@openrig/cli 0.4.8 → 0.5.1

package/daemon/dist/domain/outbox-handler.js

@@ -1,4 +1,42 @@
-export const OUTBOX_DELIVERY_STATES = ["pending", "delivered", "failed"];
+/**
+ * The EXECUTABLE wake-intent namespace. A durable wake intent is written by the
+ * daemon (QueueRepository.stageWakeIntent) with an id under this prefix, and the
+ * startup drain EXECUTES every pending row under it as a real wake.
+ *
+ * NOT a route reservation: the public `/outbox/record` audit route no longer
+ * refuses caller-supplied ids under this prefix (the W4-era MF5 guard was unbuilt —
+ * founder ruling, over-engineering audit: its justification required an adversary
+ * inside this trust domain, where the only caller is the daemon's own localhost
+ * client). A caller CAN now record an id under this prefix and the drain will
+ * select it. Single source of truth for the drain query only.
+ */
+export const WAKE_INTENT_PREFIX = "wake-intent-";
+// W1 (transactional closure): `indeterminate` is the ambiguous-delivery outcome —
+// a send that landed on the wire but whose render could not be CONFIRMED (transport
+// res.ok && !verified). It is never silently promoted to `delivered` (unconfirmed)
+// nor demoted to `failed` (it may have landed); the CAS transitions gate on 'pending',
+// so an indeterminate row is TERMINAL-BY-CAS (reconciliation is an out-of-scope
+// follow-on, not a W1 transition).
+// `sending` (MF3) is a transient CLAIM state: a drainer atomically moves a wake
+// intent pending→sending BEFORE the external send, so an overlapping drainer finds
+// nothing to claim and cannot double-send. A crash mid-send leaves the row visibly
+// `sending`; the recovery boundary (`reconcileAbandonedSending`, run once at
+// startup) reconciles it to `indeterminate` — the send is never blindly re-driven.
+export const OUTBOX_DELIVERY_STATES = ["pending", "sending", "delivered", "failed", "indeterminate"];
+/**
+ * Validate a raw `delivery_state` cell against the closed union before it is typed
+ * as an {@link OutboxDeliveryState}. Replaces the prior unchecked `as` cast: a cast
+ * never fails, so a stray DB value (corruption, a newer daemon's state read by an
+ * older one) would silently masquerade as a typed value and make every downstream
+ * narrowing unsound. We control every writer, so an unknown value is a real defect —
+ * fail loud rather than fabricate a type.
+ */
+export function parseDeliveryState(raw) {
+    if (OUTBOX_DELIVERY_STATES.includes(raw)) {
+        return raw;
+    }
+    throw new OutboxHandlerError("invalid_delivery_state", `outbox row has unknown delivery_state ${JSON.stringify(raw)} (expected one of ${OUTBOX_DELIVERY_STATES.join(", ")})`);
+}
 export class OutboxHandlerError extends Error {
     code;
     constructor(code, message) {
@@ -20,8 +58,12 @@ function newOutboxId() {
  */
 export class OutboxHandler {
     db;
+    /** P21 §4: detected once — a curated-migration test DB (or a pre-067 daemon) may lack the
+     *  era-stamp column, so the writer degrades (omits it) instead of throwing. */
+    hasIdentityProvenanceColumn;
     constructor(db) {
         this.db = db;
+        this.hasIdentityProvenanceColumn = this.db.prepare("PRAGMA table_info(outbox_entries)").all().some((col) => col.name === "identity_provenance");
     }
     record(input) {
         const id = input.outboxId ?? newOutboxId();
@@ -31,11 +73,20 @@ export class OutboxHandler {
         const ts = new Date().toISOString();
         const tags = input.tags ? JSON.stringify(input.tags) : null;
         const urgency = input.urgency ?? "routine";
-        this.db
-            .prepare(`INSERT INTO outbox_entries (
-          outbox_id, sender_session, destination_session, body, tags, urgency, ts_dispatched, audit_pointer
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
-            .run(id, input.senderSession, input.destinationSession, input.body, tags, urgency, ts, input.auditPointer ?? null);
+        if (this.hasIdentityProvenanceColumn) {
+            this.db
+                .prepare(`INSERT INTO outbox_entries (
+            outbox_id, sender_session, destination_session, body, tags, urgency, ts_dispatched, audit_pointer, identity_provenance
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                .run(id, input.senderSession, input.destinationSession, input.body, tags, urgency, ts, input.auditPointer ?? null, input.identityProvenance ?? null);
+        }
+        else {
+            this.db
+                .prepare(`INSERT INTO outbox_entries (
+            outbox_id, sender_session, destination_session, body, tags, urgency, ts_dispatched, audit_pointer
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
+                .run(id, input.senderSession, input.destinationSession, input.body, tags, urgency, ts, input.auditPointer ?? null);
+        }
         return this.getByIdOrThrow(id);
     }
     markDelivered(outboxId) {
@@ -67,6 +118,61 @@ export class OutboxHandler {
         }
         return this.getByIdOrThrow(outboxId);
     }
+    /**
+     * W1 (transactional closure): record an AMBIGUOUS delivery outcome — the send
+     * landed but its render could not be confirmed (transport res.ok && !verified).
+     * Same compare-and-set shape as markFailed/markDelivered (guards on 'pending'),
+     * so it is idempotent and NEVER clobbers a row that already resolved. An
+     * indeterminate row is terminal-by-CAS: it is never silently promoted to
+     * delivered nor demoted to failed by the drain.
+     */
+    markIndeterminate(outboxId) {
+        const result = this.db
+            .prepare(`UPDATE outbox_entries
+           SET delivery_state = 'indeterminate'
+         WHERE outbox_id = ? AND delivery_state = 'pending'`)
+            .run(outboxId);
+        if (result.changes === 0) {
+            const entry = this.getById(outboxId);
+            if (!entry)
+                throw new OutboxHandlerError("outbox_not_found", `outbox ${outboxId} not found`);
+            return entry;
+        }
+        return this.getByIdOrThrow(outboxId);
+    }
+    /**
+     * MF3: atomically CLAIM a pending wake intent for delivery (pending→sending)
+     * BEFORE the external send. Returns true iff this caller won the claim. An
+     * overlapping drainer's claim finds the row no longer `pending` and returns
+     * false, so exactly one caller performs the external send.
+     */
+    claimForDelivery(outboxId) {
+        const result = this.db
+            .prepare(`UPDATE outbox_entries SET delivery_state = 'sending'
+          WHERE outbox_id = ? AND delivery_state = 'pending'`)
+            .run(outboxId);
+        return result.changes === 1;
+    }
+    /**
+     * MF3: finalize a CLAIMED wake intent (sending→delivered|indeterminate|failed)
+     * after its external send resolved. CAS-guarded on `sending` so it only ever
+     * finalizes a row this drainer claimed. `delivered_at` is stamped only for a
+     * confirmed delivery.
+     */
+    finalizeDelivery(outboxId, state) {
+        const deliveredAt = state === "delivered" ? new Date().toISOString() : null;
+        const result = this.db
+            .prepare(`UPDATE outbox_entries SET delivery_state = ?, delivered_at = ?
+          WHERE outbox_id = ? AND delivery_state = 'sending'`)
+            .run(state, deliveredAt, outboxId);
+        if (result.changes === 0) {
+            const entry = this.getById(outboxId);
+            if (!entry)
+                throw new OutboxHandlerError("outbox_not_found", `outbox ${outboxId} not found`);
+            return entry;
+        }
+        return this.getByIdOrThrow(outboxId);
+    }
     getById(outboxId) {
         const row = this.getByIdRaw(outboxId);
         return row ? this.rowToEntry(row) : null;
@@ -77,6 +183,43 @@ export class OutboxHandler {
             .all(senderSession, limit);
         return rows.map((r) => this.rowToEntry(r));
     }
+    /**
+     * W1 (transactional closure): list still-`pending` rows whose outbox_id begins
+     * with `idPrefix`, oldest first. The drain uses this to recover intents a crash
+     * left committed-but-undelivered. `idPrefix` is a trusted compile-time constant
+     * (e.g. "wake-intent-") with no LIKE wildcards. Oldest-first + bounded `limit`
+     * so a caller can page and terminate on a served short batch (never a silent cap).
+     */
+    listPending(idPrefix, limit = 200) {
+        // EXACT-CASE prefix match. SQLite `LIKE` is case-insensitive by default, so a
+        // `LIKE 'wake-intent-%'` selector would also execute `WAKE-INTENT-…` variants.
+        // `substr(...) = ?` uses the binary collation (case-sensitive), so exactly one
+        // spelling is executable. With the route-side prefix refusal unbuilt, this
+        // narrowness is the ONLY thing keeping a recorded case variant out of the
+        // executable drain — widen it and variants become executable.
+        const rows = this.db
+            .prepare(`SELECT * FROM outbox_entries
+          WHERE delivery_state = 'pending' AND substr(outbox_id, 1, ?) = ?
+          ORDER BY ts_dispatched ASC, rowid ASC LIMIT ?`)
+            .all(idPrefix.length, idPrefix, limit);
+        return rows.map((r) => this.rowToEntry(r));
+    }
+    /**
+     * BLOCKING 1 (guard re-seal): at a process/recovery boundary, atomically
+     * reconcile ABANDONED claims — rows a crashed process left in the transient
+     * `sending` state — to `indeterminate` WITHOUT re-sending. A `sending` row is
+     * ambiguous (the external send may or may not have landed after the claim), so
+     * it records `indeterminate`, never a forever-transient claim and never a blind
+     * re-send. EXACT-CASE prefix, matching the executable selector. Returns the
+     * count reconciled.
+     */
+    reconcileAbandonedSending(idPrefix) {
+        const result = this.db
+            .prepare(`UPDATE outbox_entries SET delivery_state = 'indeterminate'
+          WHERE delivery_state = 'sending' AND substr(outbox_id, 1, ?) = ?`)
+            .run(idPrefix.length, idPrefix);
+        return result.changes;
+    }
     getByIdRaw(outboxId) {
         return this.db
             .prepare("SELECT * FROM outbox_entries WHERE outbox_id = ?")
@@ -97,7 +240,7 @@ export class OutboxHandler {
             tags: row.tags ? JSON.parse(row.tags) : null,
             urgency: row.urgency,
             tsDispatched: row.ts_dispatched,
-            deliveryState: row.delivery_state,
+            deliveryState: parseDeliveryState(row.delivery_state),
             deliveredAt: row.delivered_at,
             auditPointer: row.audit_pointer,
         };

package/daemon/dist/domain/outbox-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"outbox-handler.js","sourceRoot":"","sources":["../../src/domain/outbox-handler.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAU,CAAC;AAuClF,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAS;IACtB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,SAAS,WAAW;IAClB,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjF,OAAO,UAAU,EAAE,IAAI,GAAG,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,aAAa;IACf,EAAE,CAAoB;IAE/B,YAAY,EAAqB;QAC/B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,CAAC;IAED,MAAM,CAAC,KAAwB;QAC7B,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE/C,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,SAAS,CAAC;QAE3C,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;;0CAEkC,CACnC;aACA,GAAG,CACF,EAAE,EACF,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,kBAAkB,EACxB,KAAK,CAAC,IAAI,EACV,IAAI,EACJ,OAAO,EACP,EAAE,EACF,KAAK,CAAC,YAAY,IAAI,IAAI,CAC3B,CAAC;QAEJ,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,aAAa,CAAC,QAAgB;QAC5B,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CACN;;4DAEoD,CACrD;aACA,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACrB,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,UAAU,QAAQ,YAAY,CAAC,CAAC;YAC7F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,UAAU,CAAC,QAAgB;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CACN;;4DAEoD,CACrD;aACA,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjB,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,UAAU,QAAQ,YAAY,CAAC,CAAC;YAC7F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,CAAC,QAAgB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED,aAAa,CAAC,aAAqB,EAAE,KAAK,GAAG,GAAG;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN,uGAAuG,CACxG;aACA,GAAG,CAAC,aAAa,EAAE,KAAK,CAAqB,CAAC;QACjD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAEO,UAAU,CAAC,QAAgB;QACjC,OAAO,IAAI,CAAC,EAAE;aACX,OAAO,CAAC,kDAAkD,CAAC;aAC3D,GAAG,CAAC,QAAQ,CAA+B,CAAC;IACjD,CAAC;IAEO,cAAc,CAAC,QAAgB;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,UAAU,QAAQ,wBAAwB,CAAC,CAAC;QACzG,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,UAAU,CAAC,GAAmB;QACpC,OAAO;YACL,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,aAAa,EAAE,GAAG,CAAC,cAAc;YACjC,kBAAkB,EAAE,GAAG,CAAC,mBAAmB;YAC3C,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAc,CAAC,CAAC,CAAC,IAAI;YAC1D,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,YAAY,EAAE,GAAG,CAAC,aAAa;YAC/B,aAAa,EAAE,GAAG,CAAC,cAAqC;YACxD,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,YAAY,EAAE,GAAG,CAAC,aAAa;SAChC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"outbox-handler.js","sourceRoot":"","sources":["../../src/domain/outbox-handler.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAEjD,kFAAkF;AAClF,oFAAoF;AACpF,mFAAmF;AACnF,uFAAuF;AACvF,gFAAgF;AAChF,mCAAmC;AACnC,gFAAgF;AAChF,mFAAmF;AACnF,mFAAmF;AACnF,6EAA6E;AAC7E,mFAAmF;AACnF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,CAAU,CAAC;AAG9G;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAK,sBAA4C,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChE,OAAO,GAA0B,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,kBAAkB,CAC1B,wBAAwB,EACxB,yCAAyC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,qBAAqB,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACtH,CAAC;AACJ,CAAC;AAyCD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAS;IACtB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,SAAS,WAAW;IAClB,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjF,OAAO,UAAU,EAAE,IAAI,GAAG,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,aAAa;IACf,EAAE,CAAoB;IAC/B;mFAC+E;IAC9D,2BAA2B,CAAU;IAEtD,YAAY,EAAqB;QAC/B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,2BAA2B,GAC9B,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,GAAG,EACzD,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,CAAC,KAAwB;QAC7B,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE/C,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,SAAS,CAAC;QAE3C,IAAI,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACrC,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN;;+CAEqC,CACtC;iBACA,GAAG,CACF,EAAE,EACF,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,kBAAkB,EACxB,KAAK,CAAC,IAAI,EACV,IAAI,EACJ,OAAO,EACP,EAAE,EACF,KAAK,CAAC,YAAY,IAAI,IAAI,EAC1B,KAAK,CAAC,kBAAkB,IAAI,IAAI,CACjC,CAAC;QACN,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN;;4CAEkC,CACnC;iBACA,GAAG,CACF,EAAE,EACF,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,kBAAkB,EACxB,KAAK,CAAC,IAAI,EACV,IAAI,EACJ,OAAO,EACP,EAAE,EACF,KAAK,CAAC,YAAY,IAAI,IAAI,CAC3B,CAAC;QACN,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,aAAa,CAAC,QAAgB;QAC5B,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CACN;;4DAEoD,CACrD;aACA,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACrB,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,UAAU,QAAQ,YAAY,CAAC,CAAC;YAC7F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,UAAU,CAAC,QAAgB;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CACN;;4DAEoD,CACrD;aACA,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjB,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,UAAU,QAAQ,YAAY,CAAC,CAAC;YAC7F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;OAOG;IACH,iBAAiB,CAAC,QAAgB;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CACN;;4DAEoD,CACrD;aACA,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjB,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,UAAU,QAAQ,YAAY,CAAC,CAAC;YAC7F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,QAAgB;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CACN;6DACqD,CACtD;aACA,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjB,OAAO,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,QAAgB,EAAE,KAA+C;QAChF,MAAM,WAAW,GAAG,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CACN;6DACqD,CACtD;aACA,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,UAAU,QAAQ,YAAY,CAAC,CAAC;YAC7F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,CAAC,QAAgB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED,aAAa,CAAC,aAAqB,EAAE,KAAK,GAAG,GAAG;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN,uGAAuG,CACxG;aACA,GAAG,CAAC,aAAa,EAAE,KAAK,CAAqB,CAAC;QACjD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,QAAgB,EAAE,KAAK,GAAG,GAAG;QACvC,8EAA8E;QAC9E,+EAA+E;QAC/E,+EAA+E;QAC/E,2EAA2E;QAC3E,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN;;wDAEgD,CACjD;aACA,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAqB,CAAC;QAC7D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;OAQG;IACH,yBAAyB,CAAC,QAAgB;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CACN;2EACmE,CACpE;aACA,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAEO,UAAU,CAAC,QAAgB;QACjC,OAAO,IAAI,CAAC,EAAE;aACX,OAAO,CAAC,kDAAkD,CAAC;aAC3D,GAAG,CAAC,QAAQ,CAA+B,CAAC;IACjD,CAAC;IAEO,cAAc,CAAC,QAAgB;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,UAAU,QAAQ,wBAAwB,CAAC,CAAC;QACzG,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,UAAU,CAAC,GAAmB;QACpC,OAAO;YACL,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,aAAa,EAAE,GAAG,CAAC,cAAc;YACjC,kBAAkB,EAAE,GAAG,CAAC,mBAAmB;YAC3C,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAc,CAAC,CAAC,CAAC,IAAI;YAC1D,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,YAAY,EAAE,GAAG,CAAC,aAAa;YAC/B,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC;YACrD,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,YAAY,EAAE,GAAG,CAAC,aAAa;SAChC,CAAC;IACJ,CAAC;CACF"}

package/daemon/dist/domain/permission-drift-observer.d.ts

@@ -0,0 +1,35 @@
+import type Database from "better-sqlite3";
+import { type PermissionDriftDiagnostic, type PermissionDriftFs } from "./permission-drift.js";
+export interface PermissionDriftReader {
+    diagnose(nodeId: string): PermissionDriftDiagnostic | null;
+}
+/** Warmed outside request handling; cold reads are immediate UNKNOWN. */
+export declare class ClaudePermissionModeCache {
+    private readonly load;
+    private readonly ttlMs;
+    private readonly now;
+    private value;
+    private loading;
+    private loadedAt;
+    constructor(load?: () => Promise<string[] | null>, ttlMs?: number, now?: () => number);
+    warm(): void;
+    read(): string[] | null;
+}
+type AccessSync = (path: string, mode?: number) => void;
+/** Strict, read-only, generation-aware observer for an explicitly requested seat. */
+export declare class PermissionDriftObserver implements PermissionDriftReader {
+    private readonly input;
+    private readonly observations;
+    private readonly fs;
+    private readonly now?;
+    constructor(input: {
+        db: Database.Database;
+        fs?: PermissionDriftFs;
+        now?: () => Date;
+        permissionModes?: ClaudePermissionModeCache;
+        accessSync?: AccessSync;
+    });
+    diagnose(nodeId: string): PermissionDriftDiagnostic | null;
+}
+export {};
+//# sourceMappingURL=permission-drift-observer.d.ts.map

package/daemon/dist/domain/permission-drift-observer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-drift-observer.d.ts","sourceRoot":"","sources":["../../src/domain/permission-drift-observer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAGL,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACvB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,yBAAyB,GAAG,IAAI,CAAC;CAC5D;AA2BD,yEAAyE;AACzE,qBAAa,yBAAyB;IAMlC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAPtB,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAK;gBAGF,IAAI,GAAE,MAAM,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAA6B,EAChE,KAAK,SAAS,EACd,GAAG,GAAE,MAAM,MAAiB;IAG/C,IAAI,IAAI,IAAI;IAYZ,IAAI,IAAI,MAAM,EAAE,GAAG,IAAI;CAIxB;AAED,KAAK,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;AAoBxD,qFAAqF;AACrF,qBAAa,uBAAwB,YAAW,qBAAqB;IAMjE,OAAO,CAAC,QAAQ,CAAC,KAAK;IALxB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAoB;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAa;gBAGf,KAAK,EAAE;QACtB,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;QACtB,EAAE,CAAC,EAAE,iBAAiB,CAAC;QACvB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;QACjB,eAAe,CAAC,EAAE,yBAAyB,CAAC;QAC5C,UAAU,CAAC,EAAE,UAAU,CAAC;KACzB;IASH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,yBAAyB,GAAG,IAAI;CAc3D"}

package/daemon/dist/domain/permission-drift-observer.js

@@ -0,0 +1,108 @@
+import fs from "node:fs";
+import nodePath from "node:path";
+import { execFile } from "node:child_process";
+import { AppliedLaunchObservationStore } from "./applied-launch-observation-store.js";
+import { diagnoseRuntimePosture, parseClaudePermissionModes, } from "./permission-drift.js";
+function commandAvailable(command) {
+    const pathValue = process.env.PATH;
+    if (!pathValue)
+        return false;
+    for (const entry of pathValue.split(nodePath.delimiter)) {
+        if (!entry)
+            continue;
+        try {
+            fs.accessSync(nodePath.join(entry, command), fs.constants.X_OK);
+            return true;
+        }
+        catch {
+            // Try the next PATH entry.
+        }
+    }
+    return false;
+}
+async function loadClaudePermissionModes() {
+    return await new Promise((resolve) => {
+        execFile("claude", ["--help"], {
+            encoding: "utf8",
+            timeout: 1_000,
+            maxBuffer: 1024 * 1024,
+        }, (error, stdout) => resolve(error ? null : parseClaudePermissionModes(stdout)));
+    });
+}
+/** Warmed outside request handling; cold reads are immediate UNKNOWN. */
+export class ClaudePermissionModeCache {
+    load;
+    ttlMs;
+    now;
+    value = null;
+    loading = false;
+    loadedAt = 0;
+    constructor(load = loadClaudePermissionModes, ttlMs = 60_000, now = Date.now) {
+        this.load = load;
+        this.ttlMs = ttlMs;
+        this.now = now;
+    }
+    warm() {
+        if (this.loading || (this.loadedAt > 0 && this.now() - this.loadedAt < this.ttlMs))
+            return;
+        this.loading = true;
+        void this.load()
+            .then((value) => { this.value = value; })
+            .catch(() => { this.value = null; })
+            .finally(() => {
+            this.loadedAt = this.now();
+            this.loading = false;
+        });
+    }
+    read() {
+        this.warm();
+        return this.value;
+    }
+}
+function productionFs(permissionModes, accessSync) {
+    return {
+        readFile: (path) => fs.readFileSync(path, "utf8"),
+        cwdReadable: (path) => {
+            try {
+                accessSync(path, fs.constants.R_OK);
+                return true;
+            }
+            catch (error) {
+                const code = error.code;
+                if (code === "EACCES" || code === "EPERM")
+                    return false;
+                throw error;
+            }
+        },
+        commandAvailable,
+        claudePermissionModes: () => permissionModes.read(),
+    };
+}
+/** Strict, read-only, generation-aware observer for an explicitly requested seat. */
+export class PermissionDriftObserver {
+    input;
+    observations;
+    fs;
+    now;
+    constructor(input) {
+        this.input = input;
+        this.observations = new AppliedLaunchObservationStore(input.db);
+        const permissionModes = input.permissionModes ?? new ClaudePermissionModeCache();
+        permissionModes.warm();
+        this.fs = input.fs ?? productionFs(permissionModes, input.accessSync ?? ((path, mode) => fs.accessSync(path, mode)));
+        this.now = input.now;
+    }
+    diagnose(nodeId) {
+        const node = this.input.db.prepare("SELECT runtime, cwd FROM nodes WHERE id = ?").get(nodeId);
+        if (!node)
+            return null;
+        return diagnoseRuntimePosture({
+            runtime: node.runtime ?? "unknown",
+            cwd: node.cwd,
+            applied: this.observations.readCurrent(nodeId),
+            fs: this.fs,
+            now: this.now,
+        });
+    }
+}
+//# sourceMappingURL=permission-drift-observer.js.map

package/daemon/dist/domain/permission-drift-observer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-drift-observer.js","sourceRoot":"","sources":["../../src/domain/permission-drift-observer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAG3B,MAAM,uBAAuB,CAAC;AAM/B,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IACnC,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,yBAAyB;IACtC,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;YAC7B,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,IAAI,GAAG,IAAI;SACvB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,MAAM,OAAO,yBAAyB;IAMjB;IACA;IACA;IAPX,KAAK,GAAoB,IAAI,CAAC;IAC9B,OAAO,GAAG,KAAK,CAAC;IAChB,QAAQ,GAAG,CAAC,CAAC;IAErB,YACmB,OAAuC,yBAAyB,EAChE,QAAQ,MAAM,EACd,MAAoB,IAAI,CAAC,GAAG;QAF5B,SAAI,GAAJ,IAAI,CAA4D;QAChE,UAAK,GAAL,KAAK,CAAS;QACd,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ,IAAI;QACF,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO;QAC3F,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,KAAK,IAAI,CAAC,IAAI,EAAE;aACb,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;aACxC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;aACnC,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC,CAAC,CAAC;IACP,CAAC;IAED,IAAI;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;CACF;AAID,SAAS,YAAY,CAAC,eAA0C,EAAE,UAAsB;IACtF,OAAO;QACL,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;QACjD,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YACpB,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACpC,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;gBACnD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO;oBAAE,OAAO,KAAK,CAAC;gBACxD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,gBAAgB;QAChB,qBAAqB,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE;KACpD,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,OAAO,uBAAuB;IAMf;IALF,YAAY,CAAgC;IAC5C,EAAE,CAAoB;IACtB,GAAG,CAAc;IAElC,YACmB,KAMhB;QANgB,UAAK,GAAL,KAAK,CAMrB;QAED,IAAI,CAAC,YAAY,GAAG,IAAI,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,IAAI,yBAAyB,EAAE,CAAC;QACjF,eAAe,CAAC,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,YAAY,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACrH,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACvB,CAAC;IAED,QAAQ,CAAC,MAAc;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC,GAAG,CAAC,MAAM,CAG/E,CAAC;QACd,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,sBAAsB,CAAC;YAC5B,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS;YAClC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC;YAC9C,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;IACL,CAAC;CACF"}

package/daemon/dist/domain/permission-drift.d.ts

@@ -0,0 +1,60 @@
+export type AppliedLaunchAxis = "permission" | "sandbox" | "resource_trust" | "not_applicable";
+export type AppliedLaunchState = "observed" | "unknown";
+export interface AppliedLaunchObservation {
+    runtime: string;
+    axis: AppliedLaunchAxis;
+    state: AppliedLaunchState;
+    value: string | null;
+    reason?: string;
+}
+export type TransportState = "healthy" | "connect" | "timeout" | "response";
+export type CwdReadState = "visible" | "denied" | "unknown";
+export type CommandPathState = "available" | "missing" | "unknown";
+export type EnforcementState = "aligned" | "drift" | "unknown";
+export interface EffectiveClaudePermission {
+    defaultMode: string;
+    allow: string[];
+    ask: string[];
+    deny: string[];
+}
+export interface RuntimeEnforcementDiagnostic {
+    axis: AppliedLaunchAxis;
+    state: EnforcementState;
+    expected: string | null;
+    effective: string | EffectiveClaudePermission | null;
+    sourcePath: string | null;
+    reason?: string;
+}
+export interface PermissionDriftDiagnostic {
+    transport: {
+        state: TransportState;
+    };
+    cwdRead: {
+        state: CwdReadState;
+    };
+    commandPath: {
+        state: CommandPathState;
+    };
+    enforcement: RuntimeEnforcementDiagnostic;
+    observedAt: string;
+}
+export interface PermissionDriftFs {
+    readFile(path: string): string;
+    cwdReadable(path: string): boolean | null;
+    commandAvailable(command: string): boolean | null;
+    /** Live harness-derived Claude permission-mode vocabulary. null = unresolved. */
+    claudePermissionModes(): string[] | null;
+}
+export declare function parseClaudePermissionModes(help: string): string[] | null;
+export declare function observeClaudePermission(flag: string): AppliedLaunchObservation;
+export declare function observeCodexSandbox(arg: string): AppliedLaunchObservation;
+export declare function observePiResourceTrust(trust: "approve" | "no-approve"): AppliedLaunchObservation;
+export declare function diagnoseRuntimePosture(input: {
+    runtime: string;
+    cwd: string | null;
+    applied: AppliedLaunchObservation | null;
+    fs: PermissionDriftFs;
+    now?: () => Date;
+}): PermissionDriftDiagnostic;
+export declare function renderPermissionDriftSummary(diagnostic: PermissionDriftDiagnostic): string;
+//# sourceMappingURL=permission-drift.d.ts.map

package/daemon/dist/domain/permission-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-drift.d.ts","sourceRoot":"","sources":["../../src/domain/permission-drift.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,SAAS,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;AAC/F,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AAC5E,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAC5D,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AACnE,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;AAE/D,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,yBAAyB,GAAG,IAAI,CAAC;IACrD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE;QAAE,KAAK,EAAE,cAAc,CAAA;KAAE,CAAC;IACrC,OAAO,EAAE;QAAE,KAAK,EAAE,YAAY,CAAA;KAAE,CAAC;IACjC,WAAW,EAAE;QAAE,KAAK,EAAE,gBAAgB,CAAA;KAAE,CAAC;IACzC,WAAW,EAAE,4BAA4B,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAC1C,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAClD,iFAAiF;IACjF,qBAAqB,IAAI,MAAM,EAAE,GAAG,IAAI,CAAC;CAC1C;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAQxE;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,CAQ9E;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,wBAAwB,CAYzE;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,SAAS,GAAG,YAAY,GAAG,wBAAwB,CAEhG;AAoJD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAAC;IACzC,EAAE,EAAE,iBAAiB,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,GAAG,yBAAyB,CAW5B;AAED,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,yBAAyB,GAAG,MAAM,CAkB1F"}

package/daemon/dist/domain/permission-drift.js

@@ -0,0 +1,208 @@
+import nodePath from "node:path";
+export function parseClaudePermissionModes(help) {
+    const start = help.indexOf("--permission-mode <mode>");
+    if (start < 0)
+        return null;
+    const block = help.slice(start, start + 600);
+    const choices = block.match(/choices:\s*([^)]+)\)/)?.[1];
+    if (!choices)
+        return null;
+    const values = [...choices.matchAll(/"([^"]+)"/g)].map((match) => match[1]);
+    return values.length > 0 ? values : null;
+}
+export function observeClaudePermission(flag) {
+    if (flag.trim() === "--permission-mode acceptEdits") {
+        return { runtime: "claude-code", axis: "permission", state: "observed", value: "acceptEdits" };
+    }
+    if (flag.trim() === "--dangerously-skip-permissions") {
+        return { runtime: "claude-code", axis: "permission", state: "observed", value: "bypassPermissions" };
+    }
+    return { runtime: "claude-code", axis: "permission", state: "unknown", value: null, reason: "unrecognized_launch_argument" };
+}
+export function observeCodexSandbox(arg) {
+    const normalized = arg.trim().replace(/\s+/g, " ");
+    if (normalized === "-s workspace-write") {
+        return { runtime: "codex", axis: "sandbox", state: "observed", value: "workspace-write" };
+    }
+    if (normalized === "-s danger-full-access") {
+        return { runtime: "codex", axis: "sandbox", state: "observed", value: "danger-full-access" };
+    }
+    if (normalized.startsWith("-p ")) {
+        return { runtime: "codex", axis: "sandbox", state: "unknown", value: null, reason: "named_profile_unresolved" };
+    }
+    return { runtime: "codex", axis: "sandbox", state: "unknown", value: null, reason: "unrecognized_launch_argument" };
+}
+export function observePiResourceTrust(trust) {
+    return { runtime: "pi", axis: "resource_trust", state: "observed", value: trust };
+}
+function runtimeCommand(runtime) {
+    if (runtime === "claude-code")
+        return "claude";
+    if (runtime === "codex")
+        return "codex";
+    if (runtime === "pi")
+        return "pi";
+    return null;
+}
+function cwdReadState(fs, cwd) {
+    if (!cwd)
+        return "unknown";
+    try {
+        const value = fs.cwdReadable(cwd);
+        return value === true ? "visible" : value === false ? "denied" : "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+function commandPathState(fs, runtime) {
+    const command = runtimeCommand(runtime);
+    if (!command)
+        return "unknown";
+    try {
+        const value = fs.commandAvailable(command);
+        return value === true ? "available" : value === false ? "missing" : "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+function unknownEnforcement(axis, expected, sourcePath, reason) {
+    return { axis, state: "unknown", expected, effective: null, sourcePath, reason };
+}
+function parseStringArray(value) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string"))
+        return null;
+    return [...value];
+}
+function inspectClaude(cwd, applied, fs) {
+    const expected = applied?.state === "observed" ? applied.value : null;
+    if (!cwd) {
+        return unknownEnforcement("permission", expected, null, "cwd_unknown");
+    }
+    const sourcePath = nodePath.join(cwd, ".claude", "settings.local.json");
+    if (!applied || applied.runtime !== "claude-code" || applied.axis !== "permission" || applied.state !== "observed" || !expected) {
+        return unknownEnforcement("permission", expected, sourcePath, applied?.reason ?? "applied_launch_unknown");
+    }
+    if (expected === "bypassPermissions") {
+        return {
+            axis: "permission",
+            state: "aligned",
+            expected,
+            effective: expected,
+            sourcePath: null,
+            reason: "launch_bypasses_project_permissions",
+        };
+    }
+    let raw;
+    try {
+        raw = fs.readFile(sourcePath);
+    }
+    catch (error) {
+        const code = error.code;
+        return unknownEnforcement("permission", expected, sourcePath, code === "ENOENT" ? "settings_missing" : "settings_unreadable");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return unknownEnforcement("permission", expected, sourcePath, "settings_unparseable");
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        return unknownEnforcement("permission", expected, sourcePath, "settings_invalid_shape");
+    }
+    const permissions = parsed.permissions;
+    if (typeof permissions !== "object" || permissions === null || Array.isArray(permissions)) {
+        return unknownEnforcement("permission", expected, sourcePath, permissions === undefined ? "permissions_missing" : "permissions_invalid_shape");
+    }
+    const record = permissions;
+    const defaultMode = record.defaultMode;
+    if (typeof defaultMode !== "string") {
+        return unknownEnforcement("permission", expected, sourcePath, "default_mode_missing");
+    }
+    let supportedModes;
+    try {
+        const liveModes = fs.claudePermissionModes();
+        if (!liveModes || liveModes.length === 0) {
+            return unknownEnforcement("permission", expected, sourcePath, "harness_semantics_unknown");
+        }
+        supportedModes = new Set(liveModes);
+    }
+    catch {
+        return unknownEnforcement("permission", expected, sourcePath, "harness_semantics_unknown");
+    }
+    if (!supportedModes.has(defaultMode)) {
+        return unknownEnforcement("permission", expected, sourcePath, "unsupported_default_mode");
+    }
+    const allow = parseStringArray(record.allow);
+    const ask = parseStringArray(record.ask);
+    const deny = parseStringArray(record.deny);
+    if (!allow || !ask || !deny) {
+        return unknownEnforcement("permission", expected, sourcePath, "permission_rules_invalid_shape");
+    }
+    const denySet = new Set(deny);
+    if (allow.some((entry) => denySet.has(entry))) {
+        return unknownEnforcement("permission", expected, sourcePath, "conflicting_rules");
+    }
+    const effective = { defaultMode, allow, ask, deny };
+    return {
+        axis: "permission",
+        state: defaultMode === expected ? "aligned" : "drift",
+        expected,
+        effective,
+        sourcePath,
+    };
+}
+function inspectLaunchBoundRuntime(runtime, applied) {
+    const axis = runtime === "codex" ? "sandbox" : runtime === "pi" ? "resource_trust" : "not_applicable";
+    if (!applied || applied.runtime !== runtime || applied.axis !== axis || applied.state !== "observed" || !applied.value) {
+        return unknownEnforcement(axis, null, null, applied?.reason ?? "applied_launch_unknown");
+    }
+    return {
+        axis,
+        state: "aligned",
+        expected: applied.value,
+        effective: applied.value,
+        sourcePath: null,
+        reason: "generation_matched_launch_effect",
+    };
+}
+export function diagnoseRuntimePosture(input) {
+    const enforcement = input.runtime === "claude-code"
+        ? inspectClaude(input.cwd, input.applied, input.fs)
+        : inspectLaunchBoundRuntime(input.runtime, input.applied);
+    return {
+        transport: { state: "healthy" },
+        cwdRead: { state: cwdReadState(input.fs, input.cwd) },
+        commandPath: { state: commandPathState(input.fs, input.runtime) },
+        enforcement,
+        observedAt: (input.now?.() ?? new Date()).toISOString(),
+    };
+}
+export function renderPermissionDriftSummary(diagnostic) {
+    const axisLabel = diagnostic.enforcement.axis === "resource_trust"
+        ? "resource trust"
+        : diagnostic.enforcement.axis;
+    const effective = typeof diagnostic.enforcement.effective === "object" && diagnostic.enforcement.effective !== null
+        ? diagnostic.enforcement.effective.defaultMode
+        : diagnostic.enforcement.effective;
+    const pieces = [
+        `transport: ${diagnostic.transport.state}`,
+        `cwd/read: ${diagnostic.cwdRead.state}`,
+        `command/PATH: ${diagnostic.commandPath.state}`,
+        `${axisLabel}: ${diagnostic.enforcement.state.toUpperCase()}`,
+    ];
+    if (diagnostic.enforcement.expected)
+        pieces.push(`expected=${diagnostic.enforcement.expected}`);
+    if (effective)
+        pieces.push(`effective=${effective}`);
+    if (diagnostic.enforcement.sourcePath)
+        pieces.push(`source=${diagnostic.enforcement.sourcePath}`);
+    if (diagnostic.enforcement.reason)
+        pieces.push(`reason=${diagnostic.enforcement.reason}`);
+    return pieces.join(" · ");
+}
+//# sourceMappingURL=permission-drift.js.map