@namzu/cli 12.1.0 → 13.0.0

package/dist/integrations/subagents/runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/integrations/subagents/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAGN,YAAY,EACZ,aAAa,EAMb,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAElB,kBAAkB,EAClB,aAAa,EAGb,0BAA0B,EAI1B,YAAY,EACZ,wBAAwB,EACxB,OAAO,EACP,WAAW,EACX,UAAU,EACV,QAAQ,EACR,UAAU,EACV,kBAAkB,GAClB,MAAM,YAAY,CAAA;AAEnB,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAA;AAEzD,MAAM,eAAe,GAAG;IACvB,sGAAsG;IACtG,oFAAoF;IACpF,2HAA2H;IAC3H,8FAA8F;IAC9F,EAAE;IACF,4EAA4E;IAC5E,+HAA+H;IAC/H,sKAAsK;IACtK,mGAAmG;CACnG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAyCZ;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,IAA4B;IAE5B,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,CAAA;IAC5C,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAA;IACxC,MAAM,UAAU,GAAG,IAAI,kBAAkB,EAAE,CAAA;IAE3C,MAAM,SAAS,GAAa,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAA;IACrF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAA;IACpF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAC1C,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAC7C,QAAQ,CACR,CAAA;IACD,yEAAyE;IACzE,EAAE;IACF,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,6EAA6E;IAC7E,kCAAkC;IAClC,EAAE;IACF,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,aAAa,CAC9C,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,EACtE,QAAQ,CACR,CAAA;IACD,MAAM,KAAK,CAAC,aAAa,CAAC,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAA;IAE3E,IAAI,cAAc,GAAG,CAAC,CAAA;IACtB,MAAM,YAAY,GAAG,IAAI,0BAA0B,CAAC;QACnD,KAAK;QACL,iBAAiB,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,aAAa,EAAE,cAAc,EAAE,CAAC;KACrE,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,IAAI,aAAa,EAAE,CAAA;IACpC,QAAQ,CAAC,QAAQ,CAChB,eAAe,CACd,wBAAwB,EACxB,8BAA8B,EAC9B,eAAe,EACf,IAAI,CACJ,CACD,CAAA;IAED,MAAM,aAAa,GAAG,IAAI,YAAY,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE;QACrD,YAAY,EAAE,KAAK;QACnB,mBAAmB,EAAE,YAAY;QACjC,iBAAiB,EAAE,IAAI,wBAAwB,EAAE;QACjD,QAAQ,EAAE,IAAI,wBAAwB,CAAC,KAAK,CAAC;QAC7C,aAAa;KACb,CAAC,CAAA;IAEF,MAAM,WAAW,GAAqB;QACrC,WAAW,EAAE,OAAO,CAAC,eAAe,CAAC;QACrC,aAAa,EAAE,OAAO;QACtB,qBAAqB,EAAE,IAAI,eAAe,EAAE;QAC5C,KAAK,EAAE,CAAC;QACR,aAAa,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE;QACzD,QAAQ;QACR,OAAO,EAAE,MAAM,CAAC,EAAE;QAClB,SAAS,EAAE,aAAa,CAAC,EAAE;QAC3B,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,WAAW,EAAE,SAAS;KACtB,CAAA;IAED,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IAE1E,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,MAAM,SAAS,GAAG,UAAU,CAAC;QAC5B,IAAI,EAAE,OAAO;QACb,WAAW,EACV,oFAAoF;YACpF,0FAA0F;YAC1F,oGAAoG;YACpG,kGAAkG;YAClG,mGAAmG;YACnG,uDAAuD;QACxD,WAAW,EAAE,kBAAkB,CAAC;YAC/B,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACX,WAAW,EAAE;oBACZ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+CAA+C;iBAC5D;gBACD,MAAM,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+DAA+D;iBAC5E;gBACD,IAAI,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EACV,oGAAoG;iBACrG;aACD;YACD,QAAQ,EAAE,CAAC,aAAa,EAAE,QAAQ,CAAC;SACnC,CAAC;QACF,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,KAAK;QAClB,eAAe,EAAE,IAAI;QACrB,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO;YAC3B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAA0C,CAAA;YACnE,IAAI,OAAO,GAAG,wBAAwB,CAAA;YACtC,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;YAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAA;YAClC,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,OAAO,EAAE,UAAU,EAAE,CAAA;gBAC/B,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,EAAE,uBAAuB,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAA;YAC7F,CAAC;YACD,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;oBACvC,OAAO;oBACP,MAAM;oBACN,gBAAgB,EAAE,IAAI,CAAC,GAAG;oBAC1B,6DAA6D;oBAC7D,2DAA2D;oBAC3D,4DAA4D;oBAC5D,4DAA4D;oBAC5D,oCAAoC;oBACpC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACjE,CAAC,CAAA;gBACF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBAC1D,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,EAAE,MAAM,CAAA;gBAC1C,MAAM,SAAS,GACd,SAAS,CAAC,KAAK,KAAK,WAAW,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,WAAW,CAAC,CAAA;gBAC1F,MAAM,UAAU,GACf,OAAO,SAAS,CAAC,MAAM,EAAE,MAAM,KAAK,QAAQ;oBAC3C,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM;oBACzB,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS;wBACvC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;wBACzC,CAAC,CAAC,EAAE,CAAA;gBACP,IAAI,CAAC,SAAS,EAAE,CAAC;oBAChB,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,EAAE;wBACV,KAAK,EAAE,aAAa,OAAO,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,MAAM,EAAE,SAAS,IAAI,UAAU,IAAI,aAAa,EAAE;qBAC/G,CAAA;gBACF,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,IAAI,8BAA8B,EAAE,CAAA;YAC/E,CAAC;oBAAS,CAAC;gBACV,oEAAoE;gBACpE,oEAAoE;gBACpE,8DAA8D;gBAC9D,IAAI,OAAO;oBAAE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAC1C,CAAC;QACF,CAAC;KACD,CAAC,CAAA;IAEF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAA;AAC3E,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACvB,EAAU,EACV,WAAmB,EACnB,YAAoB,EACpB,IAA4B;IAE5B,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC;QAC/B,EAAE;QACF,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,SAAS;QACnB,WAAW;KACX,CAAC,CAAA;IACF,2EAA2E;IAC3E,uEAAuE;IACvE,EAAE;IACF,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,oCAAoC;IACpC,MAAM,IAAI,GACT,YAAY,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,eAAe,EAAE,CAAA;IAC7F,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACzF,OAAO;QACN,IAAI,EAAE;YACL,EAAE;YACF,IAAI,EAAE,EAAE;YACR,OAAO,EAAE,OAAO;YAChB,QAAQ,EAAE,SAAS;YACnB,WAAW;YACX,KAAK,EAAE,EAAE;YACT,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE;SACrD;QACD,yEAAyE;QACzE,6EAA6E;QAC7E,UAAU,EAAE,KAA+D;QAC3E,aAAa,EAAE,KAAK,EAAE,OAAO,EAAgC,EAAE;YAC9D,uEAAuE;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,yCAAyC;YACzC,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;YAC9E,OAAO;gBACN,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO;gBAC3C,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO;gBACvC,aAAa,EAAE,EAAE;gBACjB,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE;gBAC9B,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE;gBACxB,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,MAAM,OAAO,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM;gBAClE,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChF,CAAA;QACF,CAAC;KACD,CAAA;AACF,CAAC"}
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/integrations/subagents/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAGN,YAAY,EACZ,aAAa,EAMb,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAElB,kBAAkB,EAElB,aAAa,EAIb,0BAA0B,EAI1B,YAAY,EACZ,wBAAwB,EACxB,OAAO,EACP,WAAW,EACX,UAAU,EACV,QAAQ,EACR,UAAU,EACV,kBAAkB,GAClB,MAAM,YAAY,CAAA;AAEnB,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAA;AAEzD,MAAM,eAAe,GAAG;IACvB,sGAAsG;IACtG,oFAAoF;IACpF,2HAA2H;IAC3H,8FAA8F;IAC9F,EAAE;IACF,4EAA4E;IAC5E,+HAA+H;IAC/H,sKAAsK;IACtK,mGAAmG;CACnG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAoCZ;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,IAA4B;IAE5B,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,CAAA;IAC5C,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAA;IACxC,MAAM,UAAU,GAAG,IAAI,kBAAkB,EAAE,CAAA;IAE3C,MAAM,SAAS,GAAa;QAC3B,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC;QAC7B,QAAQ;KACR,CAAA;IACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAA;IACpF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAC1C,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAC7C,QAAQ,CACR,CAAA;IACD,yEAAyE;IACzE,EAAE;IACF,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,6EAA6E;IAC7E,kCAAkC;IAClC,EAAE;IACF,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,aAAa,CAC9C,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,EACtE,QAAQ,CACR,CAAA;IACD,MAAM,KAAK,CAAC,aAAa,CAAC,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAA;IAE3E,IAAI,cAAc,GAAG,CAAC,CAAA;IACtB,MAAM,YAAY,GAAG,IAAI,0BAA0B,CAAC;QACnD,KAAK;QACL,iBAAiB,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,aAAa,EAAE,cAAc,EAAE,CAAC;KACrE,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,IAAI,aAAa,EAAE,CAAA;IACpC,QAAQ,CAAC,QAAQ,CAChB,eAAe,CACd,wBAAwB,EACxB,8BAA8B,EAC9B,eAAe,EACf,IAAI,CACJ,CACD,CAAA;IAED,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1E,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE;QACrD,YAAY,EAAE,KAAK;QACnB,mBAAmB,EAAE,YAAY;QACjC,iBAAiB,EAAE,IAAI,wBAAwB,EAAE;QACjD,QAAQ,EAAE,IAAI,wBAAwB,CAAC,KAAK,CAAC;QAC7C,YAAY;KACZ,CAAC,CAAA;IAEF,MAAM,WAAW,GAAqB;QACrC,WAAW,EAAE,OAAO,CAAC,eAAe,CAAC;QACrC,aAAa,EAAE,OAAO;QACtB,qBAAqB,EAAE,IAAI,eAAe,EAAE;QAC5C,KAAK,EAAE,CAAC;QACR,aAAa,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE;QACzD,QAAQ;QACR,OAAO,EAAE,MAAM,CAAC,EAAE;QAClB,SAAS,EAAE,aAAa,CAAC,EAAE;QAC3B,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,WAAW,EAAE,SAAS;KACtB,CAAA;IAED,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IAE1E,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,MAAM,SAAS,GAAG,UAAU,CAAC;QAC5B,IAAI,EAAE,OAAO;QACb,WAAW,EACV,oFAAoF;YACpF,0FAA0F;YAC1F,oGAAoG;YACpG,kGAAkG;YAClG,mGAAmG;YACnG,uDAAuD;QACxD,WAAW,EAAE,kBAAkB,CAAC;YAC/B,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACX,WAAW,EAAE;oBACZ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+CAA+C;iBAC5D;gBACD,MAAM,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+DAA+D;iBAC5E;gBACD,IAAI,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EACV,oGAAoG;iBACrG;aACD;YACD,QAAQ,EAAE,CAAC,aAAa,EAAE,QAAQ,CAAC;SACnC,CAAC;QACF,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,KAAK;QAClB,eAAe,EAAE,IAAI;QACrB,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO;YAC3B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAA0C,CAAA;YACnE,IAAI,OAAO,GAAG,wBAAwB,CAAA;YACtC,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;YAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAA;YAClC,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,OAAO,EAAE,UAAU,EAAE,CAAA;gBAC/B,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,EAAE,uBAAuB,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAA;YAC7F,CAAC;YACD,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;oBACvC,OAAO;oBACP,MAAM;oBACN,gBAAgB,EAAE,IAAI,CAAC,GAAG;oBAC1B,6DAA6D;oBAC7D,2DAA2D;oBAC3D,4DAA4D;oBAC5D,4DAA4D;oBAC5D,oCAAoC;oBACpC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACjE,CAAC,CAAA;gBACF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBAC1D,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,EAAE,MAAM,CAAA;gBAC1C,MAAM,SAAS,GACd,SAAS,CAAC,KAAK,KAAK,WAAW,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,WAAW,CAAC,CAAA;gBAC1F,MAAM,UAAU,GACf,OAAO,SAAS,CAAC,MAAM,EAAE,MAAM,KAAK,QAAQ;oBAC3C,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM;oBACzB,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS;wBACvC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;wBACzC,CAAC,CAAC,EAAE,CAAA;gBACP,IAAI,CAAC,SAAS,EAAE,CAAC;oBAChB,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,EAAE;wBACV,KAAK,EAAE,aAAa,OAAO,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,MAAM,EAAE,SAAS,IAAI,UAAU,IAAI,aAAa,EAAE;qBAC/G,CAAA;gBACF,CAAC;gBACD,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,UAAU,IAAI,8BAA8B;iBACpD,CAAA;YACF,CAAC;oBAAS,CAAC;gBACV,oEAAoE;gBACpE,oEAAoE;gBACpE,8DAA8D;gBAC9D,IAAI,OAAO;oBAAE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAC1C,CAAC;QACF,CAAC;KACD,CAAC,CAAA;IAEF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAA;AAC3E,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACvB,EAAU,EACV,WAAmB,EACnB,YAAoB,EACpB,IAA4B;IAE5B,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC;QAC/B,EAAE;QACF,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,SAAS;QACnB,WAAW;KACX,CAAC,CAAA;IACF,2EAA2E;IAC3E,uEAAuE;IACvE,EAAE;IACF,MAAM,IAAI,GACT,YAAY,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,eAAe,EAAE,CAAA;IAC7F,OAAO;QACN,IAAI,EAAE;YACL,EAAE;YACF,IAAI,EAAE,EAAE;YACR,OAAO,EAAE,OAAO;YAChB,QAAQ,EAAE,SAAS;YACnB,WAAW;YACX,KAAK,EAAE,EAAE;YACT,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE;SACrD;QACD,yEAAyE;QACzE,6EAA6E;QAC7E,UAAU,EAAE,KAA+D;QAC3E,aAAa,EAAE,KAAK,EAAE,OAAO,EAAgC,EAAE;YAC9D,uEAAuE;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,yCAAyC;YACzC,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;YAC9E,OAAO;gBACN,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO;gBAC3C,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO;gBACvC,aAAa,EAAE,EAAE;gBACjB,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE;gBAC9B,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE;gBACxB,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;gBAC9D,GAAG,CAAC,IAAI,CAAC,yBAAyB;oBACjC,CAAC,CAAC,EAAE,yBAAyB,EAAE,IAAI,CAAC,yBAAyB,EAAE,EAAE;oBACjE,CAAC,CAAC,EAAE,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChF,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1E,GAAG,CAAC,IAAI,CAAC,wBAAwB,KAAK,SAAS;oBAC9C,CAAC,CAAC,EAAE,wBAAwB,EAAE,IAAI,CAAC,wBAAwB,EAAE;oBAC7D,CAAC,CAAC,EAAE,CAAC;aACN,CAAA;QACF,CAAC;KACD,CAAA;AACF,CAAC"}

package/dist/integrations/trust/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/integrations/trust/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAeH,wBAAgB,aAAa,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE9D;AAWD,wBAAgB,eAAe,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,EAAE,CAOlE;AAED,8DAA8D;AAC9D,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG,OAAO,CASxE;AAED,kDAAkD;AAClD,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG,IAAI,CAQpE"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/integrations/trust/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA4BH,wBAAgB,aAAa,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE9D;AAED,wBAAgB,eAAe,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,EAAE,CAOlE;AAED,8DAA8D;AAC9D,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG,OAAO,CAcxE;AAED,kDAAkD;AAClD,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG,IAAI,CAapE"}

package/dist/integrations/trust/store.js

@@ -7,24 +7,27 @@
  * counts as trusted if it — or any ancestor — has been trusted, so
  * trusting a repo root covers its subfolders.
  */
-import { mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join, resolve, sep } from 'node:path';
+import { canonicalProjectPath } from '../../permissions/canonical-project.js';
 const DIR_MODE = 0o700;
 const FILE_MODE = 0o600;
 const TRUST_FILE_VERSION = 1;
-export function trustFilePath(home = homedir()) {
-    return join(home, '.namzu', 'trust.json');
-}
-/** Resolve symlinks + normalize so the same dir isn't trusted twice. */
-function canonical(dir) {
+function canonicalStoredPath(dir) {
     try {
-        return realpathSync(resolve(dir));
+        return canonicalProjectPath(dir);
     }
     catch {
+        // A remembered checkout may have been removed. Keeping its normalized
+        // name readable does not admit a live project; the target below must
+        // resolve successfully before it can match.
         return resolve(dir);
     }
 }
+export function trustFilePath(home = homedir()) {
+    return join(home, '.namzu', 'trust.json');
+}
 export function readTrustedDirs(home = homedir()) {
     try {
         const parsed = JSON.parse(readFileSync(trustFilePath(home), 'utf8'));
@@ -36,8 +39,14 @@ export function readTrustedDirs(home = homedir()) {
 }
 /** True when `dir` or any ancestor is in the trusted list. */
 export function isTrusted(dir, home = homedir()) {
-    const target = canonical(dir);
-    const trusted = readTrustedDirs(home).map(canonical);
+    let target;
+    try {
+        target = canonicalProjectPath(dir);
+    }
+    catch {
+        return false;
+    }
+    const trusted = readTrustedDirs(home).map(canonicalStoredPath);
     for (const t of trusted) {
         if (target === t || target.startsWith(t.endsWith(sep) ? t : t + sep)) {
             return true;
@@ -47,13 +56,18 @@ export function isTrusted(dir, home = homedir()) {
 }
 /** Add `dir` to the trusted list (idempotent). */
 export function trustDir(dir, home = homedir()) {
-    const target = canonical(dir);
+    const target = canonicalProjectPath(dir);
     const current = readTrustedDirs(home);
-    if (current.map(canonical).includes(target))
+    if (current.map(canonicalStoredPath).includes(target))
         return;
-    const next = { version: TRUST_FILE_VERSION, trusted: [...current, target] };
+    const next = {
+        version: TRUST_FILE_VERSION,
+        trusted: [...current, target],
+    };
     const path = trustFilePath(home);
     mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
-    writeFileSync(path, `${JSON.stringify(next, null, 2)}\n`, { mode: FILE_MODE });
+    writeFileSync(path, `${JSON.stringify(next, null, 2)}\n`, {
+        mode: FILE_MODE,
+    });
 }
 //# sourceMappingURL=store.js.map

package/dist/integrations/trust/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/integrations/trust/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAEvD,MAAM,QAAQ,GAAG,KAAK,CAAA;AACtB,MAAM,SAAS,GAAG,KAAK,CAAA;AACvB,MAAM,kBAAkB,GAAG,CAAC,CAAA;AAO5B,MAAM,UAAU,aAAa,CAAC,OAAe,OAAO,EAAE;IACrD,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;AAC1C,CAAC;AAED,wEAAwE;AACxE,SAAS,SAAS,CAAC,GAAW;IAC7B,IAAI,CAAC;QACJ,OAAO,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,OAAO,CAAC,GAAG,CAAC,CAAA;IACpB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,OAAO,EAAE;IACvD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAuB,CAAA;QAC1F,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAChG,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,SAAS,CAAC,GAAW,EAAE,OAAe,OAAO,EAAE;IAC9D,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACpD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YACtE,OAAO,IAAI,CAAA;QACZ,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,QAAQ,CAAC,GAAW,EAAE,OAAe,OAAO,EAAE;IAC7D,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IACrC,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAM;IACnD,MAAM,IAAI,GAAc,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,MAAM,CAAC,EAAE,CAAA;IACtF,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAChC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;AAC/E,CAAC"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/integrations/trust/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAEvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAA;AAE7E,MAAM,QAAQ,GAAG,KAAK,CAAA;AACtB,MAAM,SAAS,GAAG,KAAK,CAAA;AACvB,MAAM,kBAAkB,GAAG,CAAC,CAAA;AAE5B,SAAS,mBAAmB,CAAC,GAAW;IACvC,IAAI,CAAC;QACJ,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,sEAAsE;QACtE,qEAAqE;QACrE,4CAA4C;QAC5C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAA;IACpB,CAAC;AACF,CAAC;AAOD,MAAM,UAAU,aAAa,CAAC,OAAe,OAAO,EAAE;IACrD,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;AAC1C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,OAAO,EAAE;IACvD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAuB,CAAA;QAC1F,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAChG,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,SAAS,CAAC,GAAW,EAAE,OAAe,OAAO,EAAE;IAC9D,IAAI,MAAc,CAAA;IAClB,IAAI,CAAC;QACJ,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IAC9D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YACtE,OAAO,IAAI,CAAA;QACZ,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,QAAQ,CAAC,GAAW,EAAE,OAAe,OAAO,EAAE;IAC7D,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;IACxC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IACrC,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAM;IAC7D,MAAM,IAAI,GAAc;QACvB,OAAO,EAAE,kBAAkB;QAC3B,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,MAAM,CAAC;KAC7B,CAAA;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAChC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QACzD,IAAI,EAAE,SAAS;KACf,CAAC,CAAA;AACH,CAAC"}

package/dist/permissions/canonical-project.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Resolve a project path once at the authority boundary.
+ *
+ * Every operation admitted by a trust decision must keep this exact result.
+ * Re-resolving a lexical symlink later would let it be redirected after the
+ * operator approved a different directory.
+ */
+export declare function canonicalProjectPath(dir: string): string;
+//# sourceMappingURL=canonical-project.d.ts.map

package/dist/permissions/canonical-project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-project.d.ts","sourceRoot":"","sources":["../../src/permissions/canonical-project.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAExD"}

package/dist/permissions/canonical-project.js

@@ -0,0 +1,13 @@
+import { realpathSync } from 'node:fs';
+import { resolve } from 'node:path';
+/**
+ * Resolve a project path once at the authority boundary.
+ *
+ * Every operation admitted by a trust decision must keep this exact result.
+ * Re-resolving a lexical symlink later would let it be redirected after the
+ * operator approved a different directory.
+ */
+export function canonicalProjectPath(dir) {
+    return realpathSync(resolve(dir));
+}
+//# sourceMappingURL=canonical-project.js.map

package/dist/permissions/canonical-project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-project.js","sourceRoot":"","sources":["../../src/permissions/canonical-project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC/C,OAAO,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;AAClC,CAAC"}

package/dist/permissions/checks.d.ts

@@ -0,0 +1,65 @@
+/**
+ * An operator's own expectations about their own permission table, checked.
+ *
+ * ## Why config needs tests at all
+ *
+ * A `[permissions]` entry is a glob compiled to a regular expression and
+ * evaluated against a subject the operator never sees. Every part of that
+ * pipeline has been wrong at least once in this repository, and each time the
+ * failure was silent and permissive: a rule that read like a prohibition and
+ * decided nothing, an `allow` whose match began wherever the text did, a glob
+ * whose trailing star reached past the end of a command. In every case the
+ * config LOOKED right, and nothing the operator could run would have told them
+ * otherwise.
+ *
+ * A test case attached to the policy turns that into a startup failure. It is
+ * the same argument as `a-falsifiable-comment-is-a-test`, applied to
+ * configuration: a claim nobody can check is a claim nobody should believe.
+ *
+ * ## What a check is
+ *
+ * A tool, an input, and the decision the operator believes their table
+ * produces:
+ *
+ *     "permissionChecks": [
+ *       { "tool": "bash", "input": { "command": "git status --short" }, "expect": "allow" },
+ *       { "tool": "bash", "input": { "command": "git status && rm -rf ~" }, "expect": "ask" }
+ *     ]
+ *
+ * The second is the interesting one. It asserts a NEGATIVE — that the table
+ * does not stretch to cover a command the operator never named — and a negative
+ * is exactly what a table of globs cannot be read for.
+ *
+ * ## Why it runs the real gate
+ *
+ * Re-implementing the matching here would check this file against itself. The
+ * check compiles the operator's table to rules and hands them to the same
+ * `AuthorizationGate` a run uses, so what it verifies is the decision that will
+ * actually be taken.
+ *
+ * The floor is deliberately OFF while checking. `denyDangerousPatterns` would
+ * answer for the four catastrophic commands before any operator rule was
+ * consulted, so a check written about the table would silently be answered by
+ * something else — and would keep passing after the rule it was written for was
+ * deleted.
+ */
+import { type AuthorizationRule } from '@namzu/sdk';
+import type { CompileDiagnostic, PermissionEffect } from './rules.js';
+/** One operator-authored expectation about the permission table. */
+export interface PermissionCheck {
+    readonly tool: string;
+    readonly input: Readonly<Record<string, unknown>>;
+    readonly expect: PermissionEffect;
+}
+export type PermissionChecksConfig = readonly PermissionCheck[];
+/**
+ * Evaluate every check against the compiled table.
+ *
+ * Returns a diagnostic per failure rather than throwing, for the reason the
+ * compiler already collects rather than throws: one wrong expectation should
+ * cost that line and not the other nine. But a failure must be SAID — a check
+ * that silently passes is worse than no check, because it is a reason to
+ * believe.
+ */
+export declare function verifyPermissionChecks(rules: readonly AuthorizationRule[], checks: PermissionChecksConfig | undefined): CompileDiagnostic[];
+//# sourceMappingURL=checks.d.ts.map

package/dist/permissions/checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/permissions/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAqB,KAAK,iBAAiB,EAAe,MAAM,YAAY,CAAA;AAEnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAGrE,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACjD,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CACjC;AAED,MAAM,MAAM,sBAAsB,GAAG,SAAS,eAAe,EAAE,CAAA;AAa/D;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACrC,KAAK,EAAE,SAAS,iBAAiB,EAAE,EACnC,MAAM,EAAE,sBAAsB,GAAG,SAAS,GACxC,iBAAiB,EAAE,CAwDrB"}

package/dist/permissions/checks.js

@@ -0,0 +1,122 @@
+/**
+ * An operator's own expectations about their own permission table, checked.
+ *
+ * ## Why config needs tests at all
+ *
+ * A `[permissions]` entry is a glob compiled to a regular expression and
+ * evaluated against a subject the operator never sees. Every part of that
+ * pipeline has been wrong at least once in this repository, and each time the
+ * failure was silent and permissive: a rule that read like a prohibition and
+ * decided nothing, an `allow` whose match began wherever the text did, a glob
+ * whose trailing star reached past the end of a command. In every case the
+ * config LOOKED right, and nothing the operator could run would have told them
+ * otherwise.
+ *
+ * A test case attached to the policy turns that into a startup failure. It is
+ * the same argument as `a-falsifiable-comment-is-a-test`, applied to
+ * configuration: a claim nobody can check is a claim nobody should believe.
+ *
+ * ## What a check is
+ *
+ * A tool, an input, and the decision the operator believes their table
+ * produces:
+ *
+ *     "permissionChecks": [
+ *       { "tool": "bash", "input": { "command": "git status --short" }, "expect": "allow" },
+ *       { "tool": "bash", "input": { "command": "git status && rm -rf ~" }, "expect": "ask" }
+ *     ]
+ *
+ * The second is the interesting one. It asserts a NEGATIVE — that the table
+ * does not stretch to cover a command the operator never named — and a negative
+ * is exactly what a table of globs cannot be read for.
+ *
+ * ## Why it runs the real gate
+ *
+ * Re-implementing the matching here would check this file against itself. The
+ * check compiles the operator's table to rules and hands them to the same
+ * `AuthorizationGate` a run uses, so what it verifies is the decision that will
+ * actually be taken.
+ *
+ * The floor is deliberately OFF while checking. `denyDangerousPatterns` would
+ * answer for the four catastrophic commands before any operator rule was
+ * consulted, so a check written about the table would silently be answered by
+ * something else — and would keep passing after the rule it was written for was
+ * deleted.
+ */
+import { AuthorizationGate, NOOP_LOGGER } from '@namzu/sdk';
+import { isPermissionEffect } from './rules.js';
+/**
+ * The gate's vocabulary against the operator's.
+ *
+ * `review` is what the gate returns when nothing decided, and `ask` is what the
+ * operator writes for it. Two names for one outcome is a translation, not a
+ * mapping to be got wrong in one direction.
+ */
+function asEffect(decision) {
+    return decision === 'review' ? 'ask' : decision;
+}
+/**
+ * Evaluate every check against the compiled table.
+ *
+ * Returns a diagnostic per failure rather than throwing, for the reason the
+ * compiler already collects rather than throws: one wrong expectation should
+ * cost that line and not the other nine. But a failure must be SAID — a check
+ * that silently passes is worse than no check, because it is a reason to
+ * believe.
+ */
+export function verifyPermissionChecks(rules, checks) {
+    if (!checks || checks.length === 0)
+        return [];
+    const diagnostics = [];
+    const gate = new AuthorizationGate({
+        enabled: true,
+        rules: [...rules],
+        allowReadOnlyTools: false,
+        // Off on purpose; see the note at the top of this file.
+        denyDangerousPatterns: false,
+        logDecisions: false,
+    }, NOOP_LOGGER);
+    for (const [index, check] of checks.entries()) {
+        const where = `permissionChecks[${index}]`;
+        if (typeof check?.tool !== 'string' || check.tool === '') {
+            diagnostics.push({ tool: where, message: 'expected a "tool" naming the tool to evaluate' });
+            continue;
+        }
+        if (typeof check.input !== 'object' || check.input === null || Array.isArray(check.input)) {
+            diagnostics.push({
+                tool: where,
+                message: `expected an "input" object for ${check.tool}; got ${describe(check.input)}`,
+            });
+            continue;
+        }
+        if (!isPermissionEffect(check.expect)) {
+            diagnostics.push({
+                tool: where,
+                message: `expected "expect" to be "allow", "ask" or "deny"; got ${JSON.stringify(check.expect)}`,
+            });
+            continue;
+        }
+        const verdict = gate.evaluate({
+            toolName: check.tool,
+            toolInput: check.input,
+            toolDef: undefined,
+        });
+        const actual = asEffect(verdict.decision);
+        if (actual === check.expect)
+            continue;
+        // The reason is quoted because it names the rule that decided, which is
+        // the difference between "your config is wrong" and a message someone
+        // can act on without re-deriving the whole table.
+        diagnostics.push({
+            tool: where,
+            message: `${check.tool} ${JSON.stringify(check.input)} is "${actual}", not the expected "${check.expect}" — ${verdict.reason}`,
+        });
+    }
+    return diagnostics;
+}
+function describe(value) {
+    if (value === null)
+        return 'null';
+    return Array.isArray(value) ? 'an array' : typeof value;
+}
+//# sourceMappingURL=checks.js.map

package/dist/permissions/checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../src/permissions/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAE,iBAAiB,EAA0B,WAAW,EAAE,MAAM,YAAY,CAAA;AAGnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAW/C;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,QAAqC;IACtD,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAA;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACrC,KAAmC,EACnC,MAA0C;IAE1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAE7C,MAAM,WAAW,GAAwB,EAAE,CAAA;IAC3C,MAAM,IAAI,GAAG,IAAI,iBAAiB,CACjC;QACC,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;QACjB,kBAAkB,EAAE,KAAK;QACzB,wDAAwD;QACxD,qBAAqB,EAAE,KAAK;QAC5B,YAAY,EAAE,KAAK;KACnB,EACD,WAAW,CACX,CAAA;IAED,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,oBAAoB,KAAK,GAAG,CAAA;QAE1C,IAAI,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YAC1D,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAA;YAC3F,SAAQ;QACT,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3F,WAAW,CAAC,IAAI,CAAC;gBAChB,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,kCAAkC,KAAK,CAAC,IAAI,SAAS,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;aACrF,CAAC,CAAA;YACF,SAAQ;QACT,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,WAAW,CAAC,IAAI,CAAC;gBAChB,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,yDAAyD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;aAChG,CAAC,CAAA;YACF,SAAQ;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC7B,QAAQ,EAAE,KAAK,CAAC,IAAI;YACpB,SAAS,EAAE,KAAK,CAAC,KAAK;YACtB,OAAO,EAAE,SAAS;SAClB,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QACzC,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM;YAAE,SAAQ;QAErC,wEAAwE;QACxE,sEAAsE;QACtE,kDAAkD;QAClD,WAAW,CAAC,IAAI,CAAC;YAChB,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,MAAM,wBAAwB,KAAK,CAAC,MAAM,OAAO,OAAO,CAAC,MAAM,EAAE;SAC9H,CAAC,CAAA;IACH,CAAC;IAED,OAAO,WAAW,CAAA;AACnB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAA;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,KAAK,CAAA;AACxD,CAAC"}

package/dist/permissions/headless-trust.d.ts

@@ -44,11 +44,15 @@
  * an answer, which is the failure this package keeps finding rather than a
  * milder version of it.
  */
-export interface TrustDecision {
-    readonly allowed: boolean;
-    /** Present only on a refusal. Names the folder and both ways forward. */
-    readonly message?: string;
-}
+export type TrustDecision = {
+    readonly allowed: true;
+    /** Canonical target captured by the decision; use it for every later operation. */
+    readonly cwd: string;
+} | {
+    readonly allowed: false;
+    /** Names the folder and both ways forward. */
+    readonly message: string;
+};
 export interface TrustCheck {
     readonly cwd: string;
     /** `--trust` was passed: the operator accepts this folder for this run. */

package/dist/permissions/headless-trust.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"headless-trust.d.ts","sourceRoot":"","sources":["../../src/permissions/headless-trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAIH,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,yEAAyE;IACzE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAA;CAC3C;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,aAAa,CAqBpE"}
+{"version":3,"file":"headless-trust.d.ts","sourceRoot":"","sources":["../../src/permissions/headless-trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAKH,MAAM,MAAM,aAAa,GACtB;IACA,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;IACtB,mFAAmF;IACnF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACnB,GACD;IACA,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAA;IACvB,8CAA8C;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACvB,CAAA;AAEJ,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAA;CAC3C;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,aAAa,CAiCpE"}

package/dist/permissions/headless-trust.js

@@ -45,20 +45,34 @@
  * milder version of it.
  */
 import { isTrusted } from '../integrations/trust/store.js';
+import { canonicalProjectPath } from './canonical-project.js';
 export function decideHeadlessTrust(check) {
+    // Capture the real target exactly once. The permission and every operation
+    // it admits must refer to the same directory entry even if the lexical
+    // `--cwd` was a symlink and somebody repoints it immediately afterward.
+    let cwd;
+    try {
+        cwd = canonicalProjectPath(check.cwd);
+    }
+    catch {
+        return {
+            allowed: false,
+            message: `refusing to run because the working directory changed or became unavailable while trust was being checked: ${check.cwd}`,
+        };
+    }
     // `--trust` is per-run and is deliberately NOT written to the trust file.
     // One reflexive use must not change the machine's state forever; the TUI
     // stays the only path that records durable trust, because that is the one
     // where a human is actually looking at a prompt.
     if (check.trustFlag)
-        return { allowed: true };
+        return { allowed: true, cwd };
     const isDirTrusted = check.trusted ?? ((dir) => isTrusted(dir));
-    if (isDirTrusted(check.cwd))
-        return { allowed: true };
+    if (isDirTrusted(cwd))
+        return { allowed: true, cwd };
     return {
         allowed: false,
         message: [
-            `refusing to run in a folder nobody has trusted: ${check.cwd}`,
+            `refusing to run in a folder nobody has trusted: ${cwd}`,
             '',
             "namzu reads this folder's files, runs commands in it and executes its",
             'code, and a headless run approves those tools without asking because',

package/dist/permissions/headless-trust.js.map

@@ -1 +1 @@
-{"version":3,"file":"headless-trust.js","sourceRoot":"","sources":["../../src/permissions/headless-trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAA;AAgB1D,MAAM,UAAU,mBAAmB,CAAC,KAAiB;IACpD,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,iDAAiD;IACjD,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;IACvE,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACrD,OAAO;QACN,OAAO,EAAE,KAAK;QACd,OAAO,EAAE;YACR,mDAAmD,KAAK,CAAC,GAAG,EAAE;YAC9D,EAAE;YACF,uEAAuE;YACvE,sEAAsE;YACtE,yBAAyB;YACzB,EAAE;YACF,uEAAuE;YACvE,8DAA8D;SAC9D,CAAC,IAAI,CAAC,IAAI,CAAC;KACZ,CAAA;AACF,CAAC"}
+{"version":3,"file":"headless-trust.js","sourceRoot":"","sources":["../../src/permissions/headless-trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAA;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAsB7D,MAAM,UAAU,mBAAmB,CAAC,KAAiB;IACpD,2EAA2E;IAC3E,uEAAuE;IACvE,wEAAwE;IACxE,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACJ,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACtC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO;YACN,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,8GAA8G,KAAK,CAAC,GAAG,EAAE;SAClI,CAAA;IACF,CAAC;IACD,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,iDAAiD;IACjD,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;IAClD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;IACvE,IAAI,YAAY,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;IACpD,OAAO;QACN,OAAO,EAAE,KAAK;QACd,OAAO,EAAE;YACR,mDAAmD,GAAG,EAAE;YACxD,EAAE;YACF,uEAAuE;YACvE,sEAAsE;YACtE,yBAAyB;YACzB,EAAE;YACF,uEAAuE;YACvE,8DAA8D;SAC9D,CAAC,IAAI,CAAC,IAAI,CAAC;KACZ,CAAA;AACF,CAAC"}

package/dist/permissions/rules.d.ts

@@ -10,7 +10,8 @@
  * The whole surface is pure: config in, rules out. The gate stays the only
  * thing that decides anything, which is what keeps this testable without a run.
  */
-import type { AuthorizationRule } from '@namzu/sdk';
+import { type AuthorizationRule } from '@namzu/sdk';
+import { type PermissionChecksConfig } from './checks.js';
 /** What the operator wants to happen when a rule matches. */
 export type PermissionEffect = 'allow' | 'ask' | 'deny';
 export declare function isPermissionEffect(value: unknown): value is PermissionEffect;
@@ -95,8 +96,8 @@ export declare function patternToRegExpSource(pattern: string): string;
  * own leading `.*` sits after the quote. `git status*` is anchored, and
  * `*git status*` is not.
  *
- * **Two loosenesses remain, and neither is fixable from here.** Both come from
- * matching a glob against a SERIALISED OBJECT rather than against a value.
+ * **Two loosenesses remain here, and both come from matching a glob against a
+ * SERIALISED OBJECT rather than against a value.**
  *
  * 1. A pattern can match the start of ANY argument's value, not only the one
  *    the operator had in mind.
@@ -108,9 +109,17 @@ export declare function patternToRegExpSource(pattern: string): string;
  *    the serialised object and would match nothing.
  *
  * The kernel's `argument_pattern` removes both, because its subject is the
- * argument's own value and it needs neither escape. It is implemented and
- * unused here. Reaching it needs a way for an operator to NAME the argument in
- * config, which is an operator-facing syntax decision rather than a repair.
+ * argument's own value and it needs neither escape. This comment used to say
+ * reaching it needed an operator-facing way to NAME the argument, and that was
+ * the wrong place to look for the name: the operator does not know it and
+ * should not have to, while the TOOL always does. A tool that declares
+ * `commandArgument` is compiled through `argument_pattern` instead, which is
+ * why `bash` no longer arrives here at all.
+ *
+ * What is left for this function is every tool that declares nothing — MCP
+ * servers, host tools, `edit` and `read` — where a glob against the serialised
+ * input remains the only subject available, and where loosening 2 is bounded
+ * by there being no command line to chain onto.
  */
 export declare function toolScopedPattern(tool: string, pattern: string, decision?: 'allow' | 'deny'): string;
 /** Whether `input` satisfies `pattern`, with the matching above. */
@@ -139,5 +148,5 @@ export declare function bySpecificity(a: string, b: string): number;
  * A tool nobody wrote a rule for is therefore asked about, and there is no way
  * to spell "allow everything by omission" — the only way to widen is to say so.
  */
-export declare function compilePermissions(config: PermissionsConfig | undefined): CompiledPermissions;
+export declare function compilePermissions(config: PermissionsConfig | undefined, checks?: PermissionChecksConfig): CompiledPermissions;
 //# sourceMappingURL=rules.d.ts.map

package/dist/permissions/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/permissions/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAEnD,6DAA6D;AAC7D,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAA;AAIvD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAA;AAE1F,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAA;AAExE,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC5C;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,iBAAiB,EAAE,CAAA;CAClD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQ7D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,wBAAgB,iBAAiB,CAChC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,OAAO,GAAG,MAAe,GACjC,MAAM,CASR;AAMD,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAKtE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAU1D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,GAAG,mBAAmB,CAgD7F"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/permissions/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,iBAAiB,EAA2B,MAAM,YAAY,CAAA;AAE5E,OAAO,EAAE,KAAK,sBAAsB,EAA0B,MAAM,aAAa,CAAA;AAEjF,6DAA6D;AAC7D,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAA;AAIvD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAA;AAE1F,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAA;AAExE,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC5C;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,iBAAiB,EAAE,CAAA;CAClD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQ7D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,wBAAgB,iBAAiB,CAChC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,OAAO,GAAG,MAAe,GACjC,MAAM,CASR;AA+CD,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAKtE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAU1D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,iBAAiB,GAAG,SAAS,EACrC,MAAM,CAAC,EAAE,sBAAsB,GAC7B,mBAAmB,CAqErB"}

package/dist/permissions/rules.js

@@ -10,6 +10,8 @@
  * The whole surface is pure: config in, rules out. The gate stays the only
  * thing that decides anything, which is what keeps this testable without a run.
  */
+import { builtinCommandArguments } from '@namzu/sdk';
+import { verifyPermissionChecks } from './checks.js';
 const EFFECTS = new Set(['allow', 'ask', 'deny']);
 export function isPermissionEffect(value) {
     return typeof value === 'string' && EFFECTS.has(value);
@@ -76,8 +78,8 @@ export function patternToRegExpSource(pattern) {
  * own leading `.*` sits after the quote. `git status*` is anchored, and
  * `*git status*` is not.
  *
- * **Two loosenesses remain, and neither is fixable from here.** Both come from
- * matching a glob against a SERIALISED OBJECT rather than against a value.
+ * **Two loosenesses remain here, and both come from matching a glob against a
+ * SERIALISED OBJECT rather than against a value.**
  *
  * 1. A pattern can match the start of ANY argument's value, not only the one
  *    the operator had in mind.
@@ -89,9 +91,17 @@ export function patternToRegExpSource(pattern) {
  *    the serialised object and would match nothing.
  *
  * The kernel's `argument_pattern` removes both, because its subject is the
- * argument's own value and it needs neither escape. It is implemented and
- * unused here. Reaching it needs a way for an operator to NAME the argument in
- * config, which is an operator-facing syntax decision rather than a repair.
+ * argument's own value and it needs neither escape. This comment used to say
+ * reaching it needed an operator-facing way to NAME the argument, and that was
+ * the wrong place to look for the name: the operator does not know it and
+ * should not have to, while the TOOL always does. A tool that declares
+ * `commandArgument` is compiled through `argument_pattern` instead, which is
+ * why `bash` no longer arrives here at all.
+ *
+ * What is left for this function is every tool that declares nothing — MCP
+ * servers, host tools, `edit` and `read` — where a glob against the serialised
+ * input remains the only subject available, and where loosening 2 is bounded
+ * by there being no command line to chain onto.
  */
 export function toolScopedPattern(tool, pattern, decision = 'deny') {
     const toolPart = escapeRegExp(tool);
@@ -103,6 +113,41 @@ export function toolScopedPattern(tool, pattern, decision = 'deny') {
     const anchorToValue = decision === 'allow' && pattern.replaceAll('*', '') !== '';
     return anchorToValue ? `^${toolPart} .*"${argPart}.*$` : `^${toolPart} .*${argPart}.*$`;
 }
+/**
+ * Compile one pattern for a tool that declares a command argument.
+ *
+ * This carries the asymmetry `toolScopedPattern` established, because the
+ * reasons for it did not change when the subject did. An `allow` anchors: it is
+ * a claim about a command, and a claim that matches a prefix is a claim about
+ * something else. A `deny` stays loose: an operator who denied `rm -rf*` means
+ * it wherever it appears, and `sudo rm -rf /` is the case that proves it —
+ * anchoring the deny would stop it matching, and a deny that stops matching
+ * fails open.
+ *
+ * What the subject gained is the part that could not be done before. The gate
+ * reads this argument as the COMMANDS the line runs, so the anchored `allow`
+ * is anchored per command: `git status*` no longer approves
+ * `git status && rm -rf ~`, and the loose `deny` now also sees a command that
+ * rides behind a separator.
+ */
+function commandRule(tool, argument, pattern, decision) {
+    // All wildcards means "every call to this tool", and that has to keep
+    // meaning it. As a pattern it would stop being true the moment the tool is
+    // called without that argument, so it is emitted as the rule that says it.
+    if (pattern.replaceAll('*', '') === '') {
+        return decision === 'allow'
+            ? { type: 'allow_by_name', toolNames: [tool] }
+            : { type: 'deny_by_name', toolNames: [tool] };
+    }
+    const anchored = patternToRegExpSource(pattern);
+    return {
+        type: 'argument_pattern',
+        toolNames: [tool],
+        argument,
+        pattern: decision === 'allow' ? anchored : anchored.slice(1, -1),
+        decision,
+    };
+}
 function escapeRegExp(value) {
     return value.replace(/[.*+^${}()|[\]\\?]/g, '\\$&');
 }
@@ -150,11 +195,18 @@ export function bySpecificity(a, b) {
  * A tool nobody wrote a rule for is therefore asked about, and there is no way
  * to spell "allow everything by omission" — the only way to widen is to say so.
  */
-export function compilePermissions(config) {
+export function compilePermissions(config, checks) {
     const rules = [];
     const diagnostics = [];
+    // Checks still run against an empty table. "This command is asked about"
+    // is a claim worth holding when there is no config at all, and returning
+    // early would make the check silently pass by never running.
     if (!config)
-        return { rules, diagnostics };
+        return { rules, diagnostics: verifyPermissionChecks(rules, checks) };
+    // Asked once. The map is derived from the builtin tools rather than listed
+    // here, so a tool that starts or stops taking a command line changes this
+    // compiler by changing itself.
+    const commandArguments = builtinCommandArguments();
     for (const [tool, permission] of Object.entries(config)) {
         if (isPermissionEffect(permission)) {
             if (permission === 'allow')
@@ -193,14 +245,27 @@ export function compilePermissions(config) {
                 });
                 continue;
             }
-            rules.push({
-                type: 'custom_pattern',
-                pattern: toolScopedPattern(tool, pattern, effect),
-                target: 'both',
-                decision: effect,
-            });
+            // A tool that declares which of its arguments holds a command line
+            // gets the rule that can read one. `custom_pattern` stays the
+            // fallback for everything else, and the two loosenesses documented
+            // on `toolScopedPattern` are exactly what this branch removes.
+            const argument = commandArguments.get(tool);
+            if (argument === undefined) {
+                rules.push({
+                    type: 'custom_pattern',
+                    pattern: toolScopedPattern(tool, pattern, effect),
+                    target: 'both',
+                    decision: effect,
+                });
+                continue;
+            }
+            rules.push(commandRule(tool, argument, pattern, effect));
         }
     }
+    // After compiling, never during: a check is a claim about the FINISHED
+    // table, and evaluating one against a half-built rule list would answer
+    // with whatever order the config happened to be written in.
+    diagnostics.push(...verifyPermissionChecks(rules, checks));
     return { rules, diagnostics };
 }
 //# sourceMappingURL=rules.js.map