@paraharness/fs 0.0.0-stage → 0.1.0

package/dist/executors/internal/fs-coding-tool-drivers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-coding-tool-drivers.js","sourceRoot":"","sources":["../../../src/executors/internal/fs-coding-tool-drivers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAQ5C,OAAO,EAEL,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAEL,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA6B,EAC7B,IAAa,EACb,GAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAA8B,CAAC;IACzE,MAAM,EAAE,YAAY,EAAE,GAAG,yBAAyB,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,CAAsB,EAAE,OAAO,EAAE,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC5B,IAA6B,EAC7B,IAAa,EACb,GAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAiC,CAAC;IAC5E,OAAO,sBAAsB,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA8B,EAC9B,IAAa,EACb,GAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAkC,CAAC;IAC7E,OAAO,uBAAuB,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC"}

package/dist/executors/internal/fs-search-tool-drivers.d.ts

@@ -0,0 +1,26 @@
+import type { FsGlobToolNode, FsGrepToolNode, StepExecutionContext, ToolExecutionResult } from '@paraharness/core';
+/**
+ * Validates `args` against `node.inputSchema` and enumerates matching workspace files for `fs:glob`.
+ *
+ * @template THandle Runtime handle type of the active isolation scope.
+ *
+ * @param {FsGlobToolNode<THandle>}       node - Passive `fs:glob` tool AST node.
+ * @param {unknown}                       args - Raw tool call arguments.
+ * @param {StepExecutionContext<THandle>} ctx  - Active step execution context.
+ *
+ * @returns {Promise<ToolExecutionResult>} Frozen tool execution result containing newline-joined relative paths.
+ */
+export declare function globFsToolFiles<THandle = unknown>(node: FsGlobToolNode<THandle>, args: unknown, ctx: StepExecutionContext<THandle>): Promise<ToolExecutionResult>;
+/**
+ * Validates `args` against `node.inputSchema` and searches workspace files for `fs:grep`.
+ *
+ * @template THandle Runtime handle type of the active isolation scope.
+ *
+ * @param {FsGrepToolNode<THandle>}       node - Passive `fs:grep` tool AST node.
+ * @param {unknown}                       args - Raw tool call arguments.
+ * @param {StepExecutionContext<THandle>} ctx  - Active step execution context.
+ *
+ * @returns {Promise<ToolExecutionResult>} Frozen tool execution result containing newline-joined `path:line:text` matches.
+ */
+export declare function grepFsToolFiles<THandle = unknown>(node: FsGrepToolNode<THandle>, args: unknown, ctx: StepExecutionContext<THandle>): Promise<ToolExecutionResult>;
+//# sourceMappingURL=fs-search-tool-drivers.d.ts.map

package/dist/executors/internal/fs-search-tool-drivers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-search-tool-drivers.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/fs-search-tool-drivers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,mBAAmB,CAAC;AAQ3B;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,OAAO,GAAG,OAAO,EACrD,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,EAC7B,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,oBAAoB,CAAC,OAAO,CAAC,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAK9B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,OAAO,GAAG,OAAO,EACrD,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,EAC7B,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,oBAAoB,CAAC,OAAO,CAAC,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAI9B"}

package/dist/executors/internal/fs-search-tool-drivers.js

@@ -0,0 +1,37 @@
+import { enumerateWorkspaceFiles } from './enumerate-workspace-files.js';
+import { extractWorktreeRootAndBaseRef } from './extract-worktree-root-and-base-ref.js';
+import { grepWorkspaceFiles, } from './grep-workspace-files.js';
+/**
+ * Validates `args` against `node.inputSchema` and enumerates matching workspace files for `fs:glob`.
+ *
+ * @template THandle Runtime handle type of the active isolation scope.
+ *
+ * @param {FsGlobToolNode<THandle>}       node - Passive `fs:glob` tool AST node.
+ * @param {unknown}                       args - Raw tool call arguments.
+ * @param {StepExecutionContext<THandle>} ctx  - Active step execution context.
+ *
+ * @returns {Promise<ToolExecutionResult>} Frozen tool execution result containing newline-joined relative paths.
+ */
+export async function globFsToolFiles(node, args, ctx) {
+    const parsed = node.inputSchema.parse(args);
+    const { rootPath } = extractWorktreeRootAndBaseRef(ctx.scopeHandle);
+    const matched = await enumerateWorkspaceFiles(rootPath, parsed.pattern);
+    return Object.freeze({ content: matched.join('\n') });
+}
+/**
+ * Validates `args` against `node.inputSchema` and searches workspace files for `fs:grep`.
+ *
+ * @template THandle Runtime handle type of the active isolation scope.
+ *
+ * @param {FsGrepToolNode<THandle>}       node - Passive `fs:grep` tool AST node.
+ * @param {unknown}                       args - Raw tool call arguments.
+ * @param {StepExecutionContext<THandle>} ctx  - Active step execution context.
+ *
+ * @returns {Promise<ToolExecutionResult>} Frozen tool execution result containing newline-joined `path:line:text` matches.
+ */
+export async function grepFsToolFiles(node, args, ctx) {
+    const parsed = node.inputSchema.parse(args);
+    const content = await grepWorkspaceFiles(ctx.scopeHandle, parsed);
+    return Object.freeze({ content });
+}
+//# sourceMappingURL=fs-search-tool-drivers.js.map

package/dist/executors/internal/fs-search-tool-drivers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-search-tool-drivers.js","sourceRoot":"","sources":["../../../src/executors/internal/fs-search-tool-drivers.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EAEL,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAA6B,EAC7B,IAAa,EACb,GAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAiC,CAAC;IAC5E,MAAM,EAAE,QAAQ,EAAE,GAAG,6BAA6B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC,MAAM,CAAsB,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAA6B,EAC7B,IAAa,EACb,GAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAC;IACxE,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,MAAM,CAAsB,EAAE,OAAO,EAAE,CAAC,CAAC;AACzD,CAAC"}

package/dist/executors/internal/glob-matcher-cache.constants.d.ts

@@ -0,0 +1,20 @@
+import type { FsBoundaryGuardNode, LeaseDelta } from '@paraharness/core';
+/**
+ * WeakMap cache of pre-compiled `(candidatePath: string) => boolean` matchers keyed by `globs` array reference (`Rule 4.4`).
+ *
+ * Avoids re-compiling `picomatch` regular expressions across repeated policy guard, matcher, and check evaluations.
+ */
+export declare const CACHED_GLOB_OR_EXACT_MATCHERS: WeakMap<readonly string[], (candidatePath: string) => boolean>;
+/**
+ * WeakMap cache of pre-compiled boundary path matchers keyed by `FsBoundaryGuardNode` reference (`Rules 4.2 & 4.4`).
+ *
+ * Avoids calling `Object.keys` and allocating fresh `boundaryGlobs` arrays across repeated boundary guard evaluations.
+ */
+export declare const CACHED_BOUNDARY_GUARD_MATCHERS: WeakMap<FsBoundaryGuardNode, (candidatePath: string) => boolean>;
+/**
+ * WeakMap cache of pre-compiled active lease write matchers keyed by `activeLeases` array reference (`Rule 4.4`).
+ *
+ * Reuses the composed lease matcher predicate across repeated guard evaluations sharing the same `activeLeases` slice.
+ */
+export declare const CACHED_ACTIVE_LEASE_WRITE_MATCHERS: WeakMap<readonly LeaseDelta[], (candidatePath: string) => boolean>;
+//# sourceMappingURL=glob-matcher-cache.constants.d.ts.map

package/dist/executors/internal/glob-matcher-cache.constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob-matcher-cache.constants.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/glob-matcher-cache.constants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEzE;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,OAAO,CACjD,SAAS,MAAM,EAAE,EACjB,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CACoC,CAAC;AAEzE;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,EAAE,OAAO,CAClD,mBAAmB,EACnB,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CACsC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,EAAE,OAAO,CACtD,SAAS,UAAU,EAAE,EACrB,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CACwC,CAAC"}

package/dist/executors/internal/glob-matcher-cache.constants.js

@@ -0,0 +1,19 @@
+/**
+ * WeakMap cache of pre-compiled `(candidatePath: string) => boolean` matchers keyed by `globs` array reference (`Rule 4.4`).
+ *
+ * Avoids re-compiling `picomatch` regular expressions across repeated policy guard, matcher, and check evaluations.
+ */
+export const CACHED_GLOB_OR_EXACT_MATCHERS = new WeakMap();
+/**
+ * WeakMap cache of pre-compiled boundary path matchers keyed by `FsBoundaryGuardNode` reference (`Rules 4.2 & 4.4`).
+ *
+ * Avoids calling `Object.keys` and allocating fresh `boundaryGlobs` arrays across repeated boundary guard evaluations.
+ */
+export const CACHED_BOUNDARY_GUARD_MATCHERS = new WeakMap();
+/**
+ * WeakMap cache of pre-compiled active lease write matchers keyed by `activeLeases` array reference (`Rule 4.4`).
+ *
+ * Reuses the composed lease matcher predicate across repeated guard evaluations sharing the same `activeLeases` slice.
+ */
+export const CACHED_ACTIVE_LEASE_WRITE_MATCHERS = new WeakMap();
+//# sourceMappingURL=glob-matcher-cache.constants.js.map

package/dist/executors/internal/glob-matcher-cache.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob-matcher-cache.constants.js","sourceRoot":"","sources":["../../../src/executors/internal/glob-matcher-cache.constants.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAGtC,IAAI,OAAO,EAAyD,CAAC;AAEzE;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAGvC,IAAI,OAAO,EAA2D,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAG3C,IAAI,OAAO,EAA6D,CAAC"}

package/dist/executors/internal/grep-workspace-files.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Validated grep arguments for {@link grepWorkspaceFiles}.
+ */
+export interface GrepWorkspaceFilesParams {
+    /** Regular expression pattern string to search for. */
+    readonly pattern: string;
+    /** Optional POSIX glob filter for candidate files. */
+    readonly glob?: string;
+    /** Optional regular expression flags. */
+    readonly flags?: string;
+}
+/**
+ * Searches workspace files matching `params.glob` against `params.pattern` and formats `path:line:text` matches.
+ *
+ * Enforces `resolveJailedWorktreePath` on every candidate file before reading.
+ *
+ * @param {unknown}                  scopeHandle - Active isolation scope handle.
+ * @param {GrepWorkspaceFilesParams} params      - Validated grep arguments (`pattern`, optional `glob` and `flags`).
+ *
+ * @returns {Promise<string>} Newline-joined `path:lineNumber:lineText` match strings.
+ */
+export declare function grepWorkspaceFiles(scopeHandle: unknown, params: GrepWorkspaceFilesParams): Promise<string>;
+//# sourceMappingURL=grep-workspace-files.d.ts.map

package/dist/executors/internal/grep-workspace-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grep-workspace-files.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/grep-workspace-files.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,sDAAsD;IACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEvB,yCAAyC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,OAAO,EACpB,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,MAAM,CAAC,CAiBjB"}

package/dist/executors/internal/grep-workspace-files.js

@@ -0,0 +1,33 @@
+import { readFile } from 'node:fs/promises';
+import { enumerateWorkspaceFiles } from './enumerate-workspace-files.js';
+import { extractWorktreeRootAndBaseRef } from './extract-worktree-root-and-base-ref.js';
+import { resolveJailedWorktreePath } from './resolve-jailed-worktree-path.js';
+/**
+ * Searches workspace files matching `params.glob` against `params.pattern` and formats `path:line:text` matches.
+ *
+ * Enforces `resolveJailedWorktreePath` on every candidate file before reading.
+ *
+ * @param {unknown}                  scopeHandle - Active isolation scope handle.
+ * @param {GrepWorkspaceFilesParams} params      - Validated grep arguments (`pattern`, optional `glob` and `flags`).
+ *
+ * @returns {Promise<string>} Newline-joined `path:lineNumber:lineText` match strings.
+ */
+export async function grepWorkspaceFiles(scopeHandle, params) {
+    const { rootPath } = extractWorktreeRootAndBaseRef(scopeHandle);
+    const candidateFiles = await enumerateWorkspaceFiles(rootPath, params.glob ?? '**/*');
+    const regex = new RegExp(params.pattern, (params.flags ?? '').replace(/g/g, ''));
+    const matches = [];
+    for (const relPath of candidateFiles) {
+        const { absolutePath } = resolveJailedWorktreePath(scopeHandle, relPath, 'read');
+        const text = await readFile(absolutePath, 'utf8');
+        const lines = text.split(/\r?\n/);
+        for (let idx = 0; idx < lines.length; idx += 1) {
+            const line = lines[idx];
+            if (line !== undefined && regex.test(line)) {
+                matches.push(`${relPath}:${String(idx + 1)}:${line}`);
+            }
+        }
+    }
+    return matches.join('\n');
+}
+//# sourceMappingURL=grep-workspace-files.js.map

package/dist/executors/internal/grep-workspace-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grep-workspace-files.js","sourceRoot":"","sources":["../../../src/executors/internal/grep-workspace-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAgB9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAoB,EACpB,MAAgC;IAEhC,MAAM,EAAE,QAAQ,EAAE,GAAG,6BAA6B,CAAC,WAAW,CAAC,CAAC;IAChE,MAAM,cAAc,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,MAAM,EAAE,YAAY,EAAE,GAAG,yBAAyB,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACjF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC"}

package/dist/executors/internal/project-violated-write-effects.d.ts

@@ -0,0 +1,15 @@
+import type { PolicyGuardEvaluationInput, PolicyGuardEvaluationResult, ToolEffect } from '@paraharness/core';
+/**
+ * Evaluates write effects in `input.proposedEffects` against `isPathBlocked` and projects `violatedEffects` strictly to unleased violating paths.
+ *
+ * Filters out any path covered by `input.activeLeases` so single-guard and multi-guard evaluations report
+ * only the uncovered paths that triggered the violation (`SPEC.md` §3.5 & §4.3).
+ *
+ * @param {PolicyGuardEvaluationInput}                       input         - Proposed tool effects and active capability leases.
+ * @param {(relPath: string, effect: ToolEffect) => boolean} isPathBlocked - Predicate returning `true` when `relPath` violates the guard.
+ * @param {(violatingPaths: readonly string[]) => string}    formatSummary - Formatter producing the diagnostic `violationSummary`.
+ *
+ * @returns {PolicyGuardEvaluationResult} Frozen policy guard evaluation result.
+ */
+export declare function projectViolatedWriteEffects(input: PolicyGuardEvaluationInput, isPathBlocked: (relPath: string, effect: ToolEffect) => boolean, formatSummary: (violatingPaths: readonly string[]) => string): PolicyGuardEvaluationResult;
+//# sourceMappingURL=project-violated-write-effects.d.ts.map

package/dist/executors/internal/project-violated-write-effects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-violated-write-effects.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/project-violated-write-effects.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,UAAU,EACX,MAAM,mBAAmB,CAAC;AAI3B;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,0BAA0B,EACjC,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,KAAK,OAAO,EAC/D,aAAa,EAAE,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,KAAK,MAAM,GAC3D,2BAA2B,CAgD7B"}

package/dist/executors/internal/project-violated-write-effects.js

@@ -0,0 +1,67 @@
+import { compileActiveLeaseWriteMatcher } from './compile-active-lease-write-matcher.js';
+/**
+ * Evaluates write effects in `input.proposedEffects` against `isPathBlocked` and projects `violatedEffects` strictly to unleased violating paths.
+ *
+ * Filters out any path covered by `input.activeLeases` so single-guard and multi-guard evaluations report
+ * only the uncovered paths that triggered the violation (`SPEC.md` §3.5 & §4.3).
+ *
+ * @param {PolicyGuardEvaluationInput}                       input         - Proposed tool effects and active capability leases.
+ * @param {(relPath: string, effect: ToolEffect) => boolean} isPathBlocked - Predicate returning `true` when `relPath` violates the guard.
+ * @param {(violatingPaths: readonly string[]) => string}    formatSummary - Formatter producing the diagnostic `violationSummary`.
+ *
+ * @returns {PolicyGuardEvaluationResult} Frozen policy guard evaluation result.
+ */
+export function projectViolatedWriteEffects(input, isPathBlocked, formatSummary) {
+    const isLeased = compileActiveLeaseWriteMatcher(input.activeLeases);
+    const violatedEffects = [];
+    const allViolatingPaths = [];
+    for (const eff of input.proposedEffects) {
+        if (eff.kind !== 'fs:effect' || (eff.mutatesScope !== true && eff.attributes?.['mode'] !== 'write'))
+            continue;
+        const rawPaths = eff.attributes?.['paths'];
+        if (!Array.isArray(rawPaths))
+            continue;
+        const violatingSet = new Set();
+        for (const rawPath of rawPaths) {
+            if (typeof rawPath !== 'string')
+                continue;
+            const normPath = rawPath.replace(/\\/g, '/').replace(/^\.\//, '');
+            if (!isLeased(normPath) && isPathBlocked(normPath, eff)) {
+                violatingSet.add(normPath);
+                allViolatingPaths.push(normPath);
+            }
+        }
+        if (violatingSet.size === 0)
+            continue;
+        const basePaths = eff.attributes?.['existingPathsAtBaseRef'];
+        const filteredBase = [];
+        for (const bp of basePaths ?? []) {
+            if (violatingSet.has(bp.replace(/\\/g, '/').replace(/^\.\//, '')))
+                filteredBase.push(bp);
+        }
+        const rawProposed = eff.attributes?.['proposedContent'];
+        const filteredProposed = {};
+        for (const vp of violatingSet) {
+            if (rawProposed?.[vp] !== undefined)
+                filteredProposed[vp] = rawProposed[vp];
+        }
+        const existingAtBase = Array.isArray(basePaths) ? Object.freeze(filteredBase) : undefined;
+        const proposed = rawProposed !== undefined ? Object.freeze(filteredProposed) : undefined;
+        violatedEffects.push(Object.freeze({
+            kind: 'fs:effect',
+            mutatesScope: true,
+            attributes: Object.freeze({
+                mode: 'write',
+                paths: Object.freeze([...violatingSet]),
+                existingPathsAtBaseRef: existingAtBase,
+                proposedContent: proposed,
+            }),
+        }));
+    }
+    return Object.freeze({
+        allowed: violatedEffects.length === 0,
+        violatedEffects: Object.freeze(violatedEffects),
+        violationSummary: violatedEffects.length === 0 ? '' : formatSummary(allViolatingPaths),
+    });
+}
+//# sourceMappingURL=project-violated-write-effects.js.map

package/dist/executors/internal/project-violated-write-effects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-violated-write-effects.js","sourceRoot":"","sources":["../../../src/executors/internal/project-violated-write-effects.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AAEzF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAiC,EACjC,aAA+D,EAC/D,aAA4D;IAE5D,MAAM,QAAQ,GAAG,8BAA8B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,eAAe,GAAmB,EAAE,CAAC;IAC3C,MAAM,iBAAiB,GAAa,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QACxC,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,GAAG,CAAC,YAAY,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC;YAAE,SAAS;QAC9G,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,SAAS;QACvC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QACvC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,SAAS;YAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAClE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;gBACxD,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC3B,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC;YAAE,SAAS;QACtC,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,wBAAwB,CAAkC,CAAC;QAC9F,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,KAAK,MAAM,EAAE,IAAI,SAAS,IAAI,EAAE,EAAE,CAAC;YACjC,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,iBAAiB,CAAiD,CAAC;QACxG,MAAM,gBAAgB,GAA2B,EAAE,CAAC;QACpD,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;YAC9B,IAAI,WAAW,EAAE,CAAC,EAAE,CAAC,KAAK,SAAS;gBAAE,gBAAgB,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,MAAM,QAAQ,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,eAAe,CAAC,IAAI,CAClB,MAAM,CAAC,MAAM,CAAe;YAC1B,IAAI,EAAE,WAAW;YACjB,YAAY,EAAE,IAAI;YAClB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;gBACxB,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC;gBACvC,sBAAsB,EAAE,cAAc;gBACtC,eAAe,EAAE,QAAQ;aAC1B,CAAC;SACH,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAA8B;QAChD,OAAO,EAAE,eAAe,CAAC,MAAM,KAAK,CAAC;QACrC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;QAC/C,gBAAgB,EAAE,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,iBAAiB,CAAC;KACvF,CAAC,CAAC;AACL,CAAC"}

package/dist/executors/internal/resolve-jailed-worktree-path.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Resolves and jails `candidatePath` strictly inside the active worktree root (`SPEC.md` §4.3).
+ *
+ * Resolves existing target or parent symlinks via `realpathSync`, blocks escapes outside
+ * `worktreePath`, and rejects writes targeting `node_modules` directories.
+ *
+ * @param {unknown}          scopeHandle           - Active isolation scope handle or `undefined`.
+ * @param {string}           candidatePath         - Raw relative or absolute path requested by a tool or source.
+ * @param {'read' | 'write'} [accessMode='read']   - Filesystem access mode (`'read'` or `'write'`).
+ *
+ * @returns {{ readonly normalizedRelPath: string; readonly absolutePath: string }} Normalized POSIX relative path and jailed absolute path.
+ *
+ * @throws {Error} If `candidatePath` is invalid, escapes `worktreePath`, or writes to `node_modules`.
+ */
+export declare function resolveJailedWorktreePath(scopeHandle: unknown, candidatePath: string, accessMode?: 'read' | 'write'): {
+    readonly normalizedRelPath: string;
+    readonly absolutePath: string;
+};
+//# sourceMappingURL=resolve-jailed-worktree-path.d.ts.map

package/dist/executors/internal/resolve-jailed-worktree-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-jailed-worktree-path.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/resolve-jailed-worktree-path.ts"],"names":[],"mappings":"AA0EA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,OAAO,EACpB,aAAa,EAAE,MAAM,EACrB,UAAU,GAAE,MAAM,GAAG,OAAgB,GACpC;IAAE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAsBvE"}

package/dist/executors/internal/resolve-jailed-worktree-path.js

@@ -0,0 +1,101 @@
+import { existsSync, lstatSync, readlinkSync, realpathSync } from 'node:fs';
+import path from 'node:path';
+import { extractWorktreeRootAndBaseRef } from './extract-worktree-root-and-base-ref.js';
+/**
+ * Resolves the canonical filesystem path for `candidatePath` under `realRoot`, following existing and dangling symlinks.
+ *
+ * Walks up non-existent path components while resolving any symlink hops (capped at 40 hops to prevent cycles).
+ *
+ * @param {string} realRoot      - Canonicalized `realpathSync` root directory of the workspace.
+ * @param {string} candidatePath - Raw relative or absolute path requested by a tool or source.
+ *
+ * @returns {string} Canonicalized target path with all existing and dangling symlinks resolved.
+ *
+ * @throws {Error} If symlink resolution exceeds 40 hops.
+ */
+function resolveCandidateRealPath(realRoot, candidatePath) {
+    let cursor = path.resolve(realRoot, candidatePath);
+    const trailing = [];
+    for (let hops = 0; !existsSync(cursor);) {
+        if (lstatSync(cursor, { throwIfNoEntry: false })?.isSymbolicLink() === true) {
+            hops += 1;
+            if (hops > 40) {
+                throw new Error(`Workspace path jail violation: symlink loop on '${candidatePath}'.`);
+            }
+            cursor = path.resolve(path.dirname(cursor), readlinkSync(cursor), ...trailing);
+            trailing.length = 0;
+            continue;
+        }
+        const parent = path.dirname(cursor);
+        if (parent === cursor)
+            break;
+        trailing.unshift(path.basename(cursor));
+        cursor = parent;
+    }
+    const resolvedBase = existsSync(cursor) ? realpathSync(cursor) : cursor;
+    return path.resolve(resolvedBase, ...trailing);
+}
+/**
+ * Determines whether a `path.relative(realRoot, targetPath)` result escapes `realRoot`.
+ *
+ * Rejects `..`, `../...`, platform-specific `..\...`, and absolute path results.
+ *
+ * @param {string} relativePath - Output of `path.relative(realRoot, targetPath)`.
+ *
+ * @returns {boolean} True when `relativePath` points outside `realRoot`.
+ */
+function isRelativePathEscapingRoot(relativePath) {
+    return (relativePath === '..' ||
+        relativePath.startsWith('../') ||
+        relativePath.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relativePath));
+}
+/**
+ * Determines whether a normalized POSIX relative path targets a `node_modules` directory or file.
+ *
+ * Used to block write/edit tools from mutating `node_modules` subtrees (`SPEC.md` §4.3).
+ *
+ * @param {string} normalizedRelPath - Normalized POSIX worktree-relative file path.
+ *
+ * @returns {boolean} True when `normalizedRelPath` is inside `node_modules`.
+ */
+function isNodeModulesRelativePath(normalizedRelPath) {
+    return (normalizedRelPath === 'node_modules' ||
+        normalizedRelPath.startsWith('node_modules/') ||
+        normalizedRelPath.includes('/node_modules/') ||
+        normalizedRelPath.endsWith('/node_modules'));
+}
+/**
+ * Resolves and jails `candidatePath` strictly inside the active worktree root (`SPEC.md` §4.3).
+ *
+ * Resolves existing target or parent symlinks via `realpathSync`, blocks escapes outside
+ * `worktreePath`, and rejects writes targeting `node_modules` directories.
+ *
+ * @param {unknown}          scopeHandle           - Active isolation scope handle or `undefined`.
+ * @param {string}           candidatePath         - Raw relative or absolute path requested by a tool or source.
+ * @param {'read' | 'write'} [accessMode='read']   - Filesystem access mode (`'read'` or `'write'`).
+ *
+ * @returns {{ readonly normalizedRelPath: string; readonly absolutePath: string }} Normalized POSIX relative path and jailed absolute path.
+ *
+ * @throws {Error} If `candidatePath` is invalid, escapes `worktreePath`, or writes to `node_modules`.
+ */
+export function resolveJailedWorktreePath(scopeHandle, candidatePath, accessMode = 'read') {
+    if (typeof candidatePath !== 'string' ||
+        candidatePath.trim().length === 0 ||
+        candidatePath.includes('\0')) {
+        throw new Error(`Invalid workspace file path '${String(candidatePath)}'.`);
+    }
+    const { rootPath } = extractWorktreeRootAndBaseRef(scopeHandle);
+    const realRoot = realpathSync(path.resolve(rootPath));
+    const realCandidate = resolveCandidateRealPath(realRoot, candidatePath);
+    const relativePath = path.relative(realRoot, realCandidate);
+    if (isRelativePathEscapingRoot(relativePath)) {
+        throw new Error(`Workspace path jail violation: '${candidatePath}' escapes worktree '${realRoot}'.`);
+    }
+    const normalizedRelPath = relativePath.length === 0 ? '.' : relativePath.split(path.sep).join('/');
+    if (accessMode === 'write' && isNodeModulesRelativePath(normalizedRelPath)) {
+        throw new Error(`Write denied: modifying node_modules path '${normalizedRelPath}' is forbidden.`);
+    }
+    return Object.freeze({ normalizedRelPath, absolutePath: realCandidate });
+}
+//# sourceMappingURL=resolve-jailed-worktree-path.js.map

package/dist/executors/internal/resolve-jailed-worktree-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-jailed-worktree-path.js","sourceRoot":"","sources":["../../../src/executors/internal/resolve-jailed-worktree-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAExF;;;;;;;;;;;GAWG;AACH,SAAS,wBAAwB,CAAC,QAAgB,EAAE,aAAqB;IACvE,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,GAAI,CAAC;QACzC,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC;YAC5E,IAAI,IAAI,CAAC,CAAC;YACV,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,mDAAmD,aAAa,IAAI,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;YAC/E,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,MAAM;YAAE,MAAM;QAC7B,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxC,MAAM,GAAG,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACxE,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,0BAA0B,CAAC,YAAoB;IACtD,OAAO,CACL,YAAY,KAAK,IAAI;QACrB,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC;QAC9B,YAAY,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,yBAAyB,CAAC,iBAAyB;IAC1D,OAAO,CACL,iBAAiB,KAAK,cAAc;QACpC,iBAAiB,CAAC,UAAU,CAAC,eAAe,CAAC;QAC7C,iBAAiB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC5C,iBAAiB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAAoB,EACpB,aAAqB,EACrB,aAA+B,MAAM;IAErC,IACE,OAAO,aAAa,KAAK,QAAQ;QACjC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QACjC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,EAC5B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,6BAA6B,CAAC,WAAW,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,wBAAwB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC5D,IAAI,0BAA0B,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,mCAAmC,aAAa,uBAAuB,QAAQ,IAAI,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnG,IAAI,UAAU,KAAK,OAAO,IAAI,yBAAyB,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,8CAA8C,iBAAiB,iBAAiB,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAC;AAC3E,CAAC"}

package/dist/executors/internal/secret-patterns.constants.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Default regular expression source strings scanned by `fs:secret-literals` (`SPEC.md` §4.3).
+ *
+ * Detects OpenAI/Anthropic `sk-` keys, GitHub `ghp_` / `github_pat_` tokens, Slack `xox*-` tokens,
+ * AWS `AKIA` access key IDs, and PEM private key headers.
+ */
+export declare const DEFAULT_SECRET_PATTERN_SOURCES: readonly string[];
+/**
+ * Pre-compiled default regular expressions for `fs:secret-literals` (`Rule 4.4`).
+ */
+export declare const DEFAULT_COMPILED_SECRET_PATTERNS: readonly RegExp[];
+/**
+ * WeakMap cache mapping frozen custom secret pattern arrays to their compiled `RegExp` lists (`Rule 4.4`).
+ */
+export declare const CACHED_SECRET_PATTERN_LISTS: WeakMap<readonly string[], readonly RegExp[]>;
+//# sourceMappingURL=secret-patterns.constants.d.ts.map

package/dist/executors/internal/secret-patterns.constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-patterns.constants.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/secret-patterns.constants.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAO1D,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,gCAAgC,EAAE,SAAS,MAAM,EAO5D,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,2BAA2B,+CAGrC,CAAC"}

package/dist/executors/internal/secret-patterns.constants.js

@@ -0,0 +1,30 @@
+/**
+ * Default regular expression source strings scanned by `fs:secret-literals` (`SPEC.md` §4.3).
+ *
+ * Detects OpenAI/Anthropic `sk-` keys, GitHub `ghp_` / `github_pat_` tokens, Slack `xox*-` tokens,
+ * AWS `AKIA` access key IDs, and PEM private key headers.
+ */
+export const DEFAULT_SECRET_PATTERN_SOURCES = Object.freeze([
+    '\\bsk-[A-Za-z0-9_-]{16,}\\b',
+    '\\bghp_[A-Za-z0-9]{20,}\\b',
+    '\\bgithub_pat_[A-Za-z0-9_]{20,}\\b',
+    '\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b',
+    '\\bAKIA[0-9A-Z]{16}\\b',
+    '-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----',
+]);
+/**
+ * Pre-compiled default regular expressions for `fs:secret-literals` (`Rule 4.4`).
+ */
+export const DEFAULT_COMPILED_SECRET_PATTERNS = Object.freeze([
+    new RegExp('\\bsk-[A-Za-z0-9_-]{16,}\\b'),
+    new RegExp('\\bghp_[A-Za-z0-9]{20,}\\b'),
+    new RegExp('\\bgithub_pat_[A-Za-z0-9_]{20,}\\b'),
+    new RegExp('\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b'),
+    new RegExp('\\bAKIA[0-9A-Z]{16}\\b'),
+    new RegExp('-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----'),
+]);
+/**
+ * WeakMap cache mapping frozen custom secret pattern arrays to their compiled `RegExp` lists (`Rule 4.4`).
+ */
+export const CACHED_SECRET_PATTERN_LISTS = new WeakMap();
+//# sourceMappingURL=secret-patterns.constants.js.map

package/dist/executors/internal/secret-patterns.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-patterns.constants.js","sourceRoot":"","sources":["../../../src/executors/internal/secret-patterns.constants.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC7E,6BAA6B;IAC7B,4BAA4B;IAC5B,oCAAoC;IACpC,oCAAoC;IACpC,wBAAwB;IACxB,mDAAmD;CACpD,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC/E,IAAI,MAAM,CAAC,6BAA6B,CAAC;IACzC,IAAI,MAAM,CAAC,4BAA4B,CAAC;IACxC,IAAI,MAAM,CAAC,oCAAoC,CAAC;IAChD,IAAI,MAAM,CAAC,oCAAoC,CAAC;IAChD,IAAI,MAAM,CAAC,wBAAwB,CAAC;IACpC,IAAI,MAAM,CAAC,mDAAmD,CAAC;CAChE,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,OAAO,EAGnD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,35 @@
+export type { FsAllowOnlyGuardNode, FsBoundaryGuardNode, FsEditToolNode, FsGlobMatcherNode, FsGlobSourceNode, FsGlobToolNode, FsGrepToolNode, FsJsonlLessonStoreNode, FsPartitionMapNode, FsPartitionPathMapping, FsProtectGuardNode, FsQuotaTripwireNode, FsReadOnlyGuardNode, FsReadToolNode, FsRegexCheckNode, FsRequireReadBeforeWriteGuardNode, FsScopedWriteGuardNode, FsSecretLiteralsGuardNode, FsTelemetryCollectorNode, FsTextSourceNode, FsWriteGuardNode, FsWriteToolNode, } from '@paraharness/core';
+export { createFsAllowOnlyGuardBuilder } from './builders/create-fs-allow-only-guard-builder.js';
+export { createFsAllowWriteGlobsLeaseDelta } from './builders/create-fs-allow-write-globs-lease-delta.js';
+export { createFsBoundaryGuardBuilder } from './builders/create-fs-boundary-guard-builder.js';
+export { createFsCodingTools } from './builders/create-fs-coding-tools.js';
+export { createFsGlobMatcherBuilder } from './builders/create-fs-glob-matcher-builder.js';
+export { createFsGlobSourceBuilder } from './builders/create-fs-glob-source-builder.js';
+export { createFsInPartitionPredicate } from './builders/create-fs-in-partition-predicate.js';
+export { createFsJsonlLessonStoreBuilder, type FsJsonlLessonStoreOptions, } from './builders/create-fs-jsonl-lesson-store-builder.js';
+export { createFsMaxFilesMutatedBuilder } from './builders/create-fs-max-files-mutated-builder.js';
+export { createFsPartitionMap } from './builders/create-fs-partition-map.js';
+export { createFsProtectGuardBuilder } from './builders/create-fs-protect-guard-builder.js';
+export { createFsReadOnlyGuardBuilder } from './builders/create-fs-read-only-guard-builder.js';
+export { createFsReadOnlyTools } from './builders/create-fs-read-only-tools.js';
+export { createFsRegexCheckBuilder, type FsRegexCheckOptions, } from './builders/create-fs-regex-check-builder.js';
+export { createFsRequireReadBeforeWriteGuardBuilder } from './builders/create-fs-require-read-before-write-guard-builder.js';
+export { createFsScopedWriteGuardBuilder } from './builders/create-fs-scoped-write-guard-builder.js';
+export { createFsSecretLiteralsGuardBuilder } from './builders/create-fs-secret-literals-guard-builder.js';
+export { createFsTelemetryBuilder } from './builders/create-fs-telemetry-builder.js';
+export { createFsTextSourceBuilder } from './builders/create-fs-text-source-builder.js';
+export { createFsWriteGuardBuilder, type FsWriteGuardOptions, } from './builders/create-fs-write-guard-builder.js';
+export type { FsNamespace } from './builders/fs-namespace-contract.js';
+export { fs } from './builders/fs-namespace.js';
+export { createFsExecutors } from './executors/create-fs-executors.js';
+export { collectFsTelemetry, evaluateFsQuotaTripwire, executeFsRegexCheck, } from './executors/fs-check-tripwire-and-telemetry.js';
+export { fsExecutors } from './executors/fs-executors.constants.js';
+export { evaluateFsGlobEffectMatcher } from './executors/fs-glob-effect-matcher.js';
+export { evaluateFsAllowOnlyGuard, evaluateFsBoundaryGuard, evaluateFsProtectGuard, evaluateFsReadOnlyGuard, } from './executors/fs-path-guard-executors.js';
+export { createFsGlobToolDriver, createFsGrepToolDriver, createFsReadToolDriver, } from './executors/fs-read-tool-drivers.js';
+export { executeFsGlobSource, executeFsTextSource, } from './executors/fs-source-executors.js';
+export type { FsToolEffect, FsToolEffectAttributes, } from './executors/fs-tool-effect.js';
+export { evaluateFsRequireReadBeforeWriteGuard, evaluateFsScopedWriteGuard, evaluateFsSecretLiteralsGuard, evaluateFsWriteGuard, } from './executors/fs-write-guard-executors.js';
+export { createFsEditToolDriver, createFsWriteToolDriver, } from './executors/fs-write-tool-drivers.js';
+export { type FsAdmitLessonParams, FsJsonlLessonStore, type FsQueryCandidatesParams, type FsRecordOutcomeParams, } from './stores/fs-jsonl-lesson-store.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,iCAAiC,EACjC,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACjG,OAAO,EAAE,iCAAiC,EAAE,MAAM,uDAAuD,CAAC;AAC1G,OAAO,EAAE,4BAA4B,EAAE,MAAM,gDAAgD,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,gDAAgD,CAAC;AAC9F,OAAO,EACL,+BAA+B,EAC/B,KAAK,yBAAyB,GAC/B,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,8BAA8B,EAAE,MAAM,mDAAmD,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAC5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,iDAAiD,CAAC;AAC/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EACL,yBAAyB,EACzB,KAAK,mBAAmB,GACzB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iEAAiE,CAAC;AAC7H,OAAO,EAAE,+BAA+B,EAAE,MAAM,oDAAoD,CAAC;AACrG,OAAO,EAAE,kCAAkC,EAAE,MAAM,uDAAuD,CAAC;AAC3G,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EACL,yBAAyB,EACzB,KAAK,mBAAmB,GACzB,MAAM,6CAA6C,CAAC;AACrD,YAAY,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,EAAE,EAAE,MAAM,4BAA4B,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EACV,YAAY,EACZ,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qCAAqC,EACrC,0BAA0B,EAC1B,6BAA6B,EAC7B,oBAAoB,GACrB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,KAAK,mBAAmB,EACxB,kBAAkB,EAClB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,GAC3B,MAAM,mCAAmC,CAAC"}

package/dist/index.js

@@ -0,0 +1,32 @@
+export { createFsAllowOnlyGuardBuilder } from './builders/create-fs-allow-only-guard-builder.js';
+export { createFsAllowWriteGlobsLeaseDelta } from './builders/create-fs-allow-write-globs-lease-delta.js';
+export { createFsBoundaryGuardBuilder } from './builders/create-fs-boundary-guard-builder.js';
+export { createFsCodingTools } from './builders/create-fs-coding-tools.js';
+export { createFsGlobMatcherBuilder } from './builders/create-fs-glob-matcher-builder.js';
+export { createFsGlobSourceBuilder } from './builders/create-fs-glob-source-builder.js';
+export { createFsInPartitionPredicate } from './builders/create-fs-in-partition-predicate.js';
+export { createFsJsonlLessonStoreBuilder, } from './builders/create-fs-jsonl-lesson-store-builder.js';
+export { createFsMaxFilesMutatedBuilder } from './builders/create-fs-max-files-mutated-builder.js';
+export { createFsPartitionMap } from './builders/create-fs-partition-map.js';
+export { createFsProtectGuardBuilder } from './builders/create-fs-protect-guard-builder.js';
+export { createFsReadOnlyGuardBuilder } from './builders/create-fs-read-only-guard-builder.js';
+export { createFsReadOnlyTools } from './builders/create-fs-read-only-tools.js';
+export { createFsRegexCheckBuilder, } from './builders/create-fs-regex-check-builder.js';
+export { createFsRequireReadBeforeWriteGuardBuilder } from './builders/create-fs-require-read-before-write-guard-builder.js';
+export { createFsScopedWriteGuardBuilder } from './builders/create-fs-scoped-write-guard-builder.js';
+export { createFsSecretLiteralsGuardBuilder } from './builders/create-fs-secret-literals-guard-builder.js';
+export { createFsTelemetryBuilder } from './builders/create-fs-telemetry-builder.js';
+export { createFsTextSourceBuilder } from './builders/create-fs-text-source-builder.js';
+export { createFsWriteGuardBuilder, } from './builders/create-fs-write-guard-builder.js';
+export { fs } from './builders/fs-namespace.js';
+export { createFsExecutors } from './executors/create-fs-executors.js';
+export { collectFsTelemetry, evaluateFsQuotaTripwire, executeFsRegexCheck, } from './executors/fs-check-tripwire-and-telemetry.js';
+export { fsExecutors } from './executors/fs-executors.constants.js';
+export { evaluateFsGlobEffectMatcher } from './executors/fs-glob-effect-matcher.js';
+export { evaluateFsAllowOnlyGuard, evaluateFsBoundaryGuard, evaluateFsProtectGuard, evaluateFsReadOnlyGuard, } from './executors/fs-path-guard-executors.js';
+export { createFsGlobToolDriver, createFsGrepToolDriver, createFsReadToolDriver, } from './executors/fs-read-tool-drivers.js';
+export { executeFsGlobSource, executeFsTextSource, } from './executors/fs-source-executors.js';
+export { evaluateFsRequireReadBeforeWriteGuard, evaluateFsScopedWriteGuard, evaluateFsSecretLiteralsGuard, evaluateFsWriteGuard, } from './executors/fs-write-guard-executors.js';
+export { createFsEditToolDriver, createFsWriteToolDriver, } from './executors/fs-write-tool-drivers.js';
+export { FsJsonlLessonStore, } from './stores/fs-jsonl-lesson-store.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACjG,OAAO,EAAE,iCAAiC,EAAE,MAAM,uDAAuD,CAAC;AAC1G,OAAO,EAAE,4BAA4B,EAAE,MAAM,gDAAgD,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,gDAAgD,CAAC;AAC9F,OAAO,EACL,+BAA+B,GAEhC,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,8BAA8B,EAAE,MAAM,mDAAmD,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAC5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,iDAAiD,CAAC;AAC/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EACL,yBAAyB,GAE1B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iEAAiE,CAAC;AAC7H,OAAO,EAAE,+BAA+B,EAAE,MAAM,oDAAoD,CAAC;AACrG,OAAO,EAAE,kCAAkC,EAAE,MAAM,uDAAuD,CAAC;AAC3G,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EACL,yBAAyB,GAE1B,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAAE,EAAE,EAAE,MAAM,4BAA4B,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAK5C,OAAO,EACL,qCAAqC,EACrC,0BAA0B,EAC1B,6BAA6B,EAC7B,oBAAoB,GACrB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAEL,kBAAkB,GAGnB,MAAM,mCAAmC,CAAC"}