@openrig/cli 0.5.0 → 0.5.2

package/daemon/dist/domain/permission-drift-observer.d.ts

@@ -0,0 +1,35 @@
+import type Database from "better-sqlite3";
+import { type PermissionDriftDiagnostic, type PermissionDriftFs } from "./permission-drift.js";
+export interface PermissionDriftReader {
+    diagnose(nodeId: string): PermissionDriftDiagnostic | null;
+}
+/** Warmed outside request handling; cold reads are immediate UNKNOWN. */
+export declare class ClaudePermissionModeCache {
+    private readonly load;
+    private readonly ttlMs;
+    private readonly now;
+    private value;
+    private loading;
+    private loadedAt;
+    constructor(load?: () => Promise<string[] | null>, ttlMs?: number, now?: () => number);
+    warm(): void;
+    read(): string[] | null;
+}
+type AccessSync = (path: string, mode?: number) => void;
+/** Strict, read-only, generation-aware observer for an explicitly requested seat. */
+export declare class PermissionDriftObserver implements PermissionDriftReader {
+    private readonly input;
+    private readonly observations;
+    private readonly fs;
+    private readonly now?;
+    constructor(input: {
+        db: Database.Database;
+        fs?: PermissionDriftFs;
+        now?: () => Date;
+        permissionModes?: ClaudePermissionModeCache;
+        accessSync?: AccessSync;
+    });
+    diagnose(nodeId: string): PermissionDriftDiagnostic | null;
+}
+export {};
+//# sourceMappingURL=permission-drift-observer.d.ts.map

package/daemon/dist/domain/permission-drift-observer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-drift-observer.d.ts","sourceRoot":"","sources":["../../src/domain/permission-drift-observer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAGL,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACvB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,yBAAyB,GAAG,IAAI,CAAC;CAC5D;AA2BD,yEAAyE;AACzE,qBAAa,yBAAyB;IAMlC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAPtB,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAK;gBAGF,IAAI,GAAE,MAAM,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAA6B,EAChE,KAAK,SAAS,EACd,GAAG,GAAE,MAAM,MAAiB;IAG/C,IAAI,IAAI,IAAI;IAYZ,IAAI,IAAI,MAAM,EAAE,GAAG,IAAI;CAIxB;AAED,KAAK,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;AAoBxD,qFAAqF;AACrF,qBAAa,uBAAwB,YAAW,qBAAqB;IAMjE,OAAO,CAAC,QAAQ,CAAC,KAAK;IALxB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAoB;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAa;gBAGf,KAAK,EAAE;QACtB,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;QACtB,EAAE,CAAC,EAAE,iBAAiB,CAAC;QACvB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;QACjB,eAAe,CAAC,EAAE,yBAAyB,CAAC;QAC5C,UAAU,CAAC,EAAE,UAAU,CAAC;KACzB;IASH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,yBAAyB,GAAG,IAAI;CAc3D"}

package/daemon/dist/domain/permission-drift-observer.js

@@ -0,0 +1,108 @@
+import fs from "node:fs";
+import nodePath from "node:path";
+import { execFile } from "node:child_process";
+import { AppliedLaunchObservationStore } from "./applied-launch-observation-store.js";
+import { diagnoseRuntimePosture, parseClaudePermissionModes, } from "./permission-drift.js";
+function commandAvailable(command) {
+    const pathValue = process.env.PATH;
+    if (!pathValue)
+        return false;
+    for (const entry of pathValue.split(nodePath.delimiter)) {
+        if (!entry)
+            continue;
+        try {
+            fs.accessSync(nodePath.join(entry, command), fs.constants.X_OK);
+            return true;
+        }
+        catch {
+            // Try the next PATH entry.
+        }
+    }
+    return false;
+}
+async function loadClaudePermissionModes() {
+    return await new Promise((resolve) => {
+        execFile("claude", ["--help"], {
+            encoding: "utf8",
+            timeout: 1_000,
+            maxBuffer: 1024 * 1024,
+        }, (error, stdout) => resolve(error ? null : parseClaudePermissionModes(stdout)));
+    });
+}
+/** Warmed outside request handling; cold reads are immediate UNKNOWN. */
+export class ClaudePermissionModeCache {
+    load;
+    ttlMs;
+    now;
+    value = null;
+    loading = false;
+    loadedAt = 0;
+    constructor(load = loadClaudePermissionModes, ttlMs = 60_000, now = Date.now) {
+        this.load = load;
+        this.ttlMs = ttlMs;
+        this.now = now;
+    }
+    warm() {
+        if (this.loading || (this.loadedAt > 0 && this.now() - this.loadedAt < this.ttlMs))
+            return;
+        this.loading = true;
+        void this.load()
+            .then((value) => { this.value = value; })
+            .catch(() => { this.value = null; })
+            .finally(() => {
+            this.loadedAt = this.now();
+            this.loading = false;
+        });
+    }
+    read() {
+        this.warm();
+        return this.value;
+    }
+}
+function productionFs(permissionModes, accessSync) {
+    return {
+        readFile: (path) => fs.readFileSync(path, "utf8"),
+        cwdReadable: (path) => {
+            try {
+                accessSync(path, fs.constants.R_OK);
+                return true;
+            }
+            catch (error) {
+                const code = error.code;
+                if (code === "EACCES" || code === "EPERM")
+                    return false;
+                throw error;
+            }
+        },
+        commandAvailable,
+        claudePermissionModes: () => permissionModes.read(),
+    };
+}
+/** Strict, read-only, generation-aware observer for an explicitly requested seat. */
+export class PermissionDriftObserver {
+    input;
+    observations;
+    fs;
+    now;
+    constructor(input) {
+        this.input = input;
+        this.observations = new AppliedLaunchObservationStore(input.db);
+        const permissionModes = input.permissionModes ?? new ClaudePermissionModeCache();
+        permissionModes.warm();
+        this.fs = input.fs ?? productionFs(permissionModes, input.accessSync ?? ((path, mode) => fs.accessSync(path, mode)));
+        this.now = input.now;
+    }
+    diagnose(nodeId) {
+        const node = this.input.db.prepare("SELECT runtime, cwd FROM nodes WHERE id = ?").get(nodeId);
+        if (!node)
+            return null;
+        return diagnoseRuntimePosture({
+            runtime: node.runtime ?? "unknown",
+            cwd: node.cwd,
+            applied: this.observations.readCurrent(nodeId),
+            fs: this.fs,
+            now: this.now,
+        });
+    }
+}
+//# sourceMappingURL=permission-drift-observer.js.map

package/daemon/dist/domain/permission-drift-observer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-drift-observer.js","sourceRoot":"","sources":["../../src/domain/permission-drift-observer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAG3B,MAAM,uBAAuB,CAAC;AAM/B,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IACnC,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,yBAAyB;IACtC,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;YAC7B,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,IAAI,GAAG,IAAI;SACvB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,MAAM,OAAO,yBAAyB;IAMjB;IACA;IACA;IAPX,KAAK,GAAoB,IAAI,CAAC;IAC9B,OAAO,GAAG,KAAK,CAAC;IAChB,QAAQ,GAAG,CAAC,CAAC;IAErB,YACmB,OAAuC,yBAAyB,EAChE,QAAQ,MAAM,EACd,MAAoB,IAAI,CAAC,GAAG;QAF5B,SAAI,GAAJ,IAAI,CAA4D;QAChE,UAAK,GAAL,KAAK,CAAS;QACd,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ,IAAI;QACF,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO;QAC3F,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,KAAK,IAAI,CAAC,IAAI,EAAE;aACb,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;aACxC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;aACnC,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC,CAAC,CAAC;IACP,CAAC;IAED,IAAI;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;CACF;AAID,SAAS,YAAY,CAAC,eAA0C,EAAE,UAAsB;IACtF,OAAO;QACL,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;QACjD,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YACpB,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACpC,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;gBACnD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO;oBAAE,OAAO,KAAK,CAAC;gBACxD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,gBAAgB;QAChB,qBAAqB,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE;KACpD,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,OAAO,uBAAuB;IAMf;IALF,YAAY,CAAgC;IAC5C,EAAE,CAAoB;IACtB,GAAG,CAAc;IAElC,YACmB,KAMhB;QANgB,UAAK,GAAL,KAAK,CAMrB;QAED,IAAI,CAAC,YAAY,GAAG,IAAI,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,IAAI,yBAAyB,EAAE,CAAC;QACjF,eAAe,CAAC,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,YAAY,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACrH,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACvB,CAAC;IAED,QAAQ,CAAC,MAAc;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC,GAAG,CAAC,MAAM,CAG/E,CAAC;QACd,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,sBAAsB,CAAC;YAC5B,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS;YAClC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC;YAC9C,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;IACL,CAAC;CACF"}

package/daemon/dist/domain/permission-drift.d.ts

@@ -0,0 +1,60 @@
+export type AppliedLaunchAxis = "permission" | "sandbox" | "resource_trust" | "not_applicable";
+export type AppliedLaunchState = "observed" | "unknown";
+export interface AppliedLaunchObservation {
+    runtime: string;
+    axis: AppliedLaunchAxis;
+    state: AppliedLaunchState;
+    value: string | null;
+    reason?: string;
+}
+export type TransportState = "healthy" | "connect" | "timeout" | "response";
+export type CwdReadState = "visible" | "denied" | "unknown";
+export type CommandPathState = "available" | "missing" | "unknown";
+export type EnforcementState = "aligned" | "drift" | "unknown";
+export interface EffectiveClaudePermission {
+    defaultMode: string;
+    allow: string[];
+    ask: string[];
+    deny: string[];
+}
+export interface RuntimeEnforcementDiagnostic {
+    axis: AppliedLaunchAxis;
+    state: EnforcementState;
+    expected: string | null;
+    effective: string | EffectiveClaudePermission | null;
+    sourcePath: string | null;
+    reason?: string;
+}
+export interface PermissionDriftDiagnostic {
+    transport: {
+        state: TransportState;
+    };
+    cwdRead: {
+        state: CwdReadState;
+    };
+    commandPath: {
+        state: CommandPathState;
+    };
+    enforcement: RuntimeEnforcementDiagnostic;
+    observedAt: string;
+}
+export interface PermissionDriftFs {
+    readFile(path: string): string;
+    cwdReadable(path: string): boolean | null;
+    commandAvailable(command: string): boolean | null;
+    /** Live harness-derived Claude permission-mode vocabulary. null = unresolved. */
+    claudePermissionModes(): string[] | null;
+}
+export declare function parseClaudePermissionModes(help: string): string[] | null;
+export declare function observeClaudePermission(flag: string): AppliedLaunchObservation;
+export declare function observeCodexSandbox(arg: string): AppliedLaunchObservation;
+export declare function observePiResourceTrust(trust: "approve" | "no-approve"): AppliedLaunchObservation;
+export declare function diagnoseRuntimePosture(input: {
+    runtime: string;
+    cwd: string | null;
+    applied: AppliedLaunchObservation | null;
+    fs: PermissionDriftFs;
+    now?: () => Date;
+}): PermissionDriftDiagnostic;
+export declare function renderPermissionDriftSummary(diagnostic: PermissionDriftDiagnostic): string;
+//# sourceMappingURL=permission-drift.d.ts.map

package/daemon/dist/domain/permission-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-drift.d.ts","sourceRoot":"","sources":["../../src/domain/permission-drift.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,SAAS,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;AAC/F,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AAC5E,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAC5D,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AACnE,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;AAE/D,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,yBAAyB,GAAG,IAAI,CAAC;IACrD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE;QAAE,KAAK,EAAE,cAAc,CAAA;KAAE,CAAC;IACrC,OAAO,EAAE;QAAE,KAAK,EAAE,YAAY,CAAA;KAAE,CAAC;IACjC,WAAW,EAAE;QAAE,KAAK,EAAE,gBAAgB,CAAA;KAAE,CAAC;IACzC,WAAW,EAAE,4BAA4B,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAC1C,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAClD,iFAAiF;IACjF,qBAAqB,IAAI,MAAM,EAAE,GAAG,IAAI,CAAC;CAC1C;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAQxE;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,CAQ9E;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,wBAAwB,CAYzE;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,SAAS,GAAG,YAAY,GAAG,wBAAwB,CAEhG;AAoJD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAAC;IACzC,EAAE,EAAE,iBAAiB,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,GAAG,yBAAyB,CAW5B;AAED,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,yBAAyB,GAAG,MAAM,CAkB1F"}

package/daemon/dist/domain/permission-drift.js

@@ -0,0 +1,208 @@
+import nodePath from "node:path";
+export function parseClaudePermissionModes(help) {
+    const start = help.indexOf("--permission-mode <mode>");
+    if (start < 0)
+        return null;
+    const block = help.slice(start, start + 600);
+    const choices = block.match(/choices:\s*([^)]+)\)/)?.[1];
+    if (!choices)
+        return null;
+    const values = [...choices.matchAll(/"([^"]+)"/g)].map((match) => match[1]);
+    return values.length > 0 ? values : null;
+}
+export function observeClaudePermission(flag) {
+    if (flag.trim() === "--permission-mode acceptEdits") {
+        return { runtime: "claude-code", axis: "permission", state: "observed", value: "acceptEdits" };
+    }
+    if (flag.trim() === "--dangerously-skip-permissions") {
+        return { runtime: "claude-code", axis: "permission", state: "observed", value: "bypassPermissions" };
+    }
+    return { runtime: "claude-code", axis: "permission", state: "unknown", value: null, reason: "unrecognized_launch_argument" };
+}
+export function observeCodexSandbox(arg) {
+    const normalized = arg.trim().replace(/\s+/g, " ");
+    if (normalized === "-s workspace-write") {
+        return { runtime: "codex", axis: "sandbox", state: "observed", value: "workspace-write" };
+    }
+    if (normalized === "-s danger-full-access") {
+        return { runtime: "codex", axis: "sandbox", state: "observed", value: "danger-full-access" };
+    }
+    if (normalized.startsWith("-p ")) {
+        return { runtime: "codex", axis: "sandbox", state: "unknown", value: null, reason: "named_profile_unresolved" };
+    }
+    return { runtime: "codex", axis: "sandbox", state: "unknown", value: null, reason: "unrecognized_launch_argument" };
+}
+export function observePiResourceTrust(trust) {
+    return { runtime: "pi", axis: "resource_trust", state: "observed", value: trust };
+}
+function runtimeCommand(runtime) {
+    if (runtime === "claude-code")
+        return "claude";
+    if (runtime === "codex")
+        return "codex";
+    if (runtime === "pi")
+        return "pi";
+    return null;
+}
+function cwdReadState(fs, cwd) {
+    if (!cwd)
+        return "unknown";
+    try {
+        const value = fs.cwdReadable(cwd);
+        return value === true ? "visible" : value === false ? "denied" : "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+function commandPathState(fs, runtime) {
+    const command = runtimeCommand(runtime);
+    if (!command)
+        return "unknown";
+    try {
+        const value = fs.commandAvailable(command);
+        return value === true ? "available" : value === false ? "missing" : "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+function unknownEnforcement(axis, expected, sourcePath, reason) {
+    return { axis, state: "unknown", expected, effective: null, sourcePath, reason };
+}
+function parseStringArray(value) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string"))
+        return null;
+    return [...value];
+}
+function inspectClaude(cwd, applied, fs) {
+    const expected = applied?.state === "observed" ? applied.value : null;
+    if (!cwd) {
+        return unknownEnforcement("permission", expected, null, "cwd_unknown");
+    }
+    const sourcePath = nodePath.join(cwd, ".claude", "settings.local.json");
+    if (!applied || applied.runtime !== "claude-code" || applied.axis !== "permission" || applied.state !== "observed" || !expected) {
+        return unknownEnforcement("permission", expected, sourcePath, applied?.reason ?? "applied_launch_unknown");
+    }
+    if (expected === "bypassPermissions") {
+        return {
+            axis: "permission",
+            state: "aligned",
+            expected,
+            effective: expected,
+            sourcePath: null,
+            reason: "launch_bypasses_project_permissions",
+        };
+    }
+    let raw;
+    try {
+        raw = fs.readFile(sourcePath);
+    }
+    catch (error) {
+        const code = error.code;
+        return unknownEnforcement("permission", expected, sourcePath, code === "ENOENT" ? "settings_missing" : "settings_unreadable");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return unknownEnforcement("permission", expected, sourcePath, "settings_unparseable");
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        return unknownEnforcement("permission", expected, sourcePath, "settings_invalid_shape");
+    }
+    const permissions = parsed.permissions;
+    if (typeof permissions !== "object" || permissions === null || Array.isArray(permissions)) {
+        return unknownEnforcement("permission", expected, sourcePath, permissions === undefined ? "permissions_missing" : "permissions_invalid_shape");
+    }
+    const record = permissions;
+    const defaultMode = record.defaultMode;
+    if (typeof defaultMode !== "string") {
+        return unknownEnforcement("permission", expected, sourcePath, "default_mode_missing");
+    }
+    let supportedModes;
+    try {
+        const liveModes = fs.claudePermissionModes();
+        if (!liveModes || liveModes.length === 0) {
+            return unknownEnforcement("permission", expected, sourcePath, "harness_semantics_unknown");
+        }
+        supportedModes = new Set(liveModes);
+    }
+    catch {
+        return unknownEnforcement("permission", expected, sourcePath, "harness_semantics_unknown");
+    }
+    if (!supportedModes.has(defaultMode)) {
+        return unknownEnforcement("permission", expected, sourcePath, "unsupported_default_mode");
+    }
+    const allow = parseStringArray(record.allow);
+    const ask = parseStringArray(record.ask);
+    const deny = parseStringArray(record.deny);
+    if (!allow || !ask || !deny) {
+        return unknownEnforcement("permission", expected, sourcePath, "permission_rules_invalid_shape");
+    }
+    const denySet = new Set(deny);
+    if (allow.some((entry) => denySet.has(entry))) {
+        return unknownEnforcement("permission", expected, sourcePath, "conflicting_rules");
+    }
+    const effective = { defaultMode, allow, ask, deny };
+    return {
+        axis: "permission",
+        state: defaultMode === expected ? "aligned" : "drift",
+        expected,
+        effective,
+        sourcePath,
+    };
+}
+function inspectLaunchBoundRuntime(runtime, applied) {
+    const axis = runtime === "codex" ? "sandbox" : runtime === "pi" ? "resource_trust" : "not_applicable";
+    if (!applied || applied.runtime !== runtime || applied.axis !== axis || applied.state !== "observed" || !applied.value) {
+        return unknownEnforcement(axis, null, null, applied?.reason ?? "applied_launch_unknown");
+    }
+    return {
+        axis,
+        state: "aligned",
+        expected: applied.value,
+        effective: applied.value,
+        sourcePath: null,
+        reason: "generation_matched_launch_effect",
+    };
+}
+export function diagnoseRuntimePosture(input) {
+    const enforcement = input.runtime === "claude-code"
+        ? inspectClaude(input.cwd, input.applied, input.fs)
+        : inspectLaunchBoundRuntime(input.runtime, input.applied);
+    return {
+        transport: { state: "healthy" },
+        cwdRead: { state: cwdReadState(input.fs, input.cwd) },
+        commandPath: { state: commandPathState(input.fs, input.runtime) },
+        enforcement,
+        observedAt: (input.now?.() ?? new Date()).toISOString(),
+    };
+}
+export function renderPermissionDriftSummary(diagnostic) {
+    const axisLabel = diagnostic.enforcement.axis === "resource_trust"
+        ? "resource trust"
+        : diagnostic.enforcement.axis;
+    const effective = typeof diagnostic.enforcement.effective === "object" && diagnostic.enforcement.effective !== null
+        ? diagnostic.enforcement.effective.defaultMode
+        : diagnostic.enforcement.effective;
+    const pieces = [
+        `transport: ${diagnostic.transport.state}`,
+        `cwd/read: ${diagnostic.cwdRead.state}`,
+        `command/PATH: ${diagnostic.commandPath.state}`,
+        `${axisLabel}: ${diagnostic.enforcement.state.toUpperCase()}`,
+    ];
+    if (diagnostic.enforcement.expected)
+        pieces.push(`expected=${diagnostic.enforcement.expected}`);
+    if (effective)
+        pieces.push(`effective=${effective}`);
+    if (diagnostic.enforcement.sourcePath)
+        pieces.push(`source=${diagnostic.enforcement.sourcePath}`);
+    if (diagnostic.enforcement.reason)
+        pieces.push(`reason=${diagnostic.enforcement.reason}`);
+    return pieces.join(" · ");
+}
+//# sourceMappingURL=permission-drift.js.map

package/daemon/dist/domain/permission-drift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-drift.js","sourceRoot":"","sources":["../../src/domain/permission-drift.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,WAAW,CAAC;AAkDjC,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACvD,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,GAAG,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,+BAA+B,EAAE,CAAC;QACpD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,gCAAgC,EAAE,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACvG,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;AAC/H,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnD,IAAI,UAAU,KAAK,oBAAoB,EAAE,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,UAAU,KAAK,uBAAuB,EAAE,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAClH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;AACtH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAA+B;IACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACpF,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,IAAI,OAAO,KAAK,aAAa;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,EAAqB,EAAE,GAAkB;IAC7D,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAqB,EAAE,OAAe;IAC9D,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3C,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAuB,EACvB,QAAuB,EACvB,UAAyB,EACzB,MAAc;IAEd,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3F,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,aAAa,CACpB,GAAkB,EAClB,OAAwC,EACxC,EAAqB;IAErB,MAAM,QAAQ,GAAG,OAAO,EAAE,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;IACxE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,aAAa,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChI,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,IAAI,wBAAwB,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,QAAQ,KAAK,mBAAmB,EAAE,CAAC;QACrC,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,SAAS;YAChB,QAAQ;YACR,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,qCAAqC;SAC9C,CAAC;IACJ,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;IAChI,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,wBAAwB,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,WAAW,GAAI,MAAkC,CAAC,WAAW,CAAC;IACpE,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1F,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC;IACjJ,CAAC;IACD,MAAM,MAAM,GAAG,WAAsC,CAAC;IACtD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACvC,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,cAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,EAAE,CAAC,qBAAqB,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,2BAA2B,CAAC,CAAC;QAC7F,CAAC;QACD,cAAc,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,2BAA2B,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,0BAA0B,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,gCAAgC,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9C,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,mBAAmB,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,SAAS,GAA8B,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC/E,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;QACrD,QAAQ;QACR,SAAS;QACT,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,OAAe,EACf,OAAwC;IAExC,MAAM,IAAI,GAAsB,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACzH,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACvH,OAAO,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,IAAI,wBAAwB,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,OAAO,CAAC,KAAK;QACvB,SAAS,EAAE,OAAO,CAAC,KAAK;QACxB,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,kCAAkC;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAMtC;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,KAAK,aAAa;QACjD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QACnD,CAAC,CAAC,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO;QACL,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;QAC/B,OAAO,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;QACrD,WAAW,EAAE,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;QACjE,WAAW;QACX,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;KACxD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,UAAqC;IAChF,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,KAAK,gBAAgB;QAChE,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC;IAChC,MAAM,SAAS,GAAG,OAAO,UAAU,CAAC,WAAW,CAAC,SAAS,KAAK,QAAQ,IAAI,UAAU,CAAC,WAAW,CAAC,SAAS,KAAK,IAAI;QACjH,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,WAAW;QAC9C,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC;IACrC,MAAM,MAAM,GAAG;QACb,cAAc,UAAU,CAAC,SAAS,CAAC,KAAK,EAAE;QAC1C,aAAa,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE;QACvC,iBAAiB,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE;QAC/C,GAAG,SAAS,KAAK,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE;KAC9D,CAAC;IACF,IAAI,UAAU,CAAC,WAAW,CAAC,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChG,IAAI,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,aAAa,SAAS,EAAE,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,WAAW,CAAC,UAAU;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC;IAClG,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}

package/daemon/dist/domain/predecessor-recap-resolver.d.ts

@@ -0,0 +1,26 @@
+import { type JsonlExchange } from "./session-jsonl.js";
+import type { PredecessorRecapResolver } from "./seat-handover-service.js";
+export interface PredecessorRecapResolverDeps {
+    /** Claude: the name-keyed sidecar carries `transcript_path` + `session_id`; both ride the read so
+     *  the caller can verify WHOSE record the name currently points at. */
+    readClaudeRecord: (sessionName: string) => {
+        transcriptPath: string | null;
+        sessionId: string | null;
+    };
+    /** Codex: normalized usage carries `rollout_path`; resolve it from the thread id (resume token). */
+    readCodexTranscriptPath: (args: {
+        threadId: string | null;
+        sessionName: string;
+    }) => string | null;
+    /** Look up the departing session's resume token by node + session name (codex thread id; for a
+     *  claude row this is the predecessor's session uuid — the sidecar-ownership verifier). */
+    lookupResumeToken: (nodeId: string, sessionName: string) => string | null;
+    /** Injectable for tests; defaults to the real JSONL parser. */
+    parseExchanges?: (path: string, n: number) => JsonlExchange[];
+    /** Bounded recap size (default 6). */
+    maxExchanges?: number;
+    /** Per-exchange content cap in characters (default 500); over-cap content is visibly truncated. */
+    maxCharsPerExchange?: number;
+}
+export declare function makePredecessorRecapResolver(deps: PredecessorRecapResolverDeps): PredecessorRecapResolver;
+//# sourceMappingURL=predecessor-recap-resolver.d.ts.map

package/daemon/dist/domain/predecessor-recap-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"predecessor-recap-resolver.d.ts","sourceRoot":"","sources":["../../src/domain/predecessor-recap-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,KAAK,EAAE,wBAAwB,EAA8B,MAAM,4BAA4B,CAAC;AAiCvG,MAAM,WAAW,4BAA4B;IAC3C;2EACuE;IACvE,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK;QAAE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACvG,oGAAoG;IACpG,uBAAuB,EAAE,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,GAAG,IAAI,CAAC;IACnG;+FAC2F;IAC3F,iBAAiB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC1E,+DAA+D;IAC/D,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,KAAK,aAAa,EAAE,CAAC;IAC9D,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mGAAmG;IACnG,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAOD,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,4BAA4B,GAAG,wBAAwB,CAiCzG"}

package/daemon/dist/domain/predecessor-recap-resolver.js

@@ -0,0 +1,73 @@
+import { parseJsonlExchanges } from "./session-jsonl.js";
+/**
+ * Production resolver for the seat-handover boot recap: resolve the DEPARTING seat's provider record
+ * path — claude `transcript_path` (via the sidecar, keyed by session name) or codex `rollout_path`
+ * (via the thread, keyed by the departing resume token) — and parse the last N exchanges into a
+ * bounded from-record recap.
+ *
+ * The recap is the PERMANENT claude-runtime leg of scrollback-preserving handover, not an interim
+ * measure: claude-code seats run in the tmux alternate screen, which keeps no scrollback buffer, so
+ * a successor pane can never natively scroll into the predecessor conversation there. (Codex seats
+ * get native scrollback via the in-pane respawn; the recap still renders as a convenience.)
+ *
+ * B16 — the claude leg is RACE-GUARDED and every null is NAMED. The sidecar is keyed by SESSION
+ * NAME, and the cutover reuses the canonical name across generations, so a successor that has
+ * already booted overwrites the very sidecar this resolver queries (the live defect: the resolver
+ * read the successor's fresh sidecar and honestly returned nothing, silently). Two defenses:
+ * the SERVICE now resolves BEFORE the successor launches, and this resolver verifies the sidecar's
+ * session_id against the predecessor's recorded resume token when both are present — a mismatch is
+ * an UNAVAILABLE verdict naming the collision, never a silent null and never someone else's recap.
+ * Every no-recap outcome returns { unavailableReason } so the packet can say what happened
+ * (honest-degraded means LABELED, not silent).
+ *
+ * Bounded on BOTH axes: at most `maxExchanges` exchanges, and each exchange's content is capped at
+ * `maxCharsPerExchange` characters (a single pasted-file or long-form exchange must not flood the
+ * successor pane); truncation is visible and points the reader at the full record. Pure + injected
+ * deps so the runtime-branching + guard handling is unit-tested without a live daemon; startup
+ * wires the real reads.
+ */
+const DEFAULT_MAX_EXCHANGES = 6;
+const DEFAULT_MAX_CHARS_PER_EXCHANGE = 500;
+const TRUNCATION_MARKER = "… [truncated; full text in the predecessor record]";
+function boundExchange(ex, maxChars) {
+    if (ex.content.length <= maxChars)
+        return ex;
+    return { role: ex.role, content: ex.content.slice(0, maxChars) + TRUNCATION_MARKER };
+}
+export function makePredecessorRecapResolver(deps) {
+    const parse = deps.parseExchanges ?? parseJsonlExchanges;
+    const max = deps.maxExchanges ?? DEFAULT_MAX_EXCHANGES;
+    const maxChars = deps.maxCharsPerExchange ?? DEFAULT_MAX_CHARS_PER_EXCHANGE;
+    return ({ nodeId, runtime, sessionName }) => {
+        let path;
+        if (runtime === "codex") {
+            const threadId = deps.lookupResumeToken(nodeId, sessionName);
+            if (!threadId)
+                return { unavailableReason: "no resume token recorded for the departing codex session" };
+            path = deps.readCodexTranscriptPath({ threadId, sessionName });
+            if (!path)
+                return { unavailableReason: `no rollout record found for codex thread ${threadId}` };
+        }
+        else {
+            const record = deps.readClaudeRecord(sessionName);
+            if (!record.transcriptPath) {
+                return { unavailableReason: "the name-keyed context sidecar is missing or carries no transcript_path" };
+            }
+            // Ownership guard: the sidecar must be the PREDECESSOR's, not a same-named successor's.
+            const predecessorToken = deps.lookupResumeToken(nodeId, sessionName);
+            if (predecessorToken && record.sessionId && record.sessionId !== predecessorToken) {
+                return {
+                    unavailableReason: `the name-keyed sidecar belongs to session ${record.sessionId.slice(0, 8)}…, not the departing session ` +
+                        `${predecessorToken.slice(0, 8)}… (canonical-name reuse race — the record path would be the wrong tenure's)`,
+                };
+            }
+            path = record.transcriptPath;
+        }
+        const recap = parse(path, max);
+        if (recap.length === 0) {
+            return { unavailableReason: `the predecessor record at ${path} yielded no user/assistant exchanges (empty, unreadable, or too large to read)` };
+        }
+        return { recap: recap.map((ex) => boundExchange(ex, maxChars)), recordPath: path };
+    };
+}
+//# sourceMappingURL=predecessor-recap-resolver.js.map

package/daemon/dist/domain/predecessor-recap-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"predecessor-recap-resolver.js","sourceRoot":"","sources":["../../src/domain/predecessor-recap-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAsB,MAAM,oBAAoB,CAAC;AAG7E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAC3C,MAAM,iBAAiB,GAAG,oDAAoD,CAAC;AAmB/E,SAAS,aAAa,CAAC,EAAiB,EAAE,QAAgB;IACxD,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC7C,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,iBAAiB,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,IAAkC;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,IAAI,mBAAmB,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,IAAI,qBAAqB,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,IAAI,8BAA8B,CAAC;IAC5E,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,EAA8B,EAAE;QACtE,IAAI,IAAmB,CAAC;QACxB,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAC7D,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,iBAAiB,EAAE,0DAA0D,EAAE,CAAC;YACxG,IAAI,GAAG,IAAI,CAAC,uBAAuB,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,iBAAiB,EAAE,4CAA4C,QAAQ,EAAE,EAAE,CAAC;QAClG,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC3B,OAAO,EAAE,iBAAiB,EAAE,yEAAyE,EAAE,CAAC;YAC1G,CAAC;YACD,wFAAwF;YACxF,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACrE,IAAI,gBAAgB,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;gBAClF,OAAO;oBACL,iBAAiB,EACf,6CAA6C,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,+BAA+B;wBACxG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,6EAA6E;iBAC/G,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC;QAC/B,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,iBAAiB,EAAE,6BAA6B,IAAI,gFAAgF,EAAE,CAAC;QAClJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACrF,CAAC,CAAC;AACJ,CAAC"}

package/daemon/dist/domain/projection-manifest-store.d.ts

@@ -0,0 +1,39 @@
+import type Database from "better-sqlite3";
+export interface ProjectionManifestEntry {
+    targetPath: string;
+    lastHash: string;
+    writtenAt: string;
+    sourceSpec: string | null;
+    category: string | null;
+}
+/**
+ * P20 — accessors for the projection_manifest. `record` is called ON WRITE (the
+ * projector actually wrote content to targetPath); `get` is consulted at
+ * classify-time to discriminate stale-projection (target == last_hash → safe
+ * overwrite) from operator-modified (target diverges from BOTH last_hash and the
+ * new source → protect). Upsert on target_path keeps exactly the LAST write.
+ */
+export declare class ProjectionManifestStore {
+    private readonly db;
+    constructor(db: Database.Database);
+    record(entry: {
+        targetPath: string;
+        lastHash: string;
+        writtenAt: string;
+        sourceSpec?: string | null;
+        category?: string | null;
+    }): void;
+    get(targetPath: string): ProjectionManifestEntry | null;
+    /** Convenience for the discrimination rule: the last-written hash, or null. */
+    lastHash(targetPath: string): string | null;
+    /**
+     * atom-4b — a BOOT-time whole-table readability probe, DISTINCT from a per-lookup throw. When the
+     * projection_manifest is unreadable (missing / migration-failed / corrupt), EVERY `lastHash` lookup
+     * throws → `classifyResourceProjection` returns `operator_conflict` for EVERY divergent projection →
+     * a SILENT protect-ALL degrade in which no projection ever applies. That systemic case is a safe
+     * degrade (no data loss) but must be VISIBLE: boot calls this probe to warn loudly, so an operator
+     * knows projections are held rather than silently discovering none apply. Cheap + NEVER throws.
+     */
+    isReadable(): boolean;
+}
+//# sourceMappingURL=projection-manifest-store.d.ts.map

package/daemon/dist/domain/projection-manifest-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projection-manifest-store.d.ts","sourceRoot":"","sources":["../../src/domain/projection-manifest-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAUD;;;;;;GAMG;AACH,qBAAa,uBAAuB;IACtB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ,CAAC,QAAQ;IAElD,MAAM,CAAC,KAAK,EAAE;QACZ,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,GAAG,IAAI;IAcR,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,uBAAuB,GAAG,IAAI;IAcvD,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAI3C;;;;;;;OAOG;IACH,UAAU,IAAI,OAAO;CAQtB"}