@orc-brain/core 1.0.0

package/dist/safety/envClassifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envClassifier.js","sourceRoot":"","sources":["../../src/safety/envClassifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,oEAAoE;AACpE,MAAM,QAAQ,GAAgC;IAC5C,WAAW,EAAE,CAAC;IACd,OAAO,EAAE,CAAC;IACV,OAAO,EAAE,CAAC;IACV,UAAU,EAAE,CAAC;CACd,CAAC;AAEF,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,GAAgB;IAC/C,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC;AAC9C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,KAAK,CAAC,CAAc,EAAE,CAAc;IAClD,IAAI,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACxC,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,YAAY,EAAE,CAAC;QACzE,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,uEAAuE;AACvE,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,OAAO,GAAG,IAAI;SACjB,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;SACpC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxB,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,YAAsB;IAEtB,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,GAAG,2CAA2C,CAAC;AAC/D,oEAAoE;AACpE,MAAM,YAAY,GAChB,kFAAkF,CAAC;AAErF,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,uCAAuC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAC5B,gDAAgD,CACjD,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,yBAAyB;IACzB,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC9D,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,cAAwB;IAExB,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,aAAa,CAAC;IACrE,OAAO,SAAS,CAAC;AACnB,CAAC;AAqBD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAiB,EACjB,MAAoB;IAEpB,IAAI,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC;IACzB,MAAM,OAAO,GAAa,CAAC,YAAY,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEzD,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3E,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,oCAAoC,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAChE,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;YAC9B,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,gBAAgB,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AACvC,CAAC"}

package/dist/safety/index.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Safety layer (§8): environment classifier + `PreToolUse` hook + `canUseTool`
+ * callback + mode floor. Registered on *every* worker unconditionally — the
+ * Worker Manager takes one by construction and cannot build a worker without it.
+ *
+ * Defense in depth: the `PreToolUse` hook is the hard guarantee (it runs before
+ * the rest of the permission chain and applies to subagents too), and
+ * `canUseTool` is policy refinement on top. Each is independently sufficient to
+ * stop the canonical accident.
+ */
+import type { CanUseTool, HookCallbackMatcher, HookEvent } from "@anthropic-ai/claude-agent-sdk";
+import type { AuditEvent, Environment, OrchestratorConfig, Ulid } from "@orc-brain/shared";
+import { type DenyDecision } from "./denyRules.js";
+/** Sink that persists audit events to the append-only JSONL log (§8.6). */
+export interface AuditSink {
+    record(event: AuditEvent): void;
+}
+/** Receives blocked tool calls for escalation accounting (§8.5). */
+export interface DenialReporter {
+    recordDenial(d: {
+        run_id: string | null;
+        task_id: string | null;
+        rule_id: string;
+        tool_name: string;
+        input_summary: string;
+        stated_intent?: string | null;
+    }): unknown;
+}
+/** Per-worker context the safety layer needs to gate that worker's tool calls. */
+export interface ScopeSafetyContext {
+    run_id: Ulid | null;
+    task_id: Ulid | null;
+    session_id?: string | null;
+    environment: Environment;
+    cwd: string;
+    path_allowlist: string[];
+    path_denylist: string[];
+}
+/**
+ * The safety layer. One instance per orchestrator; it produces per-worker hook
+ * and `canUseTool` closures bound to a {@link ScopeSafetyContext}.
+ */
+export declare class SafetyLayer {
+    private readonly config;
+    private readonly audit;
+    /** Optional escalation sink; denials are reported for blocking (§8.5). */
+    private readonly escalation?;
+    /** Enforcement can never be silently disabled — always true in this build. */
+    readonly enabled = true;
+    constructor(config: OrchestratorConfig, audit: AuditSink, 
+    /** Optional escalation sink; denials are reported for blocking (§8.5). */
+    escalation?: DenialReporter | undefined);
+    /**
+     * Structural mode floor (§8.3). `bypassPermissions` is unrepresentable in the
+     * Scope type; this asserts the invariant a second time at worker-build time.
+     */
+    assertPermissionMode(mode: string): void;
+    /** Builds the {@link DenyContext} for a scope from its safety context. */
+    private denyContext;
+    /**
+     * SDK-agnostic evaluation of a single tool call (§8.2). This is the pure
+     * decision function; the hook and `canUseTool` closures wrap it. Unit tests
+     * exercise this directly without the SDK.
+     */
+    evaluateToolCall(toolName: string, input: Record<string, unknown>, ctx: ScopeSafetyContext): DenyDecision;
+    /** Emits an audit event with the tool input redacted (§8.6). */
+    private emit;
+    /**
+     * Builds the `PreToolUse` hook for a worker (§8.2). This is the guarantee: it
+     * runs before the rest of the permission chain and denies via
+     * `permissionDecision: "deny"`, which holds even under `acceptEdits`.
+     */
+    buildHooks(ctx: ScopeSafetyContext): Partial<Record<HookEvent, HookCallbackMatcher[]>>;
+    /**
+     * Builds the `canUseTool` callback (§8.3): the second, runtime layer. It
+     * re-checks the same decision and can rewrite inputs. Hooks are the
+     * guarantee; this is policy refinement and defense in depth.
+     */
+    buildCanUseTool(ctx: ScopeSafetyContext): CanUseTool;
+}
+/** Constructs the singleton safety layer (§8). */
+export declare function createSafetyLayer(config: OrchestratorConfig, audit: AuditSink): SafetyLayer;
+//# sourceMappingURL=index.d.ts.map

package/dist/safety/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/safety/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EACV,UAAU,EAEV,mBAAmB,EACnB,SAAS,EAEV,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EACV,UAAU,EAEV,WAAW,EACX,kBAAkB,EAClB,IAAI,EACL,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAKL,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAIxB,2EAA2E;AAC3E,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CACjC;AAED,oEAAoE;AACpE,MAAM,WAAW,cAAc;IAC7B,YAAY,CAAC,CAAC,EAAE;QACd,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,GAAG,OAAO,CAAC;CACb;AAED,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,IAAI,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,WAAW,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAkBD;;;GAGG;AACH,qBAAa,WAAW;IAKpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAP9B,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,QAAQ;gBAGL,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,SAAS;IACjC,0EAA0E;IACzD,UAAU,CAAC,EAAE,cAAc,YAAA;IAG9C;;;OAGG;IACH,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IASxC,0EAA0E;IAC1E,OAAO,CAAC,WAAW;IAUnB;;;;OAIG;IACH,gBAAgB,CACd,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,GAAG,EAAE,kBAAkB,GACtB,YAAY;IAoCf,gEAAgE;IAChE,OAAO,CAAC,IAAI;IAyBZ;;;;OAIG;IACH,UAAU,CACR,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAwDpD;;;;OAIG;IACH,eAAe,CAAC,GAAG,EAAE,kBAAkB,GAAG,UAAU;CAwBrD;AAED,kDAAkD;AAClD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,SAAS,GACf,WAAW,CAEb"}

package/dist/safety/index.js

@@ -0,0 +1,184 @@
+/**
+ * Safety layer (§8): environment classifier + `PreToolUse` hook + `canUseTool`
+ * callback + mode floor. Registered on *every* worker unconditionally — the
+ * Worker Manager takes one by construction and cannot build a worker without it.
+ *
+ * Defense in depth: the `PreToolUse` hook is the hard guarantee (it runs before
+ * the rest of the permission chain and applies to subagents too), and
+ * `canUseTool` is policy refinement on top. Each is independently sufficient to
+ * stop the canonical accident.
+ */
+import { createHash } from "node:crypto";
+import { evaluateBash, evaluatePathRead, evaluatePathWrite, } from "./denyRules.js";
+import { isProductionLike } from "./envClassifier.js";
+import { redactValue } from "./redact.js";
+/** Tools that write to the filesystem and are checked against the allowlist. */
+const WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
+/** SHA-256 hash of a tool input, for correlating audit rows without the payload. */
+function hashInput(input) {
+    return createHash("sha256")
+        .update(JSON.stringify(input) ?? "")
+        .digest("hex");
+}
+/** A single deny reason mapped from a rule match, or null when allowed. */
+function reasonText(decision) {
+    const m = decision.match;
+    return m ? `${m.rule_id} (${m.rule_class}): ${m.reason}` : "policy";
+}
+/**
+ * The safety layer. One instance per orchestrator; it produces per-worker hook
+ * and `canUseTool` closures bound to a {@link ScopeSafetyContext}.
+ */
+export class SafetyLayer {
+    config;
+    audit;
+    escalation;
+    /** Enforcement can never be silently disabled — always true in this build. */
+    enabled = true;
+    constructor(config, audit, 
+    /** Optional escalation sink; denials are reported for blocking (§8.5). */
+    escalation) {
+        this.config = config;
+        this.audit = audit;
+        this.escalation = escalation;
+    }
+    /**
+     * Structural mode floor (§8.3). `bypassPermissions` is unrepresentable in the
+     * Scope type; this asserts the invariant a second time at worker-build time.
+     */
+    assertPermissionMode(mode) {
+        if (mode === "bypassPermissions" || mode === "dontAsk" || mode === "auto") {
+            throw new Error(`SafetyLayer: permission mode '${mode}' is not permitted (§8.3). ` +
+                `Only 'plan', 'default', and 'acceptEdits' may reach a worker.`);
+        }
+    }
+    /** Builds the {@link DenyContext} for a scope from its safety context. */
+    denyContext(ctx) {
+        return {
+            environment: ctx.environment,
+            cwd: ctx.cwd,
+            path_allowlist: ctx.path_allowlist,
+            path_denylist: ctx.path_denylist,
+            dev_posture: this.config.safety.dev_posture,
+        };
+    }
+    /**
+     * SDK-agnostic evaluation of a single tool call (§8.2). This is the pure
+     * decision function; the hook and `canUseTool` closures wrap it. Unit tests
+     * exercise this directly without the SDK.
+     */
+    evaluateToolCall(toolName, input, ctx) {
+        const deny = this.denyContext(ctx);
+        if (toolName === "Bash") {
+            const command = typeof input.command === "string" ? input.command : "";
+            return evaluateBash(command, deny);
+        }
+        if (WRITE_TOOLS.has(toolName)) {
+            const fp = input.file_path ??
+                input.notebook_path ??
+                input.path ??
+                "";
+            return evaluatePathWrite(fp, deny);
+        }
+        if (toolName === "Read") {
+            const fp = input.file_path ?? input.path ?? "";
+            return evaluatePathRead(fp, deny);
+        }
+        // MCP tools: unknown MCP tool in a production scope ⇒ deny (§8.2).
+        if (toolName.startsWith("mcp__")) {
+            if (isProductionLike(ctx.environment)) {
+                return {
+                    verdict: "deny",
+                    match: {
+                        rule_id: "MCP-1",
+                        rule_class: "infra",
+                        reason: "unclassified MCP tool in production scope",
+                    },
+                };
+            }
+            return { verdict: "allow_with_audit", match: null };
+        }
+        return { verdict: "allow", match: null };
+    }
+    /** Emits an audit event with the tool input redacted (§8.6). */
+    emit(kind, ctx, toolName, input, decision, ruleId, detail = null) {
+        const event = {
+            ts: new Date().toISOString(),
+            run_id: ctx.run_id,
+            task_id: ctx.task_id,
+            session_id: ctx.session_id ?? null,
+            kind,
+            tool_name: toolName,
+            tool_input_hash: input === null ? null : hashInput(input),
+            tool_input: redactValue(input),
+            decision,
+            rule_id: ruleId,
+            detail,
+        };
+        this.audit.record(event);
+    }
+    /**
+     * Builds the `PreToolUse` hook for a worker (§8.2). This is the guarantee: it
+     * runs before the rest of the permission chain and denies via
+     * `permissionDecision: "deny"`, which holds even under `acceptEdits`.
+     */
+    buildHooks(ctx) {
+        const hook = async (rawInput) => {
+            if (rawInput.hook_event_name !== "PreToolUse")
+                return { continue: true };
+            const toolName = rawInput.tool_name;
+            const input = (rawInput.tool_input ?? {});
+            const decision = this.evaluateToolCall(toolName, input, ctx);
+            // Every tool call is audited (§8.6).
+            this.emit("tool_call", ctx, toolName, input, decision.verdict, decision.match?.rule_id ?? null);
+            if (decision.verdict === "deny" ||
+                decision.verdict === "require_approval") {
+                this.emit("hook_block", ctx, toolName, input, "deny", decision.match?.rule_id ?? null, { reason: reasonText(decision) });
+                // Report the denial for escalation accounting (§8.5). The hook is the
+                // guarantee layer and runs before canUseTool, so counting here avoids
+                // double-counting the same blocked call.
+                this.escalation?.recordDenial({
+                    run_id: ctx.run_id,
+                    task_id: ctx.task_id,
+                    rule_id: decision.match?.rule_id ?? "policy",
+                    tool_name: toolName,
+                    input_summary: JSON.stringify(redactValue(input)).slice(0, 200),
+                });
+                return {
+                    hookSpecificOutput: {
+                        hookEventName: "PreToolUse",
+                        permissionDecision: "deny",
+                        permissionDecisionReason: `Blocked by orc-brain safety rule ${reasonText(decision)}. ` +
+                            `Do not retry; propose an alternative or mark blocked (§8.5).`,
+                    },
+                };
+            }
+            return { continue: true };
+        };
+        return { PreToolUse: [{ hooks: [hook] }] };
+    }
+    /**
+     * Builds the `canUseTool` callback (§8.3): the second, runtime layer. It
+     * re-checks the same decision and can rewrite inputs. Hooks are the
+     * guarantee; this is policy refinement and defense in depth.
+     */
+    buildCanUseTool(ctx) {
+        return async (toolName, input) => {
+            const decision = this.evaluateToolCall(toolName, input, ctx);
+            if (decision.verdict === "deny" ||
+                decision.verdict === "require_approval") {
+                this.emit("permission_deny", ctx, toolName, input, "deny", decision.match?.rule_id ?? null, { reason: reasonText(decision) });
+                return {
+                    behavior: "deny",
+                    message: `orc-brain: ${reasonText(decision)}`,
+                };
+            }
+            return { behavior: "allow", updatedInput: input };
+        };
+    }
+}
+/** Constructs the singleton safety layer (§8). */
+export function createSafetyLayer(config, audit) {
+    return new SafetyLayer(config, audit);
+}
+//# sourceMappingURL=index.js.map

package/dist/safety/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/safety/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAezC,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,GAGlB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA8B1C,gFAAgF;AAChF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;AAE5E,oFAAoF;AACpF,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SACnC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,2EAA2E;AAC3E,SAAS,UAAU,CAAC,QAAsB;IACxC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC;IACzB,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,UAAU,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,WAAW;IAKH;IACA;IAEA;IAPnB,8EAA8E;IACrE,OAAO,GAAG,IAAI,CAAC;IAExB,YACmB,MAA0B,EAC1B,KAAgB;IACjC,0EAA0E;IACzD,UAA2B;QAH3B,WAAM,GAAN,MAAM,CAAoB;QAC1B,UAAK,GAAL,KAAK,CAAW;QAEhB,eAAU,GAAV,UAAU,CAAiB;IAC3C,CAAC;IAEJ;;;OAGG;IACH,oBAAoB,CAAC,IAAY;QAC/B,IAAI,IAAI,KAAK,mBAAmB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,6BAA6B;gBAChE,+DAA+D,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAClE,WAAW,CAAC,GAAuB;QACzC,OAAO;YACL,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW;SAC5C,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,gBAAgB,CACd,QAAgB,EAChB,KAA8B,EAC9B,GAAuB;QAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAEnC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,EAAE,GACL,KAAK,CAAC,SAAoB;gBAC1B,KAAK,CAAC,aAAwB;gBAC9B,KAAK,CAAC,IAAe;gBACtB,EAAE,CAAC;YACL,OAAO,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,MAAM,EAAE,GAAI,KAAK,CAAC,SAAoB,IAAK,KAAK,CAAC,IAAe,IAAI,EAAE,CAAC;YACvE,OAAO,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,mEAAmE;QACnE,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,IAAI,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,OAAO;oBACL,OAAO,EAAE,MAAM;oBACf,KAAK,EAAE;wBACL,OAAO,EAAE,OAAO;wBAChB,UAAU,EAAE,OAAO;wBACnB,MAAM,EAAE,2CAA2C;qBACpD;iBACF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,gEAAgE;IACxD,IAAI,CACV,IAAe,EACf,GAAuB,EACvB,QAAuB,EACvB,KAAc,EACd,QAAuB,EACvB,MAAqB,EACrB,SAAkB,IAAI;QAEtB,MAAM,KAAK,GAAe;YACxB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;YAClC,IAAI;YACJ,SAAS,EAAE,QAAQ;YACnB,eAAe,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC;YACzD,UAAU,EAAE,WAAW,CAAC,KAAK,CAAC;YAC9B,QAAQ;YACR,OAAO,EAAE,MAAM;YACf,MAAM;SACP,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,UAAU,CACR,GAAuB;QAEvB,MAAM,IAAI,GAAiB,KAAK,EAAE,QAAQ,EAAE,EAAE;YAC5C,IAAI,QAAQ,CAAC,eAAe,KAAK,YAAY;gBAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzE,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC;YACpC,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAA4B,CAAC;YACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAE7D,qCAAqC;YACrC,IAAI,CAAC,IAAI,CACP,WAAW,EACX,GAAG,EACH,QAAQ,EACR,KAAK,EACL,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI,CAChC,CAAC;YAEF,IACE,QAAQ,CAAC,OAAO,KAAK,MAAM;gBAC3B,QAAQ,CAAC,OAAO,KAAK,kBAAkB,EACvC,CAAC;gBACD,IAAI,CAAC,IAAI,CACP,YAAY,EACZ,GAAG,EACH,QAAQ,EACR,KAAK,EACL,MAAM,EACN,QAAQ,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI,EAC/B,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CACjC,CAAC;gBACF,sEAAsE;gBACtE,sEAAsE;gBACtE,yCAAyC;gBACzC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC;oBAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,OAAO,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,IAAI,QAAQ;oBAC5C,SAAS,EAAE,QAAQ;oBACnB,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBAChE,CAAC,CAAC;gBACH,OAAO;oBACL,kBAAkB,EAAE;wBAClB,aAAa,EAAE,YAAY;wBAC3B,kBAAkB,EAAE,MAAM;wBAC1B,wBAAwB,EACtB,oCAAoC,UAAU,CAAC,QAAQ,CAAC,IAAI;4BAC5D,8DAA8D;qBACjE;iBACF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC,CAAC;QAEF,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,GAAuB;QACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,KAAK,EAA6B,EAAE;YAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC7D,IACE,QAAQ,CAAC,OAAO,KAAK,MAAM;gBAC3B,QAAQ,CAAC,OAAO,KAAK,kBAAkB,EACvC,CAAC;gBACD,IAAI,CAAC,IAAI,CACP,iBAAiB,EACjB,GAAG,EACH,QAAQ,EACR,KAAK,EACL,MAAM,EACN,QAAQ,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI,EAC/B,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CACjC,CAAC;gBACF,OAAO;oBACL,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,cAAc,UAAU,CAAC,QAAQ,CAAC,EAAE;iBAC9C,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QACpD,CAAC,CAAC;IACJ,CAAC;CACF;AAED,kDAAkD;AAClD,MAAM,UAAU,iBAAiB,CAC/B,MAA0B,EAC1B,KAAgB;IAEhB,OAAO,IAAI,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACxC,CAAC"}

package/dist/safety/limitSignals.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Rate-limit signal detection (§7.4). The CLI surfaces limits as human-readable
+ * error text ("You've hit your session limit · resets 3:45pm", "…weekly
+ * limit…", "…Opus limit"). There is no confirmed structured error code, so
+ * detection is pattern-matching, isolated here with patterns in config. When
+ * nothing matches but a worker failed with a 429-ish shape, we return
+ * `unknown_limit` and back off anyway — conservative by design.
+ */
+import type { LimitConfig, ModelName } from "@orc-brain/shared";
+/** Kind of limit detected. */
+export type LimitKind = "session_limit" | "weekly_limit" | "model_limit" | "unknown_limit";
+/** A detected rate-limit signal. */
+export interface LimitSignal {
+    kind: LimitKind;
+    /** Which model is quarantined, for `model_limit` (router R7). */
+    model?: ModelName;
+    /** Parsed reset time (epoch ms), if the text carried one. */
+    resets_at?: number;
+    /** The raw matched text, for surfacing in UI/reports. */
+    raw: string;
+}
+/**
+ * Parses a reset clock like "resets 3:45pm" into an epoch-ms timestamp on or
+ * after `now`. Returns undefined when no time is present. `now` is injected so
+ * the function stays pure and testable.
+ */
+export declare function parseResetTime(text: string, now: Date): number | undefined;
+/**
+ * Inspects worker error text for a rate-limit signal (§7.4). `httpish429`
+ * marks a failure that looked like a 429 even if no pattern matched, forcing a
+ * conservative `unknown_limit` back-off.
+ */
+export declare function detectLimitSignal(text: string, config: LimitConfig, now: Date, httpish429?: boolean): LimitSignal | null;
+/** Computes the next back-off delay (ms) for the Nth consecutive limit hit. */
+export declare function backoffDelayMs(attempt: number, config: LimitConfig): number;
+//# sourceMappingURL=limitSignals.d.ts.map

package/dist/safety/limitSignals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limitSignals.d.ts","sourceRoot":"","sources":["../../src/safety/limitSignals.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEhE,8BAA8B;AAC9B,MAAM,MAAM,SAAS,GACnB,eAAe,GAAG,cAAc,GAAG,aAAa,GAAG,eAAe,CAAC;AAErE,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,SAAS,CAAC;IAChB,iEAAiE;IACjE,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;CACb;AAUD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,CAe1E;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,IAAI,EACT,UAAU,UAAQ,GACjB,WAAW,GAAG,IAAI,CA8BpB;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAM3E"}

package/dist/safety/limitSignals.js

@@ -0,0 +1,79 @@
+/**
+ * Rate-limit signal detection (§7.4). The CLI surfaces limits as human-readable
+ * error text ("You've hit your session limit · resets 3:45pm", "…weekly
+ * limit…", "…Opus limit"). There is no confirmed structured error code, so
+ * detection is pattern-matching, isolated here with patterns in config. When
+ * nothing matches but a worker failed with a 429-ish shape, we return
+ * `unknown_limit` and back off anyway — conservative by design.
+ */
+const MODEL_NAMES = ["opus", "sonnet", "haiku"];
+/** Extracts a model name mentioned in the error text, if any. */
+function extractModel(text) {
+    const lower = text.toLowerCase();
+    return MODEL_NAMES.find((m) => lower.includes(`${m} limit`));
+}
+/**
+ * Parses a reset clock like "resets 3:45pm" into an epoch-ms timestamp on or
+ * after `now`. Returns undefined when no time is present. `now` is injected so
+ * the function stays pure and testable.
+ */
+export function parseResetTime(text, now) {
+    const m = text.match(/resets?\s+(?:at\s+)?(\d{1,2})(?::(\d{2}))?\s*(am|pm)?/i);
+    if (!m)
+        return undefined;
+    let hour = Number(m[1]);
+    const minute = m[2] ? Number(m[2]) : 0;
+    const ampm = m[3]?.toLowerCase();
+    if (ampm === "pm" && hour < 12)
+        hour += 12;
+    if (ampm === "am" && hour === 12)
+        hour = 0;
+    const reset = new Date(now);
+    reset.setHours(hour, minute, 0, 0);
+    // If the computed time already passed today, it must be tomorrow.
+    if (reset.getTime() <= now.getTime())
+        reset.setDate(reset.getDate() + 1);
+    return reset.getTime();
+}
+/**
+ * Inspects worker error text for a rate-limit signal (§7.4). `httpish429`
+ * marks a failure that looked like a 429 even if no pattern matched, forcing a
+ * conservative `unknown_limit` back-off.
+ */
+export function detectLimitSignal(text, config, now, httpish429 = false) {
+    const model = new RegExp(config.patterns.model_limit, "i").exec(text);
+    if (model) {
+        return {
+            kind: "model_limit",
+            model: extractModel(text),
+            resets_at: parseResetTime(text, now),
+            raw: model[0],
+        };
+    }
+    const weekly = new RegExp(config.patterns.weekly_limit, "i").exec(text);
+    if (weekly) {
+        return {
+            kind: "weekly_limit",
+            resets_at: parseResetTime(text, now),
+            raw: weekly[0],
+        };
+    }
+    const session = new RegExp(config.patterns.session_limit, "i").exec(text);
+    if (session) {
+        return {
+            kind: "session_limit",
+            resets_at: parseResetTime(text, now),
+            raw: session[0],
+        };
+    }
+    if (httpish429) {
+        return { kind: "unknown_limit", raw: text.slice(0, 200) };
+    }
+    return null;
+}
+/** Computes the next back-off delay (ms) for the Nth consecutive limit hit. */
+export function backoffDelayMs(attempt, config) {
+    const idx = Math.min(attempt, config.backoff_ms.length - 1);
+    return Math.min(config.backoff_ms[idx] ?? config.backoff_cap_ms, config.backoff_cap_ms);
+}
+//# sourceMappingURL=limitSignals.js.map

package/dist/safety/limitSignals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limitSignals.js","sourceRoot":"","sources":["../../src/safety/limitSignals.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAmBH,MAAM,WAAW,GAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAE7D,iEAAiE;AACjE,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAS;IACpD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAClB,wDAAwD,CACzD,CAAC;IACF,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACjC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,GAAG,EAAE;QAAE,IAAI,IAAI,EAAE,CAAC;IAC3C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE;QAAE,IAAI,GAAG,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,kEAAkE;IAClE,IAAI,KAAK,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE;QAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,MAAmB,EACnB,GAAS,EACT,UAAU,GAAG,KAAK;IAElB,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,KAAK,EAAE,CAAC;QACV,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC;YACzB,SAAS,EAAE,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC;YACpC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;SACd,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,SAAS,EAAE,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC;YACpC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;SACf,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC;YACpC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;SAChB,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,MAAmB;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC,GAAG,CACb,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,cAAc,EAC/C,MAAM,CAAC,cAAc,CACtB,CAAC;AACJ,CAAC"}

package/dist/safety/paths.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Path / glob helpers for allowlist enforcement (§8.2, §8.3). Write/Edit targets
+ * and Bash file arguments are resolved to absolute paths and checked against the
+ * scope's `path_allowlist` / `path_denylist` independently of any tool mode.
+ */
+/** Expands a leading `~` to the user's home directory. */
+export declare function expandHome(p: string): string;
+/** Resolves `p` to an absolute path relative to `cwd`, expanding `~`. */
+export declare function toAbsolute(p: string, cwd: string): string;
+/**
+ * Converts a glob to an anchored RegExp. Supports `**` (any depth, including
+ * across `/`), `*` (within a segment), and `?`. Globs are matched against
+ * absolute paths, so a bare glob is first resolved against `cwd`.
+ */
+export declare function globToRegExp(glob: string, cwd: string): RegExp;
+/** True when the absolute `path` is inside directory `dir` (or equal to it). */
+export declare function isInside(path: string, dir: string): boolean;
+/**
+ * True when a glob pattern matches `absPath`. A pattern that names a directory
+ * (no wildcard) also matches everything beneath it, so `src` covers `src/a.ts`.
+ */
+export declare function globMatches(pattern: string, absPath: string, cwd: string): boolean;
+/**
+ * Allowlist/denylist decision for an absolute path (§8.2). Denylist overrides
+ * allowlist. An empty allowlist denies everything (least privilege).
+ */
+export declare function isPathAllowed(absPath: string, allowlist: string[], denylist: string[], cwd: string): boolean;
+/** True when `absPath` is a sensitive credential file (§8.2 credential class). */
+export declare function isCredentialPath(absPath: string): boolean;
+/** True when `absPath` is a dotenv file (`.env`, `.env.production`, …). */
+export declare function isDotenvPath(absPath: string): boolean;
+//# sourceMappingURL=paths.d.ts.map

package/dist/safety/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/safety/paths.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,0DAA0D;AAC1D,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAI5C;AAED,yEAAyE;AACzE,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAGzD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAuB9D;AAED,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAI3D;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,GACV,OAAO,CAOT;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EAAE,EACnB,QAAQ,EAAE,MAAM,EAAE,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAGT;AAcD,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAErD"}

package/dist/safety/paths.js

@@ -0,0 +1,102 @@
+/**
+ * Path / glob helpers for allowlist enforcement (§8.2, §8.3). Write/Edit targets
+ * and Bash file arguments are resolved to absolute paths and checked against the
+ * scope's `path_allowlist` / `path_denylist` independently of any tool mode.
+ */
+import { isAbsolute, resolve } from "node:path";
+import { homedir } from "node:os";
+/** Expands a leading `~` to the user's home directory. */
+export function expandHome(p) {
+    if (p === "~")
+        return homedir();
+    if (p.startsWith("~/"))
+        return resolve(homedir(), p.slice(2));
+    return p;
+}
+/** Resolves `p` to an absolute path relative to `cwd`, expanding `~`. */
+export function toAbsolute(p, cwd) {
+    const expanded = expandHome(p);
+    return isAbsolute(expanded) ? resolve(expanded) : resolve(cwd, expanded);
+}
+/**
+ * Converts a glob to an anchored RegExp. Supports `**` (any depth, including
+ * across `/`), `*` (within a segment), and `?`. Globs are matched against
+ * absolute paths, so a bare glob is first resolved against `cwd`.
+ */
+export function globToRegExp(glob, cwd) {
+    const abs = toAbsolute(glob, cwd);
+    let re = "";
+    for (let i = 0; i < abs.length; i++) {
+        const c = abs[i];
+        if (c === "*") {
+            if (abs[i + 1] === "*") {
+                // `**` → any chars including path separators; consume an optional `/`.
+                re += ".*";
+                i++;
+                if (abs[i + 1] === "/")
+                    i++;
+            }
+            else {
+                re += "[^/]*";
+            }
+        }
+        else if (c === "?") {
+            re += "[^/]";
+        }
+        else if (".+^${}()|[]\\".includes(c)) {
+            re += "\\" + c;
+        }
+        else {
+            re += c;
+        }
+    }
+    return new RegExp(`^${re}$`);
+}
+/** True when the absolute `path` is inside directory `dir` (or equal to it). */
+export function isInside(path, dir) {
+    const p = resolve(path);
+    const d = resolve(dir);
+    return p === d || p.startsWith(d.endsWith("/") ? d : d + "/");
+}
+/**
+ * True when a glob pattern matches `absPath`. A pattern that names a directory
+ * (no wildcard) also matches everything beneath it, so `src` covers `src/a.ts`.
+ */
+export function globMatches(pattern, absPath, cwd) {
+    if (globToRegExp(pattern, cwd).test(absPath))
+        return true;
+    // Directory-prefix semantics for non-wildcard patterns.
+    if (!/[*?]/.test(pattern)) {
+        return isInside(absPath, toAbsolute(pattern, cwd));
+    }
+    return false;
+}
+/**
+ * Allowlist/denylist decision for an absolute path (§8.2). Denylist overrides
+ * allowlist. An empty allowlist denies everything (least privilege).
+ */
+export function isPathAllowed(absPath, allowlist, denylist, cwd) {
+    if (denylist.some((g) => globMatches(g, absPath, cwd)))
+        return false;
+    return allowlist.some((g) => globMatches(g, absPath, cwd));
+}
+/** Credential paths that are never readable regardless of environment (§8.2). */
+const CREDENTIAL_PATTERNS = [
+    /(^|\/)\.ssh(\/|$)/,
+    /(^|\/)\.aws\/credentials$/,
+    /(^|\/)\.aws\/config$/,
+    /(^|\/)\.gnupg(\/|$)/,
+    /(^|\/)\.netrc$/,
+    /(^|\/)\.docker\/config\.json$/,
+    /(^|\/)\.kube\/config$/,
+    /id_rsa|id_ed25519|\.pem$|\.p12$|\.pfx$/,
+];
+/** True when `absPath` is a sensitive credential file (§8.2 credential class). */
+export function isCredentialPath(absPath) {
+    return CREDENTIAL_PATTERNS.some((re) => re.test(absPath));
+}
+/** True when `absPath` is a dotenv file (`.env`, `.env.production`, …). */
+export function isDotenvPath(absPath) {
+    return /(^|\/)\.env(\.[^/]+)?$/.test(absPath);
+}
+//# sourceMappingURL=paths.js.map

package/dist/safety/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/safety/paths.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,0DAA0D;AAC1D,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IAChC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,UAAU,CAAC,CAAS,EAAE,GAAW;IAC/C,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,GAAW;IACpD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACvB,uEAAuE;gBACvE,EAAE,IAAI,IAAI,CAAC;gBACX,CAAC,EAAE,CAAC;gBACJ,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;oBAAE,CAAC,EAAE,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,OAAO,CAAC;YAChB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,EAAE,IAAI,MAAM,CAAC;QACf,CAAC;aAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,GAAW;IAChD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,OAAe,EACf,GAAW;IAEX,IAAI,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,wDAAwD;IACxD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,SAAmB,EACnB,QAAkB,EAClB,GAAW;IAEX,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,iFAAiF;AACjF,MAAM,mBAAmB,GAAa;IACpC,mBAAmB;IACnB,2BAA2B;IAC3B,sBAAsB;IACtB,qBAAqB;IACrB,gBAAgB;IAChB,+BAA+B;IAC/B,uBAAuB;IACvB,wCAAwC;CACzC,CAAC;AAEF,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAChD,CAAC"}

package/dist/safety/redact.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Secret scrubber (§8.6). Tool inputs are redacted before they are written to
+ * the append-only audit log. Pattern-based and conservative: it would rather
+ * over-redact than leak a token.
+ */
+/** Registers a literal value for redaction (spec 003 §R5). Short values are ignored. */
+export declare function registerSecretValue(value: string): void;
+/** Clears runtime-registered secret values. Test-only. */
+export declare function clearRegisteredSecretValues(): void;
+/** Redacts secrets from a plain string. */
+export declare function redactString(input: string): string;
+/**
+ * Deep-redacts secrets from an arbitrary JSON-serializable value, returning a
+ * structurally-identical copy with string leaves scrubbed (§8.6).
+ */
+export declare function redactValue(value: unknown): unknown;
+//# sourceMappingURL=redact.d.ts.map

package/dist/safety/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/safety/redact.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA6CH,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAEvD;AAED,0DAA0D;AAC1D,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED,2CAA2C;AAC3C,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CASlD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CASnD"}