@letterblack/lbe-exec 1.2.2

package/LICENSE

@@ -0,0 +1 @@
+SEE LICENSE IN LICENSE

package/README.md

@@ -0,0 +1,26 @@
+# @letterblack/lbe-exec
+
+Local host-signed execution for LetterBlack LBE.
+
+This package is the trusted, in-process controller layer. It accepts simple
+requests, creates the timestamp/nonce/signature envelope locally, validates it
+through the bundled WASM runtime, and executes approved file or allowlisted
+shell operations inside the configured project root.
+
+```js
+import { createLocalExecutor } from '@letterblack/lbe-exec';
+
+const lbe = createLocalExecutor({ rootDir: process.cwd() });
+const preview = await lbe.dryRun({ intent: 'write_file', target: 'report.md', content: 'draft' });
+const result = await lbe.execute({ intent: 'write_file', target: 'report.md', content: 'approved' });
+```
+
+`dryRun()` is strictly non-mutating: it does not create backups, write audit
+records, execute commands, modify files, or change policy.
+
+Shell execution is denied unless its command is explicitly listed in
+`shell.allowCommands`. File operations are constrained to `rootDir`, including
+against traversal and symlink escapes.
+
+Agents may call `policy.proposeRule()`. Only the trusted host/controller should
+call `policy.addRule()`.