@nac3/forge-cli 0.2.0-alpha.9 → 1.0.0

package/dist/core/reasoning_gate.js

@@ -0,0 +1,205 @@
+/**
+ * reasoning_gate.ts -- pre-LLM tier classifier (alpha.55).
+ *
+ * Cheap, deterministic features computed without an LLM call.
+ * Returns a tier suggestion + confidence + signal list. When
+ * confidence > 0.85 the cost_router uses the result directly
+ * and skips the Gemini turn_classifier (saves ~400 ms + tokens).
+ * When confidence <= 0.85 the gate's verdict is "ambiguous" and
+ * the router asks turn_classifier for a second opinion.
+ *
+ * Signals scanned:
+ *   - Message length (long prompts skew toward frontier reasoning).
+ *   - Frontier keywords (design, architecture, implement,
+ *     refactor, code, write a function, etc -- multilingual).
+ *   - Eco keywords (open, show, list, abrime, muestrame -- short
+ *     NAC3-shaped commands).
+ *   - Verb hints recognised in the manifest (e.g. references to
+ *     pizarron/lector/voz/idioma map to eco).
+ *   - Attachment presence (frontier bias).
+ *   - Prior tier in the conversation history (sticky tier when
+ *     "continua / sigue" is the explicit follow-up).
+ *
+ * All keyword lists are normalised to lowercase + accent-stripped.
+ * Multi-language (es / en) since the user types in both.
+ *
+ * ASCII-only.
+ */
+/* Normalisation: lowercase + strip combining marks. ASCII-safe
+ * because the regex is plain unicode. */
+function norm(s) {
+    return s.normalize('NFD').replace(/[̀-ͯ]/g, '').toLowerCase();
+}
+/* Keywords that push toward frontier. Multilingual ES/EN. Each
+ *  match adds +0.18 to frontier score, capped by signal weight
+ *  in score(). */
+const FRONTIER_KEYWORDS = [
+    /* design + architecture */
+    'disena', 'disenar', 'diseno', 'diseno de',
+    'design', 'designing', 'architect', 'architecture',
+    'arquitectura', 'arquitecto',
+    /* implementation / code */
+    'implementa', 'implementar', 'implementation',
+    'refactoriza', 'refactor', 'refactoring',
+    'codifica', 'codigo', 'code this', 'write a function',
+    'fix this bug', 'arregla este bug', 'resuelve el problema',
+    /* reasoning / planning */
+    'estrategia', 'strategy', 'planifica',
+    'analiza la', 'analiza el', 'analyze',
+    /* writing tasks */
+    'redacta', 'escribe un', 'write a draft', 'compose',
+    /* multi-step / complex */
+    'paso a paso', 'step by step', 'descompon', 'breakdown',
+    /* PND-066 -- render de contenido: pedir el grafo / un diagrama
+     * / una vista grafica es trabajo multi-paso (poblar + armar la
+     * vista + despachar al panel), no un comando NAC3 trivial. */
+    'grafo', 'diagrama', 'modo grafico', 'visualizacion',
+];
+/* Keywords that push toward eco. Short NAC3-shaped commands. */
+const ECO_KEYWORDS = [
+    /* navigation / listing */
+    'abrime', 'abre ', 'abrir ', 'open ', 'show me', 'muestrame',
+    'mostrame', 'listame', 'list ', 'lista ',
+    /* read / pizarron */
+    'lee la', 'leeme la', 'leeme el', 'lee el',
+    'read this tab', 'leer pestania',
+    /* simple ops */
+    'cierra', 'close ',
+    'cambia el idioma', 'cambiar idioma', 'change language',
+    'activar voz', 'apaga voz', 'desactiva voz',
+    /* short greetings stay eco */
+    'hola', 'hello', 'hi ', 'thanks', 'gracias',
+    /* NAC3 verbs reference.
+     * PND-066 -- el keyword suelto 'pizarron' se reemplazo por
+     * frases compuestas de operacion simple: la mera mencion del
+     * pizarron NO implica comando trivial ("muestra el grafo en el
+     * pizarron" es render multi-paso; en la sesion Yuemail
+     * 2026-06-10 ese keyword mando a eco los dos turnos que pedian
+     * crear una tab con el grafo). Las ops simples siguen
+     * matcheando por estas frases + sus prefijos (abre/cierra/lee). */
+    'tab en el pizarron', 'pestania en el pizarron',
+    'pestana en el pizarron', 'tab del pizarron',
+    'lector', 'reader', 'microphone',
+];
+/* Phrases that mean "sigue lo anterior" -- inherit previous tier. */
+const STICKY_FOLLOWUPS = [
+    'sigue', 'continua', 'continuar', 'continue', 'go on',
+    'y ahora', 'y despues', 'and now', 'next step',
+];
+/**
+ * Score the input and decide tier + confidence.
+ *
+ * Algorithm:
+ *   1. If a sticky follow-up phrase + previous_tier known ->
+ *      inherit previous tier with confidence 0.95.
+ *   2. Otherwise sum keyword hits. Each hit weighs 0.18 toward
+ *      its bucket.
+ *   3. Long messages (>= 200 chars) add 0.20 to frontier.
+ *      Very short (< 24 chars) add 0.10 to eco.
+ *   4. Each attachment adds 0.20 to frontier.
+ *   5. Tier = bucket with higher absolute score. Confidence =
+ *      min(0.99, |frontier - eco| + base 0.40).
+ *   6. If both buckets are < 0.20 (no strong signals)
+ *      confidence drops to 0.30 -> ambiguous.
+ */
+export function classifyGate(input) {
+    const signals = [];
+    const text = typeof input.text === 'string' ? input.text : '';
+    const n = norm(text);
+    /* 1. sticky follow-up (explicit "sigue / continua" phrases) */
+    if (input.previous_tier) {
+        for (const phrase of STICKY_FOLLOWUPS) {
+            if (n.includes(phrase)) {
+                signals.push('sticky_followup[' + phrase + ']->' + input.previous_tier);
+                return {
+                    tier: input.previous_tier,
+                    confidence: 0.95,
+                    ambiguous: false,
+                    signals,
+                };
+            }
+        }
+    }
+    /* 1b. alpha.56 -- frontier inertia. The expensive case is a
+     *  user dropping out of a frontier conversation because their
+     *  follow-up was short ("medium, python playwright", "ok",
+     *  "yes"). Once you are in a frontier topic you stay there
+     *  unless the new message has a strong eco signal. We compute
+     *  eco signals first to gate the inertia.
+     *
+     *  This intentionally runs BEFORE the regular keyword scan so
+     *  we can short-circuit without computing frontier signals --
+     *  the eco scan is cheap. */
+    if (input.previous_tier === 'frontier') {
+        let ecoQuickScore = 0;
+        for (const kw of ECO_KEYWORDS) {
+            if (n.includes(kw)) {
+                ecoQuickScore += 0.25;
+            }
+        }
+        if (ecoQuickScore < 0.30) {
+            signals.push('frontier_inertia[prev=frontier, eco_score=' + ecoQuickScore.toFixed(2) + ']');
+            return {
+                tier: 'frontier',
+                confidence: 0.90,
+                ambiguous: false,
+                signals,
+            };
+        }
+        /* Otherwise fall through -- the user did signal eco intent
+         *  even within a frontier topic (e.g. "ok abrime esa tab"
+         *  inside a design session). */
+    }
+    let ecoScore = 0;
+    let frontierScore = 0;
+    /* 2. keyword hits */
+    for (const kw of ECO_KEYWORDS) {
+        if (n.includes(kw)) {
+            ecoScore += 0.25;
+            signals.push('eco_kw[' + kw.trim() + ']');
+        }
+    }
+    for (const kw of FRONTIER_KEYWORDS) {
+        if (n.includes(kw)) {
+            frontierScore += 0.25;
+            signals.push('frontier_kw[' + kw.trim() + ']');
+        }
+    }
+    /* 3. length */
+    if (text.length >= 200) {
+        frontierScore += 0.20;
+        signals.push('long_prompt[' + text.length + ']');
+    }
+    else if (text.length < 24 && text.length > 0) {
+        ecoScore += 0.10;
+        signals.push('short_prompt[' + text.length + ']');
+    }
+    /* 4. attachments */
+    const att = typeof input.attachments === 'number' && input.attachments > 0
+        ? input.attachments
+        : 0;
+    if (att > 0) {
+        frontierScore += 0.20 * att;
+        signals.push('attachments[' + att + ']');
+    }
+    /* 5. decide */
+    const ecoCapped = Math.min(ecoScore, 1.0);
+    const frontierCapped = Math.min(frontierScore, 1.0);
+    const tier = frontierCapped > ecoCapped ? 'frontier' : 'eco';
+    let confidence = 0.40 + Math.abs(frontierCapped - ecoCapped);
+    if (confidence > 0.99)
+        confidence = 0.99;
+    /* 6. weak signal -> ambiguous */
+    const maxScore = Math.max(ecoCapped, frontierCapped);
+    let ambiguous;
+    if (maxScore < 0.20) {
+        confidence = 0.30;
+        ambiguous = true;
+        signals.push('weak_signals');
+    }
+    else {
+        ambiguous = confidence <= 0.85;
+    }
+    return { tier, confidence, ambiguous, signals };
+}
+//# sourceMappingURL=reasoning_gate.js.map

package/dist/core/reasoning_gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reasoning_gate.js","sourceRoot":"","sources":["../../src/core/reasoning_gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AA4BH;yCACyC;AACzC,SAAS,IAAI,CAAC,CAAS;IACrB,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAChE,CAAC;AAED;;kBAEkB;AAClB,MAAM,iBAAiB,GAAsB;IAC3C,2BAA2B;IAC3B,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW;IAC1C,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc;IAClD,cAAc,EAAE,YAAY;IAC5B,2BAA2B;IAC3B,YAAY,EAAE,aAAa,EAAE,gBAAgB;IAC7C,aAAa,EAAE,UAAU,EAAE,aAAa;IACxC,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB;IACrD,cAAc,EAAE,kBAAkB,EAAE,sBAAsB;IAC1D,0BAA0B;IAC1B,YAAY,EAAE,UAAU,EAAE,WAAW;IACrC,YAAY,EAAE,YAAY,EAAE,SAAS;IACrC,mBAAmB;IACnB,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS;IACnD,0BAA0B;IAC1B,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW;IACvD;;kEAE8D;IAC9D,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe;CACrD,CAAC;AAEF,gEAAgE;AAChE,MAAM,YAAY,GAAsB;IACtC,0BAA0B;IAC1B,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW;IAC5D,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ;IACxC,qBAAqB;IACrB,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ;IAC1C,eAAe,EAAE,eAAe;IAChC,gBAAgB;IAChB,QAAQ,EAAE,QAAQ;IAClB,kBAAkB,EAAE,gBAAgB,EAAE,iBAAiB;IACvD,aAAa,EAAE,WAAW,EAAE,eAAe;IAC3C,8BAA8B;IAC9B,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS;IAC3C;;;;;;;uEAOmE;IACnE,oBAAoB,EAAE,yBAAyB;IAC/C,wBAAwB,EAAE,kBAAkB;IAC5C,QAAQ,EAAE,QAAQ,EAAE,YAAY;CACjC,CAAC;AAEF,qEAAqE;AACrE,MAAM,gBAAgB,GAAsB;IAC1C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;IACrD,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW;CAC/C,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,KAAgB;IAC3C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAErB,+DAA+D;IAC/D,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,kBAAkB,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;gBACxE,OAAO;oBACL,IAAI,EAAE,KAAK,CAAC,aAAa;oBACzB,UAAU,EAAE,IAAI;oBAChB,SAAS,EAAE,KAAK;oBAChB,OAAO;iBACR,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;iCAS6B;IAC7B,IAAI,KAAK,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;QACvC,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACnB,aAAa,IAAI,IAAI,CAAC;YACxB,CAAC;QACH,CAAC;QACD,IAAI,aAAa,GAAG,IAAI,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,4CAA4C,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;YAC5F,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,KAAK;gBAChB,OAAO;aACR,CAAC;QACJ,CAAC;QACD;;wCAEgC;IAClC,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,qBAAqB;IACrB,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACnB,QAAQ,IAAI,IAAI,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACnB,aAAa,IAAI,IAAI,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,eAAe;IACf,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACvB,aAAa,IAAI,IAAI,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IACnD,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,QAAQ,IAAI,IAAI,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,oBAAoB;IACpB,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,GAAG,CAAC;QACxE,CAAC,CAAC,KAAK,CAAC,WAAW;QACnB,CAAC,CAAC,CAAC,CAAC;IACN,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACZ,aAAa,IAAI,IAAI,GAAG,GAAG,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,cAAc,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,eAAe;IACf,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC1C,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,IAAI,GAAuB,cAAc,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;IACjF,IAAI,UAAU,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAC7D,IAAI,UAAU,GAAG,IAAI;QAAE,UAAU,GAAG,IAAI,CAAC;IAEzC,iCAAiC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACrD,IAAI,SAAkB,CAAC;IACvB,IAAI,QAAQ,GAAG,IAAI,EAAE,CAAC;QACpB,UAAU,GAAG,IAAI,CAAC;QAClB,SAAS,GAAG,IAAI,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,UAAU,IAAI,IAAI,CAAC;IACjC,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC"}

package/dist/core/shell_classifier.d.ts

@@ -0,0 +1,49 @@
+/**
+ * shell_classifier.ts -- categorize a shell command into one of
+ * four risk buckets (alpha.59d).
+ *
+ * Buckets:
+ *   destructive    -- modifies / removes user data, force-pushes,
+ *                     etc. Always requires approval.
+ *   elevation      -- sudo / gsudo / runas / su. Always approval.
+ *   network        -- curl/wget/npm-install/etc that touches the
+ *                     network. Pablo's rule: approve always.
+ *   safe           -- ls, cd, pwd, git status, etc. Auto-approves
+ *                     (subject to Danger Zone toggle in limits).
+ *
+ * The classifier is intentionally CONSERVATIVE: when in doubt it
+ * escalates to a higher-risk bucket. False positives cost the
+ * user an extra approval prompt; false negatives could execute
+ * unwanted changes silently.
+ *
+ * Pattern matching is regex-based + token-aware. It does NOT
+ * try to parse shell grammar perfectly -- it catches the obvious
+ * dangerous shapes (rm -rf /, force flags, sudo prefix, network
+ * binaries, etc).
+ *
+ * ASCII-only.
+ */
+export type ShellRiskBucket = 'destructive' | 'elevation' | 'network' | 'safe';
+export interface ShellClassification {
+    bucket: ShellRiskBucket;
+    reasons: string[];
+    requires_approval: boolean;
+}
+export declare function classifyShellCommand(command: string): ShellClassification;
+export declare const _patterns: {
+    DESTRUCTIVE_TOKENS: readonly {
+        pat: RegExp;
+        reason: string;
+    }[];
+    ELEVATION_TOKENS: readonly {
+        pat: RegExp;
+        reason: string;
+    }[];
+    NETWORK_TOKENS: readonly {
+        pat: RegExp;
+        reason: string;
+    }[];
+    SAFE_TOKENS: readonly RegExp[];
+    PIPE_TO_SHELL: RegExp;
+};
+//# sourceMappingURL=shell_classifier.d.ts.map

package/dist/core/shell_classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell_classifier.d.ts","sourceRoot":"","sources":["../../src/core/shell_classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;AAE/E,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAqFD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,CAqDzE;AAGD,eAAO,MAAM,SAAS;;aA1IyB,MAAM;gBAAU,MAAM;;;aAmCxB,MAAM;gBAAU,MAAM;;;aAUxB,MAAM;gBAAU,MAAM;;;;CA+FhE,CAAC"}

package/dist/core/shell_classifier.js

@@ -0,0 +1,159 @@
+/**
+ * shell_classifier.ts -- categorize a shell command into one of
+ * four risk buckets (alpha.59d).
+ *
+ * Buckets:
+ *   destructive    -- modifies / removes user data, force-pushes,
+ *                     etc. Always requires approval.
+ *   elevation      -- sudo / gsudo / runas / su. Always approval.
+ *   network        -- curl/wget/npm-install/etc that touches the
+ *                     network. Pablo's rule: approve always.
+ *   safe           -- ls, cd, pwd, git status, etc. Auto-approves
+ *                     (subject to Danger Zone toggle in limits).
+ *
+ * The classifier is intentionally CONSERVATIVE: when in doubt it
+ * escalates to a higher-risk bucket. False positives cost the
+ * user an extra approval prompt; false negatives could execute
+ * unwanted changes silently.
+ *
+ * Pattern matching is regex-based + token-aware. It does NOT
+ * try to parse shell grammar perfectly -- it catches the obvious
+ * dangerous shapes (rm -rf /, force flags, sudo prefix, network
+ * binaries, etc).
+ *
+ * ASCII-only.
+ */
+/* Tokens that mark a destructive intent regardless of shell. */
+const DESTRUCTIVE_TOKENS = [
+    /* rm with recursive + force is the canonical "blast radius" command. */
+    { pat: /\brm\s+(?:-[a-zA-Z]*r[a-zA-Z]*\s|-[a-zA-Z]*f[a-zA-Z]*\s|--force\s|--recursive\s)/i, reason: 'rm -r/-f' },
+    /* Bare rm against a path is still destructive. */
+    { pat: /\brm\s+(?!--help|--version)/i, reason: 'rm' },
+    { pat: /\brmdir\b/i, reason: 'rmdir' },
+    { pat: /\bmv\s+(?!--help)/i, reason: 'mv (could overwrite)' },
+    { pat: /\bdd\s+if=/i, reason: 'dd' },
+    { pat: /\bshred\b/i, reason: 'shred' },
+    { pat: />\s*\/dev\/sd[a-z]/i, reason: 'redirect to raw device' },
+    { pat: />\s*\/etc\//i, reason: 'write to /etc' },
+    /* git destructive ops. */
+    { pat: /\bgit\s+push\s+(?:[^|;&]*\s)?--force\b/i, reason: 'git push --force' },
+    { pat: /\bgit\s+push\s+(?:[^|;&]*\s)?-f\b/i, reason: 'git push -f' },
+    { pat: /\bgit\s+reset\s+(?:[^|;&]*\s)?--hard\b/i, reason: 'git reset --hard' },
+    { pat: /\bgit\s+clean\s+(?:[^|;&]*-[a-zA-Z]*f)/i, reason: 'git clean -f' },
+    { pat: /\bgit\s+branch\s+(?:[^|;&]*\s)?-D\b/, reason: 'git branch -D' },
+    /* Postgres / mysql blunt instruments. */
+    { pat: /\bDROP\s+(TABLE|DATABASE|SCHEMA)\b/i, reason: 'DROP TABLE/DATABASE' },
+    { pat: /\bTRUNCATE\s+TABLE\b/i, reason: 'TRUNCATE TABLE' },
+    /* npm publish, cargo publish, etc -- one-way. */
+    { pat: /\bnpm\s+publish\b/i, reason: 'npm publish' },
+    { pat: /\bpnpm\s+publish\b/i, reason: 'pnpm publish' },
+    /* skip hooks / signing -- bypass safety. */
+    { pat: /--no-verify\b/, reason: '--no-verify' },
+    { pat: /--no-gpg-sign\b/, reason: '--no-gpg-sign' },
+    /* chmod / chown on system paths. */
+    { pat: /\bchmod\s+(?:[^|;&]*\s)?(?:777|-R\b)/i, reason: 'chmod 777 / -R' },
+    /* Windows blast tokens. */
+    { pat: /\bdel\s+\/[fsq]/i, reason: 'del /f /s /q' },
+    { pat: /\brmdir\s+\/[sq]/i, reason: 'rmdir /s /q' },
+    { pat: /\bformat\s+[a-z]:/i, reason: 'format C:' },
+];
+/* Privilege elevation: sudo / runas / etc. Always approval. */
+const ELEVATION_TOKENS = [
+    { pat: /^\s*sudo\b/, reason: 'sudo prefix' },
+    { pat: /\|\s*sudo\b/, reason: 'piped to sudo' },
+    { pat: /^\s*gsudo\b/i, reason: 'gsudo prefix' },
+    { pat: /^\s*runas\b/i, reason: 'runas prefix' },
+    { pat: /^\s*su\b/, reason: 'su prefix' },
+    { pat: /\bdoas\b/, reason: 'doas' },
+];
+/* Network egress / installs. Per Pablo: approve always. */
+const NETWORK_TOKENS = [
+    { pat: /\bcurl\b/i, reason: 'curl' },
+    { pat: /\bwget\b/i, reason: 'wget' },
+    { pat: /\bInvoke-WebRequest\b/i, reason: 'Invoke-WebRequest' },
+    { pat: /\bIwr\b/, reason: 'iwr' },
+    { pat: /\bnc\b\s|netcat\b/, reason: 'nc/netcat' },
+    /* package managers that hit the network. */
+    { pat: /\bnpm\s+(install|i|ci|update|upgrade|add)\b/i, reason: 'npm install' },
+    { pat: /\bpnpm\s+(install|add|update|i\b)/i, reason: 'pnpm install' },
+    { pat: /\byarn\s+(add|install|upgrade)\b/i, reason: 'yarn install' },
+    { pat: /\bpip\s+(install|download)\b/i, reason: 'pip install' },
+    { pat: /\bpip3\s+(install|download)\b/i, reason: 'pip3 install' },
+    { pat: /\bpoetry\s+(add|install|update)\b/i, reason: 'poetry install' },
+    { pat: /\bbrew\s+(install|upgrade|tap)\b/i, reason: 'brew install' },
+    { pat: /\bapt(-get)?\s+(install|update|upgrade)\b/i, reason: 'apt install' },
+    { pat: /\bcargo\s+(install|update|publish)\b/i, reason: 'cargo install' },
+    { pat: /\bgo\s+(get|install)\b/i, reason: 'go get/install' },
+    { pat: /\bgit\s+(clone|fetch|pull|push)\b/i, reason: 'git network op' },
+    /* docker pulls + runs from registry. */
+    { pat: /\bdocker\s+(pull|run|build|push)\b/i, reason: 'docker network op' },
+];
+/* Tokens that mark the command as command-and-pipe-to-shell --
+ *  the worst case (curl | bash). Always destructive + network. */
+const PIPE_TO_SHELL = /\|\s*(?:bash|sh|zsh|fish|pwsh|powershell)\b/i;
+/* Common safe read-only / pwd-style commands. Just a fast path
+ *  to skip the heavier scans for trivial cases. NOT used as a
+ *  whitelist -- the scanners still run + can over-rule. */
+const SAFE_TOKENS = [
+    /^\s*(ls|dir|pwd|cd|echo|cat|less|more|head|tail|wc|date|whoami|hostname|uname)\b/i,
+    /^\s*git\s+(status|log|diff|branch\b(?!.*-D)|show|describe|stash\s+list)\b/i,
+    /^\s*node\s+--version\b/i,
+    /^\s*npm\s+(?:--version|-v|ls|list|outdated)\b/i,
+    /^\s*python3?\s+--version\b/i,
+];
+export function classifyShellCommand(command) {
+    const reasons = [];
+    const trimmed = (command || '').trim();
+    if (!trimmed) {
+        return { bucket: 'safe', reasons: ['empty'], requires_approval: false };
+    }
+    /* Worst-case: pipe to shell. Treat as destructive. */
+    if (PIPE_TO_SHELL.test(trimmed)) {
+        return {
+            bucket: 'destructive',
+            reasons: ['pipe to shell interpreter'],
+            requires_approval: true,
+        };
+    }
+    /* Elevation takes precedence -- sudo X is dangerous regardless
+     *  of what X does. */
+    for (const { pat, reason } of ELEVATION_TOKENS) {
+        if (pat.test(trimmed)) {
+            return { bucket: 'elevation', reasons: [reason], requires_approval: true };
+        }
+    }
+    /* Destructive sweep. */
+    for (const { pat, reason } of DESTRUCTIVE_TOKENS) {
+        if (pat.test(trimmed))
+            reasons.push(reason);
+    }
+    if (reasons.length > 0) {
+        return { bucket: 'destructive', reasons, requires_approval: true };
+    }
+    /* Network sweep. */
+    const netReasons = [];
+    for (const { pat, reason } of NETWORK_TOKENS) {
+        if (pat.test(trimmed))
+            netReasons.push(reason);
+    }
+    if (netReasons.length > 0) {
+        return { bucket: 'network', reasons: netReasons, requires_approval: true };
+    }
+    /* Safe fast-path. */
+    for (const p of SAFE_TOKENS) {
+        if (p.test(trimmed))
+            return { bucket: 'safe', reasons: ['known safe pattern'], requires_approval: false };
+    }
+    /* Unknown -> default to safe but flag for the user. The
+     *  approval gate at the caller is what decides if approval is
+     *  required; safe bucket means "don't force approval, but
+     *  caller may still require it if 'always approve shell' is
+     *  on or Danger Zone is off + the operator wants total
+     *  control". */
+    return { bucket: 'safe', reasons: ['unclassified -- defaulted safe'], requires_approval: false };
+}
+/* Test seam. */
+export const _patterns = {
+    DESTRUCTIVE_TOKENS, ELEVATION_TOKENS, NETWORK_TOKENS, SAFE_TOKENS, PIPE_TO_SHELL,
+};
+//# sourceMappingURL=shell_classifier.js.map

package/dist/core/shell_classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell_classifier.js","sourceRoot":"","sources":["../../src/core/shell_classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAUH,gEAAgE;AAChE,MAAM,kBAAkB,GAAmD;IACzE,wEAAwE;IACxE,EAAE,GAAG,EAAE,mFAAmF,EAAE,MAAM,EAAE,UAAU,EAAE;IAChH,kDAAkD;IAClD,EAAE,GAAG,EAAE,8BAA8B,EAAE,MAAM,EAAE,IAAI,EAAE;IACrD,EAAE,GAAG,EAAE,YAAY,EAAa,MAAM,EAAE,OAAO,EAAE;IACjD,EAAE,GAAG,EAAE,oBAAoB,EAAK,MAAM,EAAE,sBAAsB,EAAE;IAChE,EAAE,GAAG,EAAE,aAAa,EAAY,MAAM,EAAE,IAAI,EAAE;IAC9C,EAAE,GAAG,EAAE,YAAY,EAAa,MAAM,EAAE,OAAO,EAAE;IACjD,EAAE,GAAG,EAAE,qBAAqB,EAAI,MAAM,EAAE,wBAAwB,EAAE;IAClE,EAAE,GAAG,EAAE,cAAc,EAAW,MAAM,EAAE,eAAe,EAAE;IACzD,0BAA0B;IAC1B,EAAE,GAAG,EAAE,yCAAyC,EAAS,MAAM,EAAE,kBAAkB,EAAE;IACrF,EAAE,GAAG,EAAE,oCAAoC,EAAc,MAAM,EAAE,aAAa,EAAE;IAChF,EAAE,GAAG,EAAE,yCAAyC,EAAS,MAAM,EAAE,kBAAkB,EAAE;IACrF,EAAE,GAAG,EAAE,yCAAyC,EAAS,MAAM,EAAE,cAAc,EAAE;IACjF,EAAE,GAAG,EAAE,qCAAqC,EAAa,MAAM,EAAE,eAAe,EAAE;IAClF,yCAAyC;IACzC,EAAE,GAAG,EAAE,qCAAqC,EAAa,MAAM,EAAE,qBAAqB,EAAE;IACxF,EAAE,GAAG,EAAE,uBAAuB,EAA2B,MAAM,EAAE,gBAAgB,EAAE;IACnF,iDAAiD;IACjD,EAAE,GAAG,EAAE,oBAAoB,EAA8B,MAAM,EAAE,aAAa,EAAE;IAChF,EAAE,GAAG,EAAE,qBAAqB,EAA6B,MAAM,EAAE,cAAc,EAAE;IACjF,4CAA4C;IAC5C,EAAE,GAAG,EAAE,eAAe,EAAmC,MAAM,EAAE,aAAa,EAAE;IAChF,EAAE,GAAG,EAAE,iBAAiB,EAAiC,MAAM,EAAE,eAAe,EAAE;IAClF,oCAAoC;IACpC,EAAE,GAAG,EAAE,uCAAuC,EAAW,MAAM,EAAE,gBAAgB,EAAE;IACnF,2BAA2B;IAC3B,EAAE,GAAG,EAAE,kBAAkB,EAAgC,MAAM,EAAE,cAAc,EAAE;IACjF,EAAE,GAAG,EAAE,mBAAmB,EAA+B,MAAM,EAAE,aAAa,EAAE;IAChF,EAAE,GAAG,EAAE,oBAAoB,EAA8B,MAAM,EAAE,WAAW,EAAE;CAC/E,CAAC;AAEF,+DAA+D;AAC/D,MAAM,gBAAgB,GAAmD;IACvE,EAAE,GAAG,EAAE,YAAY,EAAO,MAAM,EAAE,aAAa,EAAE;IACjD,EAAE,GAAG,EAAE,aAAa,EAAM,MAAM,EAAE,eAAe,EAAE;IACnD,EAAE,GAAG,EAAE,cAAc,EAAK,MAAM,EAAE,cAAc,EAAE;IAClD,EAAE,GAAG,EAAE,cAAc,EAAK,MAAM,EAAE,cAAc,EAAE;IAClD,EAAE,GAAG,EAAE,UAAU,EAAS,MAAM,EAAE,WAAW,EAAE;IAC/C,EAAE,GAAG,EAAE,UAAU,EAAS,MAAM,EAAE,MAAM,EAAE;CAC3C,CAAC;AAEF,2DAA2D;AAC3D,MAAM,cAAc,GAAmD;IACrE,EAAE,GAAG,EAAE,WAAW,EAAoD,MAAM,EAAE,MAAM,EAAE;IACtF,EAAE,GAAG,EAAE,WAAW,EAAoD,MAAM,EAAE,MAAM,EAAE;IACtF,EAAE,GAAG,EAAE,wBAAwB,EAAuC,MAAM,EAAE,mBAAmB,EAAE;IACnG,EAAE,GAAG,EAAE,SAAS,EAAsD,MAAM,EAAE,KAAK,EAAE;IACrF,EAAE,GAAG,EAAE,mBAAmB,EAA6C,MAAM,EAAE,WAAW,EAAE;IAC5F,4CAA4C;IAC5C,EAAE,GAAG,EAAE,8CAA8C,EAAiB,MAAM,EAAE,aAAa,EAAE;IAC7F,EAAE,GAAG,EAAE,oCAAoC,EAA2B,MAAM,EAAE,cAAc,EAAE;IAC9F,EAAE,GAAG,EAAE,mCAAmC,EAA4B,MAAM,EAAE,cAAc,EAAE;IAC9F,EAAE,GAAG,EAAE,+BAA+B,EAAgC,MAAM,EAAE,aAAa,EAAE;IAC7F,EAAE,GAAG,EAAE,gCAAgC,EAA+B,MAAM,EAAE,cAAc,EAAE;IAC9F,EAAE,GAAG,EAAE,oCAAoC,EAA2B,MAAM,EAAE,gBAAgB,EAAE;IAChG,EAAE,GAAG,EAAE,mCAAmC,EAA4B,MAAM,EAAE,cAAc,EAAE;IAC9F,EAAE,GAAG,EAAE,4CAA4C,EAAmB,MAAM,EAAE,aAAa,EAAE;IAC7F,EAAE,GAAG,EAAE,uCAAuC,EAAwB,MAAM,EAAE,eAAe,EAAE;IAC/F,EAAE,GAAG,EAAE,yBAAyB,EAAsC,MAAM,EAAE,gBAAgB,EAAE;IAChG,EAAE,GAAG,EAAE,oCAAoC,EAA2B,MAAM,EAAE,gBAAgB,EAAE;IAChG,wCAAwC;IACxC,EAAE,GAAG,EAAE,qCAAqC,EAA0B,MAAM,EAAE,mBAAmB,EAAE;CACpG,CAAC;AAEF;kEACkE;AAClE,MAAM,aAAa,GAAG,8CAA8C,CAAC;AAErE;;2DAE2D;AAC3D,MAAM,WAAW,GAA0B;IACzC,mFAAmF;IACnF,4EAA4E;IAC5E,yBAAyB;IACzB,gDAAgD;IAChD,6BAA6B;CAC9B,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;IAC1E,CAAC;IAED,sDAAsD;IACtD,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,CAAC,2BAA2B,CAAC;YACtC,iBAAiB,EAAE,IAAI;SACxB,CAAC;IACJ,CAAC;IAED;0BACsB;IACtB,KAAK,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,gBAAgB,EAAE,CAAC;QAC/C,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,KAAK,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,kBAAkB,EAAE,CAAC;QACjD,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACrE,CAAC;IAED,oBAAoB;IACpB,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;QAC7C,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAC7E,CAAC;IAED,qBAAqB;IACrB,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;IAC5G,CAAC;IAED;;;;;oBAKgB;IAChB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,gCAAgC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;AACnG,CAAC;AAED,gBAAgB;AAChB,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa;CACjF,CAAC"}

package/dist/core/sq_resolver.d.ts

@@ -0,0 +1,14 @@
+/** Force-clear caches. Used by tests. */
+export declare function _clearSqResolverCaches(): void;
+/** Return the active SQ rule slugs for a given step, merged with
+ *  the always-active cross-cutting set. Deduped. */
+export declare function activeRulesForStep(stepDescriptor: string | number | null | undefined): Promise<string[]>;
+/** Render a compact "ACTIVE SQ RULES" block for the system prompt.
+ *  Format: `SQ <slug>  <title>` one per line. Returns empty when
+ *  no rules apply (e.g., yaml missing). */
+export declare function renderActiveRulesBlock(stepDescriptor: string | number | null | undefined): Promise<string>;
+/** Render the ACTIVE SQ RULES block from an explicit slug list.
+ *  Used when the workflow state declares `active_sq_rules` directly
+ *  (alpha.59z.5 F1 -- skip the step inference path). */
+export declare function renderRulesBlockBySlugs(slugs: string[]): Promise<string>;
+//# sourceMappingURL=sq_resolver.d.ts.map

package/dist/core/sq_resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sq_resolver.d.ts","sourceRoot":"","sources":["../../src/core/sq_resolver.ts"],"names":[],"mappings":"AA2JA,yCAAyC;AACzC,wBAAgB,sBAAsB,IAAI,IAAI,CAG7C;AAsBD;oDACoD;AACpD,wBAAsB,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAU9G;AAED;;2CAE2C;AAC3C,wBAAsB,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAGhH;AAED;;wDAEwD;AACxD,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAwB9E"}