@miller-tech/uap 2.21.2 → 2.36.1

package/dist/policies/sandbox-grants.js

@@ -0,0 +1,562 @@
+/**
+ * Per-session sandbox grants (the D2 consent ledger).
+ *
+ * `uap sandbox` is all-or-nothing authority: the workdir + scratch are
+ * writable, everything else is EROFS. That default is right, but real work
+ * sometimes needs one more hole (a config dir, a build cache outside the
+ * tree) — and the legacy answer, `UAP_SANDBOX_ALLOW=path:path`, was
+ * UNRECORDED authority: an env var nobody audited, invisible to the
+ * operator, surviving in shell histories and hook templates forever.
+ *
+ * This ledger is the fix: every extra hole is a GRANT — bounded by a
+ * session, a TTL, and a stated reason, recorded with who consented, and
+ * audit-logged on use. "Every new authority must state who consented"
+ * (ADR 0011, the P4 bar).
+ *
+ * Design rules (inherited from the attention-queue store, review-hardened):
+ * - the ledger is shared-write state in `.uap/`, so every string is
+ *   sanitized at INGEST and the load path re-applies the same sanitizer —
+ *   a planted row must not become a kernel-writable hole or reach
+ *   operator terminals;
+ * - atomic writes with unique tmp names (no fixed `.tmp` in shared dirs);
+ * - corrupt/unreadable ledger ⇒ EMPTY ledger: the safe direction for an
+ *   authority store is least authority (the sandbox itself stays the real
+ *   kernel boundary — a lost grant just means EROFS, not a breach);
+ * - every grant expires (default 8h, hard cap 7d): authority is bounded
+ *   by construction, and revocation is a single command;
+ * - fail-OPEN for the sandbox, fail-CLOSED for the holes: load problems
+ *   never crash a sandboxed run, they just yield no holes.
+ */
+import { appendFileSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from 'fs';
+import { randomBytes, randomUUID } from 'crypto';
+import { homedir } from 'os';
+import { dirname, join } from 'path';
+import { mainCheckoutRoot } from '../utils/checkout-root.js';
+import { ledgerHeadOf, pathCoversAnchorDir, readAnchor, verifyLedger, writeAnchor } from './sandbox-anchor.js';
+/** Audit-log retention: the trail is append-only history, but an unbounded
+ *  JSONL under the shared-write `.uap/` grows forever — past
+ *  the trigger it is compacted to the newest AUDIT_MAX_LINES event lines
+ *  (plus the triggering event and one `audit-compaction` marker), so the
+ *  file lands at AUDIT_MAX_LINES + 2. The compaction is itself audited, so
+ *  a pruned trail is an EXPECTED state, never a silent one. */
+export const AUDIT_MAX_LINES = 10_000;
+export const AUDIT_PRUNE_TRIGGER = 12_000;
+/** Default grant TTL: 8h — long enough for a working session, short enough
+ *  that a forgotten hole closes itself before the next one. */
+export const DEFAULT_GRANT_TTL_SECS = 28_800;
+/** Hard cap on grant TTL: authority must be re-consented weekly at most. */
+export const MAX_GRANT_TTL_SECS = 604_800;
+/** Paths per grant cap: a grant is a scoped exception, not a hole list. */
+export const MAX_PATHS_PER_GRANT = 8;
+/**
+ * Ledger file: `<mainCheckoutRoot>/.uap/sandbox-grants.json` — ONE ledger
+ * per checkout, not per cwd, anchored at the main checkout root like the
+ * attention queue (ADR 0010): the CLI can be invoked from any worktree
+ * subdir, and a per-cwd ledger would give the same session different
+ * authority depending on where the operator happened to stand. Today the
+ * CLI is the only consumer; the anchoring also keeps a future dashboard
+ * grants view (a natural P5 surface) reading the same file.
+ * `UAP_SANDBOX_GRANTS` pins an explicit file (tests, odd layouts).
+ */
+export function sandboxGrantsPath(projectRoot) {
+    const override = process.env.UAP_SANDBOX_GRANTS;
+    if (typeof override === 'string' && override.trim() !== '')
+        return override.trim();
+    return join(mainCheckoutRoot(projectRoot), '.uap', 'sandbox-grants.json');
+}
+/** Audit trail: append-only JSONL, one line per grant/revoke/sandbox-use. */
+export function sandboxAuditPath(projectRoot) {
+    const override = process.env.UAP_SANDBOX_AUDIT;
+    if (typeof override === 'string' && override.trim() !== '')
+        return override.trim();
+    return join(mainCheckoutRoot(projectRoot), '.uap', 'sandbox-audit.jsonl');
+}
+// ---------------------------------------------------------------------------
+// Sanitization — the ledger grants KERNEL-WRITABLE HOLES and feeds operator
+// terminals; ingested strings are untrusted by construction.
+// ---------------------------------------------------------------------------
+// eslint-disable-next-line no-control-regex -- stripping control characters IS the point
+const CONTROL_CHARS = /[\x00-\x1f\x7f]/g;
+function clean(s, max) {
+    if (typeof s !== 'string')
+        return '';
+    return s.replace(CONTROL_CHARS, ' ').trim().slice(0, max);
+}
+/**
+ * A grantable path must be ABSOLUTE, must exist (you grant a real hole, not
+ * a speculative one), and must not be an over-broad root — checked AFTER
+ * symlink resolution: `/tmp/link -> $HOME` passes a string-only refusal and
+ * bwrap's `--bind` follows the link, so the check that matters is against
+ * the REALPATH (`/`, `/home`, $HOME itself — the same refusal the sandbox
+ * applies to a too-broad workdir: an over-broad grant IS a sandbox escape).
+ * Returns the RESOLVED path (what the bind will actually target), or null.
+ */
+export function validateGrantPath(p) {
+    if (!p.startsWith('/'))
+        return null;
+    const home = process.env.HOME || homedir();
+    let resolved;
+    try {
+        if (!existsSync(p))
+            return null;
+        resolved = realpathSync(p);
+    }
+    catch {
+        return null;
+    }
+    if (resolved === '/' || resolved === '/home' || resolved === home)
+        return null;
+    return resolved;
+}
+function sanitizeGrant(raw) {
+    // `id` goes through the SAME clean() as every other string field: the row is
+    // rendered on operator terminals (the grants listing, the dashboard section,
+    // the revoke command line), and a planted id carrying ANSI/OSC bytes would
+    // fire exactly when the operator is drawn to inspect a tamper alarm
+    // (review M1, 2026-10-11). trim() alone was the one gap.
+    const id = clean(raw.id, 64);
+    const sessionId = clean(raw.sessionId, 64);
+    const reason = clean(raw.reason, 300);
+    const grantedBy = clean(raw.grantedBy, 64);
+    if (!id ||
+        !sessionId ||
+        !reason || // a grant without a stated reason is exactly what this ledger exists to refuse
+        !grantedBy ||
+        typeof raw.grantedAt !== 'string' ||
+        typeof raw.expiresAt !== 'string') {
+        return null;
+    }
+    const paths = [];
+    const rawPaths = Array.isArray(raw.paths) ? raw.paths : [];
+    for (const rp of rawPaths) {
+        if (typeof rp !== 'string')
+            return null;
+        // The load path re-applies the FULL grantable-path validation, not just
+        // a string prefix: a planted well-formed row with `paths:["/"]` would
+        // otherwise become a real `--bind / /` hole (the bind follows the row,
+        // so the row must carry nothing the operator would have refused — the
+        // review's blocker finding). A row with ANY
+        // ungrantable path is dropped whole: least authority, and a half-row
+        // is a forged consent record.
+        const p = validateGrantPath(clean(rp, 512));
+        if (!p)
+            return null;
+        if (!paths.includes(p))
+            paths.push(p);
+    }
+    if (paths.length === 0)
+        return null; // a grant must grant something
+    // Timestamps must parse, and the expiry must respect the hard TTL bound —
+    // a planted `expiresAt: "9999"` never lapses under the lexicographic
+    // compare in listAuthority, which is exactly the "forever grant" this
+    // ledger exists to prevent. `grantedAt` is kept as written (history), but
+    // must be a parseable instant.
+    if (!Number.isFinite(Date.parse(raw.grantedAt)))
+        return null;
+    const expiresMs = Date.parse(raw.expiresAt);
+    if (!Number.isFinite(expiresMs) || expiresMs > Date.now() + MAX_GRANT_TTL_SECS * 1000)
+        return null;
+    return {
+        id,
+        sessionId,
+        paths,
+        reason,
+        grantedBy,
+        grantedAt: raw.grantedAt,
+        expiresAt: raw.expiresAt,
+    };
+}
+// ---------------------------------------------------------------------------
+// Store — least-authority load, atomic persist.
+// ---------------------------------------------------------------------------
+function loadGrants(projectRoot) {
+    try {
+        const path = sandboxGrantsPath(projectRoot);
+        if (!existsSync(path))
+            return [];
+        const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+        if (!Array.isArray(parsed))
+            return [];
+        const grants = [];
+        for (const raw of parsed) {
+            if (typeof raw !== 'object' || raw === null)
+                continue;
+            const g = sanitizeGrant(raw);
+            if (g)
+                grants.push(g); // malformed rows are dropped, never fatal
+        }
+        return grants;
+    }
+    catch (err) {
+        // Unreadable ledger = empty ledger: the SAFE direction for authority.
+        // The sandbox keeps its kernel boundary; only the extra holes vanish.
+        console.warn(`[sandbox-grants] ledger unreadable, treating as empty (no extra holes): ${err instanceof Error ? err.message : String(err)}`);
+        return [];
+    }
+}
+function persistGrants(projectRoot, grants) {
+    try {
+        const path = sandboxGrantsPath(projectRoot);
+        // Create the TARGET's directory (not <cwd>/.uap): the ledger may live at
+        // the main checkout root while cwd is a worktree subdir, or at a
+        // UAP_SANDBOX_GRANTS override — mkdir-ing the wrong place fails the
+        // write it was supposed to enable.
+        mkdirSync(dirname(path), { recursive: true });
+        // Unique tmp name: a fixed `.tmp` in shared-write .uap/ is an
+        // interleave-truncate and symlink-clobber target (review finding).
+        const tmp = `${path}.${process.pid}-${randomBytes(3).toString('hex')}.tmp`;
+        writeFileSync(tmp, JSON.stringify(grants, null, 2), 'utf-8');
+        renameSync(tmp, path);
+        return true;
+    }
+    catch (err) {
+        // A failed persist is reported, never silent — but it must not throw:
+        // the caller (sandbox launch) treats "no persisted grants" as safe.
+        console.warn(`[sandbox-grants] ledger persist failed (grants NOT active for this session): ${err instanceof Error ? err.message : String(err)}`);
+        return false;
+    }
+}
+/** The last parseable seq in an audit line list (0 when none parse): seqs
+ *  are monotonic, so the last parseable line IS the high-water. A malformed
+ *  tail degrades to the last good seq, never to a collision. */
+function scanHighWater(lines) {
+    for (let i = lines.length - 1; i >= 0; i--) {
+        try {
+            const last = JSON.parse(lines[i]);
+            if (typeof last.seq === 'number' && Number.isFinite(last.seq))
+                return last.seq;
+        }
+        catch {
+            /* keep scanning */
+        }
+    }
+    return 0;
+}
+/** The audit file's high-water seq (0 when the file is absent, empty, or
+ *  wholly malformed) — what anchorMutation witnesses after an operation's
+ *  line has landed. */
+function auditHighWater(projectRoot) {
+    try {
+        const path = sandboxAuditPath(projectRoot);
+        if (!existsSync(path))
+            return 0;
+        const text = readFileSync(path, 'utf-8');
+        if (text.length === 0)
+            return 0;
+        return scanHighWater(text.split('\n').filter((l) => l.length > 0));
+    }
+    catch {
+        return 0;
+    }
+}
+/** Append one audit line. Append-only, best-effort, never throws. Every line
+ *  carries a monotonic `seq` — recovered as the max of the file's last
+ *  parseable seq and the ANCHOR's witnessed high-water, so numbering
+ *  survives compaction AND file deletion (a trail whose numbering can
+ *  restart is a forgeable trail). The file is compacted past
+ *  AUDIT_PRUNE_TRIGGER with the drop recorded in an `audit-compaction`
+ *  marker. */
+function audit(projectRoot, event) {
+    try {
+        const path = sandboxAuditPath(projectRoot);
+        mkdirSync(dirname(path), { recursive: true });
+        let lines = [];
+        let fileHi = 0;
+        if (existsSync(path)) {
+            const text = readFileSync(path, 'utf-8');
+            if (text.length > 0) {
+                lines = text.split('\n').filter((l) => l.length > 0);
+                // Scan BACKWARDS for the last parseable line: after a compaction the
+                // file holds 10k lines with seqs up in the 12k+ range, so the old
+                // `lines.length` fallback could REUSE a live seq number. A malformed
+                // tail degrades to (last good seq + 1), never to a collision.
+                fileHi = scanHighWater(lines);
+            }
+        }
+        // The anchor's seqHi covers what the FILE cannot: deletion. The anchor
+        // only witnesses seqs at recorded mutations, so a file grown past the
+        // anchor (e.g. by sandbox-run lines) still numbers correctly — max of
+        // both.
+        const seq = Math.max(fileHi, readAnchor(projectRoot)?.seqHi ?? 0) + 1;
+        if (lines.length + 1 > AUDIT_PRUNE_TRIGGER) {
+            const kept = lines.slice(-AUDIT_MAX_LINES);
+            kept.push(JSON.stringify({ ...event, seq }));
+            kept.push(JSON.stringify({
+                ts: new Date().toISOString(),
+                action: 'audit-compaction',
+                dropped: lines.length + 1 - kept.length,
+                seq: seq + 1,
+            }));
+            const tmp = `${path}.${process.pid}-${randomBytes(3).toString('hex')}.tmp`;
+            writeFileSync(tmp, kept.map((l) => `${l}\n`).join(''), 'utf-8');
+            renameSync(tmp, path);
+            return;
+        }
+        appendFileSync(path, `${JSON.stringify({ ...event, seq })}\n`, 'utf-8');
+    }
+    catch (err) {
+        console.warn(`[sandbox-grants] audit append failed (grant/revoke still applied): ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+// ---------------------------------------------------------------------------
+// Trust anchor (ADR 0011 follow-up, shipped): see sandbox-anchor.ts.
+// ---------------------------------------------------------------------------
+/** Verify the SANITIZED on-disk ledger against the out-of-checkout anchor.
+ *  'unanchored' is the pre-bootstrap state, not a failure. When `grants` is
+ *  passed (an already-loaded sanitized snapshot), the SAME snapshot is
+ *  verified and then acted on — the torn-read fix (a review finding):
+ *  loading the file twice left a window where the hash saw one state and
+ *  the resolver acted on another. */
+export function verifyLedgerIntegrity(projectRoot, grants) {
+    const onDisk = grants ?? loadGrants(projectRoot);
+    return verifyLedger(projectRoot, ledgerHeadOf(onDisk));
+}
+/** Advance the anchor to a CONFIRMED on-disk state (called only after the
+ *  lost-update guard proved the persist landed, and AFTER the operation's
+ *  audit line is written, so the seq high-water the anchor witnesses
+ *  includes it). A failed anchor write is loud but never fatal: the ledger
+ *  stays operative; verification is simply not possible until the next
+ *  recorded mutation succeeds. */
+function anchorMutation(projectRoot, confirmed) {
+    const prior = readAnchor(projectRoot);
+    const seqHi = Math.max(prior?.seqHi ?? 0, auditHighWater(projectRoot));
+    if (!writeAnchor(projectRoot, ledgerHeadOf(confirmed), (prior?.mutations ?? 0) + 1, seqHi)) {
+        console.warn('[sandbox-grants] trust-anchor write failed — the ledger is active but NOT verifiable; ' +
+            'the next successful grant/renew/revoke will try to anchor it');
+        return;
+    }
+    // Verify-after-write (review interleave finding): a concurrent writer's
+    // anchor landing between ours and the ledger read leaves a persistent
+    // false mismatch on a healthy ledger. Confirm ours is what the disk now
+    // holds; if not, say so — never a silent divergence.
+    const after = verifyLedgerIntegrity(projectRoot);
+    if (after.state !== 'ok') {
+        console.warn(`[sandbox-grants] the trust anchor moved to a concurrent writer's state after this mutation (${after.state}) — ` +
+            'if `uap sandbox grants` reports a mismatch you did not cause, re-run the last grant/revoke');
+    }
+}
+// ---------------------------------------------------------------------------
+// Operations.
+// ---------------------------------------------------------------------------
+/** Create a grant. Returns the grant, or a refusal reason. */
+export function grantAuthority(projectRoot, input) {
+    const sessionId = clean(input.sessionId, 64);
+    if (!sessionId)
+        return { ok: false, error: 'a grant requires --session <id> (the session this authority is scoped to)' };
+    const reason = clean(input.reason, 300);
+    if (!reason)
+        return { ok: false, error: 'a grant requires --reason "..." — consent must be stated, not implied' };
+    const paths = [];
+    for (const p of input.paths) {
+        const v = validateGrantPath(p);
+        if (!v)
+            return { ok: false, error: `not grantable: '${p}' (must be an existing absolute path, and not / , /home, or $HOME itself)` };
+        // The one hole that must never open: a grant covering the trust-anchor
+        // dir lets the sandboxed side delete or corrupt the tamper evidence
+        // itself (the anchor is ro-bound by default, but a hole
+        // over it makes it writable).
+        if (pathCoversAnchorDir(v)) {
+            return { ok: false, error: `not grantable: '${p}' covers the sandbox trust-anchor directory — a hole there could destroy the tamper evidence itself` };
+        }
+        if (!paths.includes(v))
+            paths.push(v);
+        if (paths.length > MAX_PATHS_PER_GRANT)
+            return { ok: false, error: `more than ${MAX_PATHS_PER_GRANT} paths in one grant — split it` };
+    }
+    if (paths.length === 0) {
+        return { ok: false, error: 'a grant grants something: pass at least one writable path' };
+    }
+    // TTL is FAIL-CLOSED on garbage: undefined → the 8h default, but a
+    // non-numeric or negative --ttl is REFUSED outright (the security
+    // review caught bad input silently meaning "give 8h anyway" — the wrong
+    // direction for authority). 0 floors to 1s: a
+    // zero-second grant is a recorded consent that expires immediately.
+    let ttl;
+    if (input.ttlSecs === undefined) {
+        ttl = DEFAULT_GRANT_TTL_SECS;
+    }
+    else if (!Number.isFinite(input.ttlSecs) || input.ttlSecs < 0) {
+        return { ok: false, error: `--ttl must be a non-negative number of seconds (got '${input.ttlSecs}')` };
+    }
+    else {
+        ttl = Math.min(Math.max(1, Math.floor(input.ttlSecs)), MAX_GRANT_TTL_SECS);
+    }
+    const now = new Date();
+    const grant = {
+        id: `sbg-${randomUUID().slice(0, 8)}`,
+        sessionId,
+        paths,
+        reason,
+        grantedBy: process.env.USER || process.env.LOGNAME || 'unknown',
+        grantedAt: now.toISOString(),
+        expiresAt: new Date(now.getTime() + ttl * 1000).toISOString(),
+    };
+    for (let attempt = 0;; attempt++) {
+        // ONE load, ONE hash, one array to act on (the torn-read fix — a
+        // review finding): verifying a separate read left a window where the
+        // hash saw one state and the mint acted on another.
+        const loaded = loadGrants(projectRoot);
+        const integrity = verifyLedgerIntegrity(projectRoot, loaded);
+        if (integrity.state === 'mismatch') {
+            // A tampered ledger must not mint legitimacy: refuse to RECORD new
+            // consent on top of a state that failed integrity verification.
+            return {
+                ok: false,
+                error: `ledger failed integrity verification — ${integrity.detail}; refusing to record new consent until it is resolved`,
+            };
+        }
+        const existing = loaded.filter((g) => g.expiresAt > now.toISOString());
+        // Dedupe: an identical open grant (same session + same paths) is refreshed,
+        // not duplicated — a second `grant` for the same hole renews its TTL.
+        const twin = existing.find((g) => g.sessionId === grant.sessionId && g.paths.length === grant.paths.length && grant.paths.every((p) => g.paths.includes(p)));
+        if (twin) {
+            twin.expiresAt = grant.expiresAt;
+            twin.reason = grant.reason;
+            twin.grantedAt = grant.grantedAt;
+            // A failed persist must not be reported as a renewal: the OLD expiry
+            // stays active (the safe direction), and the operator keeps the truth.
+            if (!persistGrants(projectRoot, existing)) {
+                return { ok: false, error: 'ledger persist failed — the renewal is NOT active (the previous expiry stands)' };
+            }
+            // Lost-update guard: load→modify→persist has no lock, and the atomic
+            // rename prevents corruption, not lost updates — a concurrent writer
+            // landing after ours drops our renewal while we report success.
+            // Verify ours survived; retry once against the fresh state.
+            const confirmedAll = loadGrants(projectRoot);
+            const after = confirmedAll.find((g) => g.id === twin.id);
+            if (!after || after.expiresAt !== twin.expiresAt) {
+                if (attempt === 0)
+                    continue;
+                return { ok: false, error: 'ledger changed under a concurrent writer — renewal not confirmed; retry the grant' };
+            }
+            // Audit FIRST, then anchor: the anchor witnesses the audit high-water,
+            // and it must include this operation's line (audit-then-anchor is what
+            // makes seq survive audit-file deletion — the anchor's seqHi is the
+            // floor the next line numbers from).
+            audit(projectRoot, { ts: grant.grantedAt, action: 'grant-renewed', grantId: twin.id, sessionId, paths, reason });
+            anchorMutation(projectRoot, confirmedAll);
+            return { ok: true, grant: twin };
+        }
+        const all = [...existing, grant];
+        if (!persistGrants(projectRoot, all)) {
+            return { ok: false, error: 'ledger persist failed — the grant is NOT active (refusing to report success)' };
+        }
+        // Lost-update guard (same shape as the renewal path): two concurrent
+        // grants can both read-modify-write and silently drop the loser's row
+        // while its CLI reports success — verify the row survived before
+        // claiming the grant active.
+        const confirmedAll = loadGrants(projectRoot);
+        if (!confirmedAll.some((g) => g.id === grant.id)) {
+            if (attempt === 0)
+                continue;
+            return { ok: false, error: 'ledger changed under a concurrent writer — the grant is NOT confirmed; retry' };
+        }
+        // Audit FIRST, then anchor — same reason as the renewal path above.
+        audit(projectRoot, { ts: grant.grantedAt, action: 'grant', grantId: grant.id, sessionId, paths, reason, ttlSecs: ttl });
+        anchorMutation(projectRoot, confirmedAll);
+        return { ok: true, grant };
+    }
+}
+/** List grants, optionally scoped to one session. Expired rows are inert. */
+export function listAuthority(projectRoot, sessionId) {
+    const nowIso = new Date().toISOString();
+    const sid = sessionId ? clean(sessionId, 64) : '';
+    return loadGrants(projectRoot).filter((g) => g.expiresAt > nowIso && (!sid || g.sessionId === sid));
+}
+/** Revoke one grant by id. Returns true only when it was found AND removed
+ *  from the ledger — a failed persist leaves the grant active, and reporting
+ *  success over a live grant would be a false consent record. */
+export function revokeAuthority(projectRoot, grantId) {
+    const id = clean(grantId, 64);
+    // A mismatched ledger may still LOSE authority (revoking is the safe
+    // direction) — but the revoke re-anchors the remaining rows as the new
+    // baseline, so a pre-existing mismatch is named loudly at the exact
+    // moment it stops being detectable.
+    const preIntegrity = verifyLedgerIntegrity(projectRoot);
+    for (let attempt = 0;; attempt++) {
+        const all = loadGrants(projectRoot);
+        const keep = all.filter((g) => g.id !== id);
+        if (keep.length === all.length)
+            return false;
+        if (!persistGrants(projectRoot, keep))
+            return false;
+        // Lost-update guard (security review): a concurrent writer landing
+        // after our persist can resurrect the row; verify the removal actually
+        // landed before reporting success, retrying once against fresh state.
+        const confirmedAll = loadGrants(projectRoot);
+        if (confirmedAll.some((g) => g.id === id)) {
+            if (attempt === 0)
+                continue;
+            return false;
+        }
+        // Audit FIRST, then anchor — same reason as the grant/renew paths.
+        audit(projectRoot, { ts: new Date().toISOString(), action: 'revoke', grantId: id });
+        anchorMutation(projectRoot, confirmedAll);
+        if (preIntegrity.state === 'mismatch') {
+            console.warn(`[sandbox-grants] NOTE: the ledger had failed integrity verification before this revoke — ${preIntegrity.detail}. ` +
+                'The remaining rows are now anchored as the new baseline; inspect them with `uap sandbox grants`.');
+        }
+        return true;
+    }
+}
+/**
+ * Resolve the ACTIVE authority for a session — what `uap sandbox` will
+ * actually open. Expired or malformed rows are invisible here; the sandbox
+ * never has to reason about them.
+ */
+export function resolveSessionGrants(projectRoot, sessionId) {
+    // ONE load: the snapshot that gets verified is the SAME snapshot that
+    // resolves the holes (the torn-read fix).
+    const loaded = loadGrants(projectRoot);
+    // Fail-CLOSED on tamper evidence (ADR 0011): a ledger that fails anchor
+    // verification opens ZERO grant-derived holes. The sandbox's own kernel
+    // boundary is unaffected — only the extra holes close (the safe direction
+    // for authority, same rule as an unreadable ledger).
+    const integrity = verifyLedgerIntegrity(projectRoot, loaded);
+    if (integrity.state === 'mismatch') {
+        console.error(`[sandbox-grants] INTEGRITY MISMATCH — ${integrity.detail}. ` +
+            'Opening NO grant-derived writable holes for this session; the sandbox boundary itself is unaffected. ' +
+            'Run `uap sandbox grants` to inspect the ledger.');
+        return { grants: [], paths: [] };
+    }
+    if (integrity.state === 'unanchored' && loaded.length > 0) {
+        // The quiet dangerous state (review finding): grants exist but the anchor is
+        // gone/never written, so tamper evidence is OFF. Never silent.
+        console.warn(`[sandbox-grants] ${loaded.length} grant(s) on disk but NO trust anchor — tamper evidence is inactive; ` +
+            'the next successful grant/renew/revoke (re-)anchors the ledger');
+    }
+    const nowIso = new Date().toISOString();
+    const sid = clean(sessionId, 64);
+    const active = loaded.filter((g) => g.expiresAt > nowIso && (!sid || g.sessionId === sid));
+    const paths = [];
+    for (const g of active)
+        for (const p of g.paths)
+            if (!paths.includes(p))
+                paths.push(p);
+    return { grants: active, paths };
+}
+/** Record that a sandbox run USED its grants (the "who consented, when used" line).
+ *  `netMode` is the network mode the run ACTUALLY engaged ('off' = the kernel
+ *  egress boundary): the audit line is the consent record, so it must state
+ *  the boundary that was really on. The legacy-env record states what the
+ *  run actually OPENED (`legacyBound`, the resolved targets that were bound)
+ *  separately from what plan time REFUSED (`legacyRefused`) — recording a
+ *  refused entry as the run's allow would attribute authority the run never
+ *  had, and the durable record must agree with the launch banner. */
+export function auditSandboxUse(projectRoot, sessionId, used, legacyBound, legacyRefused, netMode) {
+    audit(projectRoot, {
+        ts: new Date().toISOString(),
+        action: 'sandbox-run',
+        sessionId: clean(sessionId, 64),
+        grantIds: used.grants.map((g) => g.id),
+        paths: used.paths,
+        netMode,
+        // The legacy env is still honored (backwards compatibility) but named in
+        // the audit: unrecorded authority is exactly what this ledger replaced.
+        // Control chars are cleaned here too — the audit line is operator-
+        // terminal output as much as JSONL.
+        unrecordedAllow: legacyBound.map((p) => clean(p, 512)),
+        unrecordedRefused: legacyRefused.map((p) => clean(p, 512)),
+    });
+}
+//# sourceMappingURL=sandbox-grants.js.map

package/dist/policies/sandbox-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-grants.js","sourceRoot":"","sources":["../../src/policies/sandbox-grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAClH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAG/G;;;;;+DAK+D;AAC/D,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AA+B1C;+DAC+D;AAC/D,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAC7C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAC1C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAChD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnF,OAAO,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC;AAC5E,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC/C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnF,OAAO,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC;AAC5E,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,6DAA6D;AAC7D,8EAA8E;AAE9E,yFAAyF;AACzF,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAEzC,SAAS,KAAK,CAAC,CAAU,EAAE,GAAW;IACpC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS;IACzC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IAC3C,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,GAAqD;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,oEAAoE;IACpE,yDAAyD;IACzD,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7B,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC3C,IACE,CAAC,EAAE;QACH,CAAC,SAAS;QACV,CAAC,MAAM,IAAI,+EAA+E;QAC1F,CAAC,SAAS;QACV,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QACjC,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,EACjC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACxC,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,4CAA4C;QAC5C,qEAAqE;QACrE,8BAA8B;QAC9B,MAAM,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,+BAA+B;IACpE,0EAA0E;IAC1E,qEAAqE;IACrE,sEAAsE;IACtE,0EAA0E;IAC1E,+BAA+B;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,GAAG,IAAI;QAAE,OAAO,IAAI,CAAC;IACnG,OAAO;QACL,EAAE;QACF,SAAS;QACT,KAAK;QACL,MAAM;QACN,SAAS;QACT,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E,SAAS,UAAU,CAAC,WAAmB;IACrC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,MAAM,MAAM,GAAmB,EAAE,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;gBAAE,SAAS;YACtD,MAAM,CAAC,GAAG,aAAa,CAAC,GAA4B,CAAC,CAAC;YACtD,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,0CAA0C;QACnE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,sEAAsE;QACtE,OAAO,CAAC,IAAI,CACV,2EACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,WAAmB,EAAE,MAAsB;IAChE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC5C,yEAAyE;QACzE,iEAAiE;QACjE,oEAAoE;QACpE,mCAAmC;QACnC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,8DAA8D;QAC9D,mEAAmE;QACnE,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QAC3E,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7D,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,oEAAoE;QACpE,OAAO,CAAC,IAAI,CACV,gFACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;gEAEgE;AAChE,SAAS,aAAa,CAAC,KAAe;IACpC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAsB,CAAC;YACvD,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;uBAEuB;AACvB,SAAS,cAAc,CAAC,WAAmB;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAChC,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED;;;;;;cAMc;AACd,SAAS,KAAK,CAAC,WAAmB,EAAE,KAA8B;IAChE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC3C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACzC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACrD,qEAAqE;gBACrE,kEAAkE;gBAClE,qEAAqE;gBACrE,8DAA8D;gBAC9D,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,QAAQ;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,mBAAmB,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI,CACP,IAAI,CAAC,SAAS,CAAC;gBACb,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,MAAM,EAAE,kBAAkB;gBAC1B,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;gBACvC,GAAG,EAAE,GAAG,GAAG,CAAC;aACb,CAAC,CACH,CAAC;YACF,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YAC3E,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;YAChE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,cAAc,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,sEACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,qEAAqE;AACrE,8EAA8E;AAE9E;;;;;qCAKqC;AACrC,MAAM,UAAU,qBAAqB,CAAC,WAAmB,EAAE,MAAuB;IAChF,MAAM,MAAM,GAAG,MAAM,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;kCAKkC;AAClC,SAAS,cAAc,CAAC,WAAmB,EAAE,SAAyB;IACpE,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;QAC3F,OAAO,CAAC,IAAI,CACV,wFAAwF;YACtF,8DAA8D,CACjE,CAAC;QACF,OAAO;IACT,CAAC;IACD,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,qDAAqD;IACrD,MAAM,KAAK,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CACV,+FAA+F,KAAK,CAAC,KAAK,MAAM;YAC9G,4FAA4F,CAC/F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,8DAA8D;AAC9D,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,KAAiB;IACnE,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2EAA2E,EAAE,CAAC;IACzH,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uEAAuE,EAAE,CAAC;IAElH,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,2EAA2E,EAAE,CAAC;QACrI,uEAAuE;QACvE,oEAAoE;QACpE,wDAAwD;QACxD,8BAA8B;QAC9B,IAAI,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,qGAAqG,EAAE,CAAC;QACzJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,GAAG,mBAAmB;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,mBAAmB,gCAAgC,EAAE,CAAC;IACxI,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2DAA2D,EAAE,CAAC;IAC3F,CAAC;IAED,mEAAmE;IACnE,kEAAkE;IAClE,wEAAwE;IACxE,8CAA8C;IAC9C,oEAAoE;IACpE,IAAI,GAAW,CAAC;IAChB,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,GAAG,GAAG,sBAAsB,CAAC;IAC/B,CAAC;SAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wDAAwD,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;IACzG,CAAC;SAAM,CAAC;QACN,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,KAAK,GAAiB;QAC1B,EAAE,EAAE,OAAO,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACrC,SAAS;QACT,KAAK;QACL,MAAM;QACN,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS;QAC/D,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KAC9D,CAAC;IAEF,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,iEAAiE;QACjE,qEAAqE;QACrE,oDAAoD;QACpD,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACnC,mEAAmE;YACnE,gEAAgE;YAChE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,0CAA0C,SAAS,CAAC,MAAM,uDAAuD;aACzH,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACvE,4EAA4E;QAC5E,sEAAsE;QACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CACjI,CAAC;QACF,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YACjC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC3B,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YACjC,qEAAqE;YACrE,uEAAuE;YACvE,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gFAAgF,EAAE,CAAC;YAChH,CAAC;YACD,qEAAqE;YACrE,qEAAqE;YACrE,gEAAgE;YAChE,4DAA4D;YAC5D,MAAM,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;YACzD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;gBACjD,IAAI,OAAO,KAAK,CAAC;oBAAE,SAAS;gBAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mFAAmF,EAAE,CAAC;YACnH,CAAC;YACD,uEAAuE;YACvE,uEAAuE;YACvE,oEAAoE;YACpE,qCAAqC;YACrC,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACjH,cAAc,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8EAA8E,EAAE,CAAC;QAC9G,CAAC;QACD,qEAAqE;QACrE,sEAAsE;QACtE,iEAAiE;QACjE,6BAA6B;QAC7B,MAAM,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACjD,IAAI,OAAO,KAAK,CAAC;gBAAE,SAAS;YAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8EAA8E,EAAE,CAAC;QAC9G,CAAC;QACD,oEAAoE;QACpE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACxH,cAAc,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,WAAmB,EAAE,SAAkB;IACnE,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,OAAO,UAAU,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC;AACtG,CAAC;AAED;;iEAEiE;AACjE,MAAM,UAAU,eAAe,CAAC,WAAmB,EAAE,OAAe;IAClE,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9B,qEAAqE;IACrE,uEAAuE;IACvE,oEAAoE;IACpE,oCAAoC;IACpC,MAAM,YAAY,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;IACxD,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC7C,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACpD,mEAAmE;QACnE,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAC1C,IAAI,OAAO,KAAK,CAAC;gBAAE,SAAS;YAC5B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,mEAAmE;QACnE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACpF,cAAc,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAC1C,IAAI,YAAY,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACtC,OAAO,CAAC,IAAI,CACV,4FAA4F,YAAY,CAAC,MAAM,IAAI;gBACjH,kGAAkG,CACrG,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB,EAAE,SAAiB;IACzE,sEAAsE;IACtE,0CAA0C;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACvC,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,qDAAqD;IACrD,MAAM,SAAS,GAAG,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,SAAS,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,CAAC,KAAK,CACX,yCAAyC,SAAS,CAAC,MAAM,IAAI;YAC3D,uGAAuG;YACvG,iDAAiD,CACpD,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,KAAK,YAAY,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,6EAA6E;QAC7E,+DAA+D;QAC/D,OAAO,CAAC,IAAI,CACV,oBAAoB,MAAM,CAAC,MAAM,uEAAuE;YACtG,gEAAgE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;qEAOqE;AACrE,MAAM,UAAU,eAAe,CAC7B,WAAmB,EACnB,SAAiB,EACjB,IAAoB,EACpB,WAAqB,EACrB,aAAuB,EACvB,OAAyB;IAEzB,KAAK,CAAC,WAAW,EAAE;QACjB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,MAAM,EAAE,aAAa;QACrB,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;QAC/B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO;QACP,yEAAyE;QACzE,wEAAwE;QACxE,mEAAmE;QACnE,oCAAoC;QACpC,eAAe,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtD,iBAAiB,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;KAC3D,CAAC,CAAC;AACL,CAAC"}

package/dist/state/manifest.d.ts

@@ -1,7 +1,7 @@
 /**
  * Implementation-State Manifest — a machine-generated snapshot of what this
  * project IS and where its implementation actually stands, derived from
- * ground truth (package.json, CHANGELOG, git branch, .factory registries)
+ * ground truth (package.json, git log, git branch, .factory registries)
  * rather than hand-maintained docs that drift.
  *
  * Written to `.uap/state-manifest.json`; the reactor injects a one-line
@@ -14,7 +14,9 @@ export interface StateManifest {
     version: string;
     generatedAt: string;
     branch?: string;
-    /** Latest CHANGELOG headings, newest first — the real "what shipped lately". */
+    /** Latest commit subjects, newest first — the real "what shipped lately".
+     * UNTRUSTED input: commit subjects are contributor-authored text; they are
+     * stripped + single-lined at ingest and re-stripped at the digest boundary. */
     recentChanges: string[];
     /** Registry counts when the project has them (skills/droids/patterns). */
     counts?: Record<string, number>;

package/dist/state/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/state/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAMD,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAExD;AA4BD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CA6C/E;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAiB5E;AAED,qEAAqE;AACrE,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAW/E;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAe9D"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/state/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;mFAE+E;IAC/E,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAMD,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAExD;AAoDD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAkC/E;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAiB5E;AAED,qEAAqE;AACrE,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAW/E;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAmB9D"}