@nanonets/graft 0.23.1 → 0.24.1

package/dist/skills/receipts.js

@@ -0,0 +1,223 @@
+/**
+ * Receipts (design 2.7, 4.9): what the PreToolUse save gate decided about one
+ * `trail skills add`, for the CLI that runs right after it. One per session
+ * (`~/.trail/receipts/<session-id>.json`), replaced by the next add, found
+ * only for its run and name while fresh, and used once: the CLI sets `usedAt`
+ * when it acts on it, and a used receipt never counts again.
+ *
+ * A receipt is a hint, never proof. The CLI re-decides from the transcript
+ * (4.9 CLI half); a receipt the agent wrote itself is caught there.
+ *
+ * `lineAt` is the one positioned read the gate makes of the transcript: the
+ * line that starts at a byte offset the fold recorded, so the gate checks the
+ * person's typed line and each step's call and result without reading the
+ * whole file.
+ */
+import { createHash } from 'node:crypto';
+import { closeSync, lstatSync, openSync, readdirSync, readSync, realpathSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { readJsonSafe, trailPath, withLock, writePrivate } from '../util/private-fs.js';
+import { sessionPath } from '../trace/gate-file.js';
+import { dialectFor } from '../trace/dialect.js';
+/** A receipt older than this is stale: the CLI runs right after its PreToolUse. */
+const FRESH_MS = 10 * 60_000;
+/** Clock skew allowed between the hook and the CLI. */
+const AHEAD_MS = 5_000;
+const DEFAULT_MAX_LINE = 1024 * 1024;
+const TIERS = new Set(['A', 'B', 'C', 'D']);
+const CONSENTS = new Set(['offer-yes', 'asked', 'none']);
+const ASKED = new Set(['this repo', 'every repo', 'repo', 'team']);
+/** A session id as a file name, as phase 0's state.ts does it: anything odd is hashed. */
+function fileId(sessionId) {
+    if (/^[A-Za-z0-9_-][A-Za-z0-9._-]{0,127}$/.test(sessionId))
+        return sessionId;
+    return `h-${createHash('sha256').update(String(sessionId)).digest('hex').slice(0, 16)}`;
+}
+const receiptsDir = (env) => trailPath(env, 'receipts');
+/** <home>/receipts/<session-id>.json */
+export function receiptPath(sessionId, env) {
+    return join(receiptsDir(env), `${fileId(String(sessionId))}.json`);
+}
+/** Replaces the session's previous receipt. */
+export function writeReceipt(r, env) {
+    writePrivate(receiptPath(r.session, env), `${JSON.stringify(r, null, 2)}\n`);
+}
+const str = (v) => typeof v === 'string';
+const num = (v) => typeof v === 'number' && Number.isFinite(v);
+/** The receipt as Trail writes it, or null: a file of any other shape is not one. */
+function asReceipt(v) {
+    if (!v || typeof v !== 'object' || Array.isArray(v))
+        return null;
+    const r = v;
+    if (r.v !== 1 || !str(r.session) || !str(r.transcriptPath) || !str(r.toolUseId) || !str(r.runId) || !str(r.name) || !str(r.at))
+        return null;
+    if (!str(r.host) || !TIERS.has(r.tier) || !CONSENTS.has(r.consent) || (r.offerId !== null && !str(r.offerId)))
+        return null;
+    if (r.typed !== null && (!r.typed || typeof r.typed !== 'object' || !num(r.typed.offset) || !str(r.typed.lineSha)))
+        return null;
+    if (typeof r.typedYes !== 'boolean' || typeof r.typedSave !== 'boolean' || (r.asked !== null && !ASKED.has(r.asked)))
+        return null;
+    if (!num(r.stepsTotal) || !num(r.stepsVerified) || (r.verdict !== 'live' && r.verdict !== 'held'))
+        return null;
+    if (r.usedAt !== null && !str(r.usedAt))
+        return null;
+    if (r.checkout !== undefined && !str(r.checkout))
+        return null;
+    return r;
+}
+/** One receipt file, read only when it is a regular file (never through a link). */
+function readReceiptFile(path) {
+    try {
+        if (!lstatSync(path).isFile())
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return asReceipt(readJsonSafe(path));
+}
+/** The unused receipt (usedAt null) for this run and name, fresh (<= 10 min old, not > 5 s in the future). Scans receipts/*.json. */
+export function findReceipt(runId, name, now = new Date(), env) {
+    let names;
+    try {
+        names = readdirSync(receiptsDir(env));
+    }
+    catch {
+        return null;
+    }
+    let best = null;
+    for (const n of names) {
+        if (!n.endsWith('.json'))
+            continue;
+        const r = readReceiptFile(join(receiptsDir(env), n));
+        if (!r || r.usedAt !== null || r.runId !== runId || r.name !== name)
+            continue;
+        const age = now.getTime() - Date.parse(r.at);
+        if (Number.isNaN(age) || age > FRESH_MS || age < -AHEAD_MS)
+            continue;
+        if (!best || Date.parse(r.at) > Date.parse(best.at))
+            best = r;
+    }
+    return best;
+}
+const sameReceipt = (a, b) => a.session === b.session && a.toolUseId === b.toolUseId && a.runId === b.runId && a.name === b.name && a.at === b.at;
+/** Sets usedAt on the receipt on disk, when it is still this one (a newer add replaces it, and stays unused). */
+export function markReceiptUsed(r, now = new Date(), env) {
+    const path = receiptPath(r.session, env);
+    withLock(path, () => {
+        const cur = readReceiptFile(path);
+        if (!cur || !sameReceipt(cur, r) || cur.usedAt !== null)
+            return;
+        writePrivate(path, `${JSON.stringify({ ...cur, usedAt: now.toISOString() }, null, 2)}\n`);
+    }, 1000);
+}
+/**
+ * The transcript line that starts at offset: one positioned read of at most maxBytes (default 1 MB), from the
+ * byte before it, so an offset inside a line is refused. null past the end, with no newline within maxBytes, or
+ * unreadable.
+ */
+export function lineAt(transcriptPath, offset, maxBytes = DEFAULT_MAX_LINE) {
+    if (!Number.isSafeInteger(offset) || offset < 0 || !(maxBytes > 0))
+        return null;
+    let fd;
+    try {
+        fd = openSync(transcriptPath, 'r');
+    }
+    catch {
+        return null;
+    }
+    try {
+        const from = offset === 0 ? 0 : offset - 1;
+        const lead = offset - from;
+        const buf = Buffer.alloc(lead + Math.floor(maxBytes));
+        const n = readSync(fd, buf, 0, buf.length, from);
+        if (n <= lead)
+            return null;
+        if (lead === 1 && buf[0] !== 0x0a)
+            return null;
+        const end = buf.indexOf(0x0a, lead);
+        if (end < 0 || end >= n)
+            return null;
+        return buf.subarray(lead, end).toString('utf8');
+    }
+    catch {
+        return null;
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/**
+ * The whole lines that end right before `offset` (which must be a line start), oldest first: one positioned read of
+ * at most maxBytes (default 1 MB) back from it. A line cut by the window is left out. [] at offset 0, inside a
+ * line, or unreadable.
+ */
+export function linesBefore(transcriptPath, offset, maxBytes = DEFAULT_MAX_LINE) {
+    if (!Number.isSafeInteger(offset) || offset <= 0 || !(maxBytes > 0))
+        return [];
+    let fd;
+    try {
+        fd = openSync(transcriptPath, 'r');
+    }
+    catch {
+        return [];
+    }
+    try {
+        const from = Math.max(0, offset - Math.floor(maxBytes));
+        const buf = Buffer.alloc(offset - from);
+        const n = readSync(fd, buf, 0, buf.length, from);
+        if (n !== buf.length || buf[n - 1] !== 0x0a)
+            return [];
+        const lines = buf.subarray(0, n - 1).toString('utf8').split('\n');
+        return from > 0 ? lines.slice(1) : lines;
+    }
+    catch {
+        return [];
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** sha256 hex of the whole line, as read (no newline). */
+export function lineSha(line) {
+    return createHash('sha256').update(line, 'utf8').digest('hex');
+}
+export function typedLineStillThere(transcriptPath, typed) {
+    const line = lineAt(transcriptPath, typed.offset);
+    return line !== null && lineSha(line) === typed.lineSha;
+}
+/**
+ * The receipt names the host's own transcript for its session (g7, D74), as its host's dialect knows it (4.16):
+ * for Claude Code `<projects>/<folder>/<session_id>.jsonl`, for Codex `CODEX_HOME/sessions/.../rollout-*-<session>.jsonl`
+ * whose first line names the session, each compared through realpath, so a link to a file elsewhere, a copy in /tmp
+ * or another session's file is not it. A host with no dialect can't save live; its receipt can only be held for its
+ * host, so it passes as it is, unless it claims tier A.
+ */
+export function receiptTranscriptOk(r, env = process.env) {
+    const d = dialectFor(r.host);
+    if (!d)
+        return r.tier !== 'A';
+    return d.transcriptOk(r, env);
+}
+/**
+ * The receipt names the very file the hooks read for its session (g7 review): the session state's cursor keeps the
+ * transcript's device and inode, from the path Claude Code itself gave the hooks. The path check above trusts the
+ * projects folders, and `$CLAUDE_CONFIG_DIR` comes from the env of `trail skills add`, which is the agent's; a copy
+ * under a folder the agent names, or in another project folder, is not the file the hooks read. A hard link to it
+ * is (same inode). No cursor (the hooks never read this session): no. Another host's receipt is held anyway: passes.
+ */
+export function receiptTranscriptRead(r, env = process.env) {
+    if (!dialectFor(r.host))
+        return r.tier !== 'A';
+    const cur = readJsonSafe(sessionPath(r.session, '.json', env))?.trace;
+    if (!cur || typeof cur.ino !== 'number' || typeof cur.dev !== 'number' || !cur.ino)
+        return false;
+    try {
+        const st = statSync(realpathSync(r.transcriptPath));
+        return st.isFile() && st.ino === cur.ino && st.dev === cur.dev;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=receipts.js.map

package/dist/skills/receipts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipts.js","sourceRoot":"","sources":["../../src/skills/receipts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxG,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,mFAAmF;AACnF,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,CAAC;AAC7B,uDAAuD;AACvD,MAAM,QAAQ,GAAG,KAAK,CAAC;AACvB,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAC;AACrC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAC5C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACzD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnE,0FAA0F;AAC1F,SAAS,MAAM,CAAC,SAAiB;IAC/B,IAAI,sCAAsC,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7E,OAAO,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,GAAuB,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AAE5E,wCAAwC;AACxC,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,GAAuB;IACpE,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC;AACrE,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,YAAY,CAAC,CAAU,EAAE,GAAuB;IAC9D,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;AAC/D,MAAM,GAAG,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAErF,qFAAqF;AACrF,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,CAAC,GAAG,CAAY,CAAC;IACvB,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5I,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3H,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChI,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/G,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,oFAAoF;AACpF,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC,YAAY,CAAU,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,qIAAqI;AACrI,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,IAAY,EAAE,MAAY,IAAI,IAAI,EAAE,EAAE,GAAuB;IACtG,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,GAAmB,IAAI,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACnC,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;YAAE,SAAS;QAC9E,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,QAAQ,IAAI,GAAG,GAAG,CAAC,QAAQ;YAAE,SAAS;QACrE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,IAAI,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAC7C,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;AAEtH,iHAAiH;AACjH,MAAM,UAAU,eAAe,CAAC,CAAU,EAAE,MAAY,IAAI,IAAI,EAAE,EAAE,GAAuB;IACzF,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE;QAClB,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO;QAChE,YAAY,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5F,CAAC,EAAE,IAAI,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,cAAsB,EAAE,MAAc,EAAE,WAAmB,gBAAgB;IAChG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,cAAsB,EAAE,MAAc,EAAE,WAAmB,gBAAgB;IACrG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/E,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClE,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,cAAsB,EAAE,KAA0C;IACpG,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAU,EAAE,MAAyB,OAAO,CAAC,GAAG;IAClF,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC;IAC9B,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAU,EAAE,MAAyB,OAAO,CAAC,GAAG;IACpF,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC;IAC/C,MAAM,GAAG,GAAG,YAAY,CAA+C,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC;IACpH,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACjG,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;QACpD,OAAO,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/skills/risk-delta.d.ts

@@ -0,0 +1,32 @@
+/**
+ * What a fix may not teach (b2 review, D104): the lists a repair's delta is
+ * held to, beside 1a's `neverSave` and `gatedKind` (`risk.ts`). A delta, or
+ * moment 4's fix command, becomes a lesson an agent reads as "what fixed
+ * it", and an agent chose the command, so it may not carry a way around a
+ * check: no flag that skips a hook, forces, widens what may run, points at
+ * another registry or makes the command do less; no env var that carries a
+ * credential, runs code or turns off a check; no step that logs in, changes
+ * config for good or turns off a safety check; nothing that names Trail's,
+ * the host's or the shell's own files; nothing the reader can't see.
+ *
+ * Moved here from `trace/repairs.ts` so moment 4 (offer-lesson.ts) reads the
+ * same lists instead of a copy (D104). Not in `risk.ts`: that file is at its
+ * size limit and on the PreToolUse fast path, which needs none of this.
+ */
+import type { FixDelta } from '../trace/types.js';
+export declare const RISKY_FLAG: RegExp;
+export declare const RISKY_ENV: RegExp;
+export declare const RISKY_STEP: RegExp;
+/** Git config set for one command (`git -c core.hooksPath=/dev/null push`). Case-sensitive: `git -C dir` is a directory. */
+export declare const GIT_INLINE_CONFIG: RegExp;
+export declare const OWN_FILES: RegExp;
+export declare const UNSEEN: RegExp;
+/** A delta that can't be a lesson, beyond `neverSave` and `gatedKind` (b2 review). A short-flag bundle (`-fq`) is read letter by letter. */
+export declare function riskyDelta(d: Pick<FixDelta, 'kind' | 'name' | 'text'>): boolean;
+/**
+ * Moment 4's fix command (4.14 step 3, D104): the whole command read as an enabling step, and each of its env
+ * assignments and flags read as a delta of its own, so `git push --no-verify origin v1.4.3` or `HUSKY=0 git push`
+ * never becomes "what fixed it". True: don't use it (the lesson is the phrase alone).
+ */
+export declare function riskyCommand(cmd: string): boolean;
+//# sourceMappingURL=risk-delta.d.ts.map

package/dist/skills/risk-delta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-delta.d.ts","sourceRoot":"","sources":["../../src/skills/risk-delta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGlD,eAAO,MAAM,UAAU,QAAqY,CAAC;AAC7Z,eAAO,MAAM,SAAS,QAA4jB,CAAC;AACnlB,eAAO,MAAM,UAAU,QAWN,CAAC;AAClB,4HAA4H;AAC5H,eAAO,MAAM,iBAAiB,QAAwD,CAAC;AACvF,eAAO,MAAM,SAAS,QAAqS,CAAC;AAC5T,eAAO,MAAM,MAAM,QAAgC,CAAC;AAEpD,4IAA4I;AAC5I,wBAAgB,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,GAAG,OAAO,CAM/E;AAKD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAWjD"}

package/dist/skills/risk-delta.js

@@ -0,0 +1,56 @@
+import { ASSIGN, unquote, words } from '../trace/shell-scan.js';
+export const RISKY_FLAG = /^(?:--no-verify|--no-gpg-sign|--no-sign|-n|-f|--force(?:-[\w-]+)?|--dangerously[\w-]*|--permission-mode|--allow(?:ed)?-?tools|--privileged|--cap-add|--security-opt|--registry|--index-url|--extra-index-url|--trusted-host|--otp|--insecure|-k|--no-check-certificate|--unsafe-perm|--allow-root|--dry-run|--help|-h|--version|-v|-short|--pass-?with-?no-?tests|--skip[\w-]*|--ignore[\w-]*)$/i;
+export const RISKY_ENV = /^(?:PATH|HOME|SHELL|IFS|ENV|BASH_ENV|ZDOTDIR|PROMPT_COMMAND|EDITOR|VISUAL|PAGER|BROWSER|NODE_OPTIONS|NODE_PATH|PYTHONPATH|PYTHONSTARTUP|PYTHONHTTPSVERIFY|PERL5OPT|PERL5LIB|RUBYOPT|RUBYLIB|JAVA_TOOL_OPTIONS|_JAVA_OPTIONS|HUSKY|SKIP|NODE_TLS_REJECT_UNAUTHORIZED|NODE_EXTRA_CA_CERTS|SSL_CERT_FILE|SSL_CERT_DIR|REQUESTS_CA_BUNDLE|CURL_CA_BUNDLE|CLAUDECODE)$|^(?:LD_|DYLD_|XDG_|GIT_|SSH_|TRAIL_|GRAFT_|CLAUDE_|ANTHROPIC_|PRE_COMMIT|NPM_CONFIG_)|(?:^|_)(?:TOKEN|SECRET|PASS|PASSWORD|PASSWD|PASSPHRASE|API_?KEY|KEY|AUTH\w*|CREDENTIALS?|OTP|PRIVATE\w*|COOKIE|SESSION)(?:_|$)/i;
+export const RISKY_STEP = new RegExp([
+    String.raw `\bgit\s+config\b[^;&|\n]{0,400}?(?:--global|--system|core\.hooksPath|safe\.directory|credential|\burl\.)`,
+    String.raw `\bgh\s+auth\s+(?:login|logout|refresh|setup-git|token|switch)\b`,
+    String.raw `\b(?:npm|pnpm|yarn)\b[^;&|\n]{0,200}?\s(?:login|logout|adduser|add-user|token)(?![\w:.-])`, String.raw `\b(?:npm|pnpm|yarn)\s+config\s+set\b`,
+    String.raw `\bclaude\s+(?:setup-token|login|logout|auth)\b`,
+    String.raw `\b(?:docker|podman|helm|vercel|netlify|fly(?:ctl)?|heroku|firebase|wrangler|az)\s+(?:registry\s+)?login\b`,
+    String.raw `\baws\s+(?:configure|sso\s+login)\b`, String.raw `\bgcloud\s+auth\b`,
+    String.raw `\bxattr\s+-[a-z]*[dc]`, String.raw `\b(?:spctl|csrutil|systemsetup|dscl|nvram|crontab|chown)\b`, String.raw `\bdefaults\s+write\b`,
+    String.raw `\blaunchctl\s+(?:load|bootstrap|enable|submit)\b`,
+    String.raw `(?:^|[\s;&|(='"])(?:/tmp/|/private/tmp/|/var/folders/|\$\{?TMPDIR\b)`,
+    String.raw `\bchmod\b[^;&|\n]{0,200}?(?:\s0?[0-7]{2}[2367](?=\s|$)|[\s,][ao]*\+[rwxXst]*w)`,
+].join('|'), 'i');
+/** Git config set for one command (`git -c core.hooksPath=/dev/null push`). Case-sensitive: `git -C dir` is a directory. */
+export const GIT_INLINE_CONFIG = /\bgit\b[^;&|\n]{0,200}?\s(?:-c\s*\S|--config-env\b)/;
+export const OWN_FILES = /(?:^|[\s='":@/])\.(?:trail|claude(?:\.json)?|codex|cursor|gemini|agents|mcp\.json|zshrc|zshenv|zprofile|zlogin|bashrc|bash_profile|bash_login|profile|gitconfig|ssh|npmrc|netrc|config\/(?:fish|gh|git))(?![\w-])|(?:^|[\s='":])\/etc\/|\b(?:CLAUDE|AGENTS|GEMINI)\.md\b|Library\/LaunchAgents\b/;
+export const UNSEEN = /[\p{Cc}\p{Cf}\u2028\u2029]/u;
+/** A delta that can't be a lesson, beyond `neverSave` and `gatedKind` (b2 review). A short-flag bundle (`-fq`) is read letter by letter. */
+export function riskyDelta(d) {
+    if (UNSEEN.test(d.text) || OWN_FILES.test(d.text))
+        return true;
+    if ((d.kind === 'flag' || d.kind === 'env') && /\$\(|`|[<>]\(/.test(d.text))
+        return true; // a value that runs a command
+    if (d.kind === 'flag')
+        return RISKY_FLAG.test(d.name) || (/^-[a-z]{2,4}$/i.test(d.name) && /[nfkhv]/i.test(d.name));
+    if (d.kind === 'env')
+        return RISKY_ENV.test(d.name);
+    return d.kind === 'enable-step' && (RISKY_STEP.test(d.text) || GIT_INLINE_CONFIG.test(d.text));
+}
+/** Past this a command is not read word by word: it is not a lesson's fix anyway (4.14 step 3 keeps 300 at most). */
+const WORDS_MAX = 4096;
+/**
+ * Moment 4's fix command (4.14 step 3, D104): the whole command read as an enabling step, and each of its env
+ * assignments and flags read as a delta of its own, so `git push --no-verify origin v1.4.3` or `HUSKY=0 git push`
+ * never becomes "what fixed it". True: don't use it (the lesson is the phrase alone).
+ */
+export function riskyCommand(cmd) {
+    const text = String(cmd ?? '');
+    if (!text.trim() || text.length > WORDS_MAX)
+        return true;
+    if (riskyDelta({ kind: 'enable-step', name: '', text }))
+        return true;
+    if (/\$\(|`|[<>]\(/.test(text))
+        return true; // runs a command of its own
+    for (const raw of words(text)) {
+        const w = unquote(raw);
+        if (ASSIGN.test(raw) && riskyDelta({ kind: 'env', name: w.slice(0, w.indexOf('=')), text: w }))
+            return true;
+        if (w.length > 1 && w.startsWith('-') && w !== '--' && riskyDelta({ kind: 'flag', name: w.split('=')[0], text: w }))
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=risk-delta.js.map

package/dist/skills/risk-delta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-delta.js","sourceRoot":"","sources":["../../src/skills/risk-delta.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAEhE,MAAM,CAAC,MAAM,UAAU,GAAG,kYAAkY,CAAC;AAC7Z,MAAM,CAAC,MAAM,SAAS,GAAG,yjBAAyjB,CAAC;AACnlB,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC;IACnC,MAAM,CAAC,GAAG,CAAA,0GAA0G;IACpH,MAAM,CAAC,GAAG,CAAA,iEAAiE;IAC3E,MAAM,CAAC,GAAG,CAAA,2FAA2F,EAAE,MAAM,CAAC,GAAG,CAAA,sCAAsC;IACvJ,MAAM,CAAC,GAAG,CAAA,gDAAgD;IAC1D,MAAM,CAAC,GAAG,CAAA,2GAA2G;IACrH,MAAM,CAAC,GAAG,CAAA,qCAAqC,EAAE,MAAM,CAAC,GAAG,CAAA,mBAAmB;IAC9E,MAAM,CAAC,GAAG,CAAA,uBAAuB,EAAE,MAAM,CAAC,GAAG,CAAA,4DAA4D,EAAE,MAAM,CAAC,GAAG,CAAA,sBAAsB;IAC3I,MAAM,CAAC,GAAG,CAAA,kDAAkD;IAC5D,MAAM,CAAC,GAAG,CAAA,sEAAsE;IAChF,MAAM,CAAC,GAAG,CAAA,gFAAgF;CAC3F,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;AAClB,4HAA4H;AAC5H,MAAM,CAAC,MAAM,iBAAiB,GAAG,qDAAqD,CAAC;AACvF,MAAM,CAAC,MAAM,SAAS,GAAG,kSAAkS,CAAC;AAC5T,MAAM,CAAC,MAAM,MAAM,GAAG,6BAA6B,CAAC;AAEpD,4IAA4I;AAC5I,MAAM,UAAU,UAAU,CAAC,CAA2C;IACpE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,8BAA8B;IACxH,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpH,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,qHAAqH;AACrH,MAAM,SAAS,GAAG,IAAI,CAAC;AAEvB;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,4BAA4B;IACzE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5G,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACpI,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/skills/risk.d.ts

@@ -0,0 +1,73 @@
+/**
+ * The risk lists (design 4.11, spec 10).
+ *
+ * Never save (never-save.ts, kept off the PreToolUse fast path): a command a
+ * skill may never hold, so a run with one gives no skill at all.
+ *
+ * Gated: a step that can't be undone (publish, push to prod or main, deploy,
+ * `gh pr merge`, migrations, `docker system prune`) or that logs in to a
+ * service (D93: `npm login`, `gh auth login`, `aws sso login`, ...). It stays
+ * in the skill, marked, and Claude Code asks the person right before it runs.
+ *
+ * The agent guard: commands only the person may run (turn skills or offers
+ * on, keep a held skill) and Trail's hook scripts run by hand, which would
+ * forge a hook payload. Turning things off is open to anyone.
+ *
+ * Agents wrap commands (`bash -c`, `env`, `xargs`, `find -exec`, `eval`,
+ * `{ }`, `if`, `for`), put flags anywhere (`git push origin main --force`,
+ * `npm --registry x publish`) and leave the branch implicit (`git push`), so
+ * the lists read the whole text, quotes included, and a target the skill
+ * can't know (a variable, a {param}, the current branch) counts as the risky
+ * one.
+ *
+ * The PreToolUse fast path imports this file: besides types it loads only
+ * `shell.ts`, which loads only its lexer.
+ */
+import type { GatedKind } from '../trace/types.js';
+export declare const MAX_RUN_LINES = 12;
+export declare const MAX_STEP_CHARS = 300;
+/**
+ * The words after `from`, up to the end of that call. `until` is where the next match of the same program starts
+ * (callers pass it), so `git push git push …` reads each call once and the whole scan stays linear (g7 review).
+ */
+export declare function argsAfter(text: string, from: number, until?: number): string[];
+/** Where a program word starts: not inside another word or path name (`/bin/rm` counts, `git-rm` doesn't). */
+export declare const word: (name: string) => RegExp;
+/** One `git push`: forced or not, where it went (`<current>` for the checked-out branch, `<unknown>` for a variable or {param}, `<all>`), and from what. */
+export interface Push {
+    force: boolean;
+    dsts: string[];
+    srcs: string[];
+}
+export declare function pushes(text: string): Push[];
+export declare const unknownDst: (d: string) => boolean;
+/** A value written out in the command, not read from a variable or a {param} (`$PW`, `"${PW:?set PW}"`, `{password}`, `<pw>`). */
+export declare const written: (v: string) => boolean;
+/** Every gated kind whose pattern appears anywhere in `cmd`, dry run or not: linear, for a command too long to split (3.3). */
+export declare function gatedAnywhere(cmd: string): Set<GatedKind>;
+export declare function gatedKind(cmd: string): GatedKind | null;
+/** D116 item 5: the login a command runs, as the person would type it (flags dropped), and the service; null when none. */
+export declare function loginOf(cmd: string): {
+    service: string;
+    login: string;
+} | null;
+/** "publishes 0.22.1 to npm", "moves prod to 4e1c9a2", ... (4.11). */
+export declare function gatedWhat(kind: GatedKind, cmd: string, values: Record<string, string>): string;
+/** Consecutive steps of one gated kind form one group; one host ask covers a group (3.3). */
+export declare function gatedGroups(steps: Array<{
+    n: number;
+    gated: GatedKind | null;
+}>): Array<{
+    kind: GatedKind;
+    steps: number[];
+}>;
+/** Phase 2 (P28): `restore-version`, an older version of a skill brought back. */
+export type GuardHit = 'skills-on' | 'offers-on' | 'keep-held' | 'hook-script' | 'restore-version';
+/** The words the shell runs: quotes and backslashes don't change them, and a line continuation joins with nothing. */
+export declare function shellWords(cmd: string): string;
+/** 4.11 agent guard: commands only the person may run, and Trail's hook scripts run by hand. Linear in the command. */
+export declare function agentGuard(cmd: string): {
+    hit: GuardHit;
+    reason: string;
+} | null;
+//# sourceMappingURL=risk.d.ts.map

package/dist/skills/risk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk.d.ts","sourceRoot":"","sources":["../../src/skills/risk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAGnD,eAAO,MAAM,aAAa,KAAK,CAAC;AAChC,eAAO,MAAM,cAAc,MAAM,CAAC;AAMlC;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,SAAc,GAAG,MAAM,EAAE,CAKnF;AACD,8GAA8G;AAC9G,eAAO,MAAM,IAAI,GAAI,MAAM,MAAM,WAA4E,CAAC;AAK9G,4JAA4J;AAC5J,MAAM,WAAW,IAAI;IAAG,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE;AAExE,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,CAqC3C;AACD,eAAO,MAAM,UAAU,GAAI,GAAG,MAAM,YAAsB,CAAC;AAG3D,kIAAkI;AAClI,eAAO,MAAM,OAAO,GAAI,GAAG,MAAM,YAGhC,CAAC;AA2CF,+HAA+H;AAC/H,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,CAGzD;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAMvD;AAaD,2HAA2H;AAC3H,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAK9E;AAED,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAmC9F;AAED,6FAA6F;AAC7F,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAAA;CAAE,CAAC,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAS7H;AAED,kFAAkF;AAClF,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,aAAa,GAAG,iBAAiB,CAAC;AA8EnG,sHAAsH;AACtH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAc9C;AA+ED,uHAAuH;AACvH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAYhF"}