { diffCageSnapshots, takeCageSnapshot } from "./cage-snapshot.js";
+import { CAGE_MAX_SCAN_BYTES, CAGE_MAX_TARGETS, diffCageSnapshots, takeCageSnapshot, } from "./cage-snapshot.js";
 import { signalExitCode, spawnCaged } from "./cage-process.js";
+import { createCagePushGuard } from "./cage-push-guard.js";
+import { CAGE_SESSION_ENV } from "./cage-suggest.js";
+import { CAGE_DEFAULT_WATCH_INTERVAL_MS, openCageSessionLog, startCageWatch, } from "./cage-watch.js";
 /** Per-file in-memory snapshot cap; larger revert-mode files are detect-only. */
 export const CAGE_DEFAULT_MAX_FILE_BYTES = 5 * 1024 * 1024;
 /** Total in-memory snapshot budget across all protected files. */
@@ -18,33 +22,97 @@ export function resolveCageRoot(cwd) {
         return path.resolve(cwd);
     }
 }
+function countRefusedPushes(log) {
+    if (!log || !fs.existsSync(log.path))
+        return 0;
+    return fs.readFileSync(log.path, "utf8").split("\n").filter((l) => l.includes('"event":"push_refused"')).length;
+}
+/** Live-restored changes first, then the final diff; a path changed again at exit takes the exit outcome. */
+function mergeChanges(live, final) {
+    const byPath = new Map(live ? live.restored : []);
+    for (const c of final) {
+        const earlier = byPath.get(c.abs);
+        byPath.set(c.abs, earlier ? { ...c, kind: earlier.kind, before: earlier.before } : c);
+    }
+    return [...byPath.values()].sort((a, b) => a.rel.localeCompare(b.rel));
+}
+function resolveSettings(opts) {
+    const cwd = path.resolve(opts.cwd ?? process.cwd());
+    const reportOnly = opts.reportOnly === true;
+    return {
+        cwd,
+        root: resolveCageRoot(cwd),
+        reportOnly,
+        watch: opts.watch !== false && !reportOnly,
+        intervalMs: opts.watchIntervalMs ?? CAGE_DEFAULT_WATCH_INTERVAL_MS,
+        pushGuard: opts.pushGuard !== false,
+        snap: {
+            keepBytes: !reportOnly,
+            maxFileBytes: opts.maxFileBytes ?? CAGE_DEFAULT_MAX_FILE_BYTES,
+            maxTotalBytes: opts.maxTotalBytes ?? CAGE_DEFAULT_MAX_TOTAL_BYTES,
+        },
+    };
+}
+/** Run the command with the session log, live watcher and push guard; always tear the guard down. */
+async function runSession(opts, s, plan, before) {
+    const log = s.watch || s.pushGuard ? openCageSessionLog() : null;
+    const guard = s.pushGuard ? createCagePushGuard(plan, log?.path ?? null) : null;
+    opts.onStart?.({
+        sessionLog: log?.path ?? null,
+        protectedFiles: before.entries.size,
+        watch: s.watch,
+        overrides: plan.overrides,
+        configCommitted: plan.config.committed,
+    });
+    const watcher = s.watch && log
+        ? startCageWatch({ plan, baseline: before, snapshotOptions: s.snap, intervalMs: s.intervalMs, log, bell: opts.bell })
+        : null;
+    try {
+        // The session marker lets setup-only commands (cage suggest) refuse to run inside the cage.
+        const proc = await spawnCaged(opts.command, s.cwd, { ...guard?.env, [CAGE_SESSION_ENV]: "1" });
+        return { proc, live: watcher?.stop() ?? null, log, guarded: guard !== null };
+    }
+    finally {
+        watcher?.stop();
+        guard?.dispose();
+    }
+}
 /**
- * Snapshot the protected set, run the command, diff, and revert protected changes.
- * Bytes stay in memory only; nothing is written outside the restored paths.
+ * Snapshot the protected set, run the command (restoring protected changes live unless `watch: false`),
+ * diff once more at exit, and restore what is left. Bytes stay in memory; the session log and the
+ * temporary hooks dir live in the OS temp dir, never in the repository.
  */
 export async function runCage(opts) {
-    const cwd = path.resolve(opts.cwd ?? process.cwd());
-    const root = resolveCageRoot(cwd);
-    const maxFileBytes = opts.maxFileBytes ?? CAGE_DEFAULT_MAX_FILE_BYTES;
-    const maxTotalBytes = opts.maxTotalBytes ?? CAGE_DEFAULT_MAX_TOTAL_BYTES;
-    const reportOnly = opts.reportOnly === true;
-    // Plan before spawning: an invalid manifest fails closed and the command never runs.
-    const plan = buildCagePlan(root);
-    const before = takeCageSnapshot(plan, { keepBytes: !reportOnly, maxFileBytes, maxTotalBytes });
-    const proc = await spawnCaged(opts.command, cwd);
-    const after = takeCageSnapshot(plan, { keepBytes: false, maxFileBytes, maxTotalBytes });
-    const changes = resolveCageChanges(diffCageSnapshots(before, after), { reportOnly });
+    const s = resolveSettings(opts);
+    // Plan and baseline before spawning: an invalid manifest, .cage.yaml or override, or a protected set
+    // over the caps, fails closed and the command never runs.
+    const plan = buildCagePlan(s.root, { overrides: opts.allowOverride });
+    const limits = { maxTargets: opts.maxTargets ?? CAGE_MAX_TARGETS, maxScanBytes: opts.maxScanBytes ?? CAGE_MAX_SCAN_BYTES };
+    const before = takeCageSnapshot(plan, { ...s.snap, limits });
+    const { proc, live, log, guarded } = await runSession(opts, s, plan, before);
+    const after = takeCageSnapshot(plan, { ...s.snap, keepBytes: false });
+    const changes = mergeChanges(live, resolveCageChanges(diffCageSnapshots(before, after), { reportOnly: s.reportOnly }));
     return buildCageReport({
         command: opts.command[0] ?? "",
         commandExitCode: proc.code,
         commandSignal: proc.signal,
         runtimeError: proc.spawnError,
-        root,
-        reportOnly,
-        maxFileBytes,
+        root: s.root,
+        reportOnly: s.reportOnly,
+        maxFileBytes: s.snap.maxFileBytes,
         protectedFiles: before.entries.size,
         manifestZones: plan.manifestZoneCount,
+        cageConfig: plan.config,
+        overrides: plan.overrides,
         changes,
+        watch: {
+            enabled: s.watch,
+            interval_ms: s.watch ? s.intervalMs : null,
+            live_restores: live?.liveRestores ?? 0,
+            contested: live?.contested ?? [],
+            session_log: log?.path ?? null,
+        },
+        pushGuard: { enabled: guarded, refused_pushes: countRefusedPushes(log) },
         signalExitCode,
     });
 }

package/dist/cli/lib/cage/cage-run.js.map

@@ -1 +1 @@
-{"version":3,"file":"cage-run.js","sourceRoot":"","sources":["../../../../src/cli/lib/cage/cage-run.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAmB,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/D,iFAAiF;AACjF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC3D,kEAAkE;AAClE,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAW7D,uGAAuG;AACvG,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAoB;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,2BAA2B,CAAC;IACtE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,4BAA4B,CAAC;IACzE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC;IAE5C,qFAAqF;IACrF,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IAErF,OAAO,eAAe,CAAC;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE;QAC9B,eAAe,EAAE,IAAI,CAAC,IAAI;QAC1B,aAAa,EAAE,IAAI,CAAC,MAAM;QAC1B,YAAY,EAAE,IAAI,CAAC,UAAU;QAC7B,IAAI;QACJ,UAAU;QACV,YAAY;QACZ,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QACnC,aAAa,EAAE,IAAI,CAAC,iBAAiB;QACrC,OAAO;QACP,cAAc;KACf,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"cage-run.js","sourceRoot":"","sources":["../../../../src/cli/lib/cage/cage-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAmB,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAA2B,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GAGjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,cAAc,GAGf,MAAM,iBAAiB,CAAC;AAEzB,iFAAiF;AACjF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC3D,kEAAkE;AAClE,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AA8B7D,uGAAuG;AACvG,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAA0B;IACpD,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAC/C,OAAO,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC,MAAM,CAAC;AAClH,CAAC;AAED,6GAA6G;AAC7G,SAAS,YAAY,CAAC,IAA6B,EAAE,KAA2B;IAC9E,MAAM,MAAM,GAAG,IAAI,GAAG,CAA6B,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACzE,CAAC;AAYD,SAAS,eAAe,CAAC,IAAoB;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC;IAC5C,OAAO;QACL,GAAG;QACH,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC;QAC1B,UAAU;QACV,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,UAAU;QAC1C,UAAU,EAAE,IAAI,CAAC,eAAe,IAAI,8BAA8B;QAClE,SAAS,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK;QACnC,IAAI,EAAE;YACJ,SAAS,EAAE,CAAC,UAAU;YACtB,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,2BAA2B;YAC9D,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,4BAA4B;SAClE;KACF,CAAC;AACJ,CAAC;AASD,qGAAqG;AACrG,KAAK,UAAU,UAAU,CACvB,IAAoB,EACpB,CAAe,EACf,IAAsC,EACtC,MAAoB;IAEpB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,UAAU,EAAE,GAAG,EAAE,IAAI,IAAI,IAAI;QAC7B,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QACnC,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;KACvC,CAAC,CAAC;IACH,MAAM,OAAO,GACX,CAAC,CAAC,KAAK,IAAI,GAAG;QACZ,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACrH,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,CAAC;QACH,4FAA4F;QAC5F,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/F,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;IAC/E,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,IAAI,EAAE,CAAC;QAChB,KAAK,EAAE,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAoB;IAChD,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAChC,qGAAqG;IACrG,0DAA0D;IAC1D,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,gBAAgB,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,mBAAmB,EAAE,CAAC;IAC3H,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,kBAAkB,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAEvH,OAAO,eAAe,CAAC;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE;QAC9B,eAAe,EAAE,IAAI,CAAC,IAAI;QAC1B,aAAa,EAAE,IAAI,CAAC,MAAM;QAC1B,YAAY,EAAE,IAAI,CAAC,UAAU;QAC7B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY;QACjC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QACnC,aAAa,EAAE,IAAI,CAAC,iBAAiB;QACrC,UAAU,EAAE,IAAI,CAAC,MAAM;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO;QACP,KAAK,EAAE;YACL,OAAO,EAAE,CAAC,CAAC,KAAK;YAChB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;YAC1C,aAAa,EAAE,IAAI,EAAE,YAAY,IAAI,CAAC;YACtC,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,EAAE;YAChC,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,IAAI;SAC/B;QACD,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,kBAAkB,CAAC,GAAG,CAAC,EAAE;QACxE,cAAc;KACf,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/lib/cage/cage-snapshot.d.ts

@@ -1,10 +1,15 @@
 import { type CagePlan, type CageRuleId, type CageRuleMode } from "./cage-rules.js";
+/** Baseline caps so an oversized or hostile protected set cannot stall the session. */
+export declare const CAGE_MAX_TARGETS = 5000;
+export declare const CAGE_MAX_SCAN_BYTES: number;
 export interface CageEntry {
     abs: string;
     /** POSIX path relative to the cage root (may start with `../` for a linked worktree git dir). */
     rel: string;
     rule: CageRuleId;
     mode: CageRuleMode;
+    /** A revert rule downgraded to report by `--allow-override`. */
+    overridden: boolean;
     type: "file" | "symlink";
     sha256: string;
     size: number;
@@ -21,6 +26,11 @@ export interface CageSnapshotOptions {
     keepBytes: boolean;
     maxFileBytes: number;
     maxTotalBytes: number;
+    /** Baseline only: abort when the protected set exceeds these caps (counts are reported). */
+    limits?: {
+        maxTargets: number;
+        maxScanBytes: number;
+    };
 }
 export interface CageChange {
     abs: string;
@@ -28,6 +38,7 @@ export interface CageChange {
     kind: "added" | "modified" | "deleted";
     rule: CageRuleId;
     mode: CageRuleMode;
+    overridden: boolean;
     before: CageEntry | null;
     after: CageEntry | null;
 }

package/dist/cli/lib/cage/cage-snapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cage-snapshot.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/cage/cage-snapshot.ts"],"names":[],"mappings":"AAIA,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,iGAAiG;IACjG,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,sFAAsF;IACtF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;IACvC,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;CACzB;AA+FD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAQxF;AAOD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,GAAG,UAAU,EAAE,CAezF"}
+{"version":3,"file":"cage-snapshot.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/cage/cage-snapshot.ts"],"names":[],"mappings":"AAKA,OAAO,EAKL,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AAEzB,uFAAuF;AACvF,eAAO,MAAM,gBAAgB,OAAO,CAAC;AACrC,eAAO,MAAM,mBAAmB,QAAmB,CAAC;AAEpD,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,iGAAiG;IACjG,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,YAAY,CAAC;IACnB,gEAAgE;IAChE,UAAU,EAAE,OAAO,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,sFAAsF;IACtF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,MAAM,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CACvD;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;IACvC,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;CACzB;AAqID,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAYxF;AAOD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,GAAG,UAAU,EAAE,CAezF"}

package/dist/cli/lib/cage/cage-snapshot.js

@@ -2,7 +2,11 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { toPosixRel } from "../cli-io.js";
-import { CAGE_RULE_MODES, CAGE_SCAN_SKIP_DIRS, cageBasenameRule, } from "./cage-rules.js";
+import { GantryUserError } from "../errors.js";
+import { CAGE_RULE_MODES, CAGE_SCAN_SKIP_DIRS, applyCageOverride, cageBasenameRule, } from "./cage-rules.js";
+/** Baseline caps so an oversized or hostile protected set cannot stall the session. */
+export const CAGE_MAX_TARGETS = 5000;
+export const CAGE_MAX_SCAN_BYTES = 64 * 1024 * 1024;
 const HASH_CHUNK_BYTES = 1024 * 1024;
 function sha256Hex(data) {
     return crypto.createHash("sha256").update(data).digest("hex");
@@ -23,10 +27,26 @@ function hashFileChunked(abs) {
     }
     return hash.digest("hex");
 }
-function readEntry(abs, rule, ctx) {
+/** Past a cap, keep counting sizes (lstat only, no hashing) so the error can state the full totals. */
+function countScan(abs, st, ctx) {
+    const limits = ctx.opts.limits;
+    if (!limits || ctx.scanned.seen.has(abs))
+        return ctx.scanned.over;
+    ctx.scanned.seen.add(abs);
+    ctx.scanned.files += 1;
+    ctx.scanned.bytes += st.isFile() ? st.size : 0;
+    if (ctx.scanned.files > limits.maxTargets || ctx.scanned.bytes > limits.maxScanBytes)
+        ctx.scanned.over = true;
+    return ctx.scanned.over;
+}
+function readEntry(abs, rule, ruleMode, ctx) {
     const st = fs.lstatSync(abs);
-    const mode = CAGE_RULE_MODES[rule];
-    const base = { abs, rel: toPosixRel(ctx.root, abs), rule, mode, fileMode: st.mode & 0o7777 };
+    if (countScan(abs, st, ctx))
+        return null;
+    const rel = toPosixRel(ctx.plan.root, abs);
+    const resolved = applyCageOverride(ctx.plan, rel, { rule, mode: ruleMode, overridden: false });
+    const mode = resolved.mode;
+    const base = { abs, rel, rule, mode, overridden: resolved.overridden, fileMode: st.mode & 0o7777 };
     if (st.isSymbolicLink()) {
         const target = fs.readlinkSync(abs);
         return { ...base, type: "symlink", sha256: sha256Hex(`symlink\0${target}`), size: 0, bytes: null, linkTarget: target };
@@ -42,13 +62,13 @@ function readEntry(abs, rule, ctx) {
     ctx.budget -= bytes.length;
     return { ...base, type: "file", sha256: sha256Hex(bytes), size: bytes.length, bytes, linkTarget: null };
 }
-function captureEntry(abs, rule, ctx) {
+function captureEntry(abs, rule, mode, ctx) {
     const existing = ctx.entries.get(abs);
     // A path matched by several rules keeps the strictest one (revert beats report).
-    if (existing && (existing.mode === "revert" || CAGE_RULE_MODES[rule] === "report"))
+    if (existing && (existing.mode === "revert" || existing.overridden || mode === "report"))
         return;
     try {
-        const entry = readEntry(abs, rule, ctx);
+        const entry = readEntry(abs, rule, mode, ctx);
         if (entry)
             ctx.entries.set(abs, entry);
     }
@@ -76,7 +96,7 @@ function walkTree(absDir, skipDirs, visit) {
             visit(child);
     }
 }
-function captureTarget(abs, rule, ctx) {
+function captureTarget(abs, rule, mode, ctx) {
     let st;
     try {
         st = fs.lstatSync(abs);
@@ -85,20 +105,42 @@ function captureTarget(abs, rule, ctx) {
         return;
     }
     if (st.isDirectory()) {
-        walkTree(abs, null, (child) => captureEntry(child, rule, ctx));
+        walkTree(abs, null, (child) => captureEntry(child, rule, mode, ctx));
+        return;
+    }
+    captureEntry(abs, rule, mode, ctx);
+}
+/** Whole-tree scan: built-in basename rules (`.env*`, lockfiles) and `.cage.yaml` globs. */
+function captureScanned(abs, ctx) {
+    const rule = cageBasenameRule(path.basename(abs));
+    if (rule)
+        captureEntry(abs, rule, CAGE_RULE_MODES[rule], ctx);
+    if (ctx.plan.globs.length === 0)
         return;
+    const rel = toPosixRel(ctx.plan.root, abs);
+    for (const g of ctx.plan.globs) {
+        if (g.re.test(rel))
+            captureEntry(abs, "cage_protect", g.mode, ctx);
     }
-    captureEntry(abs, rule, ctx);
+}
+function limitsError(ctx) {
+    const l = ctx.opts.limits;
+    const mib = (n) => (n / (1024 * 1024)).toFixed(1);
+    return new GantryUserError("GXT_CAGE_LIMITS_EXCEEDED", `cage: protected set too large: ${String(ctx.scanned.files)} file(s), ${mib(ctx.scanned.bytes)} MiB (limits ${String(l.maxTargets)} files, ${mib(l.maxScanBytes)} MiB); the command was not run`, "Narrow broad .cage.yaml or manifest forbidden_zones entries.", 2);
 }
 export function takeCageSnapshot(plan, opts) {
-    const ctx = { root: plan.root, opts, budget: opts.maxTotalBytes, entries: new Map() };
+    const ctx = {
+        plan,
+        opts,
+        budget: opts.maxTotalBytes,
+        entries: new Map(),
+        scanned: { files: 0, bytes: 0, over: false, seen: new Set() },
+    };
     for (const target of plan.targets)
-        captureTarget(target.abs, target.rule, ctx);
-    walkTree(plan.root, CAGE_SCAN_SKIP_DIRS, (abs) => {
-        const rule = cageBasenameRule(path.basename(abs));
-        if (rule)
-            captureEntry(abs, rule, ctx);
-    });
+        captureTarget(target.abs, target.rule, target.mode, ctx);
+    walkTree(plan.root, CAGE_SCAN_SKIP_DIRS, (abs) => captureScanned(abs, ctx));
+    if (ctx.scanned.over)
+        throw limitsError(ctx);
     return { entries: ctx.entries };
 }
 function entryChanged(a, b) {
@@ -121,7 +163,7 @@ export function diffCageSnapshots(before, after) {
         if (!kind)
             continue;
         const ref = (b ?? a);
-        changes.push({ abs, rel: ref.rel, kind, rule: ref.rule, mode: ref.mode, before: b, after: a });
+        changes.push({ abs, rel: ref.rel, kind, rule: ref.rule, mode: ref.mode, overridden: ref.overridden, before: b, after: a });
     }
     return changes.sort((x, y) => x.rel.localeCompare(y.rel));
 }

package/dist/cli/lib/cage/cage-snapshot.js.map

@@ -1 +1 @@
-{"version":3,"file":"cage-snapshot.js","sourceRoot":"","sources":["../../../../src/cli/lib/cage/cage-snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,gBAAgB,GAIjB,MAAM,iBAAiB,CAAC;AA6CzB,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAC;AAErC,SAAS,SAAS,CAAC,IAAqB;IACtC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,+EAA+E;AAC/E,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC3C,IAAI,CAAS,CAAC;QACd,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,IAAgB,EAAE,GAAmB;IACnE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC;IAC7F,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,YAAY,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACzH,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,IAAI,GACR,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC;IACvG,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC/G,CAAC;IACD,mFAAmF;IACnF,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;IAC3B,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAC1G,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,IAAgB,EAAE,GAAmB;IACtE,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtC,iFAAiF;IACjF,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC;QAAE,OAAO;IAC3F,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,KAAK;YAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,iFAAiF;IACnF,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,SAAS,QAAQ,CAAC,MAAc,EAAE,QAAoC,EAAE,KAA4B;IAClG,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC7D,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,cAAc,EAAE;YAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,IAAgB,EAAE,GAAmB;IACvE,IAAI,EAAY,CAAC;IACjB,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACrB,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAc,EAAE,IAAyB;IACxE,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IACtG,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO;QAAE,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/E,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,EAAE,CAAC,GAAG,EAAE,EAAE;QAC/C,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,IAAI;YAAE,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,YAAY,CAAC,CAAY,EAAE,CAAY;IAC9C,iEAAiE;IACjE,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAoB,EAAE,KAAmB;IACzE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC1C,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QACzC,IAAI,IAAI,GAA8B,IAAI,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,CAAC;YAAE,IAAI,GAAG,SAAS,CAAC;aACzB,IAAI,CAAC,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,OAAO,CAAC;aAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC;YAAE,IAAI,GAAG,UAAU,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"cage-snapshot.js","sourceRoot":"","sources":["../../../../src/cli/lib/cage/cage-snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,GAIjB,MAAM,iBAAiB,CAAC;AAEzB,uFAAuF;AACvF,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAoDpD,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAC;AAErC,SAAS,SAAS,CAAC,IAAqB;IACtC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,+EAA+E;AAC/E,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC3C,IAAI,CAAS,CAAC;QACd,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,uGAAuG;AACvG,SAAS,SAAS,CAAC,GAAW,EAAE,EAAY,EAAE,GAAmB;IAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;IAC/B,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IAClE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;IACvB,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,YAAY;QAAE,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAC9G,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;AAC1B,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,IAAgB,EAAE,QAAsB,EAAE,GAAmB;IAC3F,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAE,CAAC;IAChG,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC;IACnG,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,YAAY,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACzH,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,IAAI,GACR,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC;IACvG,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC/G,CAAC;IACD,mFAAmF;IACnF,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;IAC3B,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAC1G,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,IAAgB,EAAE,IAAkB,EAAE,GAAmB;IAC1F,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtC,iFAAiF;IACjF,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,IAAI,IAAI,KAAK,QAAQ,CAAC;QAAE,OAAO;IACjG,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,KAAK;YAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,iFAAiF;IACnF,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,SAAS,QAAQ,CAAC,MAAc,EAAE,QAAoC,EAAE,KAA4B;IAClG,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC7D,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,cAAc,EAAE;YAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,IAAgB,EAAE,IAAkB,EAAE,GAAmB;IAC3F,IAAI,EAAY,CAAC;IACjB,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACrB,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,4FAA4F;AAC5F,SAAS,cAAc,CAAC,GAAW,EAAE,GAAmB;IACtD,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,IAAI,IAAI;QAAE,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACxC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAmB;IACtC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,MAAO,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,IAAI,eAAe,CACxB,0BAA0B,EAC1B,kCAAkC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,gCAAgC,EAChM,8DAA8D,EAC9D,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAc,EAAE,IAAyB;IACxE,MAAM,GAAG,GAAmB;QAC1B,IAAI;QACJ,IAAI;QACJ,MAAM,EAAE,IAAI,CAAC,aAAa;QAC1B,OAAO,EAAE,IAAI,GAAG,EAAE;QAClB,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE;KAC9D,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO;QAAE,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5F,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5E,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI;QAAE,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,YAAY,CAAC,CAAY,EAAE,CAAY;IAC9C,iEAAiE;IACjE,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAoB,EAAE,KAAmB;IACzE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC1C,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QACzC,IAAI,IAAI,GAA8B,IAAI,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,CAAC;YAAE,IAAI,GAAG,SAAS,CAAC;aACzB,IAAI,CAAC,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,OAAO,CAAC;aAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC;YAAE,IAAI,GAAG,UAAU,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7H,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5D,CAAC"}

package/dist/cli/lib/cage/cage-suggest.d.ts

@@ -0,0 +1,28 @@
+import { type CageProtectEntry } from "./cage-config.js";
+/**
+ * `gantry cage suggest`: a developer-run setup step that proposes `.cage.yaml` protect entries from
+ * static heuristics. It only proposes; nothing it prints or writes is ever loaded by cage. A human
+ * reviews the proposal, moves it into `.cage.yaml` and commits it.
+ */
+export declare const CAGE_SUGGESTED_FILE = ".cage.yaml.suggested";
+/** Set by cage for the wrapped process tree; suggest refuses to run inside a session. */
+export declare const CAGE_SESSION_ENV = "GANTRY_CAGE_SESSION";
+export type CageSuggestCategory = "migrations" | "infrastructure" | "container" | "package_registry" | "code_owners" | "ci" | "git_hooks" | "keys";
+export interface CageSuggestion extends CageProtectEntry {
+    category: CageSuggestCategory;
+    reason: string;
+}
+export interface CageSuggestResult {
+    root: string;
+    suggestions: CageSuggestion[];
+    /** Matches left out because built-in rules or the existing `.cage.yaml` already protect them. */
+    already_covered: number;
+}
+export declare function suggestCageRules(root: string): CageSuggestResult;
+/** `.cage.yaml` text for the suggestions: one reason comment per entry; parses with the cage loader. */
+export declare function formatCageSuggestionsYaml(result: CageSuggestResult, existingConfig: boolean): string;
+/** Write `.cage.yaml.suggested` at the root; never `.cage.yaml`. Refuses to overwrite unless forced. */
+export declare function writeCageSuggestions(root: string, text: string, force: boolean): string;
+/** Inside a cage session the wrapped agent must not author cage rules, not even as a proposal. */
+export declare function assertOutsideCageSession(env?: NodeJS.ProcessEnv): void;
+//# sourceMappingURL=cage-suggest.d.ts.map

package/dist/cli/lib/cage/cage-suggest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cage-suggest.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/cage/cage-suggest.ts"],"names":[],"mappings":"AAIA,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAG3E;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,yBAAkC,CAAC;AAEnE,yFAAyF;AACzF,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AAEtD,MAAM,MAAM,mBAAmB,GAC3B,YAAY,GACZ,gBAAgB,GAChB,WAAW,GACX,kBAAkB,GAClB,aAAa,GACb,IAAI,GACJ,WAAW,GACX,MAAM,CAAC;AAEX,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACtD,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,iGAAiG;IACjG,eAAe,EAAE,MAAM,CAAC;CACzB;AA+GD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAWhE;AAED,wGAAwG;AACxG,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,OAAO,GAAG,MAAM,CAWpG;AAED,wGAAwG;AACxG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAWvF;AAED,kGAAkG;AAClG,wBAAgB,wBAAwB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI,CASnF"}

package/dist/cli/lib/cage/cage-suggest.js

@@ -0,0 +1,164 @@
+import fs from "node:fs";
+import path from "node:path";
+import { toPosixRel } from "../cli-io.js";
+import { GantryUserError } from "../errors.js";
+import { CAGE_CONFIG_FILE } from "./cage-config.js";
+import { CAGE_SCAN_SKIP_DIRS, buildCagePlan, classifyCagePath } from "./cage-rules.js";
+/**
+ * `gantry cage suggest`: a developer-run setup step that proposes `.cage.yaml` protect entries from
+ * static heuristics. It only proposes; nothing it prints or writes is ever loaded by cage. A human
+ * reviews the proposal, moves it into `.cage.yaml` and commits it.
+ */
+export const CAGE_SUGGESTED_FILE = `${CAGE_CONFIG_FILE}.suggested`;
+/** Set by cage for the wrapped process tree; suggest refuses to run inside a session. */
+export const CAGE_SESSION_ENV = "GANTRY_CAGE_SESSION";
+/** Directories protected as a whole tree when found anywhere (by exact name). */
+const DIR_RULES = new Map([
+    ["migrations", { category: "migrations", reason: "database migrations" }],
+    ["alembic", { category: "migrations", reason: "Alembic database migrations" }],
+    ["k8s", { category: "infrastructure", reason: "Kubernetes manifests" }],
+    ["kubernetes", { category: "infrastructure", reason: "Kubernetes manifests" }],
+    ["helm", { category: "infrastructure", reason: "Helm charts" }],
+    ["charts", { category: "infrastructure", reason: "Helm charts" }],
+    [".buildkite", { category: "ci", reason: "Buildkite pipeline" }],
+    [".woodpecker", { category: "ci", reason: "Woodpecker CI pipeline" }],
+    [".githooks", { category: "git_hooks", reason: "committed git hooks (run on commit and push)" }],
+    [".husky", { category: "git_hooks", reason: "Husky git hooks (run on commit and push)" }],
+]);
+/** Root-relative directory paths protected as a whole tree. */
+const DIR_PATHS = new Map([
+    ["db/migrate", { category: "migrations", reason: "Rails database migrations" }],
+    [".github/actions", { category: "ci", reason: "custom GitHub Actions run by CI" }],
+]);
+/** Files protected by exact basename wherever they are. */
+const FILE_RULES = new Map([
+    ["Dockerfile", { category: "container", reason: "container build definition" }],
+    ["docker-compose.yml", { category: "container", reason: "container runtime definition" }],
+    ["docker-compose.yaml", { category: "container", reason: "container runtime definition" }],
+    ["compose.yml", { category: "container", reason: "container runtime definition" }],
+    ["compose.yaml", { category: "container", reason: "container runtime definition" }],
+    [".npmrc", { category: "package_registry", reason: "npm registry and auth config" }],
+    [".yarnrc.yml", { category: "package_registry", reason: "Yarn registry and auth config" }],
+    [".pypirc", { category: "package_registry", reason: "PyPI upload credentials" }],
+    ["pip.conf", { category: "package_registry", reason: "pip index config" }],
+    [".gemrc", { category: "package_registry", reason: "RubyGems source config" }],
+    ["CODEOWNERS", { category: "code_owners", reason: "review ownership rules" }],
+    ["Jenkinsfile", { category: "ci", reason: "Jenkins pipeline" }],
+    ["bitbucket-pipelines.yml", { category: "ci", reason: "Bitbucket Pipelines config" }],
+    [".drone.yml", { category: "ci", reason: "Drone CI pipeline" }],
+    [".travis.yml", { category: "ci", reason: "Travis CI pipeline" }],
+    [".woodpecker.yml", { category: "ci", reason: "Woodpecker CI pipeline" }],
+    ["cloudbuild.yaml", { category: "ci", reason: "Google Cloud Build pipeline" }],
+    [".pre-commit-config.yaml", { category: "git_hooks", reason: "pre-commit hook config" }],
+    ["lefthook.yml", { category: "git_hooks", reason: "Lefthook git hook config" }],
+    ["lefthook.yaml", { category: "git_hooks", reason: "Lefthook git hook config" }],
+    [".lefthook.yml", { category: "git_hooks", reason: "Lefthook git hook config" }],
+]);
+/** Extensions protected repo-wide by glob once one such file exists. */
+const EXT_GLOBS = new Map([
+    [".tf", { category: "infrastructure", reason: "Terraform infrastructure" }],
+    [".tfvars", { category: "infrastructure", reason: "Terraform variables (often secrets)" }],
+    [".pem", { category: "keys", reason: "PEM keys and certificates" }],
+    [".key", { category: "keys", reason: "private keys" }],
+    [".p12", { category: "keys", reason: "PKCS#12 key stores" }],
+    [".pfx", { category: "keys", reason: "PKCS#12 key stores" }],
+]);
+/** Build output and vendored trees: anchors found there are not the project's own. */
+const SUGGEST_SKIP_DIRS = new Set([...CAGE_SCAN_SKIP_DIRS, "dist", "build", "vendor", "target"]);
+function dirRule(rel, name) {
+    return DIR_PATHS.get(rel) ?? DIR_RULES.get(name);
+}
+function fileRule(name) {
+    return FILE_RULES.get(name) ?? (name.startsWith("Dockerfile.") ? FILE_RULES.get("Dockerfile") : undefined);
+}
+function collect(root, absDir, found) {
+    let dirents;
+    try {
+        dirents = fs.readdirSync(absDir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const d of dirents) {
+        const abs = path.join(absDir, d.name);
+        const rel = toPosixRel(root, abs);
+        if (d.isDirectory()) {
+            if (SUGGEST_SKIP_DIRS.has(d.name))
+                continue;
+            const rule = dirRule(rel, d.name);
+            // A matched tree is suggested whole; nothing inside it needs its own entry.
+            if (rule)
+                found.set(`path:${rel}`, { kind: "path", value: rel, mode: "revert", ...rule });
+            else
+                collect(root, abs, found);
+            continue;
+        }
+        if (!d.isFile())
+            continue;
+        const byName = fileRule(d.name);
+        if (byName)
+            found.set(`path:${rel}`, { kind: "path", value: rel, mode: "revert", ...byName });
+        const ext = path.extname(d.name);
+        const byExt = EXT_GLOBS.get(ext);
+        if (byExt)
+            found.set(`glob:**/*${ext}`, { kind: "glob", value: `**/*${ext}`, mode: "revert", ...byExt });
+    }
+}
+/** Already protected: a path the plan reverts, or a glob `.cage.yaml` already lists verbatim. */
+function isCovered(plan, s) {
+    if (s.kind === "glob")
+        return plan.globs.some((g) => g.pattern === s.value && g.mode === "revert");
+    return classifyCagePath(plan, s.value, { overrides: false })?.mode === "revert";
+}
+function byCodePoint(a, b) {
+    if (a === b)
+        return 0;
+    return a < b ? -1 : 1;
+}
+export function suggestCageRules(root) {
+    // An invalid existing .cage.yaml fails closed here too, with the same message cage would give.
+    const plan = buildCagePlan(root);
+    const found = new Map();
+    collect(root, root, found);
+    const all = [...found.values()];
+    const suggestions = all
+        .filter((s) => !isCovered(plan, s))
+        // Code-point order, so the proposal is byte-identical across machines and locales.
+        .sort((a, b) => byCodePoint(a.value, b.value) || byCodePoint(a.kind, b.kind));
+    return { root, suggestions, already_covered: all.length - suggestions.length };
+}
+/** `.cage.yaml` text for the suggestions: one reason comment per entry; parses with the cage loader. */
+export function formatCageSuggestionsYaml(result, existingConfig) {
+    const head = [
+        "# Proposed by gantry cage suggest. Review every entry, then",
+        existingConfig
+            ? `# add the ones you want to the protect: list in ${CAGE_CONFIG_FILE} and commit it.`
+            : `# save the ones you want as ${CAGE_CONFIG_FILE} and commit it.`,
+        `# cage never reads this proposal.`,
+    ];
+    if (result.suggestions.length === 0)
+        return `${head.join("\n")}\nprotect: []\n`;
+    const body = result.suggestions.flatMap((s) => [`  # ${s.category}: ${s.reason}`, `  - ${s.kind}: ${JSON.stringify(s.value)}`]);
+    return `${[...head, "protect:", ...body].join("\n")}\n`;
+}
+/** Write `.cage.yaml.suggested` at the root; never `.cage.yaml`. Refuses to overwrite unless forced. */
+export function writeCageSuggestions(root, text, force) {
+    const file = path.join(root, CAGE_SUGGESTED_FILE);
+    try {
+        fs.writeFileSync(file, text, { flag: force ? "w" : "wx" });
+    }
+    catch (err) {
+        if (err.code === "EEXIST") {
+            throw new GantryUserError("GXT_CAGE_SUGGEST_EXISTS", `cage suggest: ${CAGE_SUGGESTED_FILE} already exists`, "Re-run with --force to replace it.", 2);
+        }
+        throw err;
+    }
+    return file;
+}
+/** Inside a cage session the wrapped agent must not author cage rules, not even as a proposal. */
+export function assertOutsideCageSession(env = process.env) {
+    if (env[CAGE_SESSION_ENV]) {
+        throw new GantryUserError("GXT_CAGE_SUGGEST_IN_SESSION", "cage suggest: refused inside a cage session; run it yourself, outside gantry cage", undefined, 2);
+    }
+}
+//# sourceMappingURL=cage-suggest.js.map

package/dist/cli/lib/cage/cage-suggest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cage-suggest.js","sourceRoot":"","sources":["../../../../src/cli/lib/cage/cage-suggest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAyB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,gBAAgB,EAAiB,MAAM,iBAAiB,CAAC;AAEtG;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,gBAAgB,YAAY,CAAC;AAEnE,yFAAyF;AACzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AA6BtD,iFAAiF;AACjF,MAAM,SAAS,GAAkC,IAAI,GAAG,CAAC;IACvD,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACzE,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAC9E,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvE,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC9E,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC/D,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACjE,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAChE,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACrE,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;IAChG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;CAC1F,CAAC,CAAC;AAEH,+DAA+D;AAC/D,MAAM,SAAS,GAAkC,IAAI,GAAG,CAAC;IACvD,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC/E,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;CACnF,CAAC,CAAC;AAEH,2DAA2D;AAC3D,MAAM,UAAU,GAAkC,IAAI,GAAG,CAAC;IACxD,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC/E,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IACzF,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC1F,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAClF,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IACnF,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IACpF,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IAC1F,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAChF,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC1E,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC9E,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC7E,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC/D,CAAC,yBAAyB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACrF,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC/D,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACjE,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACzE,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAC9E,CAAC,yBAAyB,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACxF,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC/E,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAChF,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;CACjF,CAAC,CAAC;AAEH,wEAAwE;AACxE,MAAM,SAAS,GAAkC,IAAI,GAAG,CAAC;IACvD,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC3E,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IAC1F,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IACnE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACtD,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC5D,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;CAC7D,CAAC,CAAC;AAEH,sFAAsF;AACtF,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,mBAAmB,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEtH,SAAS,OAAO,CAAC,GAAW,EAAE,IAAY;IACxC,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC7G,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,MAAc,EAAE,KAAkC;IAC/E,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACpB,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAClC,4EAA4E;YAC5E,IAAI,IAAI;gBAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;;gBACrF,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;YAAE,SAAS;QAC1B,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,MAAM;YAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC9F,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,YAAY,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAC3G,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,SAAS,SAAS,CAAC,IAAc,EAAE,CAAiB;IAClD,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACnG,OAAO,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC;AAClF,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACtB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,+FAA+F;IAC/F,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAChD,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAChC,MAAM,WAAW,GAAG,GAAG;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACnC,mFAAmF;SAClF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAChF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC;AACjF,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,yBAAyB,CAAC,MAAyB,EAAE,cAAuB;IAC1F,MAAM,IAAI,GAAG;QACX,6DAA6D;QAC7D,cAAc;YACZ,CAAC,CAAC,mDAAmD,gBAAgB,iBAAiB;YACtF,CAAC,CAAC,+BAA+B,gBAAgB,iBAAiB;QACpE,mCAAmC;KACpC,CAAC;IACF,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAChF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAChI,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,IAAY,EAAE,KAAc;IAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,eAAe,CAAC,yBAAyB,EAAE,iBAAiB,mBAAmB,iBAAiB,EAAE,oCAAoC,EAAE,CAAC,CAAC,CAAC;QACvJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,wBAAwB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC3E,IAAI,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CACvB,6BAA6B,EAC7B,mFAAmF,EACnF,SAAS,EACT,CAAC,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/cli/lib/cage/cage-watch.d.ts

@@ -0,0 +1,36 @@
+import { type CageResolvedChange } from "./cage-revert.js";
+import type { CagePlan } from "./cage-rules.js";
+import { type CageSnapshot, type CageSnapshotOptions } from "./cage-snapshot.js";
+/** Default live-check interval while the caged command runs. */
+export declare const CAGE_DEFAULT_WATCH_INTERVAL_MS = 1000;
+/** Live restores of one path before cage stops fighting the command and restores it only at exit. */
+export declare const CAGE_CONTEST_LIMIT = 3;
+/** Append-only session event log in the OS temp dir: one JSON object per line, never file bodies. */
+export interface CageSessionLog {
+    path: string;
+    append(event: Record<string, unknown>): void;
+}
+export declare function openCageSessionLog(dir?: string): CageSessionLog;
+export interface CageWatchSummary {
+    liveRestores: number;
+    contested: string[];
+    /** Live-resolved revert-rule changes, by path; the exit report merges these with the final diff. */
+    restored: Map<string, CageResolvedChange>;
+}
+export interface CageWatcher {
+    stop(): CageWatchSummary;
+}
+/**
+ * Re-snapshot the protected set on an interval while the command runs and restore revert-rule changes
+ * from the baseline bytes. Lockfiles stay report-only and are left for the exit report. A path restored
+ * {@link CAGE_CONTEST_LIMIT} times is marked contested and restored only at exit.
+ */
+export declare function startCageWatch(input: {
+    plan: CagePlan;
+    baseline: CageSnapshot;
+    snapshotOptions: CageSnapshotOptions;
+    intervalMs: number;
+    log: CageSessionLog;
+    bell?: () => void;
+}): CageWatcher;
+//# sourceMappingURL=cage-watch.d.ts.map

package/dist/cli/lib/cage/cage-watch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cage-watch.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/cage/cage-watch.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAuC,KAAK,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEtH,gEAAgE;AAChE,eAAO,MAAM,8BAA8B,OAAO,CAAC;AACnD,qGAAqG;AACrG,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAIpC,qGAAqG;AACrG,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC9C;AAED,wBAAgB,kBAAkB,CAAC,GAAG,SAAc,GAAG,cAAc,CASpE;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,oGAAoG;IACpG,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,IAAI,gBAAgB,CAAC;CAC1B;AA+CD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,YAAY,CAAC;IACvB,eAAe,EAAE,mBAAmB,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,cAAc,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC;CACnB,GAAG,WAAW,CA4Bd"}