@ouro.bot/cli 0.1.0-alpha.892 → 0.1.0-alpha.894

package/dist/senses/cmux/client.js

@@ -0,0 +1,196 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CmuxSocketError = void 0;
+exports.createCmuxClient = createCmuxClient;
+const node_crypto_1 = require("node:crypto");
+const net = __importStar(require("node:net"));
+const cmux_config_1 = require("../../heart/cmux-config");
+const runtime_1 = require("../../nerves/runtime");
+class CmuxSocketError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "CmuxSocketError";
+    }
+}
+exports.CmuxSocketError = CmuxSocketError;
+const ACCESS_REFUSED = /access denied|authentication required|invalid password|not authorized|unauthori[sz]ed/i;
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function parseRecord(line) {
+    try {
+        const value = JSON.parse(line);
+        return isRecord(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function createCmuxClient(connection, options = {}) {
+    const timeoutMs = options.timeoutMs ?? 5_000;
+    const repair = (0, cmux_config_1.cmuxRepairHint)(options.agentName ?? "<agent>");
+    const wrap = (line) => connection.auth.kind === "capability"
+        ? `_cmux_capability_v1 ${connection.auth.token} ${line}`
+        : line;
+    const refusal = (text) => text.startsWith("ERROR:") && ACCESS_REFUSED.test(text)
+        ? new CmuxSocketError("auth", `cmux refused the socket connection (${text.slice(0, 200)}); ${repair}`)
+        : null;
+    const connectError = (error) => new CmuxSocketError("unavailable", `cmux socket is not reachable at ${connection.socketPath} (${String(error.code)}); is cmux running?`);
+    /** Opens a connection, runs the password handshake when needed, and hands back a line reader. */
+    function open(onLine, onEnd) {
+        return new Promise((resolve) => {
+            const socket = net.createConnection(connection.socketPath);
+            let buffer = "";
+            let handshake = connection.auth.kind === "password";
+            socket.setEncoding("utf-8");
+            socket.on("error", (error) => onEnd(connectError(error)));
+            socket.on("close", () => onEnd());
+            socket.on("data", (chunk) => {
+                buffer += chunk;
+                let index = buffer.indexOf("\n");
+                while (index >= 0) {
+                    const line = buffer.slice(0, index).trim();
+                    buffer = buffer.slice(index + 1);
+                    index = buffer.indexOf("\n");
+                    if (!line)
+                        continue;
+                    if (handshake) {
+                        handshake = false;
+                        if (line.startsWith("ERROR:") && !line.includes("Unknown command 'auth'")) {
+                            socket.destroy();
+                            onEnd(new CmuxSocketError("auth", `cmux rejected the socket password (${line.slice(0, 200)}); ${repair}`));
+                            continue;
+                        }
+                        resolve(socket);
+                        continue;
+                    }
+                    onLine(line);
+                }
+            });
+            socket.on("connect", () => {
+                if (connection.auth.kind === "password")
+                    socket.write(`auth ${connection.auth.password}\n`);
+                else
+                    resolve(socket);
+            });
+        });
+    }
+    function request(line) {
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            let socket = null;
+            const finish = (error, value) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                socket?.destroy();
+                if (error)
+                    reject(error);
+                else
+                    resolve(value);
+            };
+            const timer = setTimeout(() => finish(new CmuxSocketError("timeout", `cmux did not answer within ${timeoutMs} ms`)), timeoutMs);
+            void open((response) => finish(refusal(response), response), (error) => finish(error ?? new CmuxSocketError("unavailable", "cmux closed the socket before answering"))).then((opened) => {
+                socket = opened;
+                opened.write(`${wrap(line)}\n`);
+            });
+        });
+    }
+    const v2Line = (method, params) => JSON.stringify({ id: (0, node_crypto_1.randomUUID)(), method, params });
+    function parseV2(text) {
+        const parsed = parseRecord(text);
+        if (!parsed)
+            throw new CmuxSocketError(text.startsWith("ERROR:") ? "command_failed" : "protocol", `unexpected cmux response: ${text.slice(0, 200)}`);
+        if (parsed.ok === true)
+            return isRecord(parsed.result) ? parsed.result : {};
+        const error = isRecord(parsed.error) ? parsed.error : {};
+        throw new CmuxSocketError(typeof error.code === "string" ? error.code : "error", typeof error.message === "string" && error.message ? error.message : "cmux error");
+    }
+    return {
+        async call(method, params = {}) {
+            const text = await request(v2Line(method, params));
+            const result = parseV2(text);
+            (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.cmux_call", message: "cmux socket call answered", meta: { method } });
+            return result;
+        },
+        async command(line) {
+            const text = await request(line);
+            if (text.startsWith("ERROR:"))
+                throw new CmuxSocketError("command_failed", text.slice(0, 500));
+            return text;
+        },
+        stream(params, handlers) {
+            let closed = false;
+            let socket = null;
+            const end = (error) => {
+                if (closed)
+                    return;
+                closed = true;
+                socket?.destroy();
+                handlers.onClose(error);
+            };
+            void open((line) => {
+                if (closed)
+                    return;
+                const refused = refusal(line);
+                if (refused)
+                    return end(refused);
+                const frame = parseRecord(line);
+                if (!frame)
+                    return end(new CmuxSocketError("protocol", `unexpected cmux event frame: ${line.slice(0, 200)}`));
+                if (frame.ok === false) {
+                    try {
+                        parseV2(line);
+                    }
+                    catch (error) {
+                        return end(error);
+                    }
+                }
+                handlers.onFrame(frame);
+            }, end).then((opened) => {
+                socket = opened;
+                if (closed)
+                    opened.destroy();
+                else
+                    opened.write(`${wrap(v2Line("events.stream", params))}\n`);
+            });
+            return { close: () => end() };
+        },
+    };
+}

package/dist/senses/cmux/floor.js

@@ -0,0 +1,407 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findRepoRoot = findRepoRoot;
+exports.resolveInsideRepo = resolveInsideRepo;
+exports.tokenizeCommand = tokenizeCommand;
+exports.gitConfigHazard = gitConfigHazard;
+exports.evaluateFloor = evaluateFloor;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const runtime_1 = require("../../nerves/runtime");
+const realFs = {
+    exists: (target) => fs.existsSync(target),
+    realpath: (target) => fs.realpathSync(target),
+    read: (target) => {
+        try {
+            return fs.readFileSync(target, "utf-8");
+        }
+        catch {
+            return null;
+        }
+    },
+};
+const MAX_COMMAND_CHARS = 2_000;
+const EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+const READ_TOOLS = new Set(["Read", "Glob", "Grep", "LS"]);
+/** Characters that chain, pipe, redirect, substitute, expand or escape anywhere in the command, quoted or not. */
+const SHELL_CONTROL = /[\n\r;&|`$<>(){}\\!#]/;
+/** Characters the shell expands as a glob when they appear outside quotes. */
+const GLOB = /[*?[\]]/;
+const PROTECTED_SEGMENTS = new Set([".git", ".claude", ".github", ".husky", ".vscode", ".idea"]);
+const PROTECTED_NAMES = new Set([
+    "package.json", ".npmrc", ".yarnrc", ".yarnrc.yml", ".mcp.json", ".gitmodules", ".gitattributes", ".gitconfig",
+    ".bashrc", ".bash_profile", ".bash_login", ".profile", ".zshrc", ".zshenv", ".zprofile", ".zlogin", ".envrc",
+    "claude.md", "agents.md", "copilot-instructions.md",
+]);
+/** Protected paths that can hold credentials: even reading them escalates. */
+const CREDENTIAL_TOUCHES = new Set(["touches an environment file", "touches .git", "touches .npmrc", "touches .yarnrc", "touches .yarnrc.yml", "touches .gitconfig", "touches .envrc", "touches .claude"]);
+/** Programs never answered for the human, even with a precedent: they delete, escalate, reach the network, wrap or run other programs. */
+const HARD_COMMANDS = new Set([
+    "rm", "rmdir", "unlink", "shred", "dd", "mkfs", "diskutil", "chmod", "chown", "chgrp", "chflags", "xattr", "mv", "cp", "ln", "install", "tee", "truncate",
+    "sudo", "su", "doas", "kill", "killall", "pkill", "launchctl", "shutdown", "reboot", "halt", "crontab", "defaults", "security", "osascript", "open",
+    "curl", "wget", "ssh", "scp", "sftp", "rsync", "nc", "ncat", "netcat", "telnet", "ftp", "socat", "gh", "az", "aws", "gcloud", "kubectl", "terraform", "docker", "fly", "vercel", "heroku",
+    "sh", "bash", "zsh", "fish", "dash", "ksh", "csh", "tcsh", "eval", "exec", "source", ".", "env", "xargs", "nohup", "time", "timeout", "nice", "caffeinate", "watch", "command", "builtin", "script", "expect", "at", "batch",
+    "npx", "pnpx", "bunx", "ouro", "cmux", "claude", "codex", "copilot", "base64", "openssl", "gpg", "date", "less", "more", "vi", "vim", "nano", "emacs",
+]);
+/** Programs that run code they are handed: a precedent may answer them only with no options at all. */
+const INTERPRETERS = new Set(["python", "python3", "node", "ruby", "perl", "php", "deno", "lua", "swift", "awk", "gawk", "sed", "jq", "make"]);
+const PACKAGE_MANAGERS = new Set(["npm", "pnpm", "yarn", "bun", "pip", "pip3", "pipx", "brew", "gem", "cargo", "go", "uv", "poetry", "composer"]);
+/** The repository's own checks, allowed only as these exact words. */
+const TEST_COMMANDS = [
+    ["npm", "test"], ["npm", "run", "test"], ["npm", "run", "lint"], ["npm", "run", "typecheck"],
+    ["swift", "test"], ["swift", "build"], ["cargo", "test"], ["cargo", "check"], ["go", "test"], ["go", "vet"],
+];
+const flags = (letters, values = {}) => ({ ...Object.fromEntries([...letters].map((letter) => [letter, "flag"])), ...values });
+const longFlags = (names, values = {}) => ({ ...Object.fromEntries(names.map((name) => [name, "flag"])), ...values });
+const GREP = {
+    short: flags("rRnilvwcEFHhosx", { e: "text", m: "num", A: "num", B: "num", C: "num" }),
+    long: longFlags(["--line-number", "--ignore-case", "--recursive", "--count", "--files-with-matches", "--fixed-strings", "--word-regexp"], { "--include": "text", "--exclude": "text", "--exclude-dir": "text" }),
+};
+const COMMANDS = {
+    ls: { short: flags("1aAlhRtrSdF"), long: longFlags(["--all", "--human-readable", "--recursive"]) },
+    pwd: { noPositional: true },
+    cat: { short: flags("n") },
+    head: { short: { n: "num", c: "num" }, digits: true },
+    tail: { short: { n: "num", c: "num" }, digits: true },
+    wc: { short: flags("lwcm") },
+    grep: GREP, egrep: GREP, fgrep: GREP,
+    rg: {
+        short: flags("inlwcFSuvHo", { g: "text", t: "text", e: "text", m: "num", A: "num", B: "num", C: "num" }),
+        long: longFlags(["--hidden", "--files", "--fixed-strings", "--ignore-case", "--line-number", "--count", "--files-with-matches", "--no-ignore"], { "--glob": "text", "--type": "text" }),
+    },
+    find: { long: longFlags(["-print", "-empty"], { "-name": "text", "-iname": "text", "-type": "text", "-maxdepth": "num", "-mindepth": "num" }) },
+    tree: { short: flags("adf", { L: "num" }) },
+    file: { short: flags("b") },
+    stat: {},
+    diff: { short: flags("uqrN") },
+    which: { short: flags("a") },
+    echo: { short: flags("n") },
+    du: { short: flags("sh", { d: "num" }) },
+    true: { noPositional: true },
+};
+/** Read-only git subcommands and their options. Any other git subcommand escalates. */
+const GIT = {
+    status: { short: flags("sb"), long: longFlags(["--short", "--branch", "--porcelain"]) },
+    log: { short: { n: "num" }, digits: true, long: longFlags(["--oneline", "--decorate", "--graph"], { "--max-count": "num" }) },
+    diff: { long: longFlags(["--name-only", "--name-status", "--cached", "--staged", "--no-ext-diff", "--no-textconv"]) },
+    show: { long: longFlags(["--name-only", "--name-status", "--oneline", "--no-ext-diff", "--no-textconv"]) },
+    "rev-parse": { long: longFlags(["--show-toplevel", "--abbrev-ref", "--short", "--is-inside-work-tree"]) },
+    "ls-files": { long: longFlags(["--others", "--exclude-standard", "--cached", "--modified"]) },
+    branch: { short: flags("arv"), long: longFlags(["--all", "--remotes", "--verbose", "--show-current"]), noPositional: true },
+    "merge-base": {},
+    "rev-list": { long: longFlags(["--count"]) },
+    describe: { long: longFlags(["--tags", "--always"]) },
+};
+/** Repository git config keys and sections that make read-only git commands run a program. */
+const GIT_CONFIG_HAZARD = /^\s*(?:fsmonitor|external|textconv|pager|sshcommand|hookspath|askpass|editor|clean|smudge|process|command|cmd|helper|program|tool)\s*=|^\s*\[\s*(?:include|includeif|filter|alias)\b/im;
+function hard(reason) {
+    return { verdict: "hard", reason };
+}
+function parseObject(text) {
+    if (text === null)
+        return null;
+    try {
+        const value = JSON.parse(text);
+        return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The nearest ancestor of `cwd` (after resolving symlinks) that holds a `.git` entry. */
+function findRepoRoot(cwd, fsx = realFs) {
+    if (!path.isAbsolute(cwd) || !fsx.exists(cwd))
+        return null;
+    let dir = fsx.realpath(cwd);
+    for (;;) {
+        if (fsx.exists(path.join(dir, ".git")))
+            return dir;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/**
+ * The repo-relative path of `target` after resolving `..` and every symlink on the part of the path
+ * that exists, or null when it lands outside the repository. A `~` path is never resolved.
+ */
+function resolveInsideRepo(repoRoot, cwd, target, fsx = realFs) {
+    if (target.startsWith("~"))
+        return null;
+    let existing = path.resolve(cwd, target);
+    const rest = [];
+    while (!fsx.exists(existing)) {
+        rest.unshift(path.basename(existing));
+        existing = path.dirname(existing);
+    }
+    const resolved = path.join(fsx.realpath(existing), ...rest);
+    if (resolved === repoRoot)
+        return ".";
+    if (!resolved.startsWith(`${repoRoot}${path.sep}`))
+        return null;
+    return path.relative(repoRoot, resolved);
+}
+function protectedPath(relative) {
+    const segments = relative.split(path.sep).map((segment) => segment.toLowerCase());
+    const protectedSegment = segments.find((segment) => PROTECTED_SEGMENTS.has(segment));
+    if (protectedSegment)
+        return `touches ${protectedSegment}`;
+    const name = segments[segments.length - 1];
+    if (PROTECTED_NAMES.has(name))
+        return `touches ${name}`;
+    if (name.startsWith(".env"))
+        return "touches an environment file";
+    return null;
+}
+/**
+ * Shell words for a single simple command, or null when quoting is unbalanced. `globbed` is true when
+ * a glob character appears outside quotes. Escapes and expansions are refused before this runs.
+ */
+function tokenizeCommand(command) {
+    const tokens = [];
+    let current = "";
+    let started = false;
+    let quote = null;
+    let globbed = false;
+    for (const char of command) {
+        if (quote) {
+            if (char === quote)
+                quote = null;
+            else
+                current += char;
+            continue;
+        }
+        if (char === "'" || char === "\"") {
+            quote = char;
+            started = true;
+            continue;
+        }
+        if (/\s/.test(char)) {
+            if (started)
+                tokens.push(current);
+            current = "";
+            started = false;
+            continue;
+        }
+        if (GLOB.test(char))
+            globbed = true;
+        current += char;
+        started = true;
+    }
+    if (quote)
+        return null;
+    if (started)
+        tokens.push(current);
+    return { tokens, globbed };
+}
+/** Whether repository git config could make a read-only git command run a program. Unreadable config counts. */
+function gitConfigHazard(repoRoot, fsx = realFs) {
+    const pointer = fsx.read(path.join(repoRoot, ".git"));
+    const gitDir = pointer === null ? path.join(repoRoot, ".git") : path.resolve(repoRoot, pointer.replace(/^gitdir:\s*/, "").trim());
+    const common = fsx.read(path.join(gitDir, "commondir"));
+    const configs = [path.join(gitDir, "config"), path.join(gitDir, "config.worktree"), ...(common ? [path.join(path.resolve(gitDir, common.trim()), "config")] : [])];
+    const texts = configs.map((file) => fsx.read(file));
+    if (texts[0] === null && (common === null || texts[2] === null))
+        return true;
+    return texts.some((text) => text !== null && GIT_CONFIG_HAZARD.test(text));
+}
+function checkWord(repoRoot, cwd, word, fsx) {
+    const relative = resolveInsideRepo(repoRoot, cwd, word, fsx);
+    return relative === null ? { outside: true, touches: null } : { outside: false, touches: protectedPath(relative) };
+}
+/** Null when every option is on the command's list and every value fits its kind; otherwise the reason. */
+function checkOptions(spec, args, positional) {
+    const value = (kind, text, name) => {
+        if (text === undefined)
+            return `${name} is missing its value`;
+        if (kind === "num" ? !/^\d+$/.test(text) : text.includes("/") || text.startsWith("~"))
+            return `${name} has a value the floor does not accept`;
+        return null;
+    };
+    let endOfOptions = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (endOfOptions || !arg.startsWith("-") || arg === "-") {
+            const reason = spec.noPositional ? "takes no arguments here" : positional(arg);
+            if (reason)
+                return reason;
+            continue;
+        }
+        if (arg === "--") {
+            endOfOptions = true;
+            continue;
+        }
+        const equals = arg.indexOf("=");
+        const name = equals > 0 ? arg.slice(0, equals) : arg;
+        const longKind = spec.long?.[name];
+        if (longKind) {
+            if (longKind === "flag") {
+                if (equals > 0)
+                    return `${name} takes no value`;
+                continue;
+            }
+            const reason = value(longKind, equals > 0 ? arg.slice(equals + 1) : args[++index], name);
+            if (reason)
+                return reason;
+            continue;
+        }
+        if (arg.startsWith("--"))
+            return `${name} is not on the allowlist`;
+        if (spec.digits && /^-\d+$/.test(arg))
+            continue;
+        for (let at = 1; at < arg.length; at += 1) {
+            const letter = arg[at];
+            const kind = spec.short?.[letter];
+            if (!kind)
+                return `-${letter} is not on the allowlist`;
+            if (kind === "flag")
+                continue;
+            const attached = arg.slice(at + 1);
+            const reason = value(kind, attached || args[++index], `-${letter}`);
+            if (reason)
+                return reason;
+            break;
+        }
+    }
+    return null;
+}
+function bashVerdict(command, repoRoot, cwd, fsx) {
+    if (typeof command !== "string" || !command.trim())
+        return hard("no command to judge");
+    if (command.length > MAX_COMMAND_CHARS)
+        return hard("command is too long to judge");
+    if (SHELL_CONTROL.test(command))
+        return hard("command chains, pipes, redirects, substitutes or expands");
+    const parsed = tokenizeCommand(command);
+    if (!parsed || parsed.tokens.length === 0)
+        return hard("command quoting does not parse");
+    if (parsed.globbed)
+        return hard("command has an unquoted glob");
+    const tokens = parsed.tokens;
+    const [program, ...args] = tokens;
+    const name = program.toLowerCase();
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(program))
+        return hard("command sets environment variables");
+    if (HARD_COMMANDS.has(name))
+        return hard(`${name} is never answered for the human`);
+    // Every word, and every value glued to an option, must stay inside the repository; credential paths escalate.
+    let touches = null;
+    for (const arg of args) {
+        const values = arg.startsWith("-") ? [arg.includes("=") ? arg.slice(arg.indexOf("=") + 1) : arg.slice(2)] : [arg];
+        for (const word of values.filter((entry) => entry.includes("/") || entry.startsWith("~") || !arg.startsWith("-"))) {
+            const check = checkWord(repoRoot, cwd, word, fsx);
+            if (check.outside)
+                return hard("command reaches outside the repository");
+            if (!arg.startsWith("-"))
+                touches ??= check.touches;
+        }
+    }
+    if (touches && CREDENTIAL_TOUCHES.has(touches))
+        return hard(`command ${touches}`);
+    const shape = { repoRoot, tool: "Bash", tokens };
+    if (TEST_COMMANDS.some((entry) => entry.length === tokens.length && entry.every((token, index) => token === tokens[index])))
+        return { verdict: "allow", reason: "runs the repository's own checks", shape };
+    if (name === "git") {
+        const subcommand = args[0] ?? "";
+        const spec = GIT[subcommand];
+        if (!spec)
+            return hard(`git ${subcommand || "with global options"} is never answered for the human`);
+        if (gitConfigHazard(repoRoot, fsx))
+            return hard("the repository's git config can run programs");
+        const reason = checkOptions(spec, args.slice(1), () => null);
+        return reason ? hard(`git ${subcommand}: ${reason}`) : { verdict: "allow", reason: `git ${subcommand} only reads`, shape };
+    }
+    const spec = COMMANDS[name];
+    if (spec && !program.includes("/")) {
+        const reason = checkOptions(spec, args, () => null);
+        return reason ? hard(`${name}: ${reason}`) : { verdict: "allow", reason: `${name} only reads`, shape };
+    }
+    if (PACKAGE_MANAGERS.has(name)) {
+        const script = (args[0] === "run" && args.length === 2) || (args[0] === "test" && args.length === 1);
+        if (!script)
+            return hard(`${name} ${args[0] ?? ""} is never answered for the human`.trim());
+    }
+    if ((INTERPRETERS.has(name) || /^python\d/.test(name)) && args.some((arg) => arg.startsWith("-")))
+        return hard(`${name} with options can run inline code`);
+    if (touches)
+        return hard(`command ${touches}`);
+    return { verdict: "soft", reason: program.includes("/") ? "runs a program by path" : `${name} is not on the allowlist`, shape };
+}
+function pathVerdict(tool, input, repoRoot, cwd, fsx) {
+    const raw = input.file_path ?? input.notebook_path ?? input.path ?? (READ_TOOLS.has(tool) ? cwd : undefined);
+    if (typeof raw !== "string" || !raw.trim())
+        return hard(`${tool} names no path`);
+    const relative = resolveInsideRepo(repoRoot, cwd, raw, fsx);
+    if (relative === null)
+        return hard(`${tool} reaches outside the repository`);
+    const blocked = protectedPath(relative);
+    if (blocked && (EDIT_TOOLS.has(tool) || CREDENTIAL_TOUCHES.has(blocked)))
+        return hard(`${tool} ${blocked}`);
+    return { verdict: "allow", reason: EDIT_TOOLS.has(tool) ? `${tool} inside the repository` : `${tool} only reads inside the repository`, shape: { repoRoot, tool, tokens: [relative] } };
+}
+function evaluateFloor(item, fsx = realFs) {
+    const verdict = judge(item, fsx);
+    (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.cmux_floor_judged", message: "judged a cmux Feed item against the floor", meta: { tool: item.toolName, verdict: verdict.verdict, reason: verdict.reason } });
+    return verdict;
+}
+function judge(item, fsx) {
+    if (item.kind !== "permissionRequest")
+        return hard("questions and plan approvals always go to the human");
+    if (item.source !== "claude")
+        return hard(`${item.source} sessions are observe-only`);
+    if (item.toolInputTruncated)
+        return hard("the request was truncated");
+    const tool = item.toolName;
+    if (!tool)
+        return hard("the request names no tool");
+    if (tool.startsWith("mcp__"))
+        return hard("MCP tools always go to the human");
+    if (!item.cwd)
+        return hard("the request has no working directory");
+    const repoRoot = findRepoRoot(item.cwd, fsx);
+    if (!repoRoot)
+        return hard("the working directory is not inside a repository");
+    const cwd = fsx.realpath(item.cwd);
+    const input = parseObject(item.toolInput);
+    if (!input)
+        return hard("the request input is not readable");
+    if (tool === "Bash")
+        return bashVerdict(input.command, repoRoot, cwd, fsx);
+    if (EDIT_TOOLS.has(tool) || READ_TOOLS.has(tool))
+        return pathVerdict(tool, input, repoRoot, cwd, fsx);
+    return hard(`${tool} always goes to the human`);
+}

package/dist/senses/cmux/principles.js

@@ -0,0 +1,72 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SEED_CMUX_PRINCIPLES = exports.CMUX_PRINCIPLES_FILE = void 0;
+exports.readCmuxPrinciples = readCmuxPrinciples;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const runtime_1 = require("../../nerves/runtime");
+/**
+ * Judgment guidance for coding-agent prompts, written by the human. It is guidance only: it never
+ * authorizes a reply. Live replies come from the code floor, the human's exact precedents and a
+ * standing owner grant. The agent reads these when it judges an escalated prompt.
+ *
+ * The bundle may hold its own `cmux-principles.md` (synced, human-authored); otherwise the seed
+ * below applies. The seed is drawn from the operator's standing desk instructions.
+ */
+exports.CMUX_PRINCIPLES_FILE = "cmux-principles.md";
+exports.SEED_CMUX_PRINCIPLES = [
+    "Keep routine work moving: a reversible step inside the session's own repository is the kind of thing the human wants answered without being woken.",
+    "Never act in the human's voice: anything that sends, posts, comments, merges or messages as them goes to them.",
+    "Never cause loss that cannot be undone: deleting files, force-pushing, rewriting shared history or wiping data goes to the human.",
+    "Credentials, sign-in, two-factor codes, payments and accepting terms always belong to the human.",
+    "Stay in scope: actions outside the session's repository, or beyond the task the session was given, go to the human.",
+    "Never widen permissions: no 'always', 'all' or bypass answers, and no edits to agent settings, hooks or CI.",
+    "Production, publishing and shared infrastructure go to the human unless they granted that exact action.",
+    "When unsure, ask: a blocked routine prompt costs the human a minute; a wrong approval can cost far more.",
+];
+function readCmuxPrinciples(agentRoot) {
+    try {
+        const text = fs.readFileSync(path.join(agentRoot, exports.CMUX_PRINCIPLES_FILE), "utf-8");
+        const principles = text.split("\n").map((line) => line.replace(/^\s*(?:[-*]|\d+[.)])\s+/, "").trim()).filter((line) => line && !line.startsWith("#"));
+        if (principles.length > 0)
+            return { source: "bundle", principles };
+    }
+    catch {
+        // No bundle file: use the seed.
+    }
+    (0, runtime_1.emitNervesEvent)({ component: "senses", event: "senses.cmux_principles_seeded", message: "using the seed cmux principles", meta: { agentRoot } });
+    return { source: "seed", principles: [...exports.SEED_CMUX_PRINCIPLES] };
+}