@openrig/cli 0.4.8 → 0.5.1

package/node_modules/@openrig/daemon/dist/domain/package-resolver.js

@@ -0,0 +1,35 @@
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { parseManifest, validateManifest, normalizeManifest, } from "./package-manifest.js";
+export class PackageResolver {
+    fs;
+    constructor(fs) {
+        this.fs = fs;
+    }
+    resolve(sourceRef, cwd) {
+        // Resolve to absolute path
+        const absoluteRef = path.isAbsolute(sourceRef)
+            ? sourceRef
+            : path.resolve(cwd ?? process.cwd(), sourceRef);
+        const manifestPath = path.join(absoluteRef, "package.yaml");
+        if (!this.fs.exists(manifestPath)) {
+            throw new Error(`No package.yaml found at ${manifestPath}`);
+        }
+        const rawYaml = this.fs.readFile(manifestPath);
+        const raw = parseManifest(rawYaml);
+        const validation = validateManifest(raw);
+        if (!validation.valid) {
+            throw new Error(`Invalid manifest: ${validation.errors.join("; ")}`);
+        }
+        const manifest = normalizeManifest(raw);
+        const manifestHash = createHash("sha256").update(rawYaml).digest("hex");
+        return {
+            sourceKind: "local_path",
+            sourceRef: absoluteRef,
+            manifest,
+            manifestHash,
+            rawManifestYaml: rawYaml,
+        };
+    }
+}
+//# sourceMappingURL=package-resolver.js.map

package/node_modules/@openrig/daemon/dist/domain/package-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-resolver.js","sourceRoot":"","sources":["../../src/domain/package-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,uBAAuB,CAAC;AAgB/B,MAAM,OAAO,eAAe;IAClB,EAAE,CAAQ;IAElB,YAAY,EAAS;QACnB,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,CAAC;IAED,OAAO,CAAC,SAAiB,EAAE,GAAY;QACrC,2BAA2B;QAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAC5C,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;QAElD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAE5D,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,4BAA4B,YAAY,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAEzC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAExE,OAAO;YACL,UAAU,EAAE,YAAY;YACxB,SAAS,EAAE,WAAW;YACtB,QAAQ;YACR,YAAY;YACZ,eAAe,EAAE,OAAO;SACzB,CAAC;IACJ,CAAC;CACF"}

package/node_modules/@openrig/daemon/dist/domain/path-safety.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Validates that a path is safe: relative, no traversal, no absolute.
+ * @param path - the path to validate
+ * @param label - human-readable label for error messages
+ * @returns error string or null if valid
+ */
+export declare function validateSafePath(path: string, label: string): string | null;
+//# sourceMappingURL=path-safety.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/path-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-safety.d.ts","sourceRoot":"","sources":["../../src/domain/path-safety.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY3E"}

package/node_modules/@openrig/daemon/dist/domain/path-safety.js

@@ -0,0 +1,24 @@
+/**
+ * Validates that a path is safe: relative, no traversal, no absolute.
+ * @param path - the path to validate
+ * @param label - human-readable label for error messages
+ * @returns error string or null if valid
+ */
+export function validateSafePath(path, label) {
+    if (!path || typeof path !== "string")
+        return `${label}: path is required`;
+    // Windows drive letter absolute
+    if (/^[A-Za-z]:[/\\]/.test(path))
+        return `${label}: absolute paths are not allowed (got "${path}")`;
+    // Normalize backslashes for traversal check
+    const normalized = path.replace(/\\/g, "/");
+    // Absolute path
+    if (normalized.startsWith("/"))
+        return `${label}: absolute paths are not allowed (got "${path}")`;
+    // Traversal
+    const segments = normalized.split("/");
+    if (segments.some((s) => s === ".."))
+        return `${label}: path traversal (..) is not allowed (got "${path}")`;
+    return null;
+}
+//# sourceMappingURL=path-safety.js.map

package/node_modules/@openrig/daemon/dist/domain/path-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-safety.js","sourceRoot":"","sources":["../../src/domain/path-safety.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IAC1D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,GAAG,KAAK,oBAAoB,CAAC;IAC3E,gCAAgC;IAChC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,KAAK,0CAA0C,IAAI,IAAI,CAAC;IACpG,4CAA4C;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,gBAAgB;IAChB,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,KAAK,0CAA0C,IAAI,IAAI,CAAC;IAClG,YAAY;IACZ,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,GAAG,KAAK,8CAA8C,IAAI,IAAI,CAAC;IAC5G,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/periodic-snapshot-scheduler.d.ts

@@ -0,0 +1,25 @@
+import type Database from "better-sqlite3";
+import type { SnapshotCapture } from "./snapshot-capture.js";
+import type { SnapshotRepository } from "./snapshot-repository.js";
+import type { SessionRegistry } from "./session-registry.js";
+import type { ResumeMetadataRefresher } from "./resume-metadata-refresher.js";
+export interface PeriodicSnapshotSchedulerDeps {
+    db: Database.Database;
+    snapshotCapture: SnapshotCapture;
+    snapshotRepo: SnapshotRepository;
+    sessionRegistry?: SessionRegistry;
+    resumeMetadataRefresher?: ResumeMetadataRefresher;
+}
+export declare class PeriodicSnapshotScheduler {
+    private timer;
+    private deps;
+    private retentionKeep;
+    private running;
+    constructor(deps: PeriodicSnapshotSchedulerDeps);
+    start(intervalMs: number, retentionKeep?: number): void;
+    stop(): void;
+    get isActive(): boolean;
+    tick(): Promise<void>;
+    private getRunningNonArchivedRigs;
+}
+//# sourceMappingURL=periodic-snapshot-scheduler.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/periodic-snapshot-scheduler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"periodic-snapshot-scheduler.d.ts","sourceRoot":"","sources":["../../src/domain/periodic-snapshot-scheduler.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAE9E,MAAM,WAAW,6BAA6B;IAC5C,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACtB,eAAe,EAAE,eAAe,CAAC;IACjC,YAAY,EAAE,kBAAkB,CAAC;IAGjC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;CACnD;AAED,qBAAa,yBAAyB;IACpC,OAAO,CAAC,KAAK,CAA+C;IAC5D,OAAO,CAAC,IAAI,CAAgC;IAC5C,OAAO,CAAC,aAAa,CAAc;IACnC,OAAO,CAAC,OAAO,CAAS;gBAEZ,IAAI,EAAE,6BAA6B;IAI/C,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,GAAE,MAAW,GAAG,IAAI;IAU3D,IAAI,IAAI,IAAI;IAOZ,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA+B3B,OAAO,CAAC,yBAAyB;CAclC"}

package/node_modules/@openrig/daemon/dist/domain/periodic-snapshot-scheduler.js

@@ -0,0 +1,76 @@
+// OPR.0.3.4.9 — periodic snapshot scheduler (crash-insurance floor).
+// Mirrors seat-activity-service timer pattern: idempotent start/stop,
+// setInterval().unref(), per-rig error isolation.
+export class PeriodicSnapshotScheduler {
+    timer = null;
+    deps;
+    retentionKeep = 10;
+    running = false;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    start(intervalMs, retentionKeep = 10) {
+        if (this.timer)
+            return;
+        this.retentionKeep = Math.max(1, retentionKeep);
+        this.timer = setInterval(() => {
+            if (this.running)
+                return;
+            void this.tick();
+        }, intervalMs);
+        this.timer.unref();
+    }
+    stop() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = null;
+        }
+    }
+    get isActive() {
+        return this.timer !== null;
+    }
+    async tick() {
+        if (this.running)
+            return;
+        this.running = true;
+        try {
+            const runningRigs = this.getRunningNonArchivedRigs();
+            for (const rigId of runningRigs) {
+                try {
+                    // OPR.0.4.3.20 FR-4 — refresh live tokens before serialize, in its OWN
+                    // try/catch so a refresh throw NEVER skips the snapshot (guard caveat:
+                    // do not wrap refresh + capture in a single try/catch).
+                    if (this.deps.resumeMetadataRefresher && this.deps.sessionRegistry) {
+                        try {
+                            // fillNullOnly: a routine snapshot refresh fills null tokens but NEVER
+                            // clears a present one (rev1-r2 fix — keep stale-present for FR-6).
+                            await this.deps.resumeMetadataRefresher.refresh(this.deps.sessionRegistry.getLatestLiveSessions(rigId), { fillNullOnly: true });
+                        }
+                        catch { /* best-effort — the snapshot still writes below */ }
+                    }
+                    this.deps.snapshotCapture.captureSnapshot(rigId, "auto-periodic");
+                    this.deps.snapshotRepo.pruneSnapshotsByKind(rigId, "auto-periodic", this.retentionKeep);
+                }
+                catch {
+                    // Per-rig error isolation: one rig's failure never aborts the tick.
+                }
+            }
+        }
+        finally {
+            this.running = false;
+        }
+    }
+    getRunningNonArchivedRigs() {
+        // Latest-session-per-node semantics: a node is running only when its
+        // NEWEST session (by created_at DESC, id DESC) has status='running'.
+        // Mirrors ps-projection.ts:116-118. An older running + newer exited
+        // session means the node is NOT running.
+        const rows = this.deps.db.prepare(`SELECT DISTINCT r.id FROM rigs r
+       JOIN nodes n ON n.rig_id = r.id
+       WHERE r.archived_at IS NULL
+         AND (SELECT s.status FROM sessions s WHERE s.node_id = n.id
+              ORDER BY s.created_at DESC, s.id DESC LIMIT 1) = 'running'`).all();
+        return rows.map((r) => r.id);
+    }
+}
+//# sourceMappingURL=periodic-snapshot-scheduler.js.map

package/node_modules/@openrig/daemon/dist/domain/periodic-snapshot-scheduler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"periodic-snapshot-scheduler.js","sourceRoot":"","sources":["../../src/domain/periodic-snapshot-scheduler.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,sEAAsE;AACtE,kDAAkD;AAkBlD,MAAM,OAAO,yBAAyB;IAC5B,KAAK,GAA0C,IAAI,CAAC;IACpD,IAAI,CAAgC;IACpC,aAAa,GAAW,EAAE,CAAC;IAC3B,OAAO,GAAG,KAAK,CAAC;IAExB,YAAY,IAAmC;QAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,UAAkB,EAAE,gBAAwB,EAAE;QAClD,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;YACzB,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,CAAC,EAAE,UAAU,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACrD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;gBAChC,IAAI,CAAC;oBACH,uEAAuE;oBACvE,uEAAuE;oBACvE,wDAAwD;oBACxD,IAAI,IAAI,CAAC,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;wBACnE,IAAI,CAAC;4BACH,uEAAuE;4BACvE,oEAAoE;4BACpE,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAC7C,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,KAAK,CAAC,EACtD,EAAE,YAAY,EAAE,IAAI,EAAE,CACvB,CAAC;wBACJ,CAAC;wBAAC,MAAM,CAAC,CAAC,mDAAmD,CAAC,CAAC;oBACjE,CAAC;oBACD,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;oBAClE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC1F,CAAC;gBAAC,MAAM,CAAC;oBACP,oEAAoE;gBACtE,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAEO,yBAAyB;QAC/B,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,yCAAyC;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAC/B;;;;yEAImE,CACpE,CAAC,GAAG,EAA2B,CAAC;QACjC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/node_modules/@openrig/daemon/dist/domain/permission-drift-observer.d.ts

@@ -0,0 +1,35 @@
+import type Database from "better-sqlite3";
+import { type PermissionDriftDiagnostic, type PermissionDriftFs } from "./permission-drift.js";
+export interface PermissionDriftReader {
+    diagnose(nodeId: string): PermissionDriftDiagnostic | null;
+}
+/** Warmed outside request handling; cold reads are immediate UNKNOWN. */
+export declare class ClaudePermissionModeCache {
+    private readonly load;
+    private readonly ttlMs;
+    private readonly now;
+    private value;
+    private loading;
+    private loadedAt;
+    constructor(load?: () => Promise<string[] | null>, ttlMs?: number, now?: () => number);
+    warm(): void;
+    read(): string[] | null;
+}
+type AccessSync = (path: string, mode?: number) => void;
+/** Strict, read-only, generation-aware observer for an explicitly requested seat. */
+export declare class PermissionDriftObserver implements PermissionDriftReader {
+    private readonly input;
+    private readonly observations;
+    private readonly fs;
+    private readonly now?;
+    constructor(input: {
+        db: Database.Database;
+        fs?: PermissionDriftFs;
+        now?: () => Date;
+        permissionModes?: ClaudePermissionModeCache;
+        accessSync?: AccessSync;
+    });
+    diagnose(nodeId: string): PermissionDriftDiagnostic | null;
+}
+export {};
+//# sourceMappingURL=permission-drift-observer.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/permission-drift-observer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-drift-observer.d.ts","sourceRoot":"","sources":["../../src/domain/permission-drift-observer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAGL,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACvB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,yBAAyB,GAAG,IAAI,CAAC;CAC5D;AA2BD,yEAAyE;AACzE,qBAAa,yBAAyB;IAMlC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAPtB,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAK;gBAGF,IAAI,GAAE,MAAM,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAA6B,EAChE,KAAK,SAAS,EACd,GAAG,GAAE,MAAM,MAAiB;IAG/C,IAAI,IAAI,IAAI;IAYZ,IAAI,IAAI,MAAM,EAAE,GAAG,IAAI;CAIxB;AAED,KAAK,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;AAoBxD,qFAAqF;AACrF,qBAAa,uBAAwB,YAAW,qBAAqB;IAMjE,OAAO,CAAC,QAAQ,CAAC,KAAK;IALxB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAoB;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAa;gBAGf,KAAK,EAAE;QACtB,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;QACtB,EAAE,CAAC,EAAE,iBAAiB,CAAC;QACvB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;QACjB,eAAe,CAAC,EAAE,yBAAyB,CAAC;QAC5C,UAAU,CAAC,EAAE,UAAU,CAAC;KACzB;IASH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,yBAAyB,GAAG,IAAI;CAc3D"}

package/node_modules/@openrig/daemon/dist/domain/permission-drift-observer.js

@@ -0,0 +1,108 @@
+import fs from "node:fs";
+import nodePath from "node:path";
+import { execFile } from "node:child_process";
+import { AppliedLaunchObservationStore } from "./applied-launch-observation-store.js";
+import { diagnoseRuntimePosture, parseClaudePermissionModes, } from "./permission-drift.js";
+function commandAvailable(command) {
+    const pathValue = process.env.PATH;
+    if (!pathValue)
+        return false;
+    for (const entry of pathValue.split(nodePath.delimiter)) {
+        if (!entry)
+            continue;
+        try {
+            fs.accessSync(nodePath.join(entry, command), fs.constants.X_OK);
+            return true;
+        }
+        catch {
+            // Try the next PATH entry.
+        }
+    }
+    return false;
+}
+async function loadClaudePermissionModes() {
+    return await new Promise((resolve) => {
+        execFile("claude", ["--help"], {
+            encoding: "utf8",
+            timeout: 1_000,
+            maxBuffer: 1024 * 1024,
+        }, (error, stdout) => resolve(error ? null : parseClaudePermissionModes(stdout)));
+    });
+}
+/** Warmed outside request handling; cold reads are immediate UNKNOWN. */
+export class ClaudePermissionModeCache {
+    load;
+    ttlMs;
+    now;
+    value = null;
+    loading = false;
+    loadedAt = 0;
+    constructor(load = loadClaudePermissionModes, ttlMs = 60_000, now = Date.now) {
+        this.load = load;
+        this.ttlMs = ttlMs;
+        this.now = now;
+    }
+    warm() {
+        if (this.loading || (this.loadedAt > 0 && this.now() - this.loadedAt < this.ttlMs))
+            return;
+        this.loading = true;
+        void this.load()
+            .then((value) => { this.value = value; })
+            .catch(() => { this.value = null; })
+            .finally(() => {
+            this.loadedAt = this.now();
+            this.loading = false;
+        });
+    }
+    read() {
+        this.warm();
+        return this.value;
+    }
+}
+function productionFs(permissionModes, accessSync) {
+    return {
+        readFile: (path) => fs.readFileSync(path, "utf8"),
+        cwdReadable: (path) => {
+            try {
+                accessSync(path, fs.constants.R_OK);
+                return true;
+            }
+            catch (error) {
+                const code = error.code;
+                if (code === "EACCES" || code === "EPERM")
+                    return false;
+                throw error;
+            }
+        },
+        commandAvailable,
+        claudePermissionModes: () => permissionModes.read(),
+    };
+}
+/** Strict, read-only, generation-aware observer for an explicitly requested seat. */
+export class PermissionDriftObserver {
+    input;
+    observations;
+    fs;
+    now;
+    constructor(input) {
+        this.input = input;
+        this.observations = new AppliedLaunchObservationStore(input.db);
+        const permissionModes = input.permissionModes ?? new ClaudePermissionModeCache();
+        permissionModes.warm();
+        this.fs = input.fs ?? productionFs(permissionModes, input.accessSync ?? ((path, mode) => fs.accessSync(path, mode)));
+        this.now = input.now;
+    }
+    diagnose(nodeId) {
+        const node = this.input.db.prepare("SELECT runtime, cwd FROM nodes WHERE id = ?").get(nodeId);
+        if (!node)
+            return null;
+        return diagnoseRuntimePosture({
+            runtime: node.runtime ?? "unknown",
+            cwd: node.cwd,
+            applied: this.observations.readCurrent(nodeId),
+            fs: this.fs,
+            now: this.now,
+        });
+    }
+}
+//# sourceMappingURL=permission-drift-observer.js.map

package/node_modules/@openrig/daemon/dist/domain/permission-drift-observer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-drift-observer.js","sourceRoot":"","sources":["../../src/domain/permission-drift-observer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAG3B,MAAM,uBAAuB,CAAC;AAM/B,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IACnC,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,yBAAyB;IACtC,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;YAC7B,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,IAAI,GAAG,IAAI;SACvB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,MAAM,OAAO,yBAAyB;IAMjB;IACA;IACA;IAPX,KAAK,GAAoB,IAAI,CAAC;IAC9B,OAAO,GAAG,KAAK,CAAC;IAChB,QAAQ,GAAG,CAAC,CAAC;IAErB,YACmB,OAAuC,yBAAyB,EAChE,QAAQ,MAAM,EACd,MAAoB,IAAI,CAAC,GAAG;QAF5B,SAAI,GAAJ,IAAI,CAA4D;QAChE,UAAK,GAAL,KAAK,CAAS;QACd,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ,IAAI;QACF,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO;QAC3F,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,KAAK,IAAI,CAAC,IAAI,EAAE;aACb,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;aACxC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;aACnC,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC,CAAC,CAAC;IACP,CAAC;IAED,IAAI;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;CACF;AAID,SAAS,YAAY,CAAC,eAA0C,EAAE,UAAsB;IACtF,OAAO;QACL,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;QACjD,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YACpB,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACpC,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;gBACnD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO;oBAAE,OAAO,KAAK,CAAC;gBACxD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,gBAAgB;QAChB,qBAAqB,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE;KACpD,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,OAAO,uBAAuB;IAMf;IALF,YAAY,CAAgC;IAC5C,EAAE,CAAoB;IACtB,GAAG,CAAc;IAElC,YACmB,KAMhB;QANgB,UAAK,GAAL,KAAK,CAMrB;QAED,IAAI,CAAC,YAAY,GAAG,IAAI,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,IAAI,yBAAyB,EAAE,CAAC;QACjF,eAAe,CAAC,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,YAAY,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACrH,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACvB,CAAC;IAED,QAAQ,CAAC,MAAc;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC,GAAG,CAAC,MAAM,CAG/E,CAAC;QACd,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,sBAAsB,CAAC;YAC5B,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS;YAClC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC;YAC9C,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;IACL,CAAC;CACF"}

package/node_modules/@openrig/daemon/dist/domain/permission-drift.d.ts

@@ -0,0 +1,60 @@
+export type AppliedLaunchAxis = "permission" | "sandbox" | "resource_trust" | "not_applicable";
+export type AppliedLaunchState = "observed" | "unknown";
+export interface AppliedLaunchObservation {
+    runtime: string;
+    axis: AppliedLaunchAxis;
+    state: AppliedLaunchState;
+    value: string | null;
+    reason?: string;
+}
+export type TransportState = "healthy" | "connect" | "timeout" | "response";
+export type CwdReadState = "visible" | "denied" | "unknown";
+export type CommandPathState = "available" | "missing" | "unknown";
+export type EnforcementState = "aligned" | "drift" | "unknown";
+export interface EffectiveClaudePermission {
+    defaultMode: string;
+    allow: string[];
+    ask: string[];
+    deny: string[];
+}
+export interface RuntimeEnforcementDiagnostic {
+    axis: AppliedLaunchAxis;
+    state: EnforcementState;
+    expected: string | null;
+    effective: string | EffectiveClaudePermission | null;
+    sourcePath: string | null;
+    reason?: string;
+}
+export interface PermissionDriftDiagnostic {
+    transport: {
+        state: TransportState;
+    };
+    cwdRead: {
+        state: CwdReadState;
+    };
+    commandPath: {
+        state: CommandPathState;
+    };
+    enforcement: RuntimeEnforcementDiagnostic;
+    observedAt: string;
+}
+export interface PermissionDriftFs {
+    readFile(path: string): string;
+    cwdReadable(path: string): boolean | null;
+    commandAvailable(command: string): boolean | null;
+    /** Live harness-derived Claude permission-mode vocabulary. null = unresolved. */
+    claudePermissionModes(): string[] | null;
+}
+export declare function parseClaudePermissionModes(help: string): string[] | null;
+export declare function observeClaudePermission(flag: string): AppliedLaunchObservation;
+export declare function observeCodexSandbox(arg: string): AppliedLaunchObservation;
+export declare function observePiResourceTrust(trust: "approve" | "no-approve"): AppliedLaunchObservation;
+export declare function diagnoseRuntimePosture(input: {
+    runtime: string;
+    cwd: string | null;
+    applied: AppliedLaunchObservation | null;
+    fs: PermissionDriftFs;
+    now?: () => Date;
+}): PermissionDriftDiagnostic;
+export declare function renderPermissionDriftSummary(diagnostic: PermissionDriftDiagnostic): string;
+//# sourceMappingURL=permission-drift.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/permission-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-drift.d.ts","sourceRoot":"","sources":["../../src/domain/permission-drift.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,SAAS,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;AAC/F,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AAC5E,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAC5D,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AACnE,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;AAE/D,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,yBAAyB,GAAG,IAAI,CAAC;IACrD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE;QAAE,KAAK,EAAE,cAAc,CAAA;KAAE,CAAC;IACrC,OAAO,EAAE;QAAE,KAAK,EAAE,YAAY,CAAA;KAAE,CAAC;IACjC,WAAW,EAAE;QAAE,KAAK,EAAE,gBAAgB,CAAA;KAAE,CAAC;IACzC,WAAW,EAAE,4BAA4B,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAC1C,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAClD,iFAAiF;IACjF,qBAAqB,IAAI,MAAM,EAAE,GAAG,IAAI,CAAC;CAC1C;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAQxE;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,CAQ9E;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,wBAAwB,CAYzE;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,SAAS,GAAG,YAAY,GAAG,wBAAwB,CAEhG;AAoJD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAAC;IACzC,EAAE,EAAE,iBAAiB,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,GAAG,yBAAyB,CAW5B;AAED,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,yBAAyB,GAAG,MAAM,CAkB1F"}

package/node_modules/@openrig/daemon/dist/domain/permission-drift.js

@@ -0,0 +1,208 @@
+import nodePath from "node:path";
+export function parseClaudePermissionModes(help) {
+    const start = help.indexOf("--permission-mode <mode>");
+    if (start < 0)
+        return null;
+    const block = help.slice(start, start + 600);
+    const choices = block.match(/choices:\s*([^)]+)\)/)?.[1];
+    if (!choices)
+        return null;
+    const values = [...choices.matchAll(/"([^"]+)"/g)].map((match) => match[1]);
+    return values.length > 0 ? values : null;
+}
+export function observeClaudePermission(flag) {
+    if (flag.trim() === "--permission-mode acceptEdits") {
+        return { runtime: "claude-code", axis: "permission", state: "observed", value: "acceptEdits" };
+    }
+    if (flag.trim() === "--dangerously-skip-permissions") {
+        return { runtime: "claude-code", axis: "permission", state: "observed", value: "bypassPermissions" };
+    }
+    return { runtime: "claude-code", axis: "permission", state: "unknown", value: null, reason: "unrecognized_launch_argument" };
+}
+export function observeCodexSandbox(arg) {
+    const normalized = arg.trim().replace(/\s+/g, " ");
+    if (normalized === "-s workspace-write") {
+        return { runtime: "codex", axis: "sandbox", state: "observed", value: "workspace-write" };
+    }
+    if (normalized === "-s danger-full-access") {
+        return { runtime: "codex", axis: "sandbox", state: "observed", value: "danger-full-access" };
+    }
+    if (normalized.startsWith("-p ")) {
+        return { runtime: "codex", axis: "sandbox", state: "unknown", value: null, reason: "named_profile_unresolved" };
+    }
+    return { runtime: "codex", axis: "sandbox", state: "unknown", value: null, reason: "unrecognized_launch_argument" };
+}
+export function observePiResourceTrust(trust) {
+    return { runtime: "pi", axis: "resource_trust", state: "observed", value: trust };
+}
+function runtimeCommand(runtime) {
+    if (runtime === "claude-code")
+        return "claude";
+    if (runtime === "codex")
+        return "codex";
+    if (runtime === "pi")
+        return "pi";
+    return null;
+}
+function cwdReadState(fs, cwd) {
+    if (!cwd)
+        return "unknown";
+    try {
+        const value = fs.cwdReadable(cwd);
+        return value === true ? "visible" : value === false ? "denied" : "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+function commandPathState(fs, runtime) {
+    const command = runtimeCommand(runtime);
+    if (!command)
+        return "unknown";
+    try {
+        const value = fs.commandAvailable(command);
+        return value === true ? "available" : value === false ? "missing" : "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+function unknownEnforcement(axis, expected, sourcePath, reason) {
+    return { axis, state: "unknown", expected, effective: null, sourcePath, reason };
+}
+function parseStringArray(value) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string"))
+        return null;
+    return [...value];
+}
+function inspectClaude(cwd, applied, fs) {
+    const expected = applied?.state === "observed" ? applied.value : null;
+    if (!cwd) {
+        return unknownEnforcement("permission", expected, null, "cwd_unknown");
+    }
+    const sourcePath = nodePath.join(cwd, ".claude", "settings.local.json");
+    if (!applied || applied.runtime !== "claude-code" || applied.axis !== "permission" || applied.state !== "observed" || !expected) {
+        return unknownEnforcement("permission", expected, sourcePath, applied?.reason ?? "applied_launch_unknown");
+    }
+    if (expected === "bypassPermissions") {
+        return {
+            axis: "permission",
+            state: "aligned",
+            expected,
+            effective: expected,
+            sourcePath: null,
+            reason: "launch_bypasses_project_permissions",
+        };
+    }
+    let raw;
+    try {
+        raw = fs.readFile(sourcePath);
+    }
+    catch (error) {
+        const code = error.code;
+        return unknownEnforcement("permission", expected, sourcePath, code === "ENOENT" ? "settings_missing" : "settings_unreadable");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return unknownEnforcement("permission", expected, sourcePath, "settings_unparseable");
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        return unknownEnforcement("permission", expected, sourcePath, "settings_invalid_shape");
+    }
+    const permissions = parsed.permissions;
+    if (typeof permissions !== "object" || permissions === null || Array.isArray(permissions)) {
+        return unknownEnforcement("permission", expected, sourcePath, permissions === undefined ? "permissions_missing" : "permissions_invalid_shape");
+    }
+    const record = permissions;
+    const defaultMode = record.defaultMode;
+    if (typeof defaultMode !== "string") {
+        return unknownEnforcement("permission", expected, sourcePath, "default_mode_missing");
+    }
+    let supportedModes;
+    try {
+        const liveModes = fs.claudePermissionModes();
+        if (!liveModes || liveModes.length === 0) {
+            return unknownEnforcement("permission", expected, sourcePath, "harness_semantics_unknown");
+        }
+        supportedModes = new Set(liveModes);
+    }
+    catch {
+        return unknownEnforcement("permission", expected, sourcePath, "harness_semantics_unknown");
+    }
+    if (!supportedModes.has(defaultMode)) {
+        return unknownEnforcement("permission", expected, sourcePath, "unsupported_default_mode");
+    }
+    const allow = parseStringArray(record.allow);
+    const ask = parseStringArray(record.ask);
+    const deny = parseStringArray(record.deny);
+    if (!allow || !ask || !deny) {
+        return unknownEnforcement("permission", expected, sourcePath, "permission_rules_invalid_shape");
+    }
+    const denySet = new Set(deny);
+    if (allow.some((entry) => denySet.has(entry))) {
+        return unknownEnforcement("permission", expected, sourcePath, "conflicting_rules");
+    }
+    const effective = { defaultMode, allow, ask, deny };
+    return {
+        axis: "permission",
+        state: defaultMode === expected ? "aligned" : "drift",
+        expected,
+        effective,
+        sourcePath,
+    };
+}
+function inspectLaunchBoundRuntime(runtime, applied) {
+    const axis = runtime === "codex" ? "sandbox" : runtime === "pi" ? "resource_trust" : "not_applicable";
+    if (!applied || applied.runtime !== runtime || applied.axis !== axis || applied.state !== "observed" || !applied.value) {
+        return unknownEnforcement(axis, null, null, applied?.reason ?? "applied_launch_unknown");
+    }
+    return {
+        axis,
+        state: "aligned",
+        expected: applied.value,
+        effective: applied.value,
+        sourcePath: null,
+        reason: "generation_matched_launch_effect",
+    };
+}
+export function diagnoseRuntimePosture(input) {
+    const enforcement = input.runtime === "claude-code"
+        ? inspectClaude(input.cwd, input.applied, input.fs)
+        : inspectLaunchBoundRuntime(input.runtime, input.applied);
+    return {
+        transport: { state: "healthy" },
+        cwdRead: { state: cwdReadState(input.fs, input.cwd) },
+        commandPath: { state: commandPathState(input.fs, input.runtime) },
+        enforcement,
+        observedAt: (input.now?.() ?? new Date()).toISOString(),
+    };
+}
+export function renderPermissionDriftSummary(diagnostic) {
+    const axisLabel = diagnostic.enforcement.axis === "resource_trust"
+        ? "resource trust"
+        : diagnostic.enforcement.axis;
+    const effective = typeof diagnostic.enforcement.effective === "object" && diagnostic.enforcement.effective !== null
+        ? diagnostic.enforcement.effective.defaultMode
+        : diagnostic.enforcement.effective;
+    const pieces = [
+        `transport: ${diagnostic.transport.state}`,
+        `cwd/read: ${diagnostic.cwdRead.state}`,
+        `command/PATH: ${diagnostic.commandPath.state}`,
+        `${axisLabel}: ${diagnostic.enforcement.state.toUpperCase()}`,
+    ];
+    if (diagnostic.enforcement.expected)
+        pieces.push(`expected=${diagnostic.enforcement.expected}`);
+    if (effective)
+        pieces.push(`effective=${effective}`);
+    if (diagnostic.enforcement.sourcePath)
+        pieces.push(`source=${diagnostic.enforcement.sourcePath}`);
+    if (diagnostic.enforcement.reason)
+        pieces.push(`reason=${diagnostic.enforcement.reason}`);
+    return pieces.join(" · ");
+}
+//# sourceMappingURL=permission-drift.js.map

package/node_modules/@openrig/daemon/dist/domain/permission-drift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-drift.js","sourceRoot":"","sources":["../../src/domain/permission-drift.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,WAAW,CAAC;AAkDjC,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACvD,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,GAAG,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,+BAA+B,EAAE,CAAC;QACpD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,gCAAgC,EAAE,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACvG,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;AAC/H,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnD,IAAI,UAAU,KAAK,oBAAoB,EAAE,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,UAAU,KAAK,uBAAuB,EAAE,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAClH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;AACtH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAA+B;IACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACpF,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,IAAI,OAAO,KAAK,aAAa;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,EAAqB,EAAE,GAAkB;IAC7D,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAqB,EAAE,OAAe;IAC9D,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3C,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAuB,EACvB,QAAuB,EACvB,UAAyB,EACzB,MAAc;IAEd,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3F,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,aAAa,CACpB,GAAkB,EAClB,OAAwC,EACxC,EAAqB;IAErB,MAAM,QAAQ,GAAG,OAAO,EAAE,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;IACxE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,aAAa,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChI,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,IAAI,wBAAwB,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,QAAQ,KAAK,mBAAmB,EAAE,CAAC;QACrC,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,SAAS;YAChB,QAAQ;YACR,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,qCAAqC;SAC9C,CAAC;IACJ,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;IAChI,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,wBAAwB,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,WAAW,GAAI,MAAkC,CAAC,WAAW,CAAC;IACpE,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1F,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC;IACjJ,CAAC;IACD,MAAM,MAAM,GAAG,WAAsC,CAAC;IACtD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACvC,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,cAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,EAAE,CAAC,qBAAqB,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,2BAA2B,CAAC,CAAC;QAC7F,CAAC;QACD,cAAc,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,2BAA2B,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,0BAA0B,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,gCAAgC,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9C,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,mBAAmB,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,SAAS,GAA8B,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC/E,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;QACrD,QAAQ;QACR,SAAS;QACT,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,OAAe,EACf,OAAwC;IAExC,MAAM,IAAI,GAAsB,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACzH,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACvH,OAAO,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,IAAI,wBAAwB,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,OAAO,CAAC,KAAK;QACvB,SAAS,EAAE,OAAO,CAAC,KAAK;QACxB,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,kCAAkC;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAMtC;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,KAAK,aAAa;QACjD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QACnD,CAAC,CAAC,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO;QACL,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;QAC/B,OAAO,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;QACrD,WAAW,EAAE,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;QACjE,WAAW;QACX,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;KACxD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,UAAqC;IAChF,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,KAAK,gBAAgB;QAChE,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC;IAChC,MAAM,SAAS,GAAG,OAAO,UAAU,CAAC,WAAW,CAAC,SAAS,KAAK,QAAQ,IAAI,UAAU,CAAC,WAAW,CAAC,SAAS,KAAK,IAAI;QACjH,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,WAAW;QAC9C,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC;IACrC,MAAM,MAAM,GAAG;QACb,cAAc,UAAU,CAAC,SAAS,CAAC,KAAK,EAAE;QAC1C,aAAa,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE;QACvC,iBAAiB,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE;QAC/C,GAAG,SAAS,KAAK,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE;KAC9D,CAAC;IACF,IAAI,UAAU,CAAC,WAAW,CAAC,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChG,IAAI,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,aAAa,SAAS,EAAE,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,WAAW,CAAC,UAAU;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC;IAClG,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}