@mafdet/cli 0.3.0

package/dist/commands/speech.js

@@ -0,0 +1,111 @@
+import { readFileSync } from "node:fs";
+import { ApiError } from "../api/errors.js";
+import { assertSurface, fetchCatalog, SurfaceMismatchError, } from "../api/models.js";
+import { ExitCode } from "../output/exit-codes.js";
+import { writeOutputFile } from "../output/write-file.js";
+import { buildRuntime, reportError, requireApiKey, } from "./runtime.js";
+const USAGE = `Usage:
+  mafdet speech [text | <file>] --model <id> --output <file> [--voice <name>] [--force]
+
+Reads the text from an argument, a file, or stdin. --output is required:
+audio is binary and must never be written to a terminal.
+`;
+export async function speechCommand(argv, io) {
+    try {
+        const runtime = buildRuntime(io);
+        requireApiKey(runtime.config);
+        let model = runtime.config.model;
+        let output;
+        let voice;
+        let force = false;
+        const positional = [];
+        for (let i = 0; i < argv.length; i += 1) {
+            const arg = argv[i];
+            const next = () => argv[(i += 1)];
+            if (arg === "--model")
+                model = next();
+            else if (arg === "--output" || arg === "-o")
+                output = next();
+            else if (arg === "--voice")
+                voice = next();
+            else if (arg === "--force")
+                force = true;
+            else if (arg.startsWith("--")) {
+                io.stderr(`mafdet speech: unknown option '${arg}'\n${USAGE}`);
+                return ExitCode.Usage;
+            }
+            else
+                positional.push(arg);
+        }
+        if (!model) {
+            io.stderr("mafdet speech: no model. Pass --model or set MAFDET_MODEL.\n");
+            return ExitCode.Usage;
+        }
+        if (!output) {
+            // Binary on a terminal corrupts the session and loses the audio.
+            io.stderr(`mafdet speech: --output is required\n${USAGE}`);
+            return ExitCode.Usage;
+        }
+        const input = await resolveInput(positional, io);
+        if (input === undefined)
+            return ExitCode.Usage;
+        const catalog = await fetchCatalog(runtime.accountPlane).catch(() => []);
+        assertSurface(catalog, model, "AUDIO_SPEECH");
+        const body = { model, input };
+        if (voice)
+            body.voice = voice;
+        const response = await runtime.dataPlane.postBinary("/audio/speech", body);
+        if (response.data.byteLength === 0) {
+            throw new ApiError({
+                kind: "server",
+                exitCode: ExitCode.Unavailable,
+                requestId: response.requestId,
+                message: "the API returned no audio",
+            });
+        }
+        writeOutputFile(output, response.data, { force });
+        io.stderr(`wrote ${output} (${response.data.byteLength} bytes, ${response.headers.get("content-type") ?? "unknown type"})\n`);
+        return ExitCode.Ok;
+    }
+    catch (error) {
+        if (error instanceof SurfaceMismatchError) {
+            io.stderr(`mafdet speech: ${error.message}\n`);
+            return ExitCode.Usage;
+        }
+        // The gateway requires a voice for TTS and says so with a code; turn that
+        // into the flag the user needs to add.
+        if (error instanceof ApiError && error.code === "TTS_VOICE_REQUIRED") {
+            io.stderr("mafdet speech: this model needs a voice - pass --voice <name> (for example --voice Kore)\n");
+            return ExitCode.Usage;
+        }
+        return reportError(error, io);
+    }
+}
+async function resolveInput(positional, io) {
+    if (positional.length > 1) {
+        io.stderr(`mafdet speech: expected one input, got ${positional.length}\n${USAGE}`);
+        return undefined;
+    }
+    if (positional.length === 1) {
+        const value = positional[0];
+        try {
+            return readFileSync(value, "utf8");
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return value;
+            throw new ApiError({
+                kind: "request",
+                exitCode: ExitCode.Usage,
+                message: `cannot read ${value}: ${error.message}`,
+            });
+        }
+    }
+    if (io.readStdin && !process.stdin.isTTY) {
+        const piped = (await io.readStdin()).trim();
+        if (piped.length > 0)
+            return piped;
+    }
+    io.stderr(`mafdet speech: no input\n${USAGE}`);
+    return undefined;
+}

package/dist/config/config.d.ts

@@ -0,0 +1,57 @@
+import { z } from "zod";
+export declare const DEFAULT_BASE_URL = "https://api.mafdet.ai/v1";
+export declare const DEFAULT_BACKEND_URL = "https://backend.mafdet.ai";
+export declare class ConfigError extends Error {
+    constructor(message: string);
+}
+declare const projectConfigSchema: z.ZodObject<{
+    model: z.ZodOptional<z.ZodString>;
+    approvalMode: z.ZodOptional<z.ZodEnum<{
+        "read-only": "read-only";
+        suggest: "suggest";
+        "auto-edit": "auto-edit";
+    }>>;
+    testCommands: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+declare const userConfigSchema: z.ZodObject<{
+    model: z.ZodOptional<z.ZodString>;
+    approvalMode: z.ZodOptional<z.ZodEnum<{
+        "read-only": "read-only";
+        suggest: "suggest";
+        "auto-edit": "auto-edit";
+    }>>;
+    baseUrl: z.ZodOptional<z.ZodString>;
+    backendUrl: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type ProjectConfig = z.infer<typeof projectConfigSchema>;
+export type UserConfig = z.infer<typeof userConfigSchema>;
+/**
+ * Remote endpoints must be HTTPS. Plain HTTP is allowed only against the local
+ * machine, where there is no network to intercept — that exception exists so a
+ * developer can point the CLI at a local proxy without a certificate.
+ */
+export declare function assertTransportAllowed(rawUrl: string, field: string): URL;
+export declare function parseUserConfig(raw: unknown, source: string): UserConfig;
+export declare function parseProjectConfig(raw: unknown, source: string): ProjectConfig;
+export interface ResolveInput {
+    /** Parsed `--model`, highest precedence. */
+    flags?: {
+        model?: string;
+    };
+    env?: NodeJS.ProcessEnv;
+    project?: ProjectConfig;
+    user?: UserConfig;
+}
+export interface ResolvedConfig {
+    model?: string;
+    /** Where `model` came from — `mafdet config list` shows this. */
+    modelSource: "flag" | "env" | "project" | "user" | "none";
+    baseUrl: string;
+    backendUrl: string;
+    approvalMode: "read-only" | "suggest" | "auto-edit";
+    apiKey?: string;
+}
+/** Plan §5.1: flag > env > project > user > default. */
+export declare function resolveConfig(input?: ResolveInput): ResolvedConfig;
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/config/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAC3D,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM;CAK5B;AAYD,QAAA,MAAM,mBAAmB;;;;;;;;kBAMd,CAAC;AAEZ,QAAA,MAAM,gBAAgB;;;;;;;;;kBAOX,CAAC;AAEZ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,GAAG,CAczE;AAOD,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAWxE;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,MAAM,GACb,aAAa,CAcf;AAED,MAAM,WAAW,YAAY;IAC3B,4CAA4C;IAC5C,KAAK,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,WAAW,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,WAAW,GAAG,SAAS,GAAG,WAAW,CAAC;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wDAAwD;AACxD,wBAAgB,aAAa,CAAC,KAAK,GAAE,YAAiB,GAAG,cAAc,CAiCtE"}

package/dist/config/config.js

@@ -0,0 +1,129 @@
+import { z } from "zod";
+import { redact } from "../security/redact.js";
+export const DEFAULT_BASE_URL = "https://api.mafdet.ai/v1";
+export const DEFAULT_BACKEND_URL = "https://backend.mafdet.ai";
+export class ConfigError extends Error {
+    constructor(message) {
+        // The message may quote a config value; redact before it can be printed.
+        super(redact(message));
+        this.name = "ConfigError";
+    }
+}
+/**
+ * Settings a project may carry. A repository is untrusted input: cloning it
+ * must never change where the CLI sends the key, so connection settings and
+ * credentials are not merely ignored here — they are rejected loudly, because
+ * silently dropping them would hide an attempt to redirect traffic.
+ */
+const FORBIDDEN_IN_PROJECT = ["apiKey", "baseUrl", "backendUrl"];
+const approvalMode = z.enum(["read-only", "suggest", "auto-edit"]);
+const projectConfigSchema = z
+    .object({
+    model: z.string().min(1).optional(),
+    approvalMode: approvalMode.optional(),
+    testCommands: z.array(z.string().min(1)).optional(),
+})
+    .strict();
+const userConfigSchema = z
+    .object({
+    model: z.string().min(1).optional(),
+    approvalMode: approvalMode.optional(),
+    baseUrl: z.string().url().optional(),
+    backendUrl: z.string().url().optional(),
+})
+    .strict();
+/**
+ * Remote endpoints must be HTTPS. Plain HTTP is allowed only against the local
+ * machine, where there is no network to intercept — that exception exists so a
+ * developer can point the CLI at a local proxy without a certificate.
+ */
+export function assertTransportAllowed(rawUrl, field) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        throw new ConfigError(`${field} is not a valid URL: ${rawUrl}`);
+    }
+    if (url.protocol === "https:")
+        return url;
+    if (url.protocol === "http:" && isLoopback(url.hostname))
+        return url;
+    throw new ConfigError(`${field} must use https (plain http is allowed only for localhost): ${rawUrl}`);
+}
+function isLoopback(hostname) {
+    const host = hostname.replace(/^\[|\]$/g, "");
+    return host === "localhost" || host === "127.0.0.1" || host === "::1";
+}
+export function parseUserConfig(raw, source) {
+    if (hasKey(raw, "apiKey")) {
+        throw new ConfigError(`${source} contains an apiKey. The CLI never reads a key from a file - remove it and set MAFDET_API_KEY instead.`);
+    }
+    const parsed = userConfigSchema.safeParse(raw);
+    if (!parsed.success) {
+        throw new ConfigError(`${source} is invalid: ${issueText(parsed.error)}`);
+    }
+    return parsed.data;
+}
+export function parseProjectConfig(raw, source) {
+    for (const forbidden of FORBIDDEN_IN_PROJECT) {
+        if (hasKey(raw, forbidden)) {
+            throw new ConfigError(`${source} sets '${forbidden}', which a project may not control. ` +
+                `Credentials and endpoints come from the environment or your user config only.`);
+        }
+    }
+    const parsed = projectConfigSchema.safeParse(raw);
+    if (!parsed.success) {
+        throw new ConfigError(`${source} is invalid: ${issueText(parsed.error)}`);
+    }
+    return parsed.data;
+}
+/** Plan §5.1: flag > env > project > user > default. */
+export function resolveConfig(input = {}) {
+    const env = input.env ?? process.env;
+    const [model, modelSource] = firstOf([
+        ["flag", input.flags?.model],
+        ["env", trimmed(env.MAFDET_MODEL)],
+        ["project", input.project?.model],
+        ["user", input.user?.model],
+    ]);
+    // Endpoints deliberately skip the project layer.
+    const baseUrl = trimmed(env.MAFDET_BASE_URL) ?? input.user?.baseUrl ?? DEFAULT_BASE_URL;
+    const backendUrl = trimmed(env.MAFDET_BACKEND_URL) ??
+        input.user?.backendUrl ??
+        DEFAULT_BACKEND_URL;
+    assertTransportAllowed(baseUrl, "base URL");
+    assertTransportAllowed(backendUrl, "backend URL");
+    return {
+        model,
+        modelSource,
+        baseUrl,
+        backendUrl,
+        // read-only is the safe default; a caller raises it explicitly.
+        approvalMode: input.project?.approvalMode ?? input.user?.approvalMode ?? "read-only",
+        // The key is environment-only, by design (plan §5.4): a flag would put it
+        // in shell history and the process list, a file would outlive its use.
+        apiKey: trimmed(env.MAFDET_API_KEY),
+    };
+}
+function firstOf(candidates) {
+    for (const [source, value] of candidates) {
+        if (value !== undefined && value.length > 0)
+            return [value, source];
+    }
+    return [undefined, "none"];
+}
+function trimmed(value) {
+    const text = value?.trim();
+    return text && text.length > 0 ? text : undefined;
+}
+function hasKey(raw, key) {
+    return (typeof raw === "object" &&
+        raw !== null &&
+        Object.prototype.hasOwnProperty.call(raw, key));
+}
+function issueText(error) {
+    return error.issues
+        .map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`)
+        .join("; ");
+}

package/dist/config/load.d.ts

@@ -0,0 +1,20 @@
+import { type ResolvedConfig } from "./config.js";
+export interface LoadOptions {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    flags?: {
+        model?: string;
+    };
+    /** Overrides for tests; production resolves from the platform. */
+    userConfigFile?: string;
+}
+export interface LoadedConfig extends ResolvedConfig {
+    sources: {
+        userConfigPath: string;
+        projectConfigPath: string;
+        userConfigFound: boolean;
+        projectConfigFound: boolean;
+    };
+}
+export declare function loadConfig(options?: LoadOptions): LoadedConfig;
+//# sourceMappingURL=load.d.ts.map

package/dist/config/load.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../src/config/load.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,cAAc,EAKpB,MAAM,aAAa,CAAC;AAGrB,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3B,kEAAkE;IAClE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAa,SAAQ,cAAc;IAClD,OAAO,EAAE;QACP,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,eAAe,EAAE,OAAO,CAAC;QACzB,kBAAkB,EAAE,OAAO,CAAC;KAC7B,CAAC;CACH;AAwBD,wBAAgB,UAAU,CAAC,OAAO,GAAE,WAAgB,GAAG,YAAY,CAyBlE"}

package/dist/config/load.js

@@ -0,0 +1,48 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { ConfigError, parseProjectConfig, parseUserConfig, resolveConfig, } from "./config.js";
+import { PROJECT_CONFIG_FILE, userConfigPath } from "./paths.js";
+/** Read a JSON config if it exists. A missing file is normal; a broken one is not. */
+function readJsonIfPresent(path) {
+    let text;
+    try {
+        text = readFileSync(path, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return { found: false, value: undefined };
+        }
+        // Unreadable-but-present (permissions, a directory) must not be mistaken
+        // for absent: silently falling back would hide the user's real settings.
+        throw new ConfigError(`cannot read ${path}: ${error.message}`);
+    }
+    try {
+        return { found: true, value: JSON.parse(text) };
+    }
+    catch (error) {
+        throw new ConfigError(`${path} is not valid JSON: ${error.message}`);
+    }
+}
+export function loadConfig(options = {}) {
+    const env = options.env ?? process.env;
+    const cwd = options.cwd ?? process.cwd();
+    const userPath = options.userConfigFile ?? userConfigPath(env);
+    const projectPath = join(cwd, PROJECT_CONFIG_FILE);
+    const userRaw = readJsonIfPresent(userPath);
+    const projectRaw = readJsonIfPresent(projectPath);
+    const user = userRaw.found
+        ? parseUserConfig(userRaw.value, userPath)
+        : undefined;
+    const project = projectRaw.found
+        ? parseProjectConfig(projectRaw.value, projectPath)
+        : undefined;
+    return {
+        ...resolveConfig({ env, flags: options.flags, project, user }),
+        sources: {
+            userConfigPath: userPath,
+            projectConfigPath: projectPath,
+            userConfigFound: userRaw.found,
+            projectConfigFound: projectRaw.found,
+        },
+    };
+}

package/dist/config/paths.d.ts

@@ -0,0 +1,11 @@
+export declare const CONFIG_FILE = "config.json";
+/** Project-level config, read from the working directory. */
+export declare const PROJECT_CONFIG_FILE = ".mafdet.json";
+/**
+ * Per-platform user config directory (plan §5.3). XDG_CONFIG_HOME and APPDATA
+ * are honoured where the platform defines them, so a machine that relocates
+ * its config root keeps working.
+ */
+export declare function userConfigDir(env?: NodeJS.ProcessEnv, os?: string, home?: string): string;
+export declare function userConfigPath(env?: NodeJS.ProcessEnv, os?: string, home?: string): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/config/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/config/paths.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,6DAA6D;AAC7D,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAElD;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,EAAE,GAAE,MAAmB,EACvB,IAAI,GAAE,MAAkB,GACvB,MAAM,CAeR;AAED,wBAAgB,cAAc,CAC5B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,EAAE,GAAE,MAAmB,EACvB,IAAI,GAAE,MAAkB,GACvB,MAAM,CAER"}

package/dist/config/paths.js

@@ -0,0 +1,26 @@
+import { homedir, platform } from "node:os";
+import { join } from "node:path";
+export const CONFIG_FILE = "config.json";
+/** Project-level config, read from the working directory. */
+export const PROJECT_CONFIG_FILE = ".mafdet.json";
+/**
+ * Per-platform user config directory (plan §5.3). XDG_CONFIG_HOME and APPDATA
+ * are honoured where the platform defines them, so a machine that relocates
+ * its config root keeps working.
+ */
+export function userConfigDir(env = process.env, os = platform(), home = homedir()) {
+    if (os === "win32") {
+        const appData = env.APPDATA?.trim();
+        return join(appData && appData.length > 0
+            ? appData
+            : join(home, "AppData", "Roaming"), "mafdet");
+    }
+    if (os === "darwin") {
+        return join(home, "Library", "Application Support", "mafdet");
+    }
+    const xdg = env.XDG_CONFIG_HOME?.trim();
+    return join(xdg && xdg.length > 0 ? xdg : join(home, ".config"), "mafdet");
+}
+export function userConfigPath(env = process.env, os = platform(), home = homedir()) {
+    return join(userConfigDir(env, os, home), CONFIG_FILE);
+}

package/dist/filesystem/diff.d.ts

@@ -0,0 +1,12 @@
+/**
+ * A unified diff, generated locally so the user sees exactly what would change
+ * before approving it. No dependency: the input is two versions of one file,
+ * and an LCS over lines is enough.
+ */
+export interface DiffOptions {
+    /** Lines of unchanged context around each change. */
+    context?: number;
+    path?: string;
+}
+export declare function unifiedDiff(before: string, after: string, options?: DiffOptions): string;
+//# sourceMappingURL=diff.d.ts.map

package/dist/filesystem/diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../src/filesystem/diff.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,WAAgB,GACxB,MAAM,CAuER"}

package/dist/filesystem/diff.js

@@ -0,0 +1,109 @@
+/**
+ * A unified diff, generated locally so the user sees exactly what would change
+ * before approving it. No dependency: the input is two versions of one file,
+ * and an LCS over lines is enough.
+ */
+export function unifiedDiff(before, after, options = {}) {
+    const context = options.context ?? 3;
+    const a = before.split("\n");
+    const b = after.split("\n");
+    const ops = diffLines(a, b);
+    const hunks = [];
+    let index = 0;
+    while (index < ops.length) {
+        if (ops[index].kind === "same") {
+            index += 1;
+            continue;
+        }
+        // Grow a hunk over nearby changes so a cluster reads as one block.
+        let start = index;
+        let end = index;
+        for (let i = index; i < ops.length; i += 1) {
+            if (ops[i].kind !== "same") {
+                end = i;
+                continue;
+            }
+            let run = 0;
+            let j = i;
+            while (j < ops.length && ops[j].kind === "same") {
+                run += 1;
+                j += 1;
+            }
+            if (run > context * 2 || j >= ops.length)
+                break;
+            i = j - 1;
+        }
+        start = Math.max(0, start - context);
+        end = Math.min(ops.length - 1, end + context);
+        let aLine = 1;
+        let bLine = 1;
+        for (let i = 0; i < start; i += 1) {
+            if (ops[i].kind !== "add")
+                aLine += 1;
+            if (ops[i].kind !== "remove")
+                bLine += 1;
+        }
+        const body = [];
+        let aCount = 0;
+        let bCount = 0;
+        for (let i = start; i <= end; i += 1) {
+            const op = ops[i];
+            if (op.kind === "same") {
+                body.push(` ${op.line}`);
+                aCount += 1;
+                bCount += 1;
+            }
+            else if (op.kind === "remove") {
+                body.push(`-${op.line}`);
+                aCount += 1;
+            }
+            else {
+                body.push(`+${op.line}`);
+                bCount += 1;
+            }
+        }
+        hunks.push(`@@ -${aLine},${aCount} +${bLine},${bCount} @@\n${body.join("\n")}`);
+        index = end + 1;
+    }
+    if (hunks.length === 0)
+        return "";
+    const header = options.path
+        ? `--- a/${options.path}\n+++ b/${options.path}\n`
+        : "";
+    return `${header}${hunks.join("\n")}\n`;
+}
+/** Classic LCS table. Files here are bounded by MAX_FILE_BYTES, so this is fine. */
+function diffLines(a, b) {
+    const lengths = Array.from({ length: a.length + 1 }, () => new Array(b.length + 1).fill(0));
+    for (let i = a.length - 1; i >= 0; i -= 1) {
+        for (let j = b.length - 1; j >= 0; j -= 1) {
+            lengths[i][j] =
+                a[i] === b[j]
+                    ? lengths[i + 1][j + 1] + 1
+                    : Math.max(lengths[i + 1][j], lengths[i][j + 1]);
+        }
+    }
+    const ops = [];
+    let i = 0;
+    let j = 0;
+    while (i < a.length && j < b.length) {
+        if (a[i] === b[j]) {
+            ops.push({ kind: "same", line: a[i] });
+            i += 1;
+            j += 1;
+        }
+        else if (lengths[i + 1][j] >= lengths[i][j + 1]) {
+            ops.push({ kind: "remove", line: a[i] });
+            i += 1;
+        }
+        else {
+            ops.push({ kind: "add", line: b[j] });
+            j += 1;
+        }
+    }
+    while (i < a.length)
+        ops.push({ kind: "remove", line: a[i++] });
+    while (j < b.length)
+        ops.push({ kind: "add", line: b[j++] });
+    return ops;
+}

package/dist/filesystem/sensitive-files.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Files the agent may not touch, however the model asks.
+ *
+ * These are denied by path, before anything is opened, and there is no broad
+ * escape hatch: plan §8.3 rules out an `--allow-secrets` flag precisely
+ * because one flag would re-open all of it. A user who genuinely needs one of
+ * these files authorises that exact path.
+ */
+export interface SensitiveVerdict {
+    denied: boolean;
+    /** Which rule matched, for an explanation the user can act on. */
+    reason?: string;
+}
+/**
+ * @param relativePath workspace-relative, POSIX-separated, already validated
+ *   as inside the workspace.
+ */
+export declare function classifySensitivePath(relativePath: string): SensitiveVerdict;
+//# sourceMappingURL=sensitive-files.d.ts.map

package/dist/filesystem/sensitive-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-files.d.ts","sourceRoot":"","sources":["../../src/filesystem/sensitive-files.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAmBH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,gBAAgB,CAqB5E"}

package/dist/filesystem/sensitive-files.js

@@ -0,0 +1,46 @@
+/**
+ * Files the agent may not touch, however the model asks.
+ *
+ * These are denied by path, before anything is opened, and there is no broad
+ * escape hatch: plan §8.3 rules out an `--allow-secrets` flag precisely
+ * because one flag would re-open all of it. A user who genuinely needs one of
+ * these files authorises that exact path.
+ */
+/** Matched against each segment of the workspace-relative path. */
+const DENIED_SEGMENT_PATTERNS = [
+    /^\.env($|\.)/i, // .env, .env.local, .env.production
+    /\.pem$/i,
+    /\.key$/i,
+    /^id_rsa/i,
+    /^id_ecdsa/i,
+    /^id_ed25519/i,
+    /^kubeconfig$/i,
+    /^credentials/i,
+    /^\.npmrc$/i, // carries registry auth tokens
+    /^\.pgpass$/i,
+];
+/** Directories whose whole subtree is denied. */
+const DENIED_DIRECTORIES = [".ssh", ".aws", ".gnupg", ".docker", ".kube"];
+/**
+ * @param relativePath workspace-relative, POSIX-separated, already validated
+ *   as inside the workspace.
+ */
+export function classifySensitivePath(relativePath) {
+    const segments = relativePath.split("/").filter((part) => part.length > 0);
+    for (const directory of DENIED_DIRECTORIES) {
+        // Deny the directory itself and everything under it, at any depth: a
+        // nested checkout must not expose ~/.aws-style credentials either.
+        if (segments.some((segment) => segment.toLowerCase() === directory)) {
+            return { denied: true, reason: `${directory}/ holds credentials` };
+        }
+    }
+    const name = segments.at(-1);
+    if (!name)
+        return { denied: false };
+    for (const pattern of DENIED_SEGMENT_PATTERNS) {
+        if (pattern.test(name)) {
+            return { denied: true, reason: `${name} looks like a secret` };
+        }
+    }
+    return { denied: false };
+}