@openlife/cli 1.7.3

package/dist/orchestrator/providers/CompositeSkillProvider.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CompositeSkillProvider = void 0;
+class CompositeSkillProvider {
+    primary;
+    fallback;
+    constructor(primary, fallback) {
+        this.primary = primary;
+        this.fallback = fallback;
+    }
+    load() {
+        const data = this.primary.load();
+        return data.length ? data : this.fallback.load();
+    }
+}
+exports.CompositeSkillProvider = CompositeSkillProvider;

package/dist/orchestrator/providers/CompositeSquadProvider.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CompositeSquadProvider = void 0;
+class CompositeSquadProvider {
+    primary;
+    fallback;
+    constructor(primary, fallback) {
+        this.primary = primary;
+        this.fallback = fallback;
+    }
+    load() {
+        const data = this.primary.load();
+        return data.length ? data : this.fallback.load();
+    }
+}
+exports.CompositeSquadProvider = CompositeSquadProvider;

package/dist/orchestrator/providers/CompositeWorkflowProvider.js

@@ -0,0 +1,46 @@
+"use strict";
+/**
+ * CompositeWorkflowProvider — primary/fallback composite for workflows.
+ *
+ * Story 1.3 — OpenLife v1.3 Agent OS Integration.
+ *
+ * Aligns the workflow provider stack with the established Composite{X}
+ * pattern (Agent, Skill, Squad, Capability). Pure refactor: existing
+ * FileWorkflowProvider already searches two roots internally, so the
+ * composite layer is for *external* sources like cloud catalogs in v1.4.
+ *
+ * For v1.3 we just wrap the existing FileWorkflowProvider so callers can
+ * upgrade to the composite shape without changing the loader.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CompositeWorkflowProvider = void 0;
+exports.defaultWorkflowProvider = defaultWorkflowProvider;
+const FileWorkflowProvider_1 = require("./FileWorkflowProvider");
+class CompositeWorkflowProvider {
+    primary;
+    fallback;
+    constructor(primary, fallback) {
+        this.primary = primary;
+        this.fallback = fallback;
+    }
+    list() {
+        const data = this.primary.list();
+        if (data.length)
+            return data;
+        return this.fallback ? this.fallback.list() : [];
+    }
+    load(id) {
+        const primaryHit = this.primary.load(id);
+        if (primaryHit)
+            return primaryHit;
+        return this.fallback ? this.fallback.load(id) : null;
+    }
+}
+exports.CompositeWorkflowProvider = CompositeWorkflowProvider;
+/**
+ * Factory: the default v1.3 composite — FileWorkflowProvider only.
+ * v1.4 will add a CloudWorkflowProvider as fallback.
+ */
+function defaultWorkflowProvider() {
+    return new CompositeWorkflowProvider(new FileWorkflowProvider_1.FileWorkflowProvider());
+}

package/dist/orchestrator/providers/FileAgentProvider.js

@@ -0,0 +1,105 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileAgentProvider = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+class FileAgentProvider {
+    roots;
+    constructor(roots = []) {
+        this.roots = roots;
+    }
+    load() {
+        const agents = [];
+        for (const root of this.roots) {
+            if (!fs.existsSync(root))
+                continue;
+            const files = this.walk(root).filter(f => f.endsWith('.md'));
+            for (const file of files) {
+                const fullPath = path.isAbsolute(file) ? file : path.join(root, file);
+                const content = fs.readFileSync(fullPath, 'utf-8');
+                agents.push(this.parseAgent(path.basename(fullPath), fullPath, content));
+            }
+        }
+        return agents;
+    }
+    walk(dir) {
+        const out = [];
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+            const full = path.join(dir, entry.name);
+            if (entry.isDirectory())
+                out.push(...this.walk(full));
+            else
+                out.push(full);
+        }
+        return out;
+    }
+    parseAgent(fileName, fullPath, content) {
+        const id = path.basename(path.dirname(fullPath)) === '.' || fileName !== 'AGENT.md'
+            ? fileName.replace(/\.md$/, '')
+            : path.basename(path.dirname(fullPath));
+        const nameMatch = content.match(/name:\s*(.+)/i);
+        const roleMatch = content.match(/role:\s*"([^"]+)"/i) || content.match(/role:\s*(.+)/i);
+        const squadMatch = content.match(/squad:\s*([^\n]+)/i);
+        const tags = [];
+        const tagRegex = /tags:\s*\[([^\]]+)\]/gi;
+        let m;
+        while ((m = tagRegex.exec(content)) !== null) {
+            m[1].split(',').map(s => s.trim().replace(/^'+|'+$/g, '')).filter(Boolean).forEach(s => { if (!tags.includes(s))
+                tags.push(s); });
+        }
+        const capabilities = [];
+        const addCap = (s) => { if (s && !capabilities.includes(s))
+            capabilities.push(s); };
+        const whenToUseMatch = content.match(/whenToUse:\s*"([^"]+)"/i);
+        if (whenToUseMatch)
+            whenToUseMatch[1].split(',').map(s => s.trim()).filter(Boolean).forEach(addCap);
+        const focusMatch = content.match(/focus:\s*"([^"]+)"/i);
+        if (focusMatch)
+            focusMatch[1].split(',').map(s => s.trim()).filter(Boolean).forEach(addCap);
+        tags.forEach(addCap);
+        let priority = 1;
+        if (id.startsWith('ai-builder-'))
+            priority += 5;
+        if (id.includes('orchestrator'))
+            priority += 3;
+        if (id.includes('review'))
+            priority += 2;
+        if (id.includes('builder'))
+            priority += 2;
+        return { id, name: nameMatch?.[1]?.trim() || id, role: roleMatch?.[1]?.trim() || 'specialist', capabilities, sourcePath: fullPath, priority, squad: squadMatch?.[1]?.trim(), tags };
+    }
+}
+exports.FileAgentProvider = FileAgentProvider;

package/dist/orchestrator/providers/FileCapabilityProvider.js

@@ -0,0 +1,106 @@
+"use strict";
+/**
+ * FileCapabilityProvider — load Capability Packs from the filesystem.
+ *
+ * Two roots searched in priority order (same pattern as FileWorkflowProvider):
+ *   1. <cwd>/.catalog/capabilities/        (project-local override)
+ *   2. <packageRoot>/dist-templates/capabilities/  (npm-shipped defaults)
+ *
+ * Local catalog wins on id collision. Honors `.catalog/`-as-runtime-SoT.
+ *
+ * Story 1.2 — OpenLife v1.3 Agent OS Integration.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileCapabilityProvider = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const CapabilityPackParser_1 = require("../capability/CapabilityPackParser");
+class FileCapabilityProvider {
+    roots;
+    constructor(opts = {}) {
+        const cwd = opts.cwd || process.cwd();
+        const packageRoot = opts.packageRoot || path.resolve(__dirname, '..', '..', '..');
+        const catalogRoot = opts.catalogRoot || path.join(cwd, '.catalog', 'capabilities');
+        const templateRoot = opts.templateRoot || path.join(packageRoot, 'dist-templates', 'capabilities');
+        this.roots = [
+            { dir: catalogRoot, source: 'catalog' },
+            { dir: templateRoot, source: 'dist-templates' },
+        ];
+    }
+    list() {
+        const seen = new Set();
+        const out = [];
+        for (const { dir, source } of this.roots) {
+            if (!fs.existsSync(dir) || !fs.statSync(dir).isDirectory())
+                continue;
+            for (const entry of fs.readdirSync(dir)) {
+                if (entry.startsWith('.'))
+                    continue;
+                const packDir = path.join(dir, entry);
+                const stat = fs.statSync(packDir);
+                if (!stat.isDirectory())
+                    continue;
+                const manifest = path.join(packDir, 'capability.yaml');
+                if (!fs.existsSync(manifest))
+                    continue;
+                const parsed = (0, CapabilityPackParser_1.parseCapabilityPackFile)(manifest);
+                // Tolerate parse failures at list-time: skip with a console hint
+                // (the registry layer will re-validate when actually loading).
+                if (!parsed.ok || !parsed.pack)
+                    continue;
+                const pack = parsed.pack;
+                if (seen.has(pack.id))
+                    continue; // catalog wins
+                seen.add(pack.id);
+                out.push({
+                    id: pack.id,
+                    name: pack.name,
+                    description: pack.description,
+                    version: pack.version,
+                    status: pack.status,
+                    filePath: manifest,
+                    packDir,
+                    source,
+                });
+            }
+        }
+        return out;
+    }
+    load(id) {
+        return this.list().find((e) => e.id === id) || null;
+    }
+}
+exports.FileCapabilityProvider = FileCapabilityProvider;

package/dist/orchestrator/providers/FileSkillProvider.js

@@ -0,0 +1,65 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileSkillProvider = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+class FileSkillProvider {
+    roots;
+    constructor(roots = []) {
+        this.roots = roots;
+    }
+    load() {
+        const skills = [];
+        for (const root of this.roots) {
+            if (!fs.existsSync(root))
+                continue;
+            const entries = fs.readdirSync(root, { withFileTypes: true }).filter(e => e.isDirectory());
+            for (const entry of entries) {
+                const skillFile = path.join(root, entry.name, 'SKILL.md');
+                if (!fs.existsSync(skillFile))
+                    continue;
+                const content = fs.readFileSync(skillFile, 'utf-8');
+                const caps = new Set();
+                const m = content.match(/<description>([\s\S]*?)<\/description>/i);
+                if (m)
+                    m[1].split(/[,.\n]/).map(s => s.trim()).filter(Boolean).forEach(s => caps.add(s));
+                skills.push({ id: entry.name, name: entry.name, sourcePath: skillFile, capabilities: Array.from(caps) });
+            }
+        }
+        return skills;
+    }
+}
+exports.FileSkillProvider = FileSkillProvider;

package/dist/orchestrator/providers/FileSquadProvider.js

@@ -0,0 +1,69 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileSquadProvider = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+class FileSquadProvider {
+    root;
+    constructor(root) {
+        this.root = root;
+    }
+    load() {
+        if (!this.root || !fs.existsSync(this.root))
+            return [];
+        const files = this.walk(this.root).filter(f => f.endsWith('.md'));
+        return files.map(file => this.parse(file, fs.readFileSync(file, 'utf-8')));
+    }
+    walk(dir) {
+        const out = [];
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+            const full = path.join(dir, entry.name);
+            if (entry.isDirectory())
+                out.push(...this.walk(full));
+            else
+                out.push(full);
+        }
+        return out;
+    }
+    parse(filePath, content) {
+        const id = path.basename(filePath) === 'SQUAD.md' ? path.basename(path.dirname(filePath)) : path.basename(filePath, '.md');
+        const title = content.split('\n').find(l => l.trim().startsWith('# '))?.replace(/^#\s*/, '') || id;
+        const capabilities = content.split(/[\n,.]/).map(s => s.trim()).filter(Boolean).slice(0, 20);
+        const domain = filePath.split('/squads/')[1]?.split('/')[0] || filePath.split('/Squads/')[1]?.split('/')[0] || 'general';
+        return { id, name: title, sourcePath: filePath, domain, capabilities };
+    }
+}
+exports.FileSquadProvider = FileSquadProvider;

package/dist/orchestrator/providers/FileWorkflowProvider.js

@@ -0,0 +1,103 @@
+"use strict";
+/**
+ * FileWorkflowProvider — load workflow YAMLs from the filesystem.
+ *
+ * Two roots are searched in priority order:
+ *   1. <process.cwd()>/.catalog/workflows/        (project-local override)
+ *   2. <packageRoot>/dist-templates/workflows/    (npm-shipped defaults)
+ *
+ * IDs collide → local catalog wins. The full list is the union of both
+ * roots, de-duplicated by id (id read from `workflow.id` after parse).
+ *
+ * Story 4.4 — OpenLife v1.2 Royal Stack.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileWorkflowProvider = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const WorkflowParser_1 = require("../workflow/WorkflowParser");
+class FileWorkflowProvider {
+    roots;
+    constructor(opts = {}) {
+        const cwd = opts.cwd || process.cwd();
+        const packageRoot = opts.packageRoot || path.resolve(__dirname, '..', '..', '..');
+        this.roots = [
+            { dir: path.join(cwd, '.catalog', 'workflows'), source: 'catalog' },
+            { dir: path.join(packageRoot, 'dist-templates', 'workflows'), source: 'dist-templates' },
+        ];
+    }
+    list() {
+        const seen = new Set();
+        const out = [];
+        for (const { dir, source } of this.roots) {
+            if (!fs.existsSync(dir) || !fs.statSync(dir).isDirectory())
+                continue;
+            for (const f of fs.readdirSync(dir)) {
+                if (!f.endsWith('.yaml') && !f.endsWith('.yml'))
+                    continue;
+                const filePath = path.join(dir, f);
+                const parsed = (0, WorkflowParser_1.parseWorkflowFile)(filePath);
+                if (!parsed.ok || !parsed.workflow)
+                    continue;
+                const wf = parsed.workflow;
+                if (seen.has(wf.id))
+                    continue; // local catalog wins
+                seen.add(wf.id);
+                out.push({
+                    id: wf.id,
+                    name: wf.name,
+                    type: wf.type,
+                    version: wf.version,
+                    filePath,
+                    source,
+                });
+            }
+        }
+        return out;
+    }
+    load(id) {
+        for (const entry of this.list()) {
+            if (entry.id !== id)
+                continue;
+            const parsed = (0, WorkflowParser_1.parseWorkflowFile)(entry.filePath);
+            if (!parsed.ok || !parsed.workflow)
+                return null;
+            return { entry, workflow: parsed.workflow };
+        }
+        return null;
+    }
+}
+exports.FileWorkflowProvider = FileWorkflowProvider;

package/dist/orchestrator/providers/SkillProvider.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/orchestrator/providers/SquadProvider.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/orchestrator/toolset/ToolsetGuard.js

@@ -0,0 +1,69 @@
+"use strict";
+/**
+ * ToolsetGuard — thin enforcement point for executor sandboxes.
+ *
+ * Story 10.1 + 10.2 — OpenLife v1.4.
+ *
+ * Wraps `ToolsetRegistry.isAllowed()` with an env-flag gate so v1.4 can
+ * land enforcement at all 5 critical execution sites without breaking
+ * existing flows. Default: OFF.
+ *
+ * Locked decision 1 of v1.4 plan: `OPENLIFE_TOOLSET_ENFORCEMENT=on` is
+ * opt-in for v1.4; flips to default-on in v1.5 after soak.
+ *
+ * Stable error code: `toolset_blocked:<category>`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ToolsetBlockedError = void 0;
+exports.isToolsetAllowed = isToolsetAllowed;
+exports.assertToolsetAllowed = assertToolsetAllowed;
+exports._resetToolsetGuardCache = _resetToolsetGuardCache;
+const ToolsetRegistry_1 = require("./ToolsetRegistry");
+let _registryCache = null;
+class ToolsetBlockedError extends Error {
+    code;
+    toolset;
+    constructor(toolset, reason) {
+        super(`toolset_blocked:${toolset} (${reason})`);
+        this.name = 'ToolsetBlockedError';
+        this.code = `toolset_blocked:${toolset}`;
+        this.toolset = toolset;
+    }
+}
+exports.ToolsetBlockedError = ToolsetBlockedError;
+/**
+ * Check whether a toolset category is allowed for the current process.
+ *
+ * - When `OPENLIFE_TOOLSET_ENFORCEMENT` is anything other than 'on',
+ *   returns true unconditionally (enforcement disabled).
+ * - When enabled, consults the active Profile via ToolsetRegistry.
+ *
+ * Never throws — callers wanting to throw use `assertAllowed`.
+ */
+function isToolsetAllowed(toolset) {
+    if ((process.env.OPENLIFE_TOOLSET_ENFORCEMENT || '').toLowerCase() !== 'on') {
+        return true;
+    }
+    if (!_registryCache)
+        _registryCache = new ToolsetRegistry_1.ToolsetRegistry();
+    return _registryCache.isAllowed(toolset).allowed;
+}
+/**
+ * Throw `ToolsetBlockedError` if the toolset is not allowed. Use at
+ * hook points before spawning processes, writing files, or making
+ * network calls.
+ */
+function assertToolsetAllowed(toolset, hint) {
+    if ((process.env.OPENLIFE_TOOLSET_ENFORCEMENT || '').toLowerCase() !== 'on')
+        return;
+    if (!_registryCache)
+        _registryCache = new ToolsetRegistry_1.ToolsetRegistry();
+    const decision = _registryCache.isAllowed(toolset);
+    if (!decision.allowed) {
+        throw new ToolsetBlockedError(toolset, hint || decision.reason);
+    }
+}
+/** Test seam — reset the cache so a test can swap profiles. */
+function _resetToolsetGuardCache() {
+    _registryCache = null;
+}

package/dist/orchestrator/toolset/ToolsetRegistry.js

@@ -0,0 +1,65 @@
+"use strict";
+/**
+ * ToolsetRegistry — per-profile toolset allow/deny enforcement.
+ *
+ * Story 5.3 — OpenLife v1.3 Agent OS Integration.
+ *
+ * Reads the active Profile (via ProfileManager) and decides whether a
+ * given toolset is in scope. Callers ask via `isAllowed(toolset)` before
+ * dispatching tool use.
+ *
+ * Profile.toolsetAllowed:
+ *   - ['*']  → all 15 categories allowed (backwards-compatible default)
+ *   - ['file', 'web', 'memory']  → only these three allowed
+ *   - []    → nothing allowed (locked-down profile)
+ *
+ * v1.3 also persists the registry's last decision per session for audit;
+ * v1.4 will wire this to the executor sandbox.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ToolsetRegistry = void 0;
+const ProfileManager_1 = require("../../cli/ProfileManager");
+const ToolsetSchema_1 = require("./ToolsetSchema");
+class ToolsetRegistry {
+    profileManager;
+    constructor(opts = {}) {
+        this.profileManager = opts.profileManager || new ProfileManager_1.ProfileManager();
+    }
+    /** Return the set of toolsets allowed by the active profile, or all when no profile set. */
+    allowedForActiveProfile() {
+        const { profile } = this.profileManager.active();
+        return this.computeAllowed(profile);
+    }
+    allowedForProfile(profileId) {
+        const profile = this.profileManager.show(profileId);
+        return this.computeAllowed(profile);
+    }
+    computeAllowed(profile) {
+        if (!profile)
+            return new Set(ToolsetSchema_1.ALL_TOOLSETS);
+        if (!profile.toolsetAllowed || profile.toolsetAllowed.length === 0)
+            return new Set();
+        if (profile.toolsetAllowed.includes('*'))
+            return new Set(ToolsetSchema_1.ALL_TOOLSETS);
+        const out = new Set();
+        for (const item of profile.toolsetAllowed) {
+            if (ToolsetSchema_1.ALL_TOOLSETS.includes(item)) {
+                out.add(item);
+            }
+        }
+        return out;
+    }
+    isAllowed(toolset, profileId) {
+        const allowed = profileId
+            ? this.allowedForProfile(profileId)
+            : this.allowedForActiveProfile();
+        if (allowed.has(toolset)) {
+            return { allowed: true, reason: 'in_profile_allowlist', toolset };
+        }
+        return { allowed: false, reason: 'not_in_profile_allowlist', toolset };
+    }
+    list() {
+        return ToolsetSchema_1.ALL_TOOLSETS;
+    }
+}
+exports.ToolsetRegistry = ToolsetRegistry;