@orc-brain/core 1.0.0

package/dist/plugins/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/plugins/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,wDAAwD;AACxD,MAAM,MAAM,GAAG,mBAAmB,CAAC;AAEnC,0EAA0E;AAC1E,MAAM,OAAO,WAAW;IAMH;IALV,IAAI,CAAS;IACd,MAAM,GAAG,KAAK,CAAC;IAEvB,YACE,QAAgB,EACC,MAAM,OAAO,CAAC,GAAG;QAAjB,QAAG,GAAH,GAAG,CAAc;QAElC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACK,YAAY;QAClB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC,CAAC,iBAAiB;QACjE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,OAAO,CAAC,IAAI,CACV,iBAAiB,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,4CAA4C,IAAI,CAAC,IAAI,EAAE,CAC7G,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,QAAQ;QACd,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE;YAAE,OAAO,EAAE,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,GAAG,GAA2B,EAAE,CAAC;YACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,uCAAuC,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,OAA+B;QAC/C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;YAChE,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,kCAAkC;IACjE,CAAC;IAED,kEAAkE;IAClE,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAa;QAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,uEAAuE,GAAG,GAAG,CAC9E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,CAAC,IAAI,mDAAmD,IAAI,CAAC,IAAI,EAAE,CAC7F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,GAAW;QACf,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,CAAC,IAAI,mDAAmD,IAAI,CAAC,IAAI,EAAE,CAC7F,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAED,8EAA8E;IAC9E,QAAQ;QACN,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,CAAC;CACF"}

package/dist/preflight.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Startup preflight & doctor checks (§2, §13.3). The cardinal rule: billing
+ * must stay on the Max subscription, never pay-as-you-go API. `ANTHROPIC_API_KEY`
+ * (and the provider-routing flags) must not be set; if they are, we refuse.
+ */
+/** Result of the provider-env check. */
+export interface ProviderEnvCheck {
+    ok: boolean;
+    /** Offending environment variables that must be unset before running. */
+    offenders: string[];
+}
+/**
+ * Fails if any provider credential / routing override is present in the current
+ * environment (§2, §13.3). These override subscription auth and switch billing.
+ */
+export declare function checkProviderEnv(env?: NodeJS.ProcessEnv): ProviderEnvCheck;
+/** A single doctor check line. */
+export interface DoctorCheck {
+    name: string;
+    ok: boolean;
+    detail: string;
+}
+/** Result of the live subscription/auth probe. */
+export interface LiveAuthResult {
+    ok: boolean;
+    apiKeySource?: string;
+    model?: string;
+    error?: string;
+}
+/**
+ * Runs a trivial SDK query and reads the init message to confirm the CLI can
+ * start without an API key, surfacing the reported auth source (§2 preflight).
+ * Best-effort: bounded by `timeoutMs`, then aborted.
+ */
+export declare function liveAuthCheck(timeoutMs?: number): Promise<LiveAuthResult>;
+/** Runs the synchronous portion of `orc doctor` (§9). */
+export declare function runDoctorSync(): DoctorCheck[];
+//# sourceMappingURL=preflight.d.ts.map

package/dist/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,yEAAyE;IACzE,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,gBAAgB,CAGlB;AAED,kCAAkC;AAClC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,kDAAkD;AAClD,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,SAAS,SAAS,GACjB,OAAO,CAAC,cAAc,CAAC,CAwCzB;AAED,yDAAyD;AACzD,wBAAgB,aAAa,IAAI,WAAW,EAAE,CAmD7C"}

package/dist/preflight.js

@@ -0,0 +1,108 @@
+/**
+ * Startup preflight & doctor checks (§2, §13.3). The cardinal rule: billing
+ * must stay on the Max subscription, never pay-as-you-go API. `ANTHROPIC_API_KEY`
+ * (and the provider-routing flags) must not be set; if they are, we refuse.
+ */
+import { execFileSync } from "node:child_process";
+import { statfsSync } from "node:fs";
+import { query as sdkQuery } from "@anthropic-ai/claude-agent-sdk";
+import { STRIPPED_ENV_KEYS } from "./spawnEnv.js";
+/**
+ * Fails if any provider credential / routing override is present in the current
+ * environment (§2, §13.3). These override subscription auth and switch billing.
+ */
+export function checkProviderEnv(env = process.env) {
+    const offenders = STRIPPED_ENV_KEYS.filter((k) => env[k] !== undefined);
+    return { ok: offenders.length === 0, offenders };
+}
+/**
+ * Runs a trivial SDK query and reads the init message to confirm the CLI can
+ * start without an API key, surfacing the reported auth source (§2 preflight).
+ * Best-effort: bounded by `timeoutMs`, then aborted.
+ */
+export async function liveAuthCheck(timeoutMs = 20_000) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const q = sdkQuery({
+            prompt: "Reply with the single word: ok",
+            options: {
+                maxTurns: 1,
+                abortController: controller,
+                env: Object.fromEntries(Object.entries(process.env).filter(([k]) => !STRIPPED_ENV_KEYS.includes(k))),
+            },
+        });
+        for await (const message of q) {
+            if (message.type === "system" && message.subtype === "init") {
+                return {
+                    ok: true,
+                    apiKeySource: message.apiKeySource,
+                    model: message.model,
+                };
+            }
+            if (message.type === "result")
+                break;
+        }
+        return { ok: true };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** Runs the synchronous portion of `orc doctor` (§9). */
+export function runDoctorSync() {
+    const checks = [];
+    const env = checkProviderEnv();
+    checks.push({
+        name: "subscription billing (no API key)",
+        ok: env.ok,
+        detail: env.ok
+            ? "no provider credentials in environment"
+            : `unset before running: ${env.offenders.join(", ")}`,
+    });
+    const [major] = process.versions.node.split(".").map(Number);
+    checks.push({
+        name: "node >= 22",
+        ok: (major ?? 0) >= 22,
+        detail: `node ${process.versions.node}`,
+    });
+    try {
+        const gitVersion = execFileSync("git", ["--version"], {
+            encoding: "utf8",
+        }).trim();
+        checks.push({ name: "git available", ok: true, detail: gitVersion });
+    }
+    catch {
+        checks.push({
+            name: "git available",
+            ok: false,
+            detail: "git not found on PATH",
+        });
+    }
+    // Disk headroom for SQLite + audit JSONL + reports (§13.9).
+    try {
+        const fs = statfsSync(process.cwd());
+        const freeBytes = fs.bfree * fs.bsize;
+        const freeGb = freeBytes / 1024 ** 3;
+        checks.push({
+            name: "disk space",
+            ok: freeGb >= 1,
+            detail: `${freeGb.toFixed(1)} GiB free`,
+        });
+    }
+    catch {
+        checks.push({
+            name: "disk space",
+            ok: true,
+            detail: "unavailable (skipped)",
+        });
+    }
+    return checks;
+}
+//# sourceMappingURL=preflight.js.map

package/dist/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,IAAI,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AASlD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACxE,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC;AAiBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAAS,GAAG,MAAM;IAElB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC;YACjB,MAAM,EAAE,gCAAgC;YACxC,OAAO,EAAE;gBACP,QAAQ,EAAE,CAAC;gBACX,eAAe,EAAE,UAAU;gBAC3B,GAAG,EAAE,MAAM,CAAC,WAAW,CACrB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAChC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAU,CAAC,CACjD,CACwB;aAC5B;SACF,CAAC,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,OAAO,IAAI,CAK1B,EAAE,CAAC;YACH,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;gBAC5D,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,YAAY,EAAE,OAAO,CAAC,YAAY;oBAClC,KAAK,EAAE,OAAO,CAAC,KAAK;iBACrB,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM;QACvC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,aAAa;IAC3B,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,CAAC,IAAI,CAAC;QACV,IAAI,EAAE,mCAAmC;QACzC,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,EAAE;YACZ,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,yBAAyB,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KACxD,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,CAAC,IAAI,CAAC;QACV,IAAI,EAAE,YAAY;QAClB,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE;QACtB,MAAM,EAAE,QAAQ,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE;KACxC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE;YACpD,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,eAAe;YACrB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,uBAAuB;SAChC,CAAC,CAAC;IACL,CAAC;IAED,4DAA4D;IAC5D,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;QACtC,MAAM,MAAM,GAAG,SAAS,GAAG,IAAI,IAAI,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,YAAY;YAClB,EAAE,EAAE,MAAM,IAAI,CAAC;YACf,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;SACxC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,YAAY;YAClB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,uBAAuB;SAChC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/reporting.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Reporting engine (§11). Renders Markdown status reports from the store — not
+ * from an LLM — on interval, milestones, manual request, and run end. Each
+ * report is persisted as a {@link Report} row, written to
+ * `reports/<run>/<timestamp>.md` (plus `latest.md` for easy tailing), and
+ * announced on the bus as `report.new` for the UI. The same body goes to every
+ * sink (UI, CLI, files).
+ */
+import type { OrchestratorConfig, Report, ReportTrigger, Run } from "@orc-brain/shared";
+import type { Store } from "./store/index.js";
+import type { EventBus } from "./eventBus.js";
+/** Resolves the reports directory under a repo's `.orc` state dir. */
+export declare function reportsDirFor(stateDir: string): string;
+/** Generates and distributes reports for runs. */
+export declare class ReportingEngine {
+    private readonly store;
+    private readonly bus;
+    private readonly config;
+    private readonly reportsDir;
+    /** Injected clock keeps burn-rate math testable. */
+    private readonly now;
+    private readonly timers;
+    constructor(store: Store, bus: EventBus, config: OrchestratorConfig, reportsDir: string, 
+    /** Injected clock keeps burn-rate math testable. */
+    now?: () => Date);
+    /** Starts the interval-report timer for a run (§11). Idempotent. */
+    startInterval(runId: string): void;
+    /** Stops the interval timer for a run. */
+    stopInterval(runId: string): void;
+    /** Stops all timers (called on shutdown). */
+    stopAll(): void;
+    /**
+     * Generates a report for a run, persists it, writes the Markdown files, and
+     * emits `report.new`. Returns the stored {@link Report} (or null if the run
+     * is unknown).
+     */
+    generate(runId: string, trigger: ReportTrigger): Report | null;
+    /** Renders the Markdown body from the store (§11 contents). */
+    renderMarkdown(run: Run, trigger: ReportTrigger): string;
+}
+//# sourceMappingURL=reporting.d.ts.map

package/dist/reporting.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reporting.d.ts","sourceRoot":"","sources":["../src/reporting.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EACV,kBAAkB,EAClB,MAAM,EACN,aAAa,EACb,GAAG,EAEJ,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C,sEAAsE;AACtE,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEtD;AAwBD,kDAAkD;AAClD,qBAAa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,oDAAoD;IACpD,OAAO,CAAC,QAAQ,CAAC,GAAG;IARtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqD;gBAGzD,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,kBAAkB,EAC1B,UAAU,EAAE,MAAM;IACnC,oDAAoD;IACnC,GAAG,GAAE,MAAM,IAAuB;IAGrD,oEAAoE;IACpE,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAalC,0CAA0C;IAC1C,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAQjC,6CAA6C;IAC7C,OAAO,IAAI,IAAI;IAKf;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI;IA+B9D,+DAA+D;IAC/D,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM;CA4HzD"}

package/dist/reporting.js

@@ -0,0 +1,229 @@
+/**
+ * Reporting engine (§11). Renders Markdown status reports from the store — not
+ * from an LLM — on interval, milestones, manual request, and run end. Each
+ * report is persisted as a {@link Report} row, written to
+ * `reports/<run>/<timestamp>.md` (plus `latest.md` for easy tailing), and
+ * announced on the bus as `report.new` for the UI. The same body goes to every
+ * sink (UI, CLI, files).
+ */
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+/** Resolves the reports directory under a repo's `.orc` state dir. */
+export function reportsDirFor(stateDir) {
+    return join(stateDir, "reports");
+}
+const STATUS_ORDER = [
+    "done",
+    "running",
+    "queued",
+    "pending",
+    "paused",
+    "blocked",
+    "failed",
+    "skipped",
+    "cancelled",
+];
+function pct(n, d) {
+    if (d <= 0)
+        return "0%";
+    return `${Math.round((100 * n) / d)}%`;
+}
+function minutesBetween(a, b) {
+    if (!a)
+        return 0;
+    return (new Date(b).getTime() - new Date(a).getTime()) / 60_000;
+}
+/** Generates and distributes reports for runs. */
+export class ReportingEngine {
+    store;
+    bus;
+    config;
+    reportsDir;
+    now;
+    timers = new Map();
+    constructor(store, bus, config, reportsDir, 
+    /** Injected clock keeps burn-rate math testable. */
+    now = () => new Date()) {
+        this.store = store;
+        this.bus = bus;
+        this.config = config;
+        this.reportsDir = reportsDir;
+        this.now = now;
+    }
+    /** Starts the interval-report timer for a run (§11). Idempotent. */
+    startInterval(runId) {
+        if (this.timers.has(runId))
+            return;
+        const ms = Math.max(1, this.config.reporting.interval_minutes) * 60_000;
+        const timer = setInterval(() => {
+            const run = this.store.getRun(runId);
+            if (!run || run.state !== "running")
+                return;
+            this.generate(runId, "interval");
+        }, ms);
+        // Do not keep the process alive solely for reporting.
+        if (typeof timer.unref === "function")
+            timer.unref();
+        this.timers.set(runId, timer);
+    }
+    /** Stops the interval timer for a run. */
+    stopInterval(runId) {
+        const timer = this.timers.get(runId);
+        if (timer) {
+            clearInterval(timer);
+            this.timers.delete(runId);
+        }
+    }
+    /** Stops all timers (called on shutdown). */
+    stopAll() {
+        for (const t of this.timers.values())
+            clearInterval(t);
+        this.timers.clear();
+    }
+    /**
+     * Generates a report for a run, persists it, writes the Markdown files, and
+     * emits `report.new`. Returns the stored {@link Report} (or null if the run
+     * is unknown).
+     */
+    generate(runId, trigger) {
+        const run = this.store.getRun(runId);
+        if (!run)
+            return null;
+        const content = this.renderMarkdown(run, trigger);
+        const dir = join(this.reportsDir, runId);
+        let path = null;
+        try {
+            mkdirSync(dir, { recursive: true });
+            const stamp = this.now().toISOString().replace(/[:.]/g, "-");
+            path = join(dir, `${stamp}.md`);
+            writeFileSync(path, content);
+            writeFileSync(join(dir, "latest.md"), content);
+        }
+        catch {
+            path = null; // File sink is best-effort; the DB row is the source of truth.
+        }
+        const report = this.store.insertReport({
+            run_id: runId,
+            trigger,
+            content_md: content,
+            path,
+        });
+        this.bus.publish({
+            type: "report.new",
+            run_id: runId,
+            payload: { report_id: report.id, trigger, path },
+        });
+        return report;
+    }
+    /** Renders the Markdown body from the store (§11 contents). */
+    renderMarkdown(run, trigger) {
+        const goal = this.store.getGoal(run.goal_id);
+        const tasks = this.store.listTasksByGoal(run.goal_id);
+        const scopes = this.store.listScopesByGoal(run.goal_id);
+        const counts = this.store.countTasksByStatus(run.goal_id);
+        const total = tasks.length;
+        const done = counts.done ?? 0;
+        const nowIso = this.now().toISOString();
+        const wallMin = minutesBetween(run.started_at, run.finished_at ?? nowIso);
+        const spent = this.store.sumCostForRun(run.id);
+        const burnPerMin = wallMin > 0 ? spent / wallMin : 0;
+        const fracDone = total > 0 ? done / total : 0;
+        const projected = fracDone > 0 ? spent / fracDone : spent;
+        const L = [];
+        L.push(`# Report — ${goal?.title ?? run.goal_id}`);
+        L.push("");
+        L.push(`- **Trigger:** ${trigger}`);
+        L.push(`- **Generated:** ${nowIso}`);
+        L.push(`- **Run state:** \`${run.state}\``);
+        L.push(`- **Wall-clock:** ${wallMin.toFixed(1)} min`);
+        L.push(`- **Tasks done:** ${done}/${total} (${pct(done, total)})`);
+        L.push("");
+        // Progress vs success criteria (Planner checklist).
+        if (goal && goal.success_criteria.length) {
+            L.push("## Success criteria");
+            for (const c of goal.success_criteria) {
+                L.push(`- [${run.state === "done" ? "x" : " "}] ${c.description}`);
+            }
+            L.push("");
+        }
+        // Task table by status.
+        L.push("## Tasks");
+        L.push("| status | count |");
+        L.push("| --- | --- |");
+        for (const status of STATUS_ORDER) {
+            const n = counts[status];
+            if (n)
+                L.push(`| ${status} | ${n} |`);
+        }
+        L.push("");
+        // Budget.
+        L.push("## Budget");
+        L.push(`- Spent (est.): $${spent.toFixed(4)} / $${run.budget_usd.toFixed(2)} (${run.budget_state})`);
+        L.push(`- Burn rate: $${burnPerMin.toFixed(4)}/min`);
+        L.push(`- Projected completion (est.): $${projected.toFixed(4)}`);
+        L.push("");
+        // Currently running subagents.
+        const running = tasks.filter((t) => t.status === "running");
+        if (running.length) {
+            L.push("## Running now");
+            for (const t of running) {
+                const sub = this.store.listSubagentsByTask(t.id).at(-1);
+                const tool = sub?.last_tool_call &&
+                    typeof sub.last_tool_call === "object" &&
+                    "name" in sub.last_tool_call
+                    ? sub.last_tool_call.name
+                    : "—";
+                L.push(`- ${t.title} [${t.model_used ?? "?"}] · ${tool}`);
+            }
+            L.push("");
+        }
+        // Scope branches (spec 002 §R8): settled worktree scopes leave a branch
+        // for manual merge; failed scopes also keep their worktree for debugging.
+        const withBranches = scopes.filter((s) => s.branch_name);
+        if (withBranches.length) {
+            L.push("## Scope branches");
+            for (const s of withBranches) {
+                const note = s.status === "done"
+                    ? "ready to merge"
+                    : s.worktree_path
+                        ? `worktree kept at ${s.worktree_path}`
+                        : s.status;
+                L.push(`- \`${s.branch_name}\` — ${s.name} (${note})`);
+            }
+            L.push("");
+        }
+        // Blockers & escalations needing the operator.
+        const escalations = this.store.listOpenEscalations(run.id);
+        if (escalations.length) {
+            L.push("## Blockers & escalations");
+            for (const e of escalations) {
+                L.push(`- **${e.rule_id}** on \`${e.tool_name}\` — ${e.input_summary}`);
+            }
+            L.push("");
+        }
+        // Deviations: retries (attempt>0), dirty pauses, degraded routing.
+        const retried = tasks.filter((t) => t.attempt > 0);
+        const dirty = tasks.filter((t) => t.dirty);
+        if (retried.length || dirty.length) {
+            L.push("## Deviations");
+            for (const t of retried)
+                L.push(`- retry: ${t.title} (attempt ${t.attempt})`);
+            for (const t of dirty)
+                L.push(`- dirty pause: ${t.title} (verify workspace on resume)`);
+            L.push("");
+        }
+        // Next planned dispatches: pending/queued tasks whose deps are met-ish.
+        const next = tasks
+            .filter((t) => t.status === "pending" || t.status === "queued")
+            .slice(0, 8);
+        if (next.length) {
+            L.push("## Next planned dispatches");
+            for (const t of next)
+                L.push(`- ${t.title} (${t.task_type})`);
+            L.push("");
+        }
+        L.push(`_Scopes: ${scopes.length}. Report generated from the store (§11)._`);
+        return L.join("\n");
+    }
+}
+//# sourceMappingURL=reporting.js.map

package/dist/reporting.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reporting.js","sourceRoot":"","sources":["../src/reporting.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAWjC,sEAAsE;AACtE,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,YAAY,GAAiB;IACjC,MAAM;IACN,SAAS;IACT,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,SAAS;IACT,WAAW;CACZ,CAAC;AAEF,SAAS,GAAG,CAAC,CAAS,EAAE,CAAS;IAC/B,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;AACzC,CAAC;AAED,SAAS,cAAc,CAAC,CAAgB,EAAE,CAAS;IACjD,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC;AAClE,CAAC;AAED,kDAAkD;AAClD,MAAM,OAAO,eAAe;IAIP;IACA;IACA;IACA;IAEA;IARF,MAAM,GAAG,IAAI,GAAG,EAA0C,CAAC;IAE5E,YACmB,KAAY,EACZ,GAAa,EACb,MAA0B,EAC1B,UAAkB;IACnC,oDAAoD;IACnC,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QALlC,UAAK,GAAL,KAAK,CAAO;QACZ,QAAG,GAAH,GAAG,CAAU;QACb,WAAM,GAAN,MAAM,CAAoB;QAC1B,eAAU,GAAV,UAAU,CAAQ;QAElB,QAAG,GAAH,GAAG,CAA+B;IAClD,CAAC;IAEJ,oEAAoE;IACpE,aAAa,CAAC,KAAa;QACzB,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC;QACxE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO;YAC5C,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACnC,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,sDAAsD;QACtD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,0CAA0C;IAC1C,YAAY,CAAC,KAAa;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,OAAO;QACL,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,KAAa,EAAE,OAAsB;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAElD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACzC,IAAI,IAAI,GAAkB,IAAI,CAAC;QAC/B,IAAI,CAAC;YACH,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC7D,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,KAAK,CAAC,CAAC;YAChC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC7B,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,IAAI,CAAC,CAAC,+DAA+D;QAC9E,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YACrC,MAAM,EAAE,KAAK;YACb,OAAO;YACP,UAAU,EAAE,OAAO;YACnB,IAAI;SACL,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YACf,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;SACjD,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,+DAA+D;IAC/D,cAAc,CAAC,GAAQ,EAAE,OAAsB;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC;QAE1E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;QAE1D,MAAM,CAAC,GAAa,EAAE,CAAC;QACvB,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,KAAK,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACnD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,IAAI,CAAC,oBAAoB,MAAM,EAAE,CAAC,CAAC;QACrC,CAAC,CAAC,IAAI,CAAC,sBAAsB,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC,qBAAqB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC,CAAC,IAAI,CAAC,qBAAqB,IAAI,IAAI,KAAK,KAAK,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACnE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEX,oDAAoD;QACpD,IAAI,IAAI,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC;YACzC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,CAAC;QAED,wBAAwB;QACxB,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnB,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC7B,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACxB,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YACzB,IAAI,CAAC;gBAAE,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEX,UAAU;QACV,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpB,CAAC,CAAC,IAAI,CACJ,oBAAoB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,YAAY,GAAG,CAC7F,CAAC;QACF,CAAC,CAAC,IAAI,CAAC,iBAAiB,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC,CAAC,IAAI,CAAC,mCAAmC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEX,+BAA+B;QAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACzB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxD,MAAM,IAAI,GACR,GAAG,EAAE,cAAc;oBACnB,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ;oBACtC,MAAM,IAAI,GAAG,CAAC,cAAc;oBAC1B,CAAC,CAAE,GAAG,CAAC,cAAmC,CAAC,IAAI;oBAC/C,CAAC,CAAC,GAAG,CAAC;gBACV,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,UAAU,IAAI,GAAG,OAAO,IAAI,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,CAAC;QAED,wEAAwE;QACxE,0EAA0E;QAC1E,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;YACxB,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;gBAC7B,MAAM,IAAI,GACR,CAAC,CAAC,MAAM,KAAK,MAAM;oBACjB,CAAC,CAAC,gBAAgB;oBAClB,CAAC,CAAC,CAAC,CAAC,aAAa;wBACf,CAAC,CAAC,oBAAoB,CAAC,CAAC,aAAa,EAAE;wBACvC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBACjB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,QAAQ,CAAC,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC;YACzD,CAAC;YACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,CAAC;QAED,+CAA+C;QAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3D,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;YACvB,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YACpC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,SAAS,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,CAAC;QAED,mEAAmE;QACnE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACnC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACxB,KAAK,MAAM,CAAC,IAAI,OAAO;gBACrB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;YACvD,KAAK,MAAM,CAAC,IAAI,KAAK;gBACnB,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,KAAK,+BAA+B,CAAC,CAAC;YACnE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,CAAC;QAED,wEAAwE;QACxE,MAAM,IAAI,GAAG,KAAK;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;aAC9D,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACf,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,IAAI;gBAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;YAC9D,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,CAAC;QAED,CAAC,CAAC,IAAI,CACJ,YAAY,MAAM,CAAC,MAAM,2CAA2C,CACrE,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;CACF"}

package/dist/safety/denyRules.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Destructive-command interception (§8.2). Bash input is parsed with a real
+ * shell tokenizer (not regex-only) to unwrap `sh -c`, `xargs`, `env`, `sudo`,
+ * command substitution, and `&&` chains, then each resolved command is matched
+ * against rule classes. A regex backstop covers unparseable input and
+ * substitution-hidden binaries; unparseable input denies in production scopes.
+ */
+import type { DevPosture, Environment } from "@orc-brain/shared";
+/** Destructive rule classes (§8.2). Keys align with `SafetyConfig.dev_posture`. */
+export type RuleClass = "filesystem" | "vcs" | "database" | "infra" | "publish" | "credential" | "network";
+/** Verdict severity, most severe first. */
+export type Verdict = "deny" | "require_approval" | "allow_with_audit" | "allow";
+/** A rule that fired against a command. */
+export interface RuleMatch {
+    rule_id: string;
+    rule_class: RuleClass;
+    reason: string;
+}
+/** Final decision for a tool call after applying environment posture. */
+export interface DenyDecision {
+    verdict: Verdict;
+    match: RuleMatch | null;
+}
+/** Context needed to evaluate a tool call against the deny rules. */
+export interface DenyContext {
+    environment: Environment;
+    cwd: string;
+    path_allowlist: string[];
+    path_denylist: string[];
+    dev_posture: Record<string, DevPosture>;
+}
+interface ParsedCommand {
+    /** Command name + arguments (no operators/redirections). */
+    args: string[];
+    /** Redirection targets (e.g. the `x` in `> x`). */
+    redirects: string[];
+    /** Operator that immediately follows this command in the pipeline, if any. */
+    nextOp?: string;
+}
+/** Detects destructive SQL inside a string (DROP/TRUNCATE, unqualified DML). */
+export declare function matchSql(sql: string): RuleMatch | null;
+/** Matches a single resolved command against every rule class (§8.2). */
+export declare function matchCommand(cmd: ParsedCommand, ctx: DenyContext): RuleMatch | null;
+/**
+ * Evaluates a Bash command string (§8.2). Recursively unwraps shells, xargs,
+ * env, and command substitution; on parse failure denies in production scopes.
+ */
+export declare function evaluateBash(command: string, ctx: DenyContext): DenyDecision;
+/**
+ * Evaluates a Write/Edit file target against the scope allowlist (§8.2, §8.3).
+ * A write outside the allowlist (or inside the denylist) is filesystem-class.
+ */
+export declare function evaluatePathWrite(filePath: string, ctx: DenyContext): DenyDecision;
+/** Evaluates a Read file target — blocks credential/dotenv reads (§8.2). */
+export declare function evaluatePathRead(filePath: string, ctx: DenyContext): DenyDecision;
+export {};
+//# sourceMappingURL=denyRules.d.ts.map

package/dist/safety/denyRules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"denyRules.d.ts","sourceRoot":"","sources":["../../src/safety/denyRules.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AASjE,mFAAmF;AACnF,MAAM,MAAM,SAAS,GACjB,YAAY,GACZ,KAAK,GACL,UAAU,GACV,OAAO,GACP,SAAS,GACT,YAAY,GACZ,SAAS,CAAC;AAEd,2CAA2C;AAC3C,MAAM,MAAM,OAAO,GACjB,MAAM,GAAG,kBAAkB,GAAG,kBAAkB,GAAG,OAAO,CAAC;AAS7D,2CAA2C;AAC3C,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,SAAS,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;CACzB;AAED,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,WAAW,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACzC;AA4BD,UAAU,aAAa;IACrB,4DAA4D;IAC5D,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,mDAAmD;IACnD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAuID,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAwBtD;AAgBD,yEAAyE;AACzE,wBAAgB,YAAY,CAC1B,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,WAAW,GACf,SAAS,GAAG,IAAI,CAiMlB;AAcD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,YAAY,CAiF5E;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,WAAW,GACf,YAAY,CAuBd;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,WAAW,GACf,YAAY,CA0Bd"}