@openrig/cli 0.5.16 → 0.5.17

package/node_modules/@openrig/daemon/dist/domain/permission-drift-observer.js

@@ -1,113 +0,0 @@
-import fs from "node:fs";
-import nodePath from "node:path";
-import { execFile } from "node:child_process";
-import { AppliedLaunchObservationStore } from "./applied-launch-observation-store.js";
-import { diagnoseRuntimePosture, parseClaudePermissionModes, } from "./permission-drift.js";
-function commandAvailable(command) {
-    const pathValue = process.env.PATH;
-    if (!pathValue)
-        return false;
-    for (const entry of pathValue.split(nodePath.delimiter)) {
-        if (!entry)
-            continue;
-        try {
-            fs.accessSync(nodePath.join(entry, command), fs.constants.X_OK);
-            return true;
-        }
-        catch {
-            // Try the next PATH entry.
-        }
-    }
-    return false;
-}
-async function loadClaudePermissionModes() {
-    return await new Promise((resolve) => {
-        execFile("claude", ["--help"], {
-            encoding: "utf8",
-            timeout: 1_000,
-            maxBuffer: 1024 * 1024,
-        }, (error, stdout) => resolve(error ? null : parseClaudePermissionModes(stdout)));
-    });
-}
-/** Warmed outside request handling; cold reads are immediate UNKNOWN. */
-export class ClaudePermissionModeCache {
-    load;
-    ttlMs;
-    now;
-    value = null;
-    loading = false;
-    loadedAt = 0;
-    constructor(load = loadClaudePermissionModes, ttlMs = 60_000, now = Date.now) {
-        this.load = load;
-        this.ttlMs = ttlMs;
-        this.now = now;
-    }
-    warm() {
-        if (this.loading || (this.loadedAt > 0 && this.now() - this.loadedAt < this.ttlMs))
-            return;
-        this.loading = true;
-        void this.load()
-            .then((value) => { this.value = value; })
-            .catch(() => { this.value = null; })
-            .finally(() => {
-            this.loadedAt = this.now();
-            this.loading = false;
-        });
-    }
-    read() {
-        this.warm();
-        return this.value;
-    }
-}
-function productionFs(permissionModes, accessSync) {
-    return {
-        readFile: (path) => fs.readFileSync(path, "utf8"),
-        cwdReadable: (path) => {
-            try {
-                accessSync(path, fs.constants.R_OK);
-                return true;
-            }
-            catch (error) {
-                const code = error.code;
-                if (code === "EACCES" || code === "EPERM")
-                    return false;
-                throw error;
-            }
-        },
-        commandAvailable,
-        claudePermissionModes: () => permissionModes.read(),
-    };
-}
-/** Strict, read-only, generation-aware observer for an explicitly requested seat. */
-export class PermissionDriftObserver {
-    input;
-    observations;
-    fs;
-    now;
-    constructor(input) {
-        this.input = input;
-        this.observations = new AppliedLaunchObservationStore(input.db);
-        // Hermeticity (hotfix qitem-20260822230440-da0d2ad6 FIX 2): construction no
-        // longer eagerly warms the mode cache — `read()` self-warms (see the cache),
-        // so the eager call added nothing but an execFile("claude","--help") from
-        // every constructed-but-unconsulted observer (the daemon test suite built
-        // ~72 such apps per run). The production daemon keeps its boot-time warm:
-        // startup.ts constructs the observer with an explicitly warmed cache.
-        const permissionModes = input.permissionModes ?? new ClaudePermissionModeCache();
-        this.fs = input.fs ?? productionFs(permissionModes, input.accessSync ?? ((path, mode) => fs.accessSync(path, mode)));
-        this.now = input.now;
-    }
-    diagnose(nodeId) {
-        const node = this.input.db.prepare("SELECT runtime, cwd FROM nodes WHERE id = ?").get(nodeId);
-        if (!node)
-            return null;
-        return diagnoseRuntimePosture({
-            runtime: node.runtime ?? "unknown",
-            cwd: node.cwd,
-            applied: this.observations.readCurrent(nodeId),
-            fs: this.fs,
-            now: this.now,
-        });
-    }
-}
-//# sourceMappingURL=permission-drift-observer.js.map

package/node_modules/@openrig/daemon/dist/domain/permission-drift-observer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"permission-drift-observer.js","sourceRoot":"","sources":["../../src/domain/permission-drift-observer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAG3B,MAAM,uBAAuB,CAAC;AAM/B,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IACnC,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,yBAAyB;IACtC,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;YAC7B,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,IAAI,GAAG,IAAI;SACvB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,MAAM,OAAO,yBAAyB;IAMjB;IACA;IACA;IAPX,KAAK,GAAoB,IAAI,CAAC;IAC9B,OAAO,GAAG,KAAK,CAAC;IAChB,QAAQ,GAAG,CAAC,CAAC;IAErB,YACmB,OAAuC,yBAAyB,EAChE,QAAQ,MAAM,EACd,MAAoB,IAAI,CAAC,GAAG;QAF5B,SAAI,GAAJ,IAAI,CAA4D;QAChE,UAAK,GAAL,KAAK,CAAS;QACd,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ,IAAI;QACF,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO;QAC3F,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,KAAK,IAAI,CAAC,IAAI,EAAE;aACb,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;aACxC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;aACnC,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC,CAAC,CAAC;IACP,CAAC;IAED,IAAI;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;CACF;AAID,SAAS,YAAY,CAAC,eAA0C,EAAE,UAAsB;IACtF,OAAO;QACL,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;QACjD,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YACpB,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACpC,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;gBACnD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO;oBAAE,OAAO,KAAK,CAAC;gBACxD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,gBAAgB;QAChB,qBAAqB,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE;KACpD,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,OAAO,uBAAuB;IAMf;IALF,YAAY,CAAgC;IAC5C,EAAE,CAAoB;IACtB,GAAG,CAAc;IAElC,YACmB,KAMhB;QANgB,UAAK,GAAL,KAAK,CAMrB;QAED,IAAI,CAAC,YAAY,GAAG,IAAI,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChE,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,IAAI,yBAAyB,EAAE,CAAC;QACjF,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,YAAY,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACrH,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACvB,CAAC;IAED,QAAQ,CAAC,MAAc;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC,GAAG,CAAC,MAAM,CAG/E,CAAC;QACd,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,sBAAsB,CAAC;YAC5B,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS;YAClC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC;YAC9C,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;IACL,CAAC;CACF"}

package/node_modules/@openrig/daemon/dist/domain/permission-drift.d.ts

@@ -1,60 +0,0 @@
-export type AppliedLaunchAxis = "permission" | "sandbox" | "resource_trust" | "not_applicable";
-export type AppliedLaunchState = "observed" | "unknown";
-export interface AppliedLaunchObservation {
-    runtime: string;
-    axis: AppliedLaunchAxis;
-    state: AppliedLaunchState;
-    value: string | null;
-    reason?: string;
-}
-export type TransportState = "healthy" | "connect" | "timeout" | "response";
-export type CwdReadState = "visible" | "denied" | "unknown";
-export type CommandPathState = "available" | "missing" | "unknown";
-export type EnforcementState = "aligned" | "drift" | "unknown";
-export interface EffectiveClaudePermission {
-    defaultMode: string;
-    allow: string[];
-    ask: string[];
-    deny: string[];
-}
-export interface RuntimeEnforcementDiagnostic {
-    axis: AppliedLaunchAxis;
-    state: EnforcementState;
-    expected: string | null;
-    effective: string | EffectiveClaudePermission | null;
-    sourcePath: string | null;
-    reason?: string;
-}
-export interface PermissionDriftDiagnostic {
-    transport: {
-        state: TransportState;
-    };
-    cwdRead: {
-        state: CwdReadState;
-    };
-    commandPath: {
-        state: CommandPathState;
-    };
-    enforcement: RuntimeEnforcementDiagnostic;
-    observedAt: string;
-}
-export interface PermissionDriftFs {
-    readFile(path: string): string;
-    cwdReadable(path: string): boolean | null;
-    commandAvailable(command: string): boolean | null;
-    /** Live harness-derived Claude permission-mode vocabulary. null = unresolved. */
-    claudePermissionModes(): string[] | null;
-}
-export declare function parseClaudePermissionModes(help: string): string[] | null;
-export declare function observeClaudePermission(flag: string): AppliedLaunchObservation;
-export declare function observeCodexSandbox(arg: string): AppliedLaunchObservation;
-export declare function observePiResourceTrust(trust: "approve" | "no-approve"): AppliedLaunchObservation;
-export declare function diagnoseRuntimePosture(input: {
-    runtime: string;
-    cwd: string | null;
-    applied: AppliedLaunchObservation | null;
-    fs: PermissionDriftFs;
-    now?: () => Date;
-}): PermissionDriftDiagnostic;
-export declare function renderPermissionDriftSummary(diagnostic: PermissionDriftDiagnostic): string;
-//# sourceMappingURL=permission-drift.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/permission-drift.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permission-drift.d.ts","sourceRoot":"","sources":["../../src/domain/permission-drift.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,SAAS,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;AAC/F,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AAC5E,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAC5D,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AACnE,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;AAE/D,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,yBAAyB,GAAG,IAAI,CAAC;IACrD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE;QAAE,KAAK,EAAE,cAAc,CAAA;KAAE,CAAC;IACrC,OAAO,EAAE;QAAE,KAAK,EAAE,YAAY,CAAA;KAAE,CAAC;IACjC,WAAW,EAAE;QAAE,KAAK,EAAE,gBAAgB,CAAA;KAAE,CAAC;IACzC,WAAW,EAAE,4BAA4B,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAC1C,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAClD,iFAAiF;IACjF,qBAAqB,IAAI,MAAM,EAAE,GAAG,IAAI,CAAC;CAC1C;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAQxE;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,CAQ9E;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,wBAAwB,CAYzE;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,SAAS,GAAG,YAAY,GAAG,wBAAwB,CAEhG;AAoJD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAAC;IACzC,EAAE,EAAE,iBAAiB,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,GAAG,yBAAyB,CAW5B;AAED,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,yBAAyB,GAAG,MAAM,CAkB1F"}

package/node_modules/@openrig/daemon/dist/domain/permission-drift.js

@@ -1,208 +0,0 @@
-import nodePath from "node:path";
-export function parseClaudePermissionModes(help) {
-    const start = help.indexOf("--permission-mode <mode>");
-    if (start < 0)
-        return null;
-    const block = help.slice(start, start + 600);
-    const choices = block.match(/choices:\s*([^)]+)\)/)?.[1];
-    if (!choices)
-        return null;
-    const values = [...choices.matchAll(/"([^"]+)"/g)].map((match) => match[1]);
-    return values.length > 0 ? values : null;
-}
-export function observeClaudePermission(flag) {
-    if (flag.trim() === "--permission-mode acceptEdits") {
-        return { runtime: "claude-code", axis: "permission", state: "observed", value: "acceptEdits" };
-    }
-    if (flag.trim() === "--dangerously-skip-permissions") {
-        return { runtime: "claude-code", axis: "permission", state: "observed", value: "bypassPermissions" };
-    }
-    return { runtime: "claude-code", axis: "permission", state: "unknown", value: null, reason: "unrecognized_launch_argument" };
-}
-export function observeCodexSandbox(arg) {
-    const normalized = arg.trim().replace(/\s+/g, " ");
-    if (normalized === "-s workspace-write") {
-        return { runtime: "codex", axis: "sandbox", state: "observed", value: "workspace-write" };
-    }
-    if (normalized === "-s danger-full-access") {
-        return { runtime: "codex", axis: "sandbox", state: "observed", value: "danger-full-access" };
-    }
-    if (normalized.startsWith("-p ")) {
-        return { runtime: "codex", axis: "sandbox", state: "unknown", value: null, reason: "named_profile_unresolved" };
-    }
-    return { runtime: "codex", axis: "sandbox", state: "unknown", value: null, reason: "unrecognized_launch_argument" };
-}
-export function observePiResourceTrust(trust) {
-    return { runtime: "pi", axis: "resource_trust", state: "observed", value: trust };
-}
-function runtimeCommand(runtime) {
-    if (runtime === "claude-code")
-        return "claude";
-    if (runtime === "codex")
-        return "codex";
-    if (runtime === "pi")
-        return "pi";
-    return null;
-}
-function cwdReadState(fs, cwd) {
-    if (!cwd)
-        return "unknown";
-    try {
-        const value = fs.cwdReadable(cwd);
-        return value === true ? "visible" : value === false ? "denied" : "unknown";
-    }
-    catch {
-        return "unknown";
-    }
-}
-function commandPathState(fs, runtime) {
-    const command = runtimeCommand(runtime);
-    if (!command)
-        return "unknown";
-    try {
-        const value = fs.commandAvailable(command);
-        return value === true ? "available" : value === false ? "missing" : "unknown";
-    }
-    catch {
-        return "unknown";
-    }
-}
-function unknownEnforcement(axis, expected, sourcePath, reason) {
-    return { axis, state: "unknown", expected, effective: null, sourcePath, reason };
-}
-function parseStringArray(value) {
-    if (value === undefined)
-        return [];
-    if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string"))
-        return null;
-    return [...value];
-}
-function inspectClaude(cwd, applied, fs) {
-    const expected = applied?.state === "observed" ? applied.value : null;
-    if (!cwd) {
-        return unknownEnforcement("permission", expected, null, "cwd_unknown");
-    }
-    const sourcePath = nodePath.join(cwd, ".claude", "settings.local.json");
-    if (!applied || applied.runtime !== "claude-code" || applied.axis !== "permission" || applied.state !== "observed" || !expected) {
-        return unknownEnforcement("permission", expected, sourcePath, applied?.reason ?? "applied_launch_unknown");
-    }
-    if (expected === "bypassPermissions") {
-        return {
-            axis: "permission",
-            state: "aligned",
-            expected,
-            effective: expected,
-            sourcePath: null,
-            reason: "launch_bypasses_project_permissions",
-        };
-    }
-    let raw;
-    try {
-        raw = fs.readFile(sourcePath);
-    }
-    catch (error) {
-        const code = error.code;
-        return unknownEnforcement("permission", expected, sourcePath, code === "ENOENT" ? "settings_missing" : "settings_unreadable");
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        return unknownEnforcement("permission", expected, sourcePath, "settings_unparseable");
-    }
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-        return unknownEnforcement("permission", expected, sourcePath, "settings_invalid_shape");
-    }
-    const permissions = parsed.permissions;
-    if (typeof permissions !== "object" || permissions === null || Array.isArray(permissions)) {
-        return unknownEnforcement("permission", expected, sourcePath, permissions === undefined ? "permissions_missing" : "permissions_invalid_shape");
-    }
-    const record = permissions;
-    const defaultMode = record.defaultMode;
-    if (typeof defaultMode !== "string") {
-        return unknownEnforcement("permission", expected, sourcePath, "default_mode_missing");
-    }
-    let supportedModes;
-    try {
-        const liveModes = fs.claudePermissionModes();
-        if (!liveModes || liveModes.length === 0) {
-            return unknownEnforcement("permission", expected, sourcePath, "harness_semantics_unknown");
-        }
-        supportedModes = new Set(liveModes);
-    }
-    catch {
-        return unknownEnforcement("permission", expected, sourcePath, "harness_semantics_unknown");
-    }
-    if (!supportedModes.has(defaultMode)) {
-        return unknownEnforcement("permission", expected, sourcePath, "unsupported_default_mode");
-    }
-    const allow = parseStringArray(record.allow);
-    const ask = parseStringArray(record.ask);
-    const deny = parseStringArray(record.deny);
-    if (!allow || !ask || !deny) {
-        return unknownEnforcement("permission", expected, sourcePath, "permission_rules_invalid_shape");
-    }
-    const denySet = new Set(deny);
-    if (allow.some((entry) => denySet.has(entry))) {
-        return unknownEnforcement("permission", expected, sourcePath, "conflicting_rules");
-    }
-    const effective = { defaultMode, allow, ask, deny };
-    return {
-        axis: "permission",
-        state: defaultMode === expected ? "aligned" : "drift",
-        expected,
-        effective,
-        sourcePath,
-    };
-}
-function inspectLaunchBoundRuntime(runtime, applied) {
-    const axis = runtime === "codex" ? "sandbox" : runtime === "pi" ? "resource_trust" : "not_applicable";
-    if (!applied || applied.runtime !== runtime || applied.axis !== axis || applied.state !== "observed" || !applied.value) {
-        return unknownEnforcement(axis, null, null, applied?.reason ?? "applied_launch_unknown");
-    }
-    return {
-        axis,
-        state: "aligned",
-        expected: applied.value,
-        effective: applied.value,
-        sourcePath: null,
-        reason: "generation_matched_launch_effect",
-    };
-}
-export function diagnoseRuntimePosture(input) {
-    const enforcement = input.runtime === "claude-code"
-        ? inspectClaude(input.cwd, input.applied, input.fs)
-        : inspectLaunchBoundRuntime(input.runtime, input.applied);
-    return {
-        transport: { state: "healthy" },
-        cwdRead: { state: cwdReadState(input.fs, input.cwd) },
-        commandPath: { state: commandPathState(input.fs, input.runtime) },
-        enforcement,
-        observedAt: (input.now?.() ?? new Date()).toISOString(),
-    };
-}
-export function renderPermissionDriftSummary(diagnostic) {
-    const axisLabel = diagnostic.enforcement.axis === "resource_trust"
-        ? "resource trust"
-        : diagnostic.enforcement.axis;
-    const effective = typeof diagnostic.enforcement.effective === "object" && diagnostic.enforcement.effective !== null
-        ? diagnostic.enforcement.effective.defaultMode
-        : diagnostic.enforcement.effective;
-    const pieces = [
-        `transport: ${diagnostic.transport.state}`,
-        `cwd/read: ${diagnostic.cwdRead.state}`,
-        `command/PATH: ${diagnostic.commandPath.state}`,
-        `${axisLabel}: ${diagnostic.enforcement.state.toUpperCase()}`,
-    ];
-    if (diagnostic.enforcement.expected)
-        pieces.push(`expected=${diagnostic.enforcement.expected}`);
-    if (effective)
-        pieces.push(`effective=${effective}`);
-    if (diagnostic.enforcement.sourcePath)
-        pieces.push(`source=${diagnostic.enforcement.sourcePath}`);
-    if (diagnostic.enforcement.reason)
-        pieces.push(`reason=${diagnostic.enforcement.reason}`);
-    return pieces.join(" · ");
-}
-//# sourceMappingURL=permission-drift.js.map

package/node_modules/@openrig/daemon/dist/domain/permission-drift.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"permission-drift.js","sourceRoot":"","sources":["../../src/domain/permission-drift.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,WAAW,CAAC;AAkDjC,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACvD,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,GAAG,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,+BAA+B,EAAE,CAAC;QACpD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,gCAAgC,EAAE,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACvG,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;AAC/H,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnD,IAAI,UAAU,KAAK,oBAAoB,EAAE,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,UAAU,KAAK,uBAAuB,EAAE,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAClH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;AACtH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAA+B;IACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACpF,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,IAAI,OAAO,KAAK,aAAa;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,EAAqB,EAAE,GAAkB;IAC7D,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAqB,EAAE,OAAe;IAC9D,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3C,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAuB,EACvB,QAAuB,EACvB,UAAyB,EACzB,MAAc;IAEd,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3F,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,aAAa,CACpB,GAAkB,EAClB,OAAwC,EACxC,EAAqB;IAErB,MAAM,QAAQ,GAAG,OAAO,EAAE,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;IACxE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,aAAa,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChI,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,IAAI,wBAAwB,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,QAAQ,KAAK,mBAAmB,EAAE,CAAC;QACrC,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,SAAS;YAChB,QAAQ;YACR,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,qCAAqC;SAC9C,CAAC;IACJ,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;IAChI,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,wBAAwB,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,WAAW,GAAI,MAAkC,CAAC,WAAW,CAAC;IACpE,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1F,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC;IACjJ,CAAC;IACD,MAAM,MAAM,GAAG,WAAsC,CAAC;IACtD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACvC,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,cAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,EAAE,CAAC,qBAAqB,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,2BAA2B,CAAC,CAAC;QAC7F,CAAC;QACD,cAAc,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,2BAA2B,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,0BAA0B,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,gCAAgC,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9C,OAAO,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,mBAAmB,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,SAAS,GAA8B,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC/E,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;QACrD,QAAQ;QACR,SAAS;QACT,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,OAAe,EACf,OAAwC;IAExC,MAAM,IAAI,GAAsB,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACzH,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACvH,OAAO,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,IAAI,wBAAwB,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,OAAO,CAAC,KAAK;QACvB,SAAS,EAAE,OAAO,CAAC,KAAK;QACxB,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,kCAAkC;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAMtC;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,KAAK,aAAa;QACjD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QACnD,CAAC,CAAC,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO;QACL,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;QAC/B,OAAO,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;QACrD,WAAW,EAAE,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;QACjE,WAAW;QACX,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;KACxD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,UAAqC;IAChF,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,KAAK,gBAAgB;QAChE,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC;IAChC,MAAM,SAAS,GAAG,OAAO,UAAU,CAAC,WAAW,CAAC,SAAS,KAAK,QAAQ,IAAI,UAAU,CAAC,WAAW,CAAC,SAAS,KAAK,IAAI;QACjH,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,WAAW;QAC9C,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC;IACrC,MAAM,MAAM,GAAG;QACb,cAAc,UAAU,CAAC,SAAS,CAAC,KAAK,EAAE;QAC1C,aAAa,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE;QACvC,iBAAiB,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE;QAC/C,GAAG,SAAS,KAAK,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE;KAC9D,CAAC;IACF,IAAI,UAAU,CAAC,WAAW,CAAC,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChG,IAAI,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,aAAa,SAAS,EAAE,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,WAAW,CAAC,UAAU;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC;IAClG,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/permission-policy/policy-ref.d.ts

@@ -1,89 +0,0 @@
-import type { LaunchPosture, PolicySurface } from "./policy-spec.js";
-/** The packaged read-only built-in policy set (README v4: 3 Policy-Mode specs + Operator/YOLO). */
-export declare const BUILTIN_POLICY_NAMES: readonly ["locked", "standard", "open", "yolo"];
-export type BuiltinPolicyName = (typeof BUILTIN_POLICY_NAMES)[number];
-/** deliberate_none: the ruled amendment 5f37e40f — the recorded choice; never file-backed. */
-export type PolicyRefOrigin = "builtin" | "custom" | "deliberate_none";
-export interface ResolvedPolicyRef {
-    /** The ref string, preserved verbatim (travels with the spec through the state). */
-    ref: string;
-    origin: PolicyRefOrigin;
-    /** Present when origin === "builtin": the validated built-in name. */
-    builtinName?: BuiltinPolicyName;
-}
-/**
- * Validate + classify a permission_policy REF. Returns a STRUCTURED error string for an invalid ref
- * (an invalid ref is a spec DEFECT, never a silent floor fallback), or null when valid. ABSENT is the
- * caller's concern (only pass a present value here). `label` prefixes the error for the surfacing
- * layer (matches the RigSpec validate convention, e.g. "permission_policy" / "pods[0].members[1].
- * permission_policy").
- */
-export declare function validatePermissionPolicyRef(value: unknown, label: string): string | null;
-/**
- * Classify a VALID ref (call validatePermissionPolicyRef first). Preserves + surfaces origin, never
- * silently reclassifies (origin honesty). Never throws on a validated ref.
- */
-export declare function classifyPermissionPolicyRef(value: string): ResolvedPolicyRef;
-/**
- * A restart-stable resolved attachment (dev-guard early ruling, 2026-08-04): persisting only the raw
- * relative ref is NOT restart-complete. We carry the raw `ref` (for export truth + later skill apply)
- * PLUS `resolvedTarget` (canonical package identifier for built-ins; the absolute resolved path for
- * custom) + `declaringDir` (custom) + `origin`, so a restore can reopen/validate the custom policy
- * and re-derive surface + launch_posture without the original in-memory RigSpec.
- */
-export interface ResolvedPolicyAttachment {
-    /** Raw ref, preserved verbatim for export + skill apply. */
-    ref: string;
-    origin: PolicyRefOrigin;
-    /** origin=builtin: the validated built-in name. */
-    builtinName?: BuiltinPolicyName;
-    /** custom: the absolute resolved path. builtin: the canonical shipped package-copy path once the
-     * packaging leg rules it (PM lane c76c7153) — ABSENT until then; NEVER a `builtin:<name>` echo of
-     * the raw ref (dev-guard correction 2: the ref is persisted separately for export; duplicating it
-     * here is not restart-stable provenance). */
-    resolvedTarget?: string;
-    /** origin=custom: the canonical (absolute) declaring RigSpec directory — restart-stable provenance. */
-    declaringDir?: string;
-    /** The resolved policy surface, when content was resolvable (custom) or known (built-in). */
-    surface?: PolicySurface;
-    /** Flag-surface launch posture for per-seat binding (floor | full_bypass). */
-    launchPosture: LaunchPosture;
-    /** Guard round-2 (8232199a): TRUE only when custom CONTENT resolution genuinely
-     *  succeeded with USABLE semantics — parse OK + known surface + (flag ⇒ a valid
-     *  launch_posture). Restore trusts a re-derivation ONLY when this is true; otherwise
-     *  the PERSISTED posture carries. Builtins: always true (name-derived semantics). */
-    contentResolved: boolean;
-}
-/** Injected reader so resolution is testable + does not hard-couple the module to fs. Throws when
- *  the target is missing/unreadable (resolver treats that as an advisory floor, provenance kept). */
-export interface PolicyResolveDeps {
-    readFile: (absolutePath: string) => string;
-}
-/**
- * The SINGLE mapping point for the built-in policies' canonical shipped package-copy path —
- * PM-RULED (inline ruling via dev-guard NOT-CLEAR at 9e94c274, lane c76c7153):
- *   repo source (future):   packages/daemon/policies/builtin/<name>.policy.md
- *   provenance target:      policies/builtin/<name>.policy.md  (package-relative;
- *                           module-relative at runtime)
- * The raw `builtin:<name>` ref stays separate (export truth); this target is the restart-
- * stable provenance. Built-in CONTENT stays a later leg — no asset read or copy here.
- */
-export declare function builtinPackageTarget(name: BuiltinPolicyName): string;
-/**
- * Resolve a VALIDATED, present ref (call validatePermissionPolicyRef first) into a restart-stable
- * attachment. `declaringDir` is the canonical directory of the RigSpec that declared the ref (custom
- * refs resolve relative to it — README v4 A2). Flag-surface CONTENT resolution is CORE-owned (guard
- * ruling): a custom `surface: flag` policy's `launch_posture` (floor|full_bypass) is read here.
- *   - built-in: name-derived posture bounded to the locked set (yolo → full_bypass, else floor);
- *     origin + canonical `builtin:<name>` target preserved. Package ASSET existence is a later leg.
- *   - custom: resolve relative to declaringDir, read + parse (Seam A), derive surface; flag →
- *     its launch_posture; config → floor (config-surface CONTENT application is deferred to the
- *     skill; no config write here). Unreadable/invalid → advisory floor, provenance still preserved.
- */
-export declare function resolvePermissionPolicyAttachment(ref: string, declaringDir: string, deps: PolicyResolveDeps): ResolvedPolicyAttachment;
-/**
- * Precedence: a per-member ref overrides the rig-level ref; absence at both is undefined (= floor).
- * member > rig > floor (README v4 + IMPL-PLAN). No pod level exists in the spec surface.
- */
-export declare function resolvePermissionPolicyRefValue(memberRef: string | null | undefined, rigRef: string | null | undefined): string | undefined;
-//# sourceMappingURL=policy-ref.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/permission-policy/policy-ref.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy-ref.d.ts","sourceRoot":"","sources":["../../../src/domain/permission-policy/policy-ref.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAErE,mGAAmG;AACnG,eAAO,MAAM,oBAAoB,iDAAkD,CAAC;AACpF,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AACtE,8FAA8F;AAC9F,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,QAAQ,GAAG,iBAAiB,CAAC;AAIvE,MAAM,WAAW,iBAAiB;IAChC,oFAAoF;IACpF,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,eAAe,CAAC;IACxB,sEAAsE;IACtE,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC;AAMD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsCxF;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAK5E;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,eAAe,CAAC;IACxB,mDAAmD;IACnD,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC;;;iDAG6C;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uGAAuG;IACvG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,8EAA8E;IAC9E,aAAa,EAAE,aAAa,CAAC;IAC7B;;;yFAGqF;IACrF,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED;qGACqG;AACrG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;CAC5C;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAEpE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,iBAAiB,GACtB,wBAAwB,CAuD1B;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,MAAM,GAAG,SAAS,CAEpB"}