@open-everywhere/core 0.1.0

package/dist/agent/channels/approval-claim-guard.d.ts

@@ -0,0 +1,112 @@
+import { type GatedConnectorWrite, type StandingWriteGrant } from "./standing-authority.js";
+import type { ReplyAudit } from "./reply-post.js";
+/** The audit action one withheld no-approval claim writes. Ids, counts and the claim's SHAPE —
+ *  never the sentence, which is model text that may quote ingested content. */
+export declare const APPROVAL_CLAIM_WITHHELD_ACTION = "approval.claim_withheld";
+/** WHICH cause the host named in the struck claim's place. A closed set, so the audit row can be
+ *  counted and joined without ever carrying the sentence. */
+export type ApprovalClaimCause = "approval-gate-ran" | "gated-connector-write" | "standing-write-grant";
+/** WHICH shape of claim was struck. A closed set, for the same reason. */
+export type ApprovalClaimShape = "none-required" | "none-presented" | "without-approval";
+/** One claim the detector found, as a SENTENCE INDEX and a shape — never the text. */
+export interface ApprovalClaim {
+    readonly shape: ApprovalClaimShape;
+    /** Which sentence of the reply it was, zero-based. Lets an operator find it in the posted body
+     *  without the row carrying a copy — it is what the audit row records. */
+    readonly sentence: number;
+    /** Absolute offsets of the MATCHED words in the reply. The removal starts at `start` and runs to
+     *  the end of that sentence — see {@link applyApprovalClaimGuard}. Never the text: an offset pair
+     *  cannot carry model prose into a row or a log. */
+    readonly start: number;
+    readonly end: number;
+}
+/**
+ * Every no-approval claim in one reply — PURE, so the patterns are testable over fixture text with
+ * no eve context, no audit store and no reply.
+ */
+export declare function detectNoApprovalClaims(text: string): readonly ApprovalClaim[];
+/** What the host observed standing behind this turn's acts, in the order the note prefers. Pure
+ *  input, so the note is testable without a session container. */
+export interface StandingAuthorityView {
+    /** An approval gate ran on this turn — `approvals/card-signal.ts`. It is armed by a posted card
+     *  AND by the session-approved path in `tools/open_pull_request.ts`, which posts a note instead,
+     *  so it proves a gate ran and NOT that a card is in the room. The note says exactly that. */
+    readonly approvalGateRan: boolean;
+    /** Gated-tier connector ops that completed on this turn. */
+    readonly gatedWrites: readonly GatedConnectorWrite[];
+    /** Credentialed write-capable hosts the compiled egress policy leaves open. */
+    readonly grants: readonly StandingWriteGrant[];
+}
+/**
+ * The opening of both NO-CARD notes, and the one stable thing a reader outside this module may match
+ * on.
+ *
+ * 🔴 `packages/core/scripts/e2e/scenarios.ts` S-CONNECTOR-TIER IMPORTS IT, and must never copy it.
+ * That leg gates on the host naming a standing grant, so a leg holding its own spelling would keep
+ * passing against a note this module had reworded — a live gate that stopped looking at anything.
+ */
+export declare const NO_CARD_NOTE_OPENING = "(No card was raised on this turn.";
+/**
+ * The host-voiced line that replaces a struck claim, or `undefined` when the host can name no cause
+ * and the reply must therefore be left alone.
+ *
+ * ORDER IS BY DIRECTNESS. A gate that RAN contradicts the claim outright, so it is said first. A
+ * gated connector write that completed with no card is the next most specific: the plane demanded an
+ * approval for that op and one already stood. The standing grant is last, because it describes the
+ * ROOM rather than the act — the host sees the policy and not the request, so that line may not say
+ * this act used it.
+ */
+export declare function standingAuthorityNote(view: StandingAuthorityView): string | undefined;
+/** What the guard did to one reply. */
+export interface ApprovalClaimGuardResult {
+    /** The body to post. BYTE-IDENTICAL to the input whenever nothing was struck — which is every
+     *  ordinary reply, and every claim the host can name no cause for. */
+    readonly body: string;
+    /** The claims struck, empty when the reply kept its text. */
+    readonly withheld: readonly ApprovalClaim[];
+    /** Which cause the note named, absent when nothing was struck. */
+    readonly cause?: ApprovalClaimCause;
+}
+/**
+ * Remove every no-approval claim from one reply and name what really stood — PURE, given the view.
+ *
+ * 🔴 THE REMOVAL RUNS FROM THE CLAIM'S FIRST WORD TO THE END OF ITS SENTENCE, and both halves of
+ * that are measured. It starts at the CLAIM rather than at the sentence, because ship #216's reply
+ * carried the page link the room had asked for in the same run-on segment —
+ * "…<https://app.notion.com/p/OE-tier-ctwrite-53128-…|Open in Notion> No confirmation or approval
+ * requirement was presented." — and a guard that answers a false security claim by deleting the
+ * answer has made the reply worse. It runs to the SENTENCE END rather than stopping at the matched
+ * words, because a note wedged mid-clause leaves the remainder of the clause hanging off it and
+ * reading as part of the host's line; review measured exactly that on three fixture sentences.
+ *
+ * THE COST, STATED: a clause that followed the claim in the same sentence goes with it. That is
+ * strictly less than `memory-claim-guard.ts` removes for the same class, and it is the price of
+ * never leaving a half-sentence attached to a host-voiced line.
+ *
+ * The note lands where the FIRST claim stood; a reply that made the same claim three ways loses all
+ * three sentences and gets ONE note, because three copies would read as a rendering fault.
+ *
+ * A view that names no cause returns the text byte-identical, claims and all: see the header for why
+ * that is the right direction here.
+ */
+export declare function applyApprovalClaimGuard(text: string, view: StandingAuthorityView): ApprovalClaimGuardResult;
+/**
+ * Write the durable row for one withheld claim — best-effort, never throws, never fails the reply.
+ *
+ * 🔴 THE ROW NAMES THE CLAIM BY SHAPE AND POSITION, NEVER BY TEXT, and names the CAUSE the host put
+ * in its place. The struck sentence is model output that can quote ingested content, and this
+ * plane's rows carry ids and counts only. A reader who needs the sentence has the posted body, where
+ * the note says one was struck.
+ */
+export declare function auditWithheldApprovalClaim(audit: ReplyAudit | undefined, platform: string, withheld: readonly ApprovalClaim[], cause: ApprovalClaimCause | undefined): Promise<void>;
+/**
+ * The whole per-reply step, in one call every choke point makes: read what the host observed
+ * standing behind this turn, strike a claim that contradicts it, and hand back the body plus the
+ * claims to audit.
+ *
+ * ONE function because the reply doors DRIFTED before over exactly this kind of shared step — a door
+ * that struck a false security claim and a door that posted it would make the guard look like a
+ * rendering glitch. `scripts/approval-claim-guard-test.ts` scans the doors for this call.
+ */
+export declare function guardApprovalClaims(text: string, audit: ReplyAudit | undefined): ApprovalClaimGuardResult;
+//# sourceMappingURL=approval-claim-guard.d.ts.map

package/dist/agent/channels/approval-claim-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-claim-guard.d.ts","sourceRoot":"","sources":["../../../agent/channels/approval-claim-guard.ts"],"names":[],"mappings":"AAoEA,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD;+EAC+E;AAC/E,eAAO,MAAM,8BAA8B,4BAA4B,CAAC;AAExE;6DAC6D;AAC7D,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,GAAG,uBAAuB,GAAG,sBAAsB,CAAC;AAExG,0EAA0E;AAC1E,MAAM,MAAM,kBAAkB,GAAG,eAAe,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;AAEzF,sFAAsF;AACtF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC;8EAC0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;wDAEoD;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAgED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,aAAa,EAAE,CAgB7E;AAED;kEACkE;AAClE,MAAM,WAAW,qBAAqB;IACpC;;kGAE8F;IAC9F,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACrD,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAChD;AAMD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,sCAAsC,CAAC;AAExE;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,GAAG,MAAM,GAAG,SAAS,CAsBrF;AAED,uCAAuC;AACvC,MAAM,WAAW,wBAAwB;IACvC;0EACsE;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,kEAAkE;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;CACrC;AAuCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,wBAAwB,CAgB3G;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,UAAU,GAAG,SAAS,EAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,SAAS,aAAa,EAAE,EAClC,KAAK,EAAE,kBAAkB,GAAG,SAAS,GACpC,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,wBAAwB,CAMzG"}

package/dist/agent/channels/approval-claim-guard.js

@@ -0,0 +1,324 @@
+// THE NO-APPROVAL-CLAIM GUARD (OPE-1876) — A REPLY MAY NOT TELL A ROOM THAT NOTHING GATED AN ACT.
+//
+// WHAT WAS MEASURED. Ship #216, leg S-CONNECTOR-TIER, Slack channel `C0EXGENRL`,
+// 11:16:23Z–11:18:40Z. The seat created a Notion page and answered:
+//
+//   "The Notion page was created and verified: • Title: OE tier ctwrite-53128 … • Link: …
+//    No confirmation or approval requirement was presented."
+//
+// The last sentence is the defect. The audit window holds no `connector.op` row and no `approval.*`
+// row for that window, and the write did not take the connector plane at all: the channel's
+// `egress.policy` row grants the connector's REST host GET, POST and PATCH under the `notion-rest`
+// credential, a standing grant declared in `agent/access/bundles.ts`. The firewall stamps the header
+// at the sandbox boundary, so the connector plane's card cannot appear on that road, by design.
+// (The host itself is named in the deployment's own bundles and in the ship report, never here:
+// `test:boundary` keeps a vendor's API host out of core, and this module needs the shape, not the
+// spelling.)
+//
+// So the sentence said something true about the card and something false about the room. A reader
+// was told that this act is ungated, when what really happened is that a named standing grant
+// already covered it. The two readings lead to opposite decisions about whether to trust the next
+// write, which is why this is a security claim and not a wording problem.
+//
+// 🔴 THE MODEL IS NOT THE RIGHT AUTHOR OF THIS SENTENCE, whatever the prompt says. Whether an act
+// needed a card is a fact about the access plane, and the seat sees only that nothing interrupted
+// it. `channels/memory-claim-guard.ts` states the same argument for durability claims and cites the
+// two ships that proved a prompt rule is not a control. So the HOST answers this one, out of its own
+// observation — `channels/standing-authority.ts`.
+//
+// ── WHAT THE GUARD DOES ─────────────────────────────────────────────────────────────────────────
+// It REMOVES the claim — from its first word to the end of its sentence — and puts ONE host-voiced
+// line there instead, naming what the host really observed: the approval gate that ran, the standing
+// approval a gated connector write went under, or the named standing grant in force for the room.
+// Every byte before the claim goes out unchanged, so the page link and the title the room asked for
+// survive.
+//
+// 🔴 IT STARTS AT THE CLAIM, NOT AT THE SENTENCE, AND THE MEASURED REPLY IS WHY.
+// `memory-claim-guard.ts` strikes whole sentences; here that would have deleted the answer, because
+// the seat put its claim in the same run-on segment as the page link — "…|Open in Notion> No
+// confirmation or approval requirement was presented." A guard that answers a false security claim by
+// destroying the link the room asked for has made the reply worse than the fabrication did.
+// {@link applyApprovalClaimGuard} carries the argument, and the cost, in full.
+//
+// 🔴 IT FIRES ONLY WHERE THE HOST CAN NAME A CAUSE, and the residual is the point of saying so. A
+// no-approval claim on a turn with no card, no gated connector write and no credentialed standing
+// write grant posts UNCHANGED: the host has nothing truer to say than the model did, and a note
+// saying "I cannot tell" would be noise on the ordinary reply that makes this claim honestly. What
+// the guard removes is the measured shape — an act that something DID stand behind, described as an
+// act nothing stands behind.
+//
+// 🔴 IT NEVER CLAIMS A WRITE HAPPENED. The standing-grant arm reports a REACH the deployment granted
+// — the firewall stamps credentials at the sandbox boundary and no host sees the individual request
+// (`channels/standing-authority.ts` says the same of its ledger). The line is worded for that: it
+// says what rides here, never what ran.
+//
+// 🔴 QUESTIONS, PLANS AND CONDITIONALS ARE OUT, and they must be. "Do you want me to proceed without
+// confirmation?" and "publishing that would need your approval" are the sentences a seat says when
+// it is behaving correctly; striking them would teach the model to stop offering the gate at all.
+// {@link MODAL_BEFORE}, {@link MODAL_IN_SPAN} and the question test keep them out.
+//
+// FAIL-SOFT. A reply with no claim in it comes back BYTE-IDENTICAL, which is every ordinary reply.
+// Outside an eve context the ledgers answer "nothing observed", which names no cause, so the text is
+// left ALONE — the opposite fail-soft direction from the memory guard's, and for the opposite
+// reason: there the host withholds an unbacked claim, here the host would be ADDING a sentence it
+// cannot back.
+import { appendAudit } from "../audit/audit.js";
+import { replySentences } from "./memory-claim-guard.js";
+import { peekCardPostedThisTurn } from "../approvals/card-signal.js";
+import { describeStandingWriteGrant, gatedConnectorWritesThisTurn, standingWriteGrantsInForce, } from "./standing-authority.js";
+/** The audit action one withheld no-approval claim writes. Ids, counts and the claim's SHAPE —
+ *  never the sentence, which is model text that may quote ingested content. */
+export const APPROVAL_CLAIM_WITHHELD_ACTION = "approval.claim_withheld";
+/**
+ * The claim patterns, in the order they are tested.
+ *
+ * EACH NEEDS A NEGATION AND AN APPROVAL NOUN IN THE SAME SENTENCE, and that conjunction is what
+ * keeps the detector off ordinary prose. "Your approval came through" carries the noun and no
+ * negation. "No pages matched" carries the negation and no noun. Neither is a claim about the gate,
+ * and neither matches.
+ */
+const CLAIM_PATTERNS = [
+    // The measured sentence: "No confirmation or approval requirement was presented." The verb is
+    // about the CARD rather than about the requirement, which is why it needs its own shape.
+    {
+        shape: "none-presented",
+        re: /\bno\b[^.!?\n]{0,60}\b(?:approval|confirmation|consent|permission|approval\s+card|prompt)\b[^.!?\n]{0,60}\b(?:presented|shown|raised|appeared|requested|asked\s+for|prompted)\b/i,
+    },
+    // "No approval was required", "no confirmation is needed", "this needed no consent".
+    {
+        shape: "none-required",
+        re: /\bno\b[^.!?\n]{0,60}\b(?:approval|confirmation|consent|authoris(?:ation|ed)|authoriz(?:ation|ed)|permission|sign-?off)\b[^.!?\n]{0,60}\b(?:required|requirement|needed|necessary)\b/i,
+    },
+    // The mirror order, with the negation inside the predicate: "approval was not required",
+    // "confirmation wasn't needed", "it did not require approval".
+    //
+    // 🔴 THE NEGATION MUST REACH A GATE VERB, and review measured why. Without that tail the first
+    // alternative took "Consent was not obtained from the vendor, so I stopped", "Your approval
+    // request is not visible to anyone else" and "The permission is not the blocker here" — ordinary,
+    // honest sentences, two of them ABOUT a gate that did hold. Replacing one of those with a line
+    // saying a standing grant covers the act inverts the very meaning the seat got right, in the
+    // host's own voice, which is worse than the claim this module exists to remove.
+    {
+        shape: "none-required",
+        re: /\b(?:approval|confirmation|consent|permission)\b[^.!?\n]{0,40}\b(?:was|were|is|are)\s+(?:not|never)\s+(?:\w+\s+){0,2}(?:required|needed|necessary|requested|presented|shown|raised|prompted|asked\s+for)\b|\b(?:did|does|do)(?:\s+not|n't)\s+(?:need|require|ask\s+for|prompt\s+for|call\s+for)\b[^.!?\n]{0,40}\b(?:approval|confirmation|consent|permission)\b/i,
+    },
+    // "created it without approval", "went ahead without any confirmation", "no prompting was needed".
+    {
+        shape: "without-approval",
+        re: /\bwithout\s+(?:any\s+|further\s+|explicit\s+|prior\s+|additional\s+)*(?:approval|confirmation|consent|permission|an?\s+approval\s+card|a\s+prompt|prompting)\b/i,
+    },
+];
+/**
+ * A modal or a conditional standing IN FRONT of the matched span, which makes the sentence a PLAN or
+ * an OFFER rather than a report about what just happened.
+ *
+ * Tested on the text BEFORE the match, on exactly the reasoning `memory-claim-guard.ts` gives for
+ * its own copy: "that will not need approval" and "I created it without approval, and I'll tell the
+ * others" both contain `will`, and only the first is a plan. The 40-character window keeps the modal
+ * attached to the claim.
+ */
+const MODAL_BEFORE = /\b(?:will|'ll|shall|would|could|can|should|must|going\s+to|about\s+to|let\s+me|if|unless|when|once|whether)\b[^.!?\n]{0,40}$/i;
+/** The same modal test INSIDE the matched span — several patterns match from the NOUN, so a modal
+ *  after it sits where the before-test can never see it ("approval would not be required"). */
+const MODAL_IN_SPAN = /\b(?:will|'ll|shall|would|could|should|must|going\s+to|about\s+to)\b/i;
+/** A sentence that ENDS in a question mark is asking, not reporting.
+ *
+ *  🔴 IT IS LOAD-BEARING, NOT TIDYING. "Shall I go ahead without confirmation?" is a seat offering
+ *  the gate, and striking it would delete the offer and post a host line saying a grant covers the
+ *  act — turning an ask into an announcement. */
+const QUESTION = /\?[\s*_>)\]]*$/;
+/**
+ * Every no-approval claim in one reply — PURE, so the patterns are testable over fixture text with
+ * no eve context, no audit store and no reply.
+ */
+export function detectNoApprovalClaims(text) {
+    const claims = [];
+    const sentences = replySentences(text);
+    for (let i = 0; i < sentences.length; i++) {
+        const segment = sentences[i];
+        const s = segment.text;
+        if (QUESTION.test(s.trimEnd()))
+            continue; // an offer of the gate, never a report about it
+        for (const p of CLAIM_PATTERNS) {
+            const m = p.re.exec(s);
+            if (m === null)
+                continue;
+            if (MODAL_BEFORE.test(s.slice(0, m.index)) || MODAL_IN_SPAN.test(m[0]))
+                continue; // a plan, not a report
+            claims.push({ shape: p.shape, sentence: i, start: segment.start + m.index, end: segment.start + m.index + m[0].length });
+            break; // one claim per sentence — a second shape in one sentence names the same wrong reading
+        }
+    }
+    return claims;
+}
+/** How many grants one note names. Past the cap the note says how many more there are rather than
+ *  growing a reply without bound. */
+const MAX_NAMED_GRANTS = 2;
+/**
+ * The opening of both NO-CARD notes, and the one stable thing a reader outside this module may match
+ * on.
+ *
+ * 🔴 `packages/core/scripts/e2e/scenarios.ts` S-CONNECTOR-TIER IMPORTS IT, and must never copy it.
+ * That leg gates on the host naming a standing grant, so a leg holding its own spelling would keep
+ * passing against a note this module had reworded — a live gate that stopped looking at anything.
+ */
+export const NO_CARD_NOTE_OPENING = "(No card was raised on this turn.";
+/**
+ * The host-voiced line that replaces a struck claim, or `undefined` when the host can name no cause
+ * and the reply must therefore be left alone.
+ *
+ * ORDER IS BY DIRECTNESS. A gate that RAN contradicts the claim outright, so it is said first. A
+ * gated connector write that completed with no card is the next most specific: the plane demanded an
+ * approval for that op and one already stood. The standing grant is last, because it describes the
+ * ROOM rather than the act — the host sees the policy and not the request, so that line may not say
+ * this act used it.
+ */
+export function standingAuthorityNote(view) {
+    // 🔴 "A GATE RAN", NEVER "A CARD WAS POSTED", because that is all the signal proves.
+    // `approvals/card-signal.ts` is armed by the card post AND by `tools/open_pull_request.ts`'s
+    // session-approved path, which posts a note and no card. A line promising a card would send a
+    // reader looking in the room for one that is not there.
+    if (view.approvalGateRan)
+        return "(An approval gate ran on this turn, so this act was not ungated.)";
+    if (view.gatedWrites.length > 0) {
+        const connections = [...new Set(view.gatedWrites.map((w) => w.connection))].join(", ");
+        return (`${NO_CARD_NOTE_OPENING} A gated ${connections} write ran on it, ` +
+            `which means an approval already stood for this session — not that the write is ungated.)`);
+    }
+    if (view.grants.length > 0) {
+        const named = view.grants.slice(0, MAX_NAMED_GRANTS).map(describeStandingWriteGrant).join("; ");
+        const more = view.grants.length - MAX_NAMED_GRANTS;
+        return (`${NO_CARD_NOTE_OPENING} Writes in this room ride a standing grant: ${named}` +
+            `${more > 0 ? `, and ${more} more` : ""}. The host sees the policy, not the request, so it cannot say whether this act used it.)`);
+    }
+    return undefined;
+}
+/** Which cause a view resolves to, so the audit row can name it without parsing the note. Kept
+ *  beside {@link standingAuthorityNote} and in the same order, and the test drives both together. */
+function causeOf(view) {
+    if (view.approvalGateRan)
+        return "approval-gate-ran";
+    if (view.gatedWrites.length > 0)
+        return "gated-connector-write";
+    if (view.grants.length > 0)
+        return "standing-write-grant";
+    return undefined;
+}
+/**
+ * Join two kept pieces across a removal, closing the gap the removal left.
+ *
+ * 🔴 IT TOUCHES THE SEAM AND NOTHING ELSE, and review measured why that matters. An earlier version
+ * collapsed doubled spaces across the WHOLE body, which re-indented every fenced code block and
+ * un-aligned every Markdown table in a guarded reply — a guard that posts Python or YAML with its
+ * indentation rewritten has broken the answer to fix a sentence. So only HORIZONTAL whitespace
+ * immediately at the join is normalised; a newline at the join is kept, and every other byte of the
+ * model's prose is passed through untouched.
+ */
+function joinSeam(left, right) {
+    const l = left.replace(/[^\S\n]+$/u, "");
+    const r = right.replace(/^[^\S\n]+/u, "");
+    if (l === "")
+        return r;
+    if (r === "")
+        return l;
+    return /\n$/u.test(l) ? `${l}${r}` : `${l} ${r}`;
+}
+/** Where a removal ENDS: the end of the sentence the claim sits in, or the claim's own end when the
+ *  detector could not place it in one. See {@link applyApprovalClaimGuard} for why the removal runs
+ *  to the sentence end rather than stopping at the matched words. */
+function removalEnd(text, claim) {
+    for (const segment of replySentences(text)) {
+        if (claim.start >= segment.start && claim.start < segment.end)
+            return Math.max(segment.end, claim.end);
+    }
+    return claim.end;
+}
+/**
+ * Remove every no-approval claim from one reply and name what really stood — PURE, given the view.
+ *
+ * 🔴 THE REMOVAL RUNS FROM THE CLAIM'S FIRST WORD TO THE END OF ITS SENTENCE, and both halves of
+ * that are measured. It starts at the CLAIM rather than at the sentence, because ship #216's reply
+ * carried the page link the room had asked for in the same run-on segment —
+ * "…<https://app.notion.com/p/OE-tier-ctwrite-53128-…|Open in Notion> No confirmation or approval
+ * requirement was presented." — and a guard that answers a false security claim by deleting the
+ * answer has made the reply worse. It runs to the SENTENCE END rather than stopping at the matched
+ * words, because a note wedged mid-clause leaves the remainder of the clause hanging off it and
+ * reading as part of the host's line; review measured exactly that on three fixture sentences.
+ *
+ * THE COST, STATED: a clause that followed the claim in the same sentence goes with it. That is
+ * strictly less than `memory-claim-guard.ts` removes for the same class, and it is the price of
+ * never leaving a half-sentence attached to a host-voiced line.
+ *
+ * The note lands where the FIRST claim stood; a reply that made the same claim three ways loses all
+ * three sentences and gets ONE note, because three copies would read as a rendering fault.
+ *
+ * A view that names no cause returns the text byte-identical, claims and all: see the header for why
+ * that is the right direction here.
+ */
+export function applyApprovalClaimGuard(text, view) {
+    const note = standingAuthorityNote(view);
+    if (note === undefined)
+        return { body: text, withheld: [] };
+    const claims = detectNoApprovalClaims(text);
+    if (claims.length === 0)
+        return { body: text, withheld: [] };
+    let out = "";
+    let cursor = 0;
+    for (const [i, claim] of claims.entries()) {
+        // A later claim already inside a removed sentence contributes nothing more to remove.
+        if (claim.start < cursor)
+            continue;
+        out = joinSeam(out, text.slice(cursor, claim.start));
+        if (i === 0)
+            out = joinSeam(out, note);
+        cursor = removalEnd(text, claim);
+    }
+    out = joinSeam(out, text.slice(cursor));
+    return { body: out.replace(/[^\S\n]+$/u, ""), withheld: claims, cause: causeOf(view) };
+}
+/**
+ * Write the durable row for one withheld claim — best-effort, never throws, never fails the reply.
+ *
+ * 🔴 THE ROW NAMES THE CLAIM BY SHAPE AND POSITION, NEVER BY TEXT, and names the CAUSE the host put
+ * in its place. The struck sentence is model output that can quote ingested content, and this
+ * plane's rows carry ids and counts only. A reader who needs the sentence has the posted body, where
+ * the note says one was struck.
+ */
+export async function auditWithheldApprovalClaim(audit, platform, withheld, cause) {
+    if (!audit || withheld.length === 0 || cause === undefined)
+        return;
+    await appendAudit({
+        org: audit.org,
+        platform,
+        workspace: audit.workspace,
+        surface: audit.surface,
+        principalId: audit.principalId,
+        action: APPROVAL_CLAIM_WITHHELD_ACTION,
+        detail: {
+            claims: withheld.length,
+            cause,
+            shapes: [...new Set(withheld.map((c) => c.shape))],
+            sentences: withheld.map((c) => c.sentence),
+            ...(audit.wakeId ? { wakeId: audit.wakeId } : {}),
+            ...(audit.sessionId ? { sessionId: audit.sessionId } : {}),
+            ...(audit.turnId ? { turnId: audit.turnId } : {}),
+        },
+    }).catch(() => undefined);
+}
+/**
+ * The whole per-reply step, in one call every choke point makes: read what the host observed
+ * standing behind this turn, strike a claim that contradicts it, and hand back the body plus the
+ * claims to audit.
+ *
+ * ONE function because the reply doors DRIFTED before over exactly this kind of shared step — a door
+ * that struck a false security claim and a door that posted it would make the guard look like a
+ * rendering glitch. `scripts/approval-claim-guard-test.ts` scans the doors for this call.
+ */
+export function guardApprovalClaims(text, audit) {
+    return applyApprovalClaimGuard(text, {
+        approvalGateRan: peekCardPostedThisTurn(),
+        gatedWrites: gatedConnectorWritesThisTurn(audit?.turnId),
+        grants: standingWriteGrantsInForce(),
+    });
+}
+//# sourceMappingURL=approval-claim-guard.js.map

package/dist/agent/channels/approval-claim-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-claim-guard.js","sourceRoot":"","sources":["../../../agent/channels/approval-claim-guard.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,EAAE;AACF,iFAAiF;AACjF,oEAAoE;AACpE,EAAE;AACF,0FAA0F;AAC1F,6DAA6D;AAC7D,EAAE;AACF,oGAAoG;AACpG,4FAA4F;AAC5F,mGAAmG;AACnG,qGAAqG;AACrG,gGAAgG;AAChG,gGAAgG;AAChG,kGAAkG;AAClG,aAAa;AACb,EAAE;AACF,kGAAkG;AAClG,8FAA8F;AAC9F,kGAAkG;AAClG,0EAA0E;AAC1E,EAAE;AACF,kGAAkG;AAClG,kGAAkG;AAClG,oGAAoG;AACpG,qGAAqG;AACrG,kDAAkD;AAClD,EAAE;AACF,mGAAmG;AACnG,mGAAmG;AACnG,qGAAqG;AACrG,kGAAkG;AAClG,oGAAoG;AACpG,WAAW;AACX,EAAE;AACF,iFAAiF;AACjF,oGAAoG;AACpG,6FAA6F;AAC7F,sGAAsG;AACtG,4FAA4F;AAC5F,+EAA+E;AAC/E,EAAE;AACF,kGAAkG;AAClG,kGAAkG;AAClG,gGAAgG;AAChG,mGAAmG;AACnG,oGAAoG;AACpG,6BAA6B;AAC7B,EAAE;AACF,qGAAqG;AACrG,oGAAoG;AACpG,kGAAkG;AAClG,wCAAwC;AACxC,EAAE;AACF,qGAAqG;AACrG,mGAAmG;AACnG,kGAAkG;AAClG,mFAAmF;AACnF,EAAE;AACF,mGAAmG;AACnG,qGAAqG;AACrG,8FAA8F;AAC9F,kGAAkG;AAClG,eAAe;AAEf,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,GAG3B,MAAM,yBAAyB,CAAC;AAGjC;+EAC+E;AAC/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,yBAAyB,CAAC;AAsBxE;;;;;;;GAOG;AACH,MAAM,cAAc,GAA2E;IAC7F,8FAA8F;IAC9F,yFAAyF;IACzF;QACE,KAAK,EAAE,gBAAgB;QACvB,EAAE,EAAE,kLAAkL;KACvL;IACD,qFAAqF;IACrF;QACE,KAAK,EAAE,eAAe;QACtB,EAAE,EAAE,sLAAsL;KAC3L;IACD,yFAAyF;IACzF,+DAA+D;IAC/D,EAAE;IACF,+FAA+F;IAC/F,4FAA4F;IAC5F,kGAAkG;IAClG,+FAA+F;IAC/F,6FAA6F;IAC7F,gFAAgF;IAChF;QACE,KAAK,EAAE,eAAe;QACtB,EAAE,EAAE,kWAAkW;KACvW;IACD,mGAAmG;IACnG;QACE,KAAK,EAAE,kBAAkB;QACzB,EAAE,EAAE,iKAAiK;KACtK;CACF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,+HAA+H,CAAC;AAErJ;+FAC+F;AAC/F,MAAM,aAAa,GAAG,uEAAuE,CAAC;AAE9F;;;;iDAIiD;AACjD,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAElC;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;QACvB,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAAE,SAAS,CAAC,gDAAgD;QAC1F,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,KAAK,IAAI;gBAAE,SAAS;YACzB,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS,CAAC,uBAAuB;YACzG,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACzH,MAAM,CAAC,uFAAuF;QAChG,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAeD;qCACqC;AACrC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,mCAAmC,CAAC;AAExE;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAA2B;IAC/D,qFAAqF;IACrF,6FAA6F;IAC7F,8FAA8F;IAC9F,wDAAwD;IACxD,IAAI,IAAI,CAAC,eAAe;QAAE,OAAO,mEAAmE,CAAC;IACrG,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvF,OAAO,CACL,GAAG,oBAAoB,YAAY,WAAW,oBAAoB;YAClE,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChG,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,gBAAgB,CAAC;QACnD,OAAO,CACL,GAAG,oBAAoB,+CAA+C,KAAK,EAAE;YAC7E,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,0FAA0F,CAClI,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAaD;qGACqG;AACrG,SAAS,OAAO,CAAC,IAA2B;IAC1C,IAAI,IAAI,CAAC,eAAe;QAAE,OAAO,mBAAmB,CAAC;IACrD,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,uBAAuB,CAAC;IAChE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,sBAAsB,CAAC;IAC1D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAa;IAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,CAAC,CAAC;IACvB,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AACnD,CAAC;AAED;;qEAEqE;AACrE,SAAS,UAAU,CAAC,IAAY,EAAE,KAAoB;IACpD,KAAK,MAAM,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,IAA2B;IAC/E,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5D,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC7D,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1C,sFAAsF;QACtF,IAAI,KAAK,CAAC,KAAK,GAAG,MAAM;YAAE,SAAS;QACnC,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC;YAAE,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACxC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAE,EAAE,CAAC;AAC1F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAA6B,EAC7B,QAAgB,EAChB,QAAkC,EAClC,KAAqC;IAErC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IACnE,MAAM,WAAW,CAAC;QAChB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,QAAQ;QACR,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,8BAA8B;QACtC,MAAM,EAAE;YACN,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,KAAK;YACL,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAClD,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC1C,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD;KACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,KAA6B;IAC7E,OAAO,uBAAuB,CAAC,IAAI,EAAE;QACnC,eAAe,EAAE,sBAAsB,EAAE;QACzC,WAAW,EAAE,4BAA4B,CAAC,KAAK,EAAE,MAAM,CAAC;QACxD,MAAM,EAAE,0BAA0B,EAAE;KACrC,CAAC,CAAC;AACL,CAAC"}

package/dist/agent/channels/attachments.d.ts

@@ -0,0 +1,113 @@
+import type { BindableContext } from "../identity/binding.js";
+/** The bytes an attachment resolver produced, plus a non-secret ref for audit/logging and the
+ *  event-supplied media type (an id-based ref carries no filename extension to infer from). */
+export interface ResolvedAttachment {
+    /** The image bytes, fetched through the resolver's own governed seam. */
+    readonly bytes: Uint8Array;
+    /** A non-secret reference string for audit (e.g. `slack-file:<id>`) — never a token or url_private. */
+    readonly ref: string;
+    /** IANA media type from the source event, when the resolver knows it. */
+    readonly mimeType?: string;
+}
+/**
+ * A size-guarded attachment source. Unlike `resolve`, it exposes the attachment's METADATA without a fetch, so a caller can refuse an unwanted type BEFORE any download.
+ * The `maxBytes` guard is honoured at the transport's Content-Length pre-check, before the body is read.
+ */
+export interface GuardedAttachment {
+    /** A non-secret reference string for audit (e.g. `slack-file:<id>`) — never a token or url_private. */
+    readonly ref: string;
+    /** IANA media type from the source event, when the resolver knows it. */
+    readonly mimeType?: string;
+    /** Original filename from the source event, when known (the caller infers a type from its
+     *  extension when the mimetype is absent, and shows it in the reader header). */
+    readonly name?: string;
+    /**
+     * Perform the credentialed, host-pinned fetch and pull the bytes, enforcing `maxBytes`. It REJECTS at the transport's Content-Length pre-check, throwing {@link AttachmentOversizeError} WITHOUT reading the body.
+     * It re-checks the ACTUAL byte count after the read, because a chunked response can exceed an absent or short Content-Length. Any other transport failure throws a plain Error.
+     */
+    pull(opts: {
+        maxBytes: number;
+    }): Promise<Uint8Array>;
+}
+/** Thrown by {@link GuardedAttachment.pull} when an upload exceeds the caller's `maxBytes`. `phase`
+ *  distinguishes the pre-read Content-Length rejection ("declared" — nothing was downloaded) from the
+ *  post-read cap ("actual" — a chunked response overran an absent/short Content-Length). */
+export declare class AttachmentOversizeError extends Error {
+    readonly bytes: number;
+    readonly phase: "declared" | "actual";
+    readonly maxBytes: number;
+    constructor(bytes: number, phase: "declared" | "actual", maxBytes: number);
+}
+/**
+ * A channel adapter's attachment resolver; `platform` is the adapter's stable key.
+ * `resolve` returns the bytes for an id THIS platform recognises, `undefined` for an id it does not own so the plane can try the next resolver, and THROWS when it owns the id but the fetch itself failed.
+ */
+export interface AttachmentResolver {
+    readonly platform: string;
+    resolve(attachmentId: string, ctx: BindableContext): Promise<ResolvedAttachment | undefined>;
+    /**
+     * OPTIONAL size-guarded variant, for a platform that can carry arbitrarily large non-image uploads: the caller gets metadata up front, to refuse a type before any fetch, plus a size-bounded byte pull that preserves the pre-download guard.
+     * `undefined` for an id this platform does not own — the SAME routing contract as `resolve`. A resolver that omits it never claims a guarded resolve, and the caller falls through or fails closed.
+     */
+    resolveGuarded?(attachmentId: string, ctx: BindableContext): Promise<GuardedAttachment | undefined>;
+}
+/** Register a channel adapter's attachment resolver (adapter/channel boot). Idempotent per
+ *  platform key: a re-registration replaces the prior resolver for that platform. */
+export declare function registerAttachmentResolver(resolver: AttachmentResolver): void;
+/**
+ * Resolve a model-named attachment id to its bytes, trying each registered resolver in registration order; the first to return a value wins.
+ * `undefined` when NO resolver claims the id, so the caller fails closed. A resolver that owns the id but fails to fetch THROWS, and that propagates as a genuine error.
+ */
+export declare function resolveAttachment(attachmentId: string, ctx: BindableContext): Promise<ResolvedAttachment | undefined>;
+/**
+ * Resolve a model-named attachment id to a SIZE-GUARDED source, trying each registered resolver's `resolveGuarded` in registration order; the first to return a value wins.
+ * `undefined` when no resolver claims the id or its platform supports no guarded read, so the caller fails closed. A resolver that owns the id but fails to probe THROWS; the bounded fetch itself is deferred to {@link GuardedAttachment.pull}.
+ */
+export declare function resolveGuardedAttachment(attachmentId: string, ctx: BindableContext): Promise<GuardedAttachment | undefined>;
+export declare function _resetAttachmentPlaneForTest(): void;
+/** One attachment a wake envelope named, as the delegation brief re-renders it. Every value is the
+ *  attribute text lifted from a rendered envelope, so it is already escaped and re-emitting it
+ *  verbatim neither double-escapes nor re-opens the breakout the renderer closed. A value that could
+ *  NOT have come from the renderer is dropped by {@link parseWakeAttachments} rather than escaped
+ *  here — see that function's header for why the admission sits there. */
+export interface BriefAttachment {
+    readonly id: string;
+    readonly kind?: string;
+    readonly name?: string;
+    readonly mimeType?: string;
+}
+/**
+ * Lift the `<attachment/>` elements out of ONE rendered wake envelope.
+ *
+ * An element with no admissible `id` is DROPPED: the id is the only thing a worker can resolve, so an
+ * element without one would hand the worker the same filename that failed. The last
+ * {@link MAX_BRIEF_ATTACHMENTS} survive.
+ *
+ * ── WHAT STOPS AN AUTHOR FORGING AN ELEMENT, STATED HONESTLY BECAUSE THE OBVIOUS ANSWER IS INCOMPLETE
+ * The obvious answer is the renderer: channels/wake-envelope.ts runs `escapeXml` over every message
+ * body on both its fenced and its unfenced arm, so a person who types `<attachment id="…"/>` into a
+ * Slack message reaches a rendered envelope as `&lt;attachment id=…`. That holds — for a RENDERED
+ * ENVELOPE.
+ *
+ * 🔴 IT DOES NOT HOLD FOR EVERY DELIVERY. `channels/normalized-wake.ts` `renderWake` emits an
+ * `addressing === "direct"` trigger as the author's body VERBATIM and unescaped, and Discord
+ * classifies every DM and every mention as `direct`. So a caller that points this parser at a raw
+ * delivery is pointing it at author-authored bytes. `isWakeEnvelopeShaped` is the caller's gate, and
+ * on that path it is a heuristic rather than a proof — a body can spell `<message` too.
+ *
+ * SO THE CONTROL IS HERE, NOT UPSTREAM, and it is admission rather than trust: an `id` must match
+ * {@link ATTACHMENT_ID_RE}, and a `kind`/`name`/`mimetype` that is over-long or carries a character
+ * the renderer's own escaping would have removed is dropped. A forged element can therefore name at
+ * most a plausible file id — which the SEAT's model already holds in its own envelope and could type
+ * into the brief by hand — and can carry no prose, no framing and no markup into the block.
+ */
+export declare function parseWakeAttachments(envelope: string): BriefAttachment[];
+/**
+ * Append the delegation brief's attachment block to a worker `message`.
+ *
+ * A strict no-op when the wake named no attachment, which is nearly every delegation. The block goes
+ * AFTER the caller's own words so the task statement still leads — the worker reads its instruction
+ * first and the file table second.
+ */
+export declare function withDelegatedAttachments(message: string, attachments: readonly BriefAttachment[]): string;
+//# sourceMappingURL=attachments.d.ts.map

package/dist/agent/channels/attachments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachments.d.ts","sourceRoot":"","sources":["../../../agent/channels/attachments.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAG9D;+FAC+F;AAC/F,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,uGAAuG;IACvG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,uGAAuG;IACvG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;qFACiF;IACjF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,IAAI,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACvD;AAED;;4FAE4F;AAC5F,qBAAa,uBAAwB,SAAQ,KAAK;IAE9C,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,QAAQ;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAH3B,YACW,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,UAAU,GAAG,QAAQ,EAC5B,QAAQ,EAAE,MAAM,EAI1B;CACF;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;IAC7F;;;OAGG;IACH,cAAc,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAC;CACrG;AAID;qFACqF;AACrF,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAG7E;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAM3H;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAOjI;AAED,wBAAgB,4BAA4B,IAAI,IAAI,CAEnD;AAwBD;;;;0EAI0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAyCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,EAAE,CASxE;AAuBD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,eAAe,EAAE,GAAG,MAAM,CAGzG"}