@paths.design/caws-cli 10.2.0 → 11.0.0

package/dist/shell/render/waiver.js

@@ -0,0 +1,94 @@
+"use strict";
+// Pure formatter for waiver records.
+//
+// The renderer does NOT decide applicability. It receives a derived
+// effectiveness label from the caller — `effectiveWaiversForGate`
+// (kernel) and `waiverEffectiveness` (kernel) own that decision.
+// Renderers stay pure so they're trivial to test and reuse from
+// `list`, `show`, and any future doctor surface.
+//
+// Two output shapes:
+//
+//   renderWaiverSummary(input)  — single-line list row used by `list`.
+//   renderWaiverDetail(input)   — multi-line detail block used by `show`.
+//
+// `now` is supplied by the caller, never read from the clock here. That
+// keeps test output deterministic and matches the discipline that the
+// rest of the shell follows.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderWaiverSummary = renderWaiverSummary;
+exports.renderWaiverDetail = renderWaiverDetail;
+function effectivenessLabel(e) {
+    switch (e) {
+        case 'active':
+            return 'ACTIVE         ';
+        case 'expired':
+            return 'EXPIRED        ';
+        case 'revoked':
+            return 'REVOKED        ';
+        case 'not_applicable':
+            return 'NOT_APPLICABLE ';
+    }
+}
+function fmtScope(w) {
+    if (w.scope?.spec_id !== undefined)
+        return `spec=${w.scope.spec_id}`;
+    return 'project-wide';
+}
+function fmtExpiryDelta(expiresAt, now) {
+    const expMs = Date.parse(expiresAt);
+    if (!Number.isFinite(expMs))
+        return '(unparseable expires_at)';
+    const deltaMs = expMs - now.getTime();
+    const absMs = Math.abs(deltaMs);
+    let unit;
+    if (absMs < 60_000)
+        unit = `${Math.round(absMs / 1000)}s`;
+    else if (absMs < 3_600_000)
+        unit = `${Math.round(absMs / 60_000)}m`;
+    else if (absMs < 86_400_000)
+        unit = `${Math.round(absMs / 3_600_000)}h`;
+    else
+        unit = `${Math.round(absMs / 86_400_000)}d`;
+    return deltaMs >= 0 ? `in ${unit}` : `${unit} ago`;
+}
+/**
+ * One-line summary suited to `caws waiver list`. Includes the kernel-
+ * derived effectiveness label so the caller doesn't need to re-classify.
+ */
+function renderWaiverSummary(input) {
+    const w = input.waiver;
+    const gates = w.gates.join(',');
+    return `${effectivenessLabel(input.effectiveness)}  ${w.id}  [${gates}]  (${fmtScope(w)})  ${w.title}`;
+}
+/**
+ * Multi-line detail block suited to `caws waiver show`. Includes
+ * everything `Waiver` carries plus a derived expiry delta.
+ */
+function renderWaiverDetail(input) {
+    const w = input.waiver;
+    const lines = [];
+    lines.push(`Waiver ${w.id}`);
+    lines.push(`  Status (stored):  ${w.status}`);
+    lines.push(`  Effectiveness:    ${input.effectiveness}`);
+    lines.push(`  Title:            ${w.title}`);
+    lines.push(`  Gates:            ${w.gates.join(', ')}`);
+    lines.push(`  Scope:            ${fmtScope(w)}`);
+    lines.push(`  Reason:           ${w.reason}`);
+    lines.push(`  Approved by:      ${w.approved_by}`);
+    lines.push(`  Created at:       ${w.created_at}`);
+    lines.push(`  Expires at:       ${w.expires_at} (${fmtExpiryDelta(w.expires_at, input.now)})`);
+    if (w.constraints?.max_uses !== undefined) {
+        lines.push(`  Max uses:         ${w.constraints.max_uses} (kernel does not enforce)`);
+    }
+    if (w.revocation !== undefined) {
+        lines.push('  Revocation:');
+        lines.push(`    Revoked at:     ${w.revocation.revoked_at}`);
+        if (w.revocation.revoked_by !== undefined)
+            lines.push(`    Revoked by:     ${w.revocation.revoked_by}`);
+        if (w.revocation.reason !== undefined)
+            lines.push(`    Reason:         ${w.revocation.reason}`);
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=waiver.js.map

package/dist/shell/render/waiver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"waiver.js","sourceRoot":"","sources":["../../../src/shell/render/waiver.ts"],"names":[],"mappings":";AAAA,qCAAqC;AACrC,EAAE;AACF,oEAAoE;AACpE,kEAAkE;AAClE,iEAAiE;AACjE,gEAAgE;AAChE,iDAAiD;AACjD,EAAE;AACF,qBAAqB;AACrB,EAAE;AACF,uEAAuE;AACvE,0EAA0E;AAC1E,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,6BAA6B;;AAqD7B,kDAIC;AAMD,gDAyBC;AAtED,SAAS,kBAAkB,CAAC,CAAsB;IAChD,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,QAAQ;YACX,OAAO,iBAAiB,CAAC;QAC3B,KAAK,SAAS;YACZ,OAAO,iBAAiB,CAAC;QAC3B,KAAK,SAAS;YACZ,OAAO,iBAAiB,CAAC;QAC3B,KAAK,gBAAgB;YACnB,OAAO,iBAAiB,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IACrE,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAS;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,0BAA0B,CAAC;IAC/D,MAAM,OAAO,GAAG,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,IAAY,CAAC;IACjB,IAAI,KAAK,GAAG,MAAM;QAAE,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC;SACrD,IAAI,KAAK,GAAG,SAAS;QAAE,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC;SAC/D,IAAI,KAAK,GAAG,UAAU;QAAE,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC;;QACnE,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC;IACjD,OAAO,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,KAA+B;IACjE,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;AACzG,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,KAA8B;IAC/D,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7B,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;IACzD,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxD,KAAK,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,UAAU,KAAK,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/F,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,WAAW,CAAC,QAAQ,4BAA4B,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS;YACvC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS;YACnC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/shell/rules.d.ts

@@ -0,0 +1,37 @@
+export declare const SHELL_RULE_PREFIXES: {
+    readonly session: "shell.session";
+    readonly binding: "shell.binding";
+    readonly command: "shell.command";
+    readonly gates: "shell.gates";
+    readonly waiver: "shell.waiver";
+};
+export declare const SHELL_RULES: {
+    readonly SESSION_RESOLVED_FROM_CLAUDE_ENV: "shell.session.resolved_from_claude_env";
+    readonly SESSION_RESOLVED_FROM_CAPSULE: "shell.session.resolved_from_capsule";
+    readonly SESSION_RESOLVED_FROM_CURSOR_ENV: "shell.session.resolved_from_cursor_env";
+    readonly SESSION_NO_STABLE_IDENTITY: "shell.session.no_stable_identity";
+    readonly SESSION_CAPSULE_MINTED: "shell.session.capsule_minted";
+    readonly SESSION_CAPSULE_INVALID: "shell.session.capsule_invalid";
+    readonly SESSION_CAPSULE_WRITE_FAILED: "shell.session.capsule_write_failed";
+    readonly BINDING_CWD_OUTSIDE_REPO: "shell.binding.cwd_outside_repo";
+    readonly BINDING_WORKTREE_NOT_FOUND_IN_REGISTRY: "shell.binding.worktree_not_found_in_registry";
+    readonly BINDING_NO_SPEC_FOR_WORKTREE: "shell.binding.no_spec_for_worktree";
+    readonly BINDING_UNBOUND_CWD: "shell.binding.unbound_cwd";
+    readonly COMMAND_INVALID_PATH_ARGUMENT: "shell.command.invalid_path_argument";
+    readonly COMMAND_PRE_CHAINED_EVENT_REFUSED: "shell.command.pre_chained_event_refused";
+    readonly COMMAND_INVALID_EVIDENCE_TYPE: "shell.command.invalid_evidence_type";
+    readonly COMMAND_MISSING_SPEC_ID: "shell.command.missing_spec_id";
+    readonly GATES_SUBPROCESS_NOT_FOUND: "shell.gates.subprocess_not_found";
+    readonly GATES_SUBPROCESS_FAILED: "shell.gates.subprocess_failed";
+    readonly GATES_REPORT_NOT_JSON: "shell.gates.report_not_json";
+    readonly GATES_REPORT_INVALID_SHAPE: "shell.gates.report_invalid_shape";
+    readonly GATES_POLICY_REQUIRED: "shell.gates.policy_required";
+    readonly WAIVER_MISSING_ID: "shell.waiver.missing_id";
+    readonly WAIVER_NOT_FOUND: "shell.waiver.not_found";
+    readonly WAIVER_DUPLICATE: "shell.waiver.duplicate";
+    readonly WAIVER_INVALID_INPUT: "shell.waiver.invalid_input";
+    readonly WAIVER_ALREADY_REVOKED: "shell.waiver.already_revoked";
+    readonly WAIVER_WRITE_FAILED: "shell.waiver.write_failed";
+};
+export type ShellRule = (typeof SHELL_RULES)[keyof typeof SHELL_RULES];
+//# sourceMappingURL=rules.d.ts.map

package/dist/shell/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/shell/rules.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,mBAAmB;;;;;;CAMtB,CAAC;AAEX,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCd,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC"}

package/dist/shell/rules.js

@@ -0,0 +1,51 @@
+"use strict";
+// Stable rule identifiers for shell-layer diagnostics.
+//
+// Shell rules live under the `shell.*` namespace. They are emitted ONLY for
+// shell-specific concerns (CLI invocation, session resolution, command-line
+// argument errors). Anything kernel-authoritative (scope decisions, doctor
+// findings, evidence validation) uses the kernel's own rule ids — the shell
+// never invents a parallel naming for those.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHELL_RULES = exports.SHELL_RULE_PREFIXES = void 0;
+exports.SHELL_RULE_PREFIXES = {
+    session: 'shell.session',
+    binding: 'shell.binding',
+    command: 'shell.command',
+    gates: 'shell.gates',
+    waiver: 'shell.waiver',
+};
+exports.SHELL_RULES = {
+    // Session identity resolution.
+    SESSION_RESOLVED_FROM_CLAUDE_ENV: 'shell.session.resolved_from_claude_env',
+    SESSION_RESOLVED_FROM_CAPSULE: 'shell.session.resolved_from_capsule',
+    SESSION_RESOLVED_FROM_CURSOR_ENV: 'shell.session.resolved_from_cursor_env',
+    SESSION_NO_STABLE_IDENTITY: 'shell.session.no_stable_identity',
+    SESSION_CAPSULE_MINTED: 'shell.session.capsule_minted',
+    SESSION_CAPSULE_INVALID: 'shell.session.capsule_invalid',
+    SESSION_CAPSULE_WRITE_FAILED: 'shell.session.capsule_write_failed',
+    // cwd → worktree binding resolution.
+    BINDING_CWD_OUTSIDE_REPO: 'shell.binding.cwd_outside_repo',
+    BINDING_WORKTREE_NOT_FOUND_IN_REGISTRY: 'shell.binding.worktree_not_found_in_registry',
+    BINDING_NO_SPEC_FOR_WORKTREE: 'shell.binding.no_spec_for_worktree',
+    BINDING_UNBOUND_CWD: 'shell.binding.unbound_cwd',
+    // Command argument / input errors.
+    COMMAND_INVALID_PATH_ARGUMENT: 'shell.command.invalid_path_argument',
+    COMMAND_PRE_CHAINED_EVENT_REFUSED: 'shell.command.pre_chained_event_refused',
+    COMMAND_INVALID_EVIDENCE_TYPE: 'shell.command.invalid_evidence_type',
+    COMMAND_MISSING_SPEC_ID: 'shell.command.missing_spec_id',
+    // quality-gates subprocess + JSON contract.
+    GATES_SUBPROCESS_NOT_FOUND: 'shell.gates.subprocess_not_found',
+    GATES_SUBPROCESS_FAILED: 'shell.gates.subprocess_failed',
+    GATES_REPORT_NOT_JSON: 'shell.gates.report_not_json',
+    GATES_REPORT_INVALID_SHAPE: 'shell.gates.report_invalid_shape',
+    GATES_POLICY_REQUIRED: 'shell.gates.policy_required',
+    // waiver command surface.
+    WAIVER_MISSING_ID: 'shell.waiver.missing_id',
+    WAIVER_NOT_FOUND: 'shell.waiver.not_found',
+    WAIVER_DUPLICATE: 'shell.waiver.duplicate',
+    WAIVER_INVALID_INPUT: 'shell.waiver.invalid_input',
+    WAIVER_ALREADY_REVOKED: 'shell.waiver.already_revoked',
+    WAIVER_WRITE_FAILED: 'shell.waiver.write_failed',
+};
+//# sourceMappingURL=rules.js.map

package/dist/shell/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/shell/rules.ts"],"names":[],"mappings":";AAAA,uDAAuD;AACvD,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,2EAA2E;AAC3E,4EAA4E;AAC5E,6CAA6C;;;AAEhC,QAAA,mBAAmB,GAAG;IACjC,OAAO,EAAE,eAAe;IACxB,OAAO,EAAE,eAAe;IACxB,OAAO,EAAE,eAAe;IACxB,KAAK,EAAE,aAAa;IACpB,MAAM,EAAE,cAAc;CACd,CAAC;AAEE,QAAA,WAAW,GAAG;IACzB,+BAA+B;IAC/B,gCAAgC,EAAE,wCAAwC;IAC1E,6BAA6B,EAAE,qCAAqC;IACpE,gCAAgC,EAAE,wCAAwC;IAC1E,0BAA0B,EAAE,kCAAkC;IAC9D,sBAAsB,EAAE,8BAA8B;IACtD,uBAAuB,EAAE,+BAA+B;IACxD,4BAA4B,EAAE,oCAAoC;IAElE,qCAAqC;IACrC,wBAAwB,EAAE,gCAAgC;IAC1D,sCAAsC,EACpC,8CAA8C;IAChD,4BAA4B,EAAE,oCAAoC;IAClE,mBAAmB,EAAE,2BAA2B;IAEhD,mCAAmC;IACnC,6BAA6B,EAAE,qCAAqC;IACpE,iCAAiC,EAAE,yCAAyC;IAC5E,6BAA6B,EAAE,qCAAqC;IACpE,uBAAuB,EAAE,+BAA+B;IAExD,4CAA4C;IAC5C,0BAA0B,EAAE,kCAAkC;IAC9D,uBAAuB,EAAE,+BAA+B;IACxD,qBAAqB,EAAE,6BAA6B;IACpD,0BAA0B,EAAE,kCAAkC;IAC9D,qBAAqB,EAAE,6BAA6B;IAEpD,0BAA0B;IAC1B,iBAAiB,EAAE,yBAAyB;IAC5C,gBAAgB,EAAE,wBAAwB;IAC1C,gBAAgB,EAAE,wBAAwB;IAC1C,oBAAoB,EAAE,4BAA4B;IAClD,sBAAsB,EAAE,8BAA8B;IACtD,mBAAmB,EAAE,2BAA2B;CACxC,CAAC"}

package/dist/shell/session/actor.d.ts

@@ -0,0 +1,14 @@
+import type { Actor, ActorKind } from '@paths.design/caws-kernel';
+import type { ResolvedSession } from './types';
+export interface BuildActorOptions {
+    readonly session: ResolvedSession;
+    readonly kind: ActorKind;
+    /**
+     * Override `actor.id`. Defaults to `session.identity.session_id`.
+     * Useful when `kind` is `'human'` and the caller has a meaningful
+     * username to attribute work to.
+     */
+    readonly id?: string;
+}
+export declare function buildActor(opts: BuildActorOptions): Actor;
+//# sourceMappingURL=actor.d.ts.map

package/dist/shell/session/actor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor.d.ts","sourceRoot":"","sources":["../../../src/shell/session/actor.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,KAAK,CAWzD"}

package/dist/shell/session/actor.js

@@ -0,0 +1,34 @@
+"use strict";
+// buildActor — assemble a kernel `Actor` envelope from the shell's resolved
+// session identity and a caller-supplied (`kind`, `id`).
+//
+// The shell does NOT decide actor kind on its own. The caller (a command
+// handler) supplies the kind matching the command's intent:
+//
+//   - `agent`:      a CAWS-driving AI agent (default for shell commands)
+//   - `human`:      a person at a terminal
+//   - `automation`: a CI runner, scheduled task, or git hook
+//   - `system`:     emitted by CAWS itself with no external actor (rare;
+//                   reserved for self-initiated bookkeeping events)
+//
+// Identity precedence:
+//   - `actor.id` defaults to the resolved `session.identity.session_id`.
+//     A caller may pass an override for `kind: 'human'` invocations
+//     (e.g., a real username from $USER), but the default is the session id.
+//   - `actor.session_id` always mirrors the resolved session.
+//   - `actor.platform` always mirrors the resolved session.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildActor = buildActor;
+function buildActor(opts) {
+    const id = opts.id ?? opts.session.identity.session_id;
+    const actor = {
+        kind: opts.kind,
+        id,
+        session_id: opts.session.identity.session_id,
+    };
+    if (opts.session.identity.platform !== undefined) {
+        return { ...actor, platform: opts.session.identity.platform };
+    }
+    return actor;
+}
+//# sourceMappingURL=actor.js.map

package/dist/shell/session/actor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor.js","sourceRoot":"","sources":["../../../src/shell/session/actor.ts"],"names":[],"mappings":";AAAA,4EAA4E;AAC5E,yDAAyD;AACzD,EAAE;AACF,yEAAyE;AACzE,4DAA4D;AAC5D,EAAE;AACF,yEAAyE;AACzE,2CAA2C;AAC3C,6DAA6D;AAC7D,yEAAyE;AACzE,oEAAoE;AACpE,EAAE;AACF,uBAAuB;AACvB,yEAAyE;AACzE,oEAAoE;AACpE,6EAA6E;AAC7E,8DAA8D;AAC9D,4DAA4D;;AAgB5D,gCAWC;AAXD,SAAgB,UAAU,CAAC,IAAuB;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IACvD,MAAM,KAAK,GAAU;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,EAAE;QACF,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU;KAC7C,CAAC;IACF,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/shell/session/resolve-session.d.ts

@@ -0,0 +1,5 @@
+import { type Diagnostic, type Result } from '@paths.design/caws-kernel';
+import type { ResolveSessionOptions, ResolvedSession } from './types';
+export declare function resolveSession(opts: ResolveSessionOptions): Result<ResolvedSession>;
+export declare function describeSessionSource(s: ResolvedSession): Diagnostic;
+//# sourceMappingURL=resolve-session.d.ts.map

package/dist/shell/session/resolve-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-session.d.ts","sourceRoot":"","sources":["../../../src/shell/session/resolve-session.ts"],"names":[],"mappings":"AAoBA,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,MAAM,EACZ,MAAM,2BAA2B,CAAC;AAGnC,OAAO,KAAK,EACV,qBAAqB,EACrB,eAAe,EAEhB,MAAM,SAAS,CAAC;AA8IjB,wBAAgB,cAAc,CAC5B,IAAI,EAAE,qBAAqB,GAC1B,MAAM,CAAC,eAAe,CAAC,CAwDzB;AAID,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,eAAe,GAAG,UAAU,CAyBpE"}

package/dist/shell/session/resolve-session.js

@@ -0,0 +1,239 @@
+"use strict";
+// resolve-session — establish a SessionIdentity for the current shell call.
+//
+// This is the SOLE shell-side authority for "who is running this command?".
+// Source order is pinned by the rewrite plan:
+//
+//   1. CLAUDE_SESSION_ID env  → platform = "claude-code"
+//   2. CAWS session capsule    → on-disk `.caws/sessions/<id>.json` that
+//                                names the current worktree root
+//   3. CURSOR_TRACE_ID env     → platform = "cursor" (low-stability fallback)
+//   4. mint a new capsule (only when `allowMint: true` is passed by the
+//      caller — read-only commands MUST NOT pass this flag)
+//
+// Anything beyond this list — for example, inferring identity from
+// `agents.json` last-active — is NOT permitted. agents.json freshness is
+// display-only.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSession = resolveSession;
+exports.describeSessionSource = describeSessionSource;
+const crypto = __importStar(require("node:crypto"));
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const caws_kernel_1 = require("@paths.design/caws-kernel");
+const rules_1 = require("../rules");
+const atomic_write_1 = require("../../store/atomic-write");
+const SESSIONS_DIRNAME = 'sessions';
+function diag(rule, message, data) {
+    const base = {
+        rule,
+        authority: 'kernel/diagnostics',
+        severity: 'error',
+        message,
+    };
+    if (data !== undefined) {
+        return { ...base, data };
+    }
+    return base;
+}
+function infoDiag(rule, message, data) {
+    const base = {
+        rule,
+        authority: 'kernel/diagnostics',
+        severity: 'info',
+        message,
+    };
+    if (data !== undefined) {
+        return { ...base, data };
+    }
+    return base;
+}
+function readCapsule(cawsDir, worktreeRoot) {
+    const sessionsDir = path.join(cawsDir, SESSIONS_DIRNAME);
+    let entries;
+    try {
+        entries = fs.readdirSync(sessionsDir);
+    }
+    catch {
+        return null;
+    }
+    // Resolve real paths so /tmp vs /private/tmp on macOS doesn't fool us.
+    let worktreeRealRoot;
+    try {
+        worktreeRealRoot = fs.realpathSync(worktreeRoot);
+    }
+    catch {
+        worktreeRealRoot = worktreeRoot;
+    }
+    for (const name of entries) {
+        if (!name.endsWith('.json'))
+            continue;
+        const capsulePath = path.join(sessionsDir, name);
+        let raw;
+        try {
+            raw = fs.readFileSync(capsulePath, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            continue;
+        }
+        if (!isCapsuleShape(parsed))
+            continue;
+        let capsuleWorktreeReal;
+        try {
+            capsuleWorktreeReal = fs.realpathSync(parsed.worktree_root);
+        }
+        catch {
+            capsuleWorktreeReal = parsed.worktree_root;
+        }
+        if (capsuleWorktreeReal === worktreeRealRoot) {
+            return { capsule: parsed, capsulePath };
+        }
+    }
+    return null;
+}
+function isCapsuleShape(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const v = value;
+    return (typeof v['session_id'] === 'string' &&
+        typeof v['platform'] === 'string' &&
+        typeof v['minted_at'] === 'string' &&
+        typeof v['worktree_root'] === 'string');
+}
+function defaultMintIdSuffix() {
+    return crypto.randomBytes(6).toString('hex');
+}
+function mintCapsule(opts) {
+    const now = (opts.now ?? (() => new Date()))();
+    const suffix = (opts.mintIdSuffix ?? defaultMintIdSuffix)();
+    const platform = opts.platform ?? process.platform;
+    const sessionId = `caws-${suffix}`;
+    const capsule = {
+        session_id: sessionId,
+        platform,
+        minted_at: now.toISOString(),
+        worktree_root: opts.worktreeRoot,
+    };
+    const sessionsDir = path.join(opts.cawsDir, SESSIONS_DIRNAME);
+    try {
+        fs.mkdirSync(sessionsDir, { recursive: true });
+    }
+    catch (e) {
+        return (0, caws_kernel_1.err)([
+            diag(rules_1.SHELL_RULES.SESSION_CAPSULE_WRITE_FAILED, `Failed to create sessions directory: ${e.message}`, { sessionsDir }),
+        ]);
+    }
+    const capsulePath = path.join(sessionsDir, `${sessionId}.json`);
+    const writeResult = (0, atomic_write_1.writeFileAtomic)(capsulePath, JSON.stringify(capsule, null, 2) + '\n');
+    if (!writeResult.ok) {
+        return (0, caws_kernel_1.err)([
+            diag(rules_1.SHELL_RULES.SESSION_CAPSULE_WRITE_FAILED, `Failed to write capsule: ${writeResult.errors[0]?.message ?? 'unknown error'}`, { capsulePath }),
+        ]);
+    }
+    return (0, caws_kernel_1.ok)({ capsule, capsulePath });
+}
+function resolveSession(opts) {
+    const env = opts.env ?? process.env;
+    const platform = opts.platform ?? process.platform;
+    const allowMint = opts.allowMint === true;
+    // 1. CLAUDE_SESSION_ID env (authority source #1)
+    const claudeId = env['CLAUDE_SESSION_ID'];
+    if (typeof claudeId === 'string' && claudeId.length > 0) {
+        return (0, caws_kernel_1.ok)({
+            identity: { session_id: claudeId, platform: 'claude-code' },
+            source: 'claude_env',
+        });
+    }
+    // 2. Capsule on disk (authority source #2)
+    const cap = readCapsule(opts.cawsDir, opts.worktreeRoot);
+    if (cap !== null) {
+        return (0, caws_kernel_1.ok)({
+            identity: {
+                session_id: cap.capsule.session_id,
+                platform: cap.capsule.platform,
+            },
+            source: 'capsule',
+            capsulePath: cap.capsulePath,
+        });
+    }
+    // 3. CURSOR_TRACE_ID env (low-stability fallback)
+    const cursorId = env['CURSOR_TRACE_ID'];
+    if (typeof cursorId === 'string' && cursorId.length > 0) {
+        return (0, caws_kernel_1.ok)({
+            identity: { session_id: cursorId, platform: 'cursor' },
+            source: 'cursor_env',
+        });
+    }
+    // 4. Mint a capsule — only when caller has opted in.
+    if (!allowMint) {
+        return (0, caws_kernel_1.err)([
+            diag(rules_1.SHELL_RULES.SESSION_NO_STABLE_IDENTITY, 'No stable session identity could be resolved. Set CLAUDE_SESSION_ID or run a write-class command to mint a capsule.', { platform, cawsDir: opts.cawsDir, worktreeRoot: opts.worktreeRoot }),
+        ]);
+    }
+    const minted = mintCapsule(opts);
+    if (!minted.ok)
+        return minted;
+    return (0, caws_kernel_1.ok)({
+        identity: {
+            session_id: minted.value.capsule.session_id,
+            platform: minted.value.capsule.platform,
+        },
+        source: 'minted',
+        capsulePath: minted.value.capsulePath,
+    });
+}
+// Re-export for shell consumers that want a single info-level finding to
+// render alongside resolved-from-capsule results.
+function describeSessionSource(s) {
+    switch (s.source) {
+        case 'claude_env':
+            return infoDiag(rules_1.SHELL_RULES.SESSION_RESOLVED_FROM_CLAUDE_ENV, `Session identity from CLAUDE_SESSION_ID env: ${s.identity.session_id}`);
+        case 'capsule':
+            return infoDiag(rules_1.SHELL_RULES.SESSION_RESOLVED_FROM_CAPSULE, `Session identity from capsule: ${s.identity.session_id}`, s.capsulePath !== undefined ? { capsulePath: s.capsulePath } : undefined);
+        case 'cursor_env':
+            return infoDiag(rules_1.SHELL_RULES.SESSION_RESOLVED_FROM_CURSOR_ENV, `Session identity from CURSOR_TRACE_ID env (low-stability fallback): ${s.identity.session_id}`);
+        case 'minted':
+            return infoDiag(rules_1.SHELL_RULES.SESSION_CAPSULE_MINTED, `Minted new session capsule: ${s.identity.session_id}`, s.capsulePath !== undefined ? { capsulePath: s.capsulePath } : undefined);
+    }
+}
+//# sourceMappingURL=resolve-session.js.map

package/dist/shell/session/resolve-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-session.js","sourceRoot":"","sources":["../../../src/shell/session/resolve-session.ts"],"names":[],"mappings":";AAAA,4EAA4E;AAC5E,EAAE;AACF,4EAA4E;AAC5E,8CAA8C;AAC9C,EAAE;AACF,yDAAyD;AACzD,yEAAyE;AACzE,iEAAiE;AACjE,8EAA8E;AAC9E,wEAAwE;AACxE,4DAA4D;AAC5D,EAAE;AACF,mEAAmE;AACnE,yEAAyE;AACzE,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgKhB,wCA0DC;AAID,sDAyBC;AArPD,oDAAsC;AACtC,4CAA8B;AAC9B,gDAAkC;AAElC,2DAKmC;AACnC,oCAAuC;AACvC,2DAA2D;AAO3D,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAEpC,SAAS,IAAI,CACX,IAAY,EACZ,OAAe,EACf,IAA8B;IAE9B,MAAM,IAAI,GAAe;QACvB,IAAI;QACJ,SAAS,EAAE,oBAAoB;QAC/B,QAAQ,EAAE,OAAO;QACjB,OAAO;KACR,CAAC;IACF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CACf,IAAY,EACZ,OAAe,EACf,IAA8B;IAE9B,MAAM,IAAI,GAAe;QACvB,IAAI;QACJ,SAAS,EAAE,oBAAoB;QAC/B,QAAQ,EAAE,MAAM;QAChB,OAAO;KACR,CAAC;IACF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAClB,OAAe,EACf,YAAoB;IAEpB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACzD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,uEAAuE;IACvE,IAAI,gBAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,gBAAgB,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB,GAAG,YAAY,CAAC;IAClC,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YAAE,SAAS;QACtC,IAAI,mBAA2B,CAAC;QAChC,IAAI,CAAC;YACH,mBAAmB,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB,GAAG,MAAM,CAAC,aAAa,CAAC;QAC7C,CAAC;QACD,IAAI,mBAAmB,KAAK,gBAAgB,EAAE,CAAC;YAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ;QACnC,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ;QACjC,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ;QAClC,OAAO,CAAC,CAAC,eAAe,CAAC,KAAK,QAAQ,CACvC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAClB,IAA2B;IAE3B,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,mBAAmB,CAAC,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,SAAS,GAAG,QAAQ,MAAM,EAAE,CAAC;IACnC,MAAM,OAAO,GAAmB;QAC9B,UAAU,EAAE,SAAS;QACrB,QAAQ;QACR,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,aAAa,EAAE,IAAI,CAAC,YAAY;KACjC,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,IAAA,iBAAG,EAAC;YACT,IAAI,CACF,mBAAW,CAAC,4BAA4B,EACxC,wCAAyC,CAAW,CAAC,OAAO,EAAE,EAC9D,EAAE,WAAW,EAAE,CAChB;SACF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,IAAA,8BAAe,EACjC,WAAW,EACX,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CACxC,CAAC;IACF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,OAAO,IAAA,iBAAG,EAAC;YACT,IAAI,CACF,mBAAW,CAAC,4BAA4B,EACxC,4BAA4B,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,eAAe,EAAE,EAC/E,EAAE,WAAW,EAAE,CAChB;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAA,gBAAE,EAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,SAAgB,cAAc,CAC5B,IAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;IAE1C,iDAAiD;IACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC1C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,IAAA,gBAAE,EAAC;YACR,QAAQ,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE;YAC3D,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;IACL,CAAC;IAED,2CAA2C;IAC3C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,OAAO,IAAA,gBAAE,EAAC;YACR,QAAQ,EAAE;gBACR,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU;gBAClC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ;aAC/B;YACD,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,GAAG,CAAC,WAAW;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,kDAAkD;IAClD,MAAM,QAAQ,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACxC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,IAAA,gBAAE,EAAC;YACR,QAAQ,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE;YACtD,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;IACL,CAAC;IAED,qDAAqD;IACrD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,IAAA,iBAAG,EAAC;YACT,IAAI,CACF,mBAAW,CAAC,0BAA0B,EACtC,qHAAqH,EACrH,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CACrE;SACF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9B,OAAO,IAAA,gBAAE,EAAC;QACR,QAAQ,EAAE;YACR,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU;YAC3C,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ;SACxC;QACD,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW;KACtC,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,kDAAkD;AAClD,SAAgB,qBAAqB,CAAC,CAAkB;IACtD,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,YAAY;YACf,OAAO,QAAQ,CACb,mBAAW,CAAC,gCAAgC,EAC5C,gDAAgD,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,CACxE,CAAC;QACJ,KAAK,SAAS;YACZ,OAAO,QAAQ,CACb,mBAAW,CAAC,6BAA6B,EACzC,kCAAkC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EACzD,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CACzE,CAAC;QACJ,KAAK,YAAY;YACf,OAAO,QAAQ,CACb,mBAAW,CAAC,gCAAgC,EAC5C,uEAAuE,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,CAC/F,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO,QAAQ,CACb,mBAAW,CAAC,sBAAsB,EAClC,+BAA+B,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EACtD,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CACzE,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/shell/session/types.d.ts

@@ -0,0 +1,56 @@
+import type { SessionIdentity } from '@paths.design/caws-kernel';
+export type SessionSource = 'claude_env' | 'capsule' | 'cursor_env' | 'minted';
+export interface ResolvedSession {
+    /** The kernel-shaped session identity. */
+    readonly identity: SessionIdentity;
+    /** Where the identity came from. Influences display and audit. */
+    readonly source: SessionSource;
+    /**
+     * For `source: 'capsule'` and `source: 'minted'`, the on-disk capsule path
+     * that was read or written. Useful for diagnostics rendering.
+     */
+    readonly capsulePath?: string;
+}
+export interface SessionCapsule {
+    readonly session_id: string;
+    readonly platform: string;
+    readonly minted_at: string;
+    readonly worktree_root: string;
+}
+export interface ResolveSessionOptions {
+    /**
+     * `false` (default): read-only resolution — never mints a capsule. If no
+     *   stable identity exists, returns `Err(SESSION_NO_STABLE_IDENTITY)`.
+     * `true`: governed-write resolution — mints a capsule if no stable
+     *   identity is found. Always returns `Ok(ResolvedSession)` on success.
+     */
+    readonly allowMint?: boolean;
+    /**
+     * Injected environment. Defaults to `process.env`. Used by tests.
+     */
+    readonly env?: NodeJS.ProcessEnv;
+    /**
+     * Injected clock. Defaults to `() => new Date()`. Used by tests.
+     */
+    readonly now?: () => Date;
+    /**
+     * Injected platform label. Defaults to `process.platform`.
+     */
+    readonly platform?: string;
+    /**
+     * Injected `cawsDir` (the directory containing `sessions/`). Required.
+     */
+    readonly cawsDir: string;
+    /**
+     * Worktree root path the session is bound to, when minting. The capsule
+     * records this so a later resolution can refuse stale capsules from
+     * other worktrees.
+     */
+    readonly worktreeRoot: string;
+    /**
+     * Random-ish suffix generator for minted session ids. Defaults to a
+     * crypto-backed implementation. Injected for deterministic tests.
+     */
+    readonly mintIdSuffix?: () => string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/shell/session/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/shell/session/types.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,MAAM,aAAa,GACrB,YAAY,GACZ,SAAS,GACT,YAAY,GACZ,QAAQ,CAAC;AAEb,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;OAEG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC;;OAEG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;CACtC"}

package/dist/shell/session/types.js

@@ -0,0 +1,15 @@
+"use strict";
+// Shell session identity model.
+//
+// The shell resolves a session identity for the current invocation. This is
+// used both for display ("which agent is doing this?") and — for governed
+// writes — for authority decisions in the kernel.
+//
+// Source priority (pinned in the rewrite plan):
+//   1. CLAUDE_SESSION_ID env
+//   2. CAWS session capsule bound to this shell+worktree
+//   3. CURSOR_TRACE_ID env (low-stability fallback)
+//
+// `agents.json last-active` is NEVER an authority source.
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/shell/session/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/shell/session/types.ts"],"names":[],"mappings":";AAAA,gCAAgC;AAChC,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,kDAAkD;AAClD,EAAE;AACF,gDAAgD;AAChD,6BAA6B;AAC7B,yDAAyD;AACzD,oDAAoD;AACpD,EAAE;AACF,0DAA0D"}

package/dist/store/agents-store.d.ts

@@ -0,0 +1,3 @@
+import { type AgentRegistry, type Result } from '@paths.design/caws-kernel';
+export declare function loadAgents(cawsDir: string): Result<AgentRegistry>;
+//# sourceMappingURL=agents-store.d.ts.map

package/dist/store/agents-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents-store.d.ts","sourceRoot":"","sources":["../../src/store/agents-store.ts"],"names":[],"mappings":"AAQA,OAAO,EAIL,KAAK,aAAa,EAClB,KAAK,MAAM,EACZ,MAAM,2BAA2B,CAAC;AAKnC,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,CAoBjE"}