@namzu/cli 35.0.0 → 36.1.0

package/dist/output/text.js

@@ -1,50 +0,0 @@
-import { inspect } from 'node:util';
-export class TextFormatter {
-    opts;
-    name = 'text';
-    constructor(opts) {
-        this.opts = opts;
-    }
-    print(data) {
-        process.stdout.write(`${renderText(data)}\n`);
-    }
-    info(message) {
-        if (this.opts.quiet)
-            return;
-        process.stderr.write(`${message}\n`);
-    }
-    error(payload) {
-        process.stderr.write(`Error: ${payload.message}\n`);
-        if (payload.details !== undefined) {
-            process.stderr.write(`${renderText(payload.details)}\n`);
-        }
-    }
-}
-function renderText(data) {
-    if (data === null || data === undefined)
-        return '';
-    if (typeof data === 'string')
-        return data;
-    if (typeof data === 'number' || typeof data === 'boolean' || typeof data === 'bigint') {
-        return String(data);
-    }
-    // A payload that brought its own rendering gets to use it.
-    //
-    // Without this a command has to choose: print the structured payload,
-    // which the `json` and `yaml` formats need, or print the human string,
-    // which text needs. Every command that wanted both ended up passing the
-    // object and letting `inspect` dump it — so `namzu eval` in its default
-    // format printed a nested object graph where a report was meant to be,
-    // with the readable version sitting unused in a `text` field one level
-    // down. Found by running the built binary, not by a test: the test
-    // asserted on the payload, which was correct, and never on what a
-    // person sees.
-    if (typeof data === 'object' && typeof data.text === 'string') {
-        return data.text;
-    }
-    // `depth: 6` is generous for CLI payloads while keeping pathological
-    // (deeply nested or self-referencing) graphs from exhausting stack/heap.
-    // `inspect` already marks already-seen objects as `[Circular]`.
-    return inspect(data, { depth: 6, colors: false, compact: false });
-}
-//# sourceMappingURL=text.js.map

package/dist/output/text.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"text.js","sourceRoot":"","sources":["../../src/output/text.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAInC,MAAM,OAAO,aAAa;IAGI;IAFpB,IAAI,GAAG,MAAe,CAAA;IAE/B,YAA6B,IAAsB;QAAtB,SAAI,GAAJ,IAAI,CAAkB;IAAG,CAAC;IAEvD,KAAK,CAAC,IAAa;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9C,CAAC;IAED,IAAI,CAAC,OAAe;QACnB,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAM;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAA;IACrC,CAAC;IAED,KAAK,CAAC,OAA+C;QACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,OAAO,CAAC,OAAO,IAAI,CAAC,CAAA;QACnD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACzD,CAAC;IACF,CAAC;CACD;AAED,SAAS,UAAU,CAAC,IAAa;IAChC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IAClD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;IACpB,CAAC;IAED,2DAA2D;IAC3D,EAAE;IACF,sEAAsE;IACtE,uEAAuE;IACvE,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,mEAAmE;IACnE,kEAAkE;IAClE,eAAe;IACf,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAQ,IAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvF,OAAQ,IAAyB,CAAC,IAAI,CAAA;IACvC,CAAC;IACD,qEAAqE;IACrE,yEAAyE;IACzE,gEAAgE;IAChE,OAAO,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;AAClE,CAAC"}

package/dist/output/yaml.js

@@ -1,26 +0,0 @@
-import { stringify as yamlStringify } from 'yaml';
-export class YamlFormatter {
-    opts;
-    name = 'yaml';
-    constructor(opts) {
-        this.opts = opts;
-    }
-    print(data) {
-        process.stdout.write(yamlStringify(data));
-    }
-    info(message) {
-        if (this.opts.quiet)
-            return;
-        process.stderr.write(yamlStringify({ level: 'info', message }));
-    }
-    error(payload) {
-        const out = {
-            level: 'error',
-            message: payload.message,
-        };
-        if (payload.details !== undefined)
-            out.details = payload.details;
-        process.stderr.write(yamlStringify(out));
-    }
-}
-//# sourceMappingURL=yaml.js.map

package/dist/output/yaml.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"yaml.js","sourceRoot":"","sources":["../../src/output/yaml.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAA;AAIjD,MAAM,OAAO,aAAa;IAGI;IAFpB,IAAI,GAAG,MAAe,CAAA;IAE/B,YAA6B,IAAsB;QAAtB,SAAI,GAAJ,IAAI,CAAkB;IAAG,CAAC;IAEvD,KAAK,CAAC,IAAa;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1C,CAAC;IAED,IAAI,CAAC,OAAe;QACnB,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAM;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,OAA+C;QACpD,MAAM,GAAG,GAA4B;YACpC,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,OAAO,CAAC,OAAO;SACxB,CAAA;QACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;YAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAA;IACzC,CAAC;CACD"}

package/dist/output-schema.js

@@ -1,18 +0,0 @@
-import { readFileSync } from 'node:fs';
-import { isDeepStrictEqual } from 'node:util';
-import { mcpJsonSchemaToZod, renderToolSchema, } from '@namzu/sdk';
-/** Resolve once at launch; the schema remains fixed for the session. */
-export function loadOutputSchema(path) {
-    const value = JSON.parse(readFileSync(path, 'utf8'));
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        throw new Error('Output schema must be a JSON Schema object.');
-    const schema = mcpJsonSchemaToZod(value);
-    const { $schema: _dialect, ...expected } = value;
-    if (!isDeepStrictEqual(renderToolSchema(schema), expected))
-        throw new Error('Output schema cannot be represented losslessly. Use an explicit object schema with properties, required and additionalProperties; unsupported constraints are not discarded.');
-    return {
-        mode: 'native',
-        schema,
-    };
-}
-//# sourceMappingURL=output-schema.js.map

package/dist/output-schema.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"output-schema.js","sourceRoot":"","sources":["../src/output-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAGN,kBAAkB,EAClB,gBAAgB,GAChB,MAAM,YAAY,CAAA;AAEnB,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IAC7D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAC/D,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAsB,CAAC,CAAA;IACzD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAgC,CAAA;IAC3E,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;QACzD,MAAM,IAAI,KAAK,CACd,8KAA8K,CAC9K,CAAA;IACF,OAAO;QACN,IAAI,EAAE,QAAQ;QACd,MAAM;KACN,CAAA;AACF,CAAC"}

package/dist/permissions/browser-sites.js

@@ -1,270 +0,0 @@
-/**
- * `browser.sites`, compiled to the kernel's rule vocabulary.
- *
- * An operator writes one level per site:
- *
- * ```yaml
- * browser:
- *   sites:
- *     "https://github.com": act
- *     "https://*.example.com": read
- *     "*": ask
- * ```
- *
- * and the gate sees `argument_pattern` rules over the two arguments the
- * browser tools canonicalise: `browser.url` (the address a navigation loads)
- * and `browser_act.origin` (the page an action changes). The tools declare
- * `url` as a URL argument, so a rule tests it whole; the SDK's input schema
- * has already turned `HTTPS://GitHub.com.:443/x` into `https://github.com/x`,
- * so one spelling per site is enough.
- *
- * | Level  | `browser` navigate / tabs new | `browser_act` |
- * | ------ | ----------------------------- | ------------- |
- * | `deny` | deny                          | deny          |
- * | `read` | allow                         | deny          |
- * | `ask`  | review                        | review        |
- * | `act`  | allow                         | allow         |
- *
- * Order is the gate's first match: every `deny` first, then the other sites
- * from most to least specific (the same order `@namzu/browser`'s host policy
- * uses, so the gate and the host agree on which key decides), then `*`.
- * Looking at the page (`snapshot`, `screenshot`, `scroll`, `wait_for`, and
- * `tabs list|select|close`) is allowed: the browser tools are network tools,
- * which are reviewed even when read-only unless a rule allows them, and the
- * page being looked at is one the host already let stay loaded.
- *
- * The origin patterns are built here, from the SDK's canonical site key,
- * rather than from a glob: `https://github.com` must not match
- * `https://github.com.evil.example`, `https://evil.example/?https://github.com`
- * or `https://github.com:8443`.
- */
-import { BROWSER_ACT_TOOL_NAME, BROWSER_TOOL_NAME, canonicalizeBrowserSitePattern, canonicalizeBrowserUrl, } from '@namzu/sdk';
-export const BROWSER_SITE_LEVELS = ['deny', 'read', 'ask', 'act'];
-/** What an unlisted site gets when `*` is not written. */
-export const DEFAULT_BROWSER_SITE_LEVEL = 'ask';
-export function isBrowserSiteLevel(value) {
-    return typeof value === 'string' && BROWSER_SITE_LEVELS.includes(value);
-}
-/** A site key as the gate and the host read it: `*`, or the SDK's canonical pattern. */
-export function canonicalBrowserSiteKey(raw) {
-    if (raw.trim() === '*')
-        return { ok: true, key: '*' };
-    const verdict = canonicalizeBrowserSitePattern(raw);
-    return verdict.ok ? { ok: true, key: verdict.pattern } : { ok: false, reason: verdict.reason };
-}
-function parseSite(key, level) {
-    const match = /^(https?):\/\/(\*\.)?([^:]+)(?::(\*|\d+))?$/.exec(key);
-    if (!match)
-        return undefined;
-    return {
-        key,
-        level,
-        scheme: match[1] ?? '',
-        host: match[3] ?? '',
-        wildcardHost: match[2] !== undefined,
-        port: match[4] ?? '',
-    };
-}
-/** Higher is more specific: exact host over wildcard, longer suffix first, exact port over `*`. */
-function specificity(site) {
-    return (site.wildcardHost ? 0 : 1_000_000) + site.host.length * 10 + (site.port === '*' ? 0 : 1);
-}
-function escapeRegExp(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-/**
- * The regex source (unanchored) that matches exactly the canonical origins
- * a site key names. `*.` is one or more whole labels; `:*` is any port or
- * none; no port is the scheme's default only, which the canonical form
- * leaves out.
- */
-function originSource(site) {
-    const host = site.wildcardHost
-        ? `(?:[^./:?#@\\[\\]]+\\.)+${escapeRegExp(site.host)}`
-        : escapeRegExp(site.host);
-    const port = site.port === '*' ? '(?::\\d{1,5})?' : site.port === '' ? '' : `:${site.port}`;
-    return `${site.scheme}://${host}${port}`;
-}
-const NAVIGATE = {
-    deny: 'deny',
-    read: 'allow',
-    ask: 'review',
-    act: 'allow',
-};
-const ACT = {
-    deny: 'deny',
-    read: 'deny',
-    ask: 'review',
-    act: 'allow',
-};
-function rulesFor(origin, level) {
-    // `*`: any value. `^` alone matches every string the argument can hold.
-    const url = origin === undefined ? '^' : `^${origin}(?:[/?#]|$)`;
-    const act = origin === undefined ? '^' : `^${origin}$`;
-    return [
-        {
-            type: 'argument_pattern',
-            toolNames: [BROWSER_TOOL_NAME],
-            argument: 'url',
-            pattern: url,
-            decision: NAVIGATE[level],
-        },
-        {
-            type: 'argument_pattern',
-            toolNames: [BROWSER_ACT_TOOL_NAME],
-            argument: 'origin',
-            pattern: act,
-            decision: ACT[level],
-        },
-    ];
-}
-/**
- * Looking at the page the browser holds. These calls carry no address; the
- * host only ever holds a page the site rules let stay (or `about:blank`).
- * `tabs new` carries a `url` and is decided by the site rules instead.
- */
-const LOOKING = [
-    {
-        type: 'argument_pattern',
-        toolNames: [BROWSER_TOOL_NAME],
-        argument: 'action',
-        pattern: '^(?:snapshot|screenshot|scroll|wait_for)$',
-        decision: 'allow',
-    },
-    {
-        type: 'argument_pattern',
-        toolNames: [BROWSER_TOOL_NAME],
-        argument: 'op',
-        pattern: '^(?:list|select|close)$',
-        decision: 'allow',
-    },
-];
-/** Canonical keys, `*` filled in, unreadable entries reported. */
-export function normalizeBrowserSites(sites) {
-    const out = {};
-    const diagnostics = [];
-    for (const [raw, level] of Object.entries(sites ?? {})) {
-        if (!isBrowserSiteLevel(level)) {
-            diagnostics.push(`browser.sites."${raw}": use deny, read, ask or act`);
-            continue;
-        }
-        const verdict = canonicalBrowserSiteKey(raw);
-        if (!verdict.ok) {
-            diagnostics.push(`browser.sites."${raw}": ${verdict.reason}`);
-            continue;
-        }
-        const existing = out[verdict.key];
-        // The same site written twice (`https://GitHub.com` and
-        // `https://github.com`): the narrower level holds, so a spelling can
-        // never widen what another spelling said.
-        out[verdict.key] = existing === undefined ? level : narrower(existing, level);
-    }
-    if (out['*'] === undefined)
-        out['*'] = DEFAULT_BROWSER_SITE_LEVEL;
-    return { sites: out, diagnostics };
-}
-/** The narrower of two levels: `deny`, then `read`, then `ask`, then `act`. */
-export function narrower(a, b) {
-    return BROWSER_SITE_LEVELS.indexOf(a) <= BROWSER_SITE_LEVELS.indexOf(b) ? a : b;
-}
-/** Compile `browser.sites` into gate rules, in the order the gate must try them. */
-export function compileBrowserSites(sites) {
-    const normalized = normalizeBrowserSites(sites);
-    const diagnostics = [...normalized.diagnostics];
-    const parsed = [];
-    for (const [key, level] of Object.entries(normalized.sites)) {
-        if (key === '*')
-            continue;
-        const site = parseSite(key, level);
-        if (site)
-            parsed.push(site);
-        else
-            diagnostics.push(`browser.sites."${key}": could not be read`);
-    }
-    const denies = parsed.filter((site) => site.level === 'deny');
-    const others = parsed
-        .filter((site) => site.level !== 'deny')
-        .sort((a, b) => specificity(b) - specificity(a) || (a.key < b.key ? -1 : 1));
-    const rules = [
-        // A blank tab is where the browser starts; it loads nothing.
-        {
-            type: 'argument_pattern',
-            toolNames: [BROWSER_TOOL_NAME],
-            argument: 'url',
-            pattern: '^about:blank$',
-            decision: 'allow',
-        },
-        ...denies.flatMap((site) => rulesFor(originSource(site), 'deny')),
-        ...others.flatMap((site) => rulesFor(originSource(site), site.level)),
-        ...rulesFor(undefined, normalized.sites['*'] ?? DEFAULT_BROWSER_SITE_LEVEL),
-        ...LOOKING,
-    ];
-    return { rules, sites: normalized.sites, diagnostics };
-}
-const BROWSER_TOOLS = new Set([BROWSER_TOOL_NAME, BROWSER_ACT_TOOL_NAME]);
-/** A `[permissions]` rule that denies a browser tool, which the site rules must not get ahead of. */
-function isBrowserDeny(rule) {
-    switch (rule.type) {
-        case 'deny_by_name':
-            return rule.toolNames.some((name) => BROWSER_TOOLS.has(name));
-        case 'argument_pattern':
-            return rule.decision === 'deny' && rule.toolNames.some((name) => BROWSER_TOOLS.has(name));
-        case 'custom_pattern':
-            return (rule.decision === 'deny' &&
-                (rule.pattern.startsWith(`^${BROWSER_TOOL_NAME}`) ||
-                    rule.pattern.startsWith(`^${BROWSER_ACT_TOOL_NAME}`)));
-        default:
-            return false;
-    }
-}
-/**
- * The session's rules with the site rules in them: a `[permissions]` deny
- * that names a browser tool first (it still wins), then the site rules, then
- * the rest of the table. An `allow` or `ask` for `browser` in the table is
- * reached only by a call no site rule decided (`back`, `forward`, `reload`).
- */
-export function withBrowserSiteRules(tableRules, siteRules) {
-    return [
-        ...tableRules.filter(isBrowserDeny),
-        ...siteRules,
-        ...tableRules.filter((rule) => !isBrowserDeny(rule)),
-    ];
-}
-/**
- * Which key of `sites` decides `origin`, and at what level: a matching
- * `deny` first, else the most specific match, else `*`. The same answer the
- * compiled rules give; used to show the rule on the review screen.
- */
-export function browserSiteRuleFor(sites, origin) {
-    const normalized = normalizeBrowserSites(sites).sites;
-    const parsed = Object.entries(normalized)
-        .filter(([key]) => key !== '*')
-        .map(([key, level]) => parseSite(key, level))
-        .filter((site) => site !== undefined);
-    const hits = parsed.filter((site) => new RegExp(`^${originSource(site)}$`).test(origin));
-    const deny = hits.find((site) => site.level === 'deny');
-    if (deny)
-        return { site: deny.key, level: 'deny' };
-    const best = hits.sort((a, b) => specificity(b) - specificity(a))[0];
-    if (best)
-        return { site: best.key, level: best.level };
-    return { site: '*', level: normalized['*'] ?? DEFAULT_BROWSER_SITE_LEVEL };
-}
-/**
- * The origin a browser call opens or acts on, canonical, or `undefined` for
- * one that names none (`snapshot`, `back`, …).
- */
-export function browserCallOrigin(toolName, input) {
-    if (typeof input !== 'object' || input === null)
-        return undefined;
-    const record = input;
-    if (toolName === BROWSER_ACT_TOOL_NAME) {
-        return typeof record.origin === 'string' ? record.origin : undefined;
-    }
-    if (toolName === BROWSER_TOOL_NAME && typeof record.url === 'string') {
-        const verdict = canonicalizeBrowserUrl(record.url);
-        return verdict.ok && verdict.url !== 'about:blank' ? verdict.origin : undefined;
-    }
-    return undefined;
-}
-//# sourceMappingURL=browser-sites.js.map

package/dist/permissions/browser-sites.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"browser-sites.js","sourceRoot":"","sources":["../../src/permissions/browser-sites.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAEN,qBAAqB,EACrB,iBAAiB,EACjB,8BAA8B,EAC9B,sBAAsB,GACtB,MAAM,YAAY,CAAA;AAOnB,MAAM,CAAC,MAAM,mBAAmB,GAAgC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;AAE9F,0DAA0D;AAC1D,MAAM,CAAC,MAAM,0BAA0B,GAAqB,KAAK,CAAA;AAEjE,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,mBAAyC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC/F,CAAC;AAMD,wFAAwF;AACxF,MAAM,UAAU,uBAAuB,CAAC,GAAW;IAClD,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;IACrD,MAAM,OAAO,GAAG,8BAA8B,CAAC,GAAG,CAAC,CAAA;IACnD,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;AAC/F,CAAC;AAaD,SAAS,SAAS,CAAC,GAAW,EAAE,KAAuB;IACtD,MAAM,KAAK,GAAG,6CAA6C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrE,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,OAAO;QACN,GAAG;QACH,KAAK;QACL,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QACpB,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QACpC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;KACpB,CAAA;AACF,CAAC;AAED,mGAAmG;AACnG,SAAS,WAAW,CAAC,IAAgB;IACpC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACjG,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;AACpD,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAgB;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY;QAC7B,CAAC,CAAC,2BAA2B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACtD,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3F,OAAO,GAAG,IAAI,CAAC,MAAM,MAAM,IAAI,GAAG,IAAI,EAAE,CAAA;AACzC,CAAC;AAID,MAAM,QAAQ,GAAuC;IACpD,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,OAAO;IACb,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,OAAO;CACZ,CAAA;AAED,MAAM,GAAG,GAAuC;IAC/C,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,OAAO;CACZ,CAAA;AAED,SAAS,QAAQ,CAAC,MAA0B,EAAE,KAAuB;IACpE,wEAAwE;IACxE,MAAM,GAAG,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,MAAM,aAAa,CAAA;IAChE,MAAM,GAAG,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,MAAM,GAAG,CAAA;IACtD,OAAO;QACN;YACC,IAAI,EAAE,kBAAkB;YACxB,SAAS,EAAE,CAAC,iBAAiB,CAAC;YAC9B,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,GAAG;YACZ,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC;SACzB;QACD;YACC,IAAI,EAAE,kBAAkB;YACxB,SAAS,EAAE,CAAC,qBAAqB,CAAC;YAClC,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,GAAG;YACZ,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC;SACpB;KACD,CAAA;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,GAAiC;IAC7C;QACC,IAAI,EAAE,kBAAkB;QACxB,SAAS,EAAE,CAAC,iBAAiB,CAAC;QAC9B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,2CAA2C;QACpD,QAAQ,EAAE,OAAO;KACjB;IACD;QACC,IAAI,EAAE,kBAAkB;QACxB,SAAS,EAAE,CAAC,iBAAiB,CAAC;QAC9B,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,OAAO;KACjB;CACD,CAAA;AAUD,kEAAkE;AAClE,MAAM,UAAU,qBAAqB,CAAC,KAAqC;IAI1E,MAAM,GAAG,GAAqC,EAAE,CAAA;IAChD,MAAM,WAAW,GAAa,EAAE,CAAA;IAChC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,WAAW,CAAC,IAAI,CAAC,kBAAkB,GAAG,+BAA+B,CAAC,CAAA;YACtE,SAAQ;QACT,CAAC;QACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAA;QAC5C,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACjB,WAAW,CAAC,IAAI,CAAC,kBAAkB,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;YAC7D,SAAQ;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACjC,wDAAwD;QACxD,qEAAqE;QACrE,0CAA0C;QAC1C,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC9E,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,0BAA0B,CAAA;IACjE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,CAAA;AACnC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,QAAQ,CAAC,CAAmB,EAAE,CAAmB;IAChE,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAChF,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,KAAqC;IACxE,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;IAC/C,MAAM,WAAW,GAAG,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,IAAI,GAAG,KAAK,GAAG;YAAE,SAAQ;QACzB,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAClC,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;;YACtB,WAAW,CAAC,IAAI,CAAC,kBAAkB,GAAG,sBAAsB,CAAC,CAAA;IACnE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,MAAM;SACnB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC;SACvC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7E,MAAM,KAAK,GAAwB;QAClC,6DAA6D;QAC7D;YACC,IAAI,EAAE,kBAAkB;YACxB,SAAS,EAAE,CAAC,iBAAiB,CAAC;YAC9B,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,eAAe;YACxB,QAAQ,EAAE,OAAO;SACjB;QACD,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACjE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACrE,GAAG,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;QAC3E,GAAG,OAAO;KACV,CAAA;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,CAAA;AACvD,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC,CAAA;AAEjF,qGAAqG;AACrG,SAAS,aAAa,CAAC,IAAuB;IAC7C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,cAAc;YAClB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;QAC9D,KAAK,kBAAkB;YACtB,OAAO,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;QAC1F,KAAK,gBAAgB;YACpB,OAAO,CACN,IAAI,CAAC,QAAQ,KAAK,MAAM;gBACxB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,iBAAiB,EAAE,CAAC;oBAChD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC,CACtD,CAAA;QACF;YACC,OAAO,KAAK,CAAA;IACd,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CACnC,UAAwC,EACxC,SAAuC;IAEvC,OAAO;QACN,GAAG,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC;QACnC,GAAG,SAAS;QACZ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;KACpD,CAAA;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CACjC,KAAyB,EACzB,MAAc;IAEd,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAA;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;SACvC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,CAAC;SAC9B,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;SAC5C,MAAM,CAAC,CAAC,IAAI,EAAsB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IACxF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAA;IACvD,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACpE,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAA;IACtD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,0BAA0B,EAAE,CAAA;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,KAAc;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACjE,MAAM,MAAM,GAAG,KAAgC,CAAA;IAC/C,IAAI,QAAQ,KAAK,qBAAqB,EAAE,CAAC;QACxC,OAAO,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IACrE,CAAC;IACD,IAAI,QAAQ,KAAK,iBAAiB,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACtE,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAClD,OAAO,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAChF,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC"}

package/dist/permissions/canonical-project.js

@@ -1,13 +0,0 @@
-import { realpathSync } from 'node:fs';
-import { resolve } from 'node:path';
-/**
- * Resolve a project path once at the authority boundary.
- *
- * Every operation admitted by a trust decision must keep this exact result.
- * Re-resolving a lexical symlink later would let it be redirected after the
- * operator approved a different directory.
- */
-export function canonicalProjectPath(dir) {
-    return realpathSync(resolve(dir));
-}
-//# sourceMappingURL=canonical-project.js.map

package/dist/permissions/canonical-project.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"canonical-project.js","sourceRoot":"","sources":["../../src/permissions/canonical-project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC/C,OAAO,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;AAClC,CAAC"}

package/dist/permissions/checks.js

@@ -1,128 +0,0 @@
-/**
- * An operator's own expectations about their own permission table, checked.
- *
- * ## Why config needs tests at all
- *
- * A `[permissions]` entry is a glob compiled to a regular expression and
- * evaluated against a subject the operator never sees. Every part of that
- * pipeline has been wrong at least once in this repository, and each time the
- * failure was silent and permissive: a rule that read like a prohibition and
- * decided nothing, an `allow` whose match began wherever the text did, a glob
- * whose trailing star reached past the end of a command. In every case the
- * config LOOKED right, and nothing the operator could run would have told them
- * otherwise.
- *
- * A test case attached to the policy turns that into a startup failure. It is
- * the same argument as `a-falsifiable-comment-is-a-test`, applied to
- * configuration: a claim nobody can check is a claim nobody should believe.
- *
- * ## What a check is
- *
- * A tool, an input, and the decision the operator believes their table
- * produces:
- *
- *     "permissionChecks": [
- *       { "tool": "bash", "input": { "command": "git status --short" }, "expect": "allow" },
- *       { "tool": "bash", "input": { "command": "git status && rm -rf ~" }, "expect": "ask" }
- *     ]
- *
- * The second is the interesting one. It asserts a NEGATIVE — that the table
- * does not stretch to cover a command the operator never named — and a negative
- * is exactly what a table of globs cannot be read for.
- *
- * ## Why it runs the real gate
- *
- * Re-implementing the matching here would check this file against itself. The
- * check compiles the operator's table to rules and hands them to the same
- * `AuthorizationGate` a turn uses, so what it verifies is the decision that will
- * actually be taken.
- *
- * The floor is deliberately OFF while checking. `denyDangerousPatterns` would
- * answer for the four catastrophic commands before any operator rule was
- * consulted, so a check written about the table would silently be answered by
- * something else — and would keep passing after the rule it was written for was
- * deleted.
- */
-import { AuthorizationGate, NOOP_LOGGER, getBuiltinTools } from '@namzu/sdk';
-import { isPermissionEffect } from './rules.js';
-/**
- * The gate's vocabulary against the operator's.
- *
- * `review` is what the gate returns when nothing decided, and `ask` is what the
- * operator writes for it. Two names for one outcome is a translation, not a
- * mapping to be got wrong in one direction.
- */
-function asEffect(decision) {
-    return decision === 'review' ? 'ask' : decision;
-}
-/**
- * Evaluate every check against the compiled table.
- *
- * Returns a diagnostic per failure rather than throwing, for the reason the
- * compiler already collects rather than throws: one wrong expectation should
- * cost that line and not the other nine. But a failure must be SAID — a check
- * that silently passes is worse than no check, because it is a reason to
- * believe.
- */
-export function verifyPermissionChecks(rules, checks) {
-    if (!checks || checks.length === 0)
-        return [];
-    const diagnostics = [];
-    const gate = new AuthorizationGate({
-        enabled: true,
-        rules: [...rules],
-        allowReadOnlyTools: false,
-        // Off on purpose; see the note at the top of this file.
-        denyDangerousPatterns: false,
-        logDecisions: false,
-    }, NOOP_LOGGER);
-    for (const [index, check] of checks.entries()) {
-        const where = `permissionChecks[${index}]`;
-        if (typeof check?.tool !== 'string' || check.tool === '') {
-            diagnostics.push({ tool: where, message: 'expected a "tool" naming the tool to evaluate' });
-            continue;
-        }
-        if (typeof check.input !== 'object' || check.input === null || Array.isArray(check.input)) {
-            diagnostics.push({
-                tool: where,
-                message: `expected an "input" object for ${check.tool}; got ${describe(check.input)}`,
-            });
-            continue;
-        }
-        if (!isPermissionEffect(check.expect)) {
-            diagnostics.push({
-                tool: where,
-                message: `expected "expect" to be "allow", "ask" or "deny"; got ${JSON.stringify(check.expect)}`,
-            });
-            continue;
-        }
-        // A builtin's command line is read for the shell the tool spawns, as it
-        // is at runtime; the CLI runs commands on the host unless a sandbox is
-        // chosen, and a sandboxed reading is only ever stricter.
-        const builtin = getBuiltinTools().find((tool) => tool.name === check.tool);
-        const commandDialect = builtin?.commandDialect?.({ sandboxed: false });
-        const verdict = gate.evaluate({
-            toolName: check.tool,
-            toolInput: check.input,
-            toolDef: undefined,
-            ...(commandDialect !== undefined ? { commandDialect } : {}),
-        });
-        const actual = asEffect(verdict.decision);
-        if (actual === check.expect)
-            continue;
-        // The reason is quoted because it names the rule that decided, which is
-        // the difference between "your config is wrong" and a message someone
-        // can act on without re-deriving the whole table.
-        diagnostics.push({
-            tool: where,
-            message: `${check.tool} ${JSON.stringify(check.input)} is "${actual}", not the expected "${check.expect}" — ${verdict.reason}`,
-        });
-    }
-    return diagnostics;
-}
-function describe(value) {
-    if (value === null)
-        return 'null';
-    return Array.isArray(value) ? 'an array' : typeof value;
-}
-//# sourceMappingURL=checks.js.map

package/dist/permissions/checks.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../src/permissions/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAE,iBAAiB,EAA0B,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAGpG,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAW/C;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,QAAqC;IACtD,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAA;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACrC,KAAmC,EACnC,MAA0C;IAE1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAE7C,MAAM,WAAW,GAAwB,EAAE,CAAA;IAC3C,MAAM,IAAI,GAAG,IAAI,iBAAiB,CACjC;QACC,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;QACjB,kBAAkB,EAAE,KAAK;QACzB,wDAAwD;QACxD,qBAAqB,EAAE,KAAK;QAC5B,YAAY,EAAE,KAAK;KACnB,EACD,WAAW,CACX,CAAA;IAED,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,oBAAoB,KAAK,GAAG,CAAA;QAE1C,IAAI,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YAC1D,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAA;YAC3F,SAAQ;QACT,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3F,WAAW,CAAC,IAAI,CAAC;gBAChB,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,kCAAkC,KAAK,CAAC,IAAI,SAAS,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;aACrF,CAAC,CAAA;YACF,SAAQ;QACT,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,WAAW,CAAC,IAAI,CAAC;gBAChB,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,yDAAyD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;aAChG,CAAC,CAAA;YACF,SAAQ;QACT,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,yDAAyD;QACzD,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAA;QAC1E,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAA;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC7B,QAAQ,EAAE,KAAK,CAAC,IAAI;YACpB,SAAS,EAAE,KAAK,CAAC,KAAK;YACtB,OAAO,EAAE,SAAS;YAClB,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QACzC,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM;YAAE,SAAQ;QAErC,wEAAwE;QACxE,sEAAsE;QACtE,kDAAkD;QAClD,WAAW,CAAC,IAAI,CAAC;YAChB,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,MAAM,wBAAwB,KAAK,CAAC,MAAM,OAAO,OAAO,CAAC,MAAM,EAAE;SAC9H,CAAC,CAAA;IACH,CAAC;IAED,OAAO,WAAW,CAAA;AACnB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAA;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,KAAK,CAAA;AACxD,CAAC"}

package/dist/permissions/headless-trust.js

@@ -1,86 +0,0 @@
-/**
- * The folder-trust gate for the headless one-shots.
- *
- * `integrations/trust/store.ts` states the contract in its own header: "before
- * namzu reads, runs commands in, or edits files in a directory, the user must
- * trust it." That was true of the TUI and false of everything else —
- * `isTrusted` had exactly one caller, `tui/App.tsx`. `exec` and `exec --json`
- * opened a session in whatever directory they were pointed at, with tools
- * auto-approved because there is nobody to ask, so
- *
- *     git clone <a stranger's repository> && cd <it> && namzu exec "what is this?"
- *
- * ran that repository's code on the machine, unattended, having asked nobody.
- *
- * ## What this stops, and what it does not
- *
- * It stops one thing: a headless run in a directory no human has vouched for
- * does not start. A decision currently made by nobody becomes a decision made
- * by someone, on the record.
- *
- * It does NOT stop a trusted directory that later turns hostile — a `git pull`
- * into a trusted checkout can bring in anything, and trust is a statement about
- * a location rather than about its current contents. It does not stop anything
- * INSIDE a trusted directory, where the operator's rules and the safety gate
- * are the only controls. And it does not stop an operator who passes the
- * opt-in reflexively. This raises the floor from "nobody was asked" to
- * "somebody typed it". It is not a sandbox and must not be described as one.
- *
- * ## Why not gate only the reading of `AGENTS.md`
- *
- * That was proposed on the grounds that a system-prompt read is authority
- * where a tool result is only data, which is true and still the wrong fix.
- * Anyone who can write `AGENTS.md` in that repository can write the build
- * script, the test file, the install hook — all of which run with tools
- * auto-approved. Declining to read the attacker's markdown while executing the
- * attacker's code blocks the weaker vector, reports success on a turn that is
- * already compromised, and would make the instructions feature silently dead
- * in CI where nothing has ever been trusted.
- *
- * ## Refuse, never degrade
- *
- * There is no reduced mode. "Degrade gracefully" here would mean executing
- * slightly less of the stranger's code and printing something that looks like
- * an answer, which is the failure this package keeps finding rather than a
- * milder version of it.
- */
-import { isTrusted } from '../integrations/trust/store.js';
-import { canonicalProjectPath } from './canonical-project.js';
-export function decideHeadlessTrust(check) {
-    // Capture the real target exactly once. The permission and every operation
-    // it admits must refer to the same directory entry even if the lexical
-    // `--cwd` was a symlink and somebody repoints it immediately afterward.
-    let cwd;
-    try {
-        cwd = canonicalProjectPath(check.cwd);
-    }
-    catch {
-        return {
-            allowed: false,
-            message: `refusing to run because the working directory changed or became unavailable while trust was being checked: ${check.cwd}`,
-        };
-    }
-    // `--trust` is per-turn and is deliberately NOT written to the trust file.
-    // One reflexive use must not change the machine's state forever; the TUI
-    // stays the only path that records durable trust, because that is the one
-    // where a human is actually looking at a prompt.
-    if (check.trustFlag)
-        return { allowed: true, cwd };
-    const isDirTrusted = check.trusted ?? ((dir) => isTrusted(dir));
-    if (isDirTrusted(cwd))
-        return { allowed: true, cwd };
-    return {
-        allowed: false,
-        message: [
-            `refusing to run in a folder nobody has trusted: ${cwd}`,
-            '',
-            "namzu reads this folder's files, runs commands in it and executes its",
-            'code, and a headless turn approves those tools without asking because',
-            'there is nobody to ask.',
-            '',
-            'Run `namzu` here once and accept the trust prompt to trust the folder',
-            'permanently, or pass --trust to accept it for this turn only.',
-        ].join('\n'),
-    };
-}
-//# sourceMappingURL=headless-trust.js.map

package/dist/permissions/headless-trust.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"headless-trust.js","sourceRoot":"","sources":["../../src/permissions/headless-trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAA;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAsB7D,MAAM,UAAU,mBAAmB,CAAC,KAAiB;IACpD,2EAA2E;IAC3E,uEAAuE;IACvE,wEAAwE;IACxE,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACJ,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACtC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO;YACN,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,8GAA8G,KAAK,CAAC,GAAG,EAAE;SAClI,CAAA;IACF,CAAC;IACD,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,iDAAiD;IACjD,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;IAClD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;IACvE,IAAI,YAAY,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;IACpD,OAAO;QACN,OAAO,EAAE,KAAK;QACd,OAAO,EAAE;YACR,mDAAmD,GAAG,EAAE;YACxD,EAAE;YACF,uEAAuE;YACvE,uEAAuE;YACvE,yBAAyB;YACzB,EAAE;YACF,uEAAuE;YACvE,+DAA+D;SAC/D,CAAC,IAAI,CAAC,IAAI,CAAC;KACZ,CAAA;AACF,CAAC"}